joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423124
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x423249
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00422f2c
mov esi, eax
mov eax, dword [0x58eb54]
cmp byte [eax], 0
je 0x4231f1
mov eax, dword [0x58e648]
call fcn.00404c10
call fcn.00404810
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4230f4]
call fcn.004084fc
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x423264
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x42322d
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x58e5ac]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x591c4c]
call fcn.004085c0
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423250
lea eax, [ebp - 4]
mov edx, dword [0x4230f4]
call fcn.00408508
ret

Function at 0x42496c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00406ab0
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a02c
mov edi, eax
cmp edi, 0x104
jbe 0x424913
mov eax, edi
add eax, eax
call fcn.0040464c
mov esi, eax
jmp 0x424915
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a02c
mov eax, esi
push eax
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x424950
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42493a
mov eax, esp
cmp esi, eax
je 0x42495d
mov eax, esi
call fcn.00404668
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x424998
cmp bl, 0
je 0x424994
cmp bl, 0x41
jl 0x42498f
cmp bl, 0x5a
jg 0x42498f
or bl, 0x20
xor al, bl
inc esi
jmp 0x424973
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4248d4

Function at 0x424c6c
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.004072c4
add esp, 0x800
pop ebx
ret
Function at 0x424f30
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.004065c4
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.00407218
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x424f75
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.00406730
jmp 0x424f8e
mov edx, ebx
dec edx
mov eax, esi
call fcn.00407330
push ebx
mov eax, dword [esi]
call fcn.00407218
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x427dd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
call sub.kernel32.dll_GetEnvironmentStringsW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x427e25
xor eax, eax
push ebp
push 0x427e1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0042b5a0
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427e25
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeEnvironmentStringsW
ret
movzx eax, byte [ebp - 1]
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x427ea0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004065c4
test esi, esi
jne 0x427ed6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406730
jmp 0x427ef4
call sub.kernel32.dll_GetCommandLineW_1
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00427d10
mov edi, eax
test esi, esi
je 0x427ef4
cmp dword [ebx], 0
je 0x427ef4
dec esi
jmp 0x427edd
add esp, 0x20c
pop edi
pop esi
pop ebx
ret
Function at 0x427f00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x428059
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
mov dword [esi], eax
test ebx, ebx
je 0x42803e
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004069d0
mov eax, dword [ebp - 4]
cmp word [eax], 0x22
je 0x427f62
push 0x428078
push dword [ebp - 4]
push 0x428078
lea eax, [ebp - 4]
mov edx, 3
call fcn.00407490
lea eax, [ebp - 8]
push eax
mov ecx, 0x428088
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0042b100
mov eax, dword [ebp - 8]
call fcn.00407218
mov ebx, eax
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.0042a7e0
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], 1
lea eax, [ebp - 0x68]
mov edx, 0x10
call fcn.0042a7e0
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push ebx
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x42803e
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x428037
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0xffffffff
jne 0x427ffa
call fcn.00405db0
jmp 0x42803e
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x428017
call fcn.00405db0
jmp 0x42803e
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42803e
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428060
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406624
ret

Function at 0x4282d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00407218
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4282ec
test al, 0x10
sete al
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x428340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00407218
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x428360
test eax, 0x10
seta al
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x4290b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
call sub.kernel32.dll_FindResourceW
mov edi, eax
mov dword [ebx + 0x10], edi
test edi, edi
jne 0x4290de
push ebp
call fcn.00429000
pop ecx
mov eax, dword [ebx + 0x10]
push eax
push esi
call sub.kernel32.dll_LoadResource
mov edi, eax
mov dword [ebx + 0x14], edi
test edi, edi
jne 0x4290f8
push ebp
call fcn.00429000
pop ecx
mov edi, ebx
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x10]
push eax
push esi
call sub.kernel32.dll_SizeofResource
mov edx, dword [ebp - 8]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x42a7f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
add esp, 0xffffffc8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, eax
mov edi, dword [esp + 4]
test edi, edi
jle 0x42a96b
mov eax, 0x42a978
mov dword [esp + 8], eax
movzx eax, word [esi]
mov edx, dword [esp + 8]
cmp ax, 0xff
ja 0x42a826
movzx eax, ax
bt dword [edx], eax
setb al
mov byte [esp + 0xc], al
cmp byte [esp + 0xc], 0
je 0x42a838
mov al, 1
jmp 0x42a860
mov eax, 0x42a998
mov dword [esp + 0x10], eax
movzx eax, word [esi]
mov edx, dword [esp + 0x10]
cmp ax, 0xff
ja 0x42a854
movzx eax, ax
bt dword [edx], eax
setb al
mov byte [esp + 0x14], al
movzx eax, byte [esp + 0x14]
test al, al
je 0x42a868
mov dl, 1
jmp 0x42a8cc
mov eax, 0x42a978
mov dword [esp + 0x18], eax
movzx eax, word [esi + 2]
mov edx, dword [esp + 0x18]
cmp ax, 0xff
ja 0x42a885
movzx eax, ax
bt dword [edx], eax
setb al
mov byte [esp + 0x1c], al
cmp byte [esp + 0x1c], 0
je 0x42a89a
mov byte [esp + 0x25], 1
jmp 0x42a8c7
mov eax, 0x42a998
mov dword [esp + 0x20], eax
movzx eax, word [esi + 2]
mov edx, dword [esp + 0x20]
cmp ax, 0xff
ja 0x42a8b7
movzx eax, ax
bt dword [edx], eax
setb al
mov byte [esp + 0x24], al
movzx eax, byte [esp + 0x24]
mov byte [esp + 0x25], al
movzx edx, byte [esp + 0x25]
test dl, dl
jne 0x42a96b
mov eax, 0x42a9b8
mov dword [esp + 0x28], eax
movzx eax, word [esi]
mov edx, dword [esp + 0x28]
cmp ax, 0xff
ja 0x42a8f0
movzx eax, ax
bt dword [edx], eax
setb al
mov byte [esp + 0x2c], al
cmp byte [esp + 0x2c], 0
jne 0x42a905
mov byte [esp + 0x35], 1
jmp 0x42a934
mov eax, 0x42a9b8
mov dword [esp + 0x30], eax
movzx eax, word [esi + 2]
mov edx, dword [esp + 0x30]
cmp ax, 0xff
ja 0x42a922
movzx eax, ax
bt dword [edx], eax
setb al
mov byte [esp + 0x34], al
movzx eax, byte [esp + 0x34]
xor al, 1
mov byte [esp + 0x35], al
cmp byte [esp + 0x35], 0
jne 0x42a96b
movzx eax, byte [esi]
movzx eax, word [eax*2 + 0x58ce54]
shl eax, 4
movzx edx, byte [esi + 2]
movzx edx, word [edx*2 + 0x58ce54]
add al, dl
mov edx, dword [esp]
mov byte [edx], al
inc dword [esp]
add esi, 4
dec edi
test edi, edi
jg 0x42a80a
mov eax, dword [esp + 4]
sub eax, edi
add esp, 0x38
pop edi
pop esi
ret
Function at 0x436b40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x11], 0
je 0x436b63
mov eax, dword [ebp - 8]
call fcn.00407218
push eax
call sub.kernel32.dll_OutputDebugStringW
pop ecx
pop ecx
pop ebp
ret

Function at 0x436da0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x436dd5
cmp dword [ebp - 0x108], 2
jne 0x436dd5
cmp dword [ebp - 0x114], 6
jae 0x436dd9
xor eax, eax
jmp 0x436ddb
mov al, 1
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x436f50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x49]
mov edx, 0x3c
call fcn.0042a7e0
mov dword [ebp - 0x49], 0x3c
xor eax, eax
mov dword [ebp - 0x45], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x41], eax
mov eax, dword [ebp - 0xc]
call fcn.00407218
mov dword [ebp - 0x39], eax
mov eax, dword [ebp + 0xc]
call fcn.00407218
mov dword [ebp - 0x35], eax
mov eax, dword [ebp + 8]
call fcn.00407218
mov dword [ebp - 0x31], eax
mov dword [ebp - 0x2d], 1
mov eax, dword [ebp - 4]
call fcn.00407218
mov dword [ebp - 0x3d], eax
lea eax, [ebp - 0x49]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 8

Function at 0x437bf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00425e78
test al, al
je 0x437c2e
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00437ba0
lea eax, [ebp - 0xc]
call fcn.00437b00
jmp 0x437c36
mov eax, dword [ebp - 8]
call fcn.004065c4
mov esp, ebp
pop ebp
ret
Function at 0x437ce0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
call fcn.00407218
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
call fcn.00407218
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
call fcn.00407218
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
call fcn.00407218
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x437d80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00437c70
push eax
mov eax, dword [ebp + 0x10]
call fcn.00437c70
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407218
push eax
mov eax, dword [ebp - 8]
call fcn.00407218
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x437f00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00425e78
test al, al
je 0x437f3e
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00437eb0
lea eax, [ebp - 0xc]
call fcn.00437e10
jmp 0x437f46
mov eax, dword [ebp - 8]
call fcn.004065c4
mov esp, ebp
pop ebp
ret
Function at 0x43b020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov esi, eax
mov byte [esp], 0
mov eax, dword [esi + 0x40034]
cmp eax, 0x10000
jb 0x43b057
and ax, 0x3ff
xor ax, 0xdc00
mov word [ebp], ax
xor eax, eax
mov dword [esi + 0x40034], eax
mov byte [esp], 1
jmp 0x43b189
lea edx, [esp + 1]
mov ecx, 1
mov eax, esi
call fcn.0043c6c0
test al, al
je 0x43b189
cmp byte [esp + 1], 0x80
jae 0x43b088
movzx eax, byte [esp + 1]
mov word [ebp], ax
mov byte [esp], 1
jmp 0x43b189
mov edi, 1
movzx eax, byte [esp + 1]
mov dword [esi + 0x40034], eax
movzx eax, byte [esp + 1]
mov byte [esp + 2], al
mov bl, 0x40
movzx eax, byte [esp + 1]
and al, 0xc0
cmp al, 0xc0
jne 0x43b189
jmp 0x43b12b
lea edx, [esp + 1]
mov ecx, 1
mov eax, esi
call fcn.0043c6c0
test al, al
jne 0x43b0d9
mov edx, 0x43b1a0
mov eax, esi
call fcn.0043c7a0
jmp 0x43b189
movzx eax, byte [esp + 1]
and al, 0xc0
cmp al, 0x80
je 0x43b0f5
mov edx, 0x43b1a0
mov eax, esi
call fcn.0043c7a0
jmp 0x43b189
movzx eax, byte [esp + 1]
and al, 0x3f
movzx eax, al
mov edx, dword [esi + 0x40034]
shl edx, 6
or eax, edx
mov dword [esi + 0x40034], eax
inc edi
cmp edi, 6
jle 0x43b124
mov edx, 0x43b1a0
mov eax, esi
call fcn.0043c7a0
jmp 0x43b189
movzx eax, bl
shr eax, 1
mov ebx, eax
test byte [esp + 2], bl
jne 0x43b0b4
mov eax, dword [edi*4 + 0x58d358]
and dword [esi + 0x40034], eax
cmp edi, 1
jle 0x43b160
mov eax, dword [edi*4 + 0x58d354]
cmp eax, dword [esi + 0x40034]
jb 0x43b160
mov edx, 0x43b1a0
mov eax, esi
call fcn.0043c7a0
jmp 0x43b189
mov eax, dword [esi + 0x40034]
cmp eax, 0x10000
jb 0x43b17a
shr eax, 0xa
add ax, 0xd7c0
mov word [ebp], ax
jmp 0x43b185
movzx eax, word [esi + 0x40034]
mov word [ebp], ax
mov byte [esp], 1
movzx eax, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x43d6e0
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 0
lea eax, [ebx + 0x18]
xor ecx, ecx
mov edx, 0x40
call fcn.00404c74
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x14], eax
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x442450
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x44247a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00407218
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
call sub.advapi32.dll_RegDeleteKeyW
pop ecx
pop ebp
ret
mov eax, dword [ebp - 4]
add eax, 4
push eax
push 2
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00407218
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4424e7
xor eax, eax
push ebp
push 0x4424e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00407218
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegDeleteValueW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4424e7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop ecx
pop ebp
ret
Function at 0x442b90
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x442d5d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004069d0
cmp dword [ebp - 4], 0
je 0x442bd3
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x442bd3
xor eax, eax
jmp 0x442bd5
mov al, 1
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x442bf0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00407620
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00442fe0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x442cd0
xor edx, edx
push ebp
push 0x442cc9
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004437b0
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00443090
test al, al
je 0x442ca7
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00406730
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x442ca7
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0xc]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00407218
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [esi + 0x1c], eax
test eax, eax
sete al
test al, al
je 0x442ca1
mov eax, dword [ebp - 8]
call fcn.00407218
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00407270
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00442b90
dec ebx
cmp ebx, 0xffffffff
jne 0x442c4f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442cd0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004437b0
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
cmp dword [0x58d40c], 0
je 0x442d12
mov ebx, dword [ebp - 0xc]
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.00407218
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00442dd0
push eax
call dword [0x58d40c]
mov dword [ebx + 0x1c], eax
test eax, eax
sete al
mov ebx, eax
jmp 0x442d3a
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00407218
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00442dd0
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov dword [ebx + 0x1c], eax
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442d64
lea eax, [ebp - 0x3c]
call fcn.004065c4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406624
ret
Function at 0x442df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x442eba
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov esi, ebx
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, edi
call fcn.00407218
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov dword [esi + 0x1c], eax
test eax, eax
sete al
test al, al
jne 0x442e72
lea eax, [ebp - 0xc]
mov ecx, edi
mov edx, 0x442ed8
call fcn.00407408
mov edx, dword [ebp - 0xc]
mov eax, dword [0x58e4dc]
mov eax, dword [eax]
mov ecx, 0x442f08
call fcn.004366a0
xor eax, eax
mov dword [ebp + 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
cmp dword [ebp - 8], 1
jne 0x442e7f
mov al, 1
jmp 0x442e9f
cmp dword [ebp - 8], 2
jne 0x442e89
mov al, 2
jmp 0x442e9f
cmp dword [ebp - 8], 4
jne 0x442e93
mov al, 3
jmp 0x442e9f
cmp dword [ebp - 8], 3
jne 0x442e9d
mov al, 4
jmp 0x442e9f
xor eax, eax
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442ec1
lea eax, [ebp - 0xc]
call fcn.004065c4
ret

Function at 0x442f30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esi
xor ecx, ecx
mov edx, 8
call fcn.00404c74
mov ebp, ebx
lea eax, [esi + 4]
push eax
push 0
lea eax, [esp + 8]
push eax
push 0
mov eax, edi
call fcn.00407218
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov dword [ebp + 0x1c], eax
test eax, eax
sete al
mov edx, eax
cmp dword [esp], 1
jne 0x442f7d
mov al, 1
jmp 0x442f9d
cmp dword [esp], 2
jne 0x442f87
mov al, 2
jmp 0x442f9d
cmp dword [esp], 4
jne 0x442f91
mov al, 3
jmp 0x442f9d
cmp dword [esp], 3
jne 0x442f9b
mov al, 4
jmp 0x442f9d
xor eax, eax
mov byte [esi], al
mov eax, edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret