joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4147e0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.004521f8
test al, al
je 0x41480e
pop ecx
xor bh, byte [ecx + ecx*8]
mov word [ebx - 0x53], ss
inc eax
adc eax, 0x7aa446a3
cwde
cmp esi, dword [edi]
dec esi
mov ebp, 0x730efedb
loopne 0x4147a5
int1
mov ah, 0xe5
call fcn.0045209f
test al, al
je 0x414835
scasb al, byte es:[edi]
out 0x5e, al
push ebp
loopne 0x41488a
stosb byte es:[edi], al
in eax, 0x8c
sub al, 0x7f
inc eax
hlt
mov edi, dword [ebp + 8]
cmp word [edi], 0
jne 0x414842
xor ecx, ecx
jmp 0x414856
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414847
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 4]
push edi
call fcn.00402ad0
push dword [ebp + 0xc]
push edi
push 0x79
call fcn.004587e8
mov ecx, dword [ebp - 4]
add esp, 0xc
push dword [ebp + 0xc]
call int.004146d0
test eax, eax
setne byte [ebp + 0xf]
call fcn.004524ef
test al, al
je 0x414899
cmp byte [ebp - 0x35], dh
shr bh, cl
cwde
dec bx
imul ebx, dword [ebx + 0x36], 0xfffffffe
in eax, dx
or eax, 0xe802ce30
pop edx
fld dword [ebx]
add byte [eax + eax*8 + 0x30e01f74], al
retf
call fcn.004521f8
test al, al
je 0x4148c1
loopne 0x4148d4
aas
outsb dx, byte [esi]
dec ebp
fdiv qword [esi]
invalid
call fcn.00452015
test al, al
je 0x4148e0
lahf
inc ecx
dec si
xchg edi, eax
pop edi
out 0xac, al
push ss
push ss
or dword [ecx], ebp
jmp 0x4148df
inc edi
cmp byte [ebp + 0xf], 0
jne 0x4148fe
push 0xa2
call fcn.004587e8
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x419970
Capabilities:
Delete registry key
Get installed programs

Disassembly:
add byte [eax], al
add byte [ebx + 0x1046c7ce], cl
add byte [eax], al
add byte [eax], al
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.004524aa
test al, al
je 0x419990
mov ebx, dword [esp + ecx*8]
movsd dword es:[edi], dword [esi]
dec edx
mov edx, 0x7a48fbaa
push edx
mov al, byte [0xb301b0e0]
call fcn.004521f8
test al, al
je 0x4199b0
leave
add dl, byte [ecx]
into
xor edx, ebp
movsb byte es:[edi], byte [esi]
xor byte [ebx], dl
in eax, 0xb7
jbe 0x419985
fisub word [edi]
daa
out 0x95, eax
push ecx
out dx, eax
push ebx
push es
cmp al, 0xe8
das
xchg dword [ebx], eax
add byte [eax + eax*8 - 0x94be08c], al
call fcn.004520e4
test al, al
je 0x4199d8
mov ah, 0xf6
jo 0x419a22
add esi, edi
inc ebp
jo 0x41994c
sbb eax, 0xe81c8e36
mov ebx, 0x1858ba1f
sbb dword [eax + 0x537464a2], edi
ficom word [eax]
xor eax, dword [edx + eax]
in al, 0x8d
inc ebp
cld
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov eax, dword [ebp + 0xc]
push 0xf003f
neg eax
push 0
sbb eax, eax
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
add eax, reloc.OLEAUT32.dll_SysReAllocString
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419a1b
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0045205a
test al, al
je 0x419a3d
loopne 0x4199a6
push ds
invalid
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41ba80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x210], ecx
call fcn.0041b7d0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x60]
call eax
test al, al
je 0x41bb6e
call fcn.00452351
test al, al
je 0x41bad2
invalid
call fcn.004520e4
test al, al
je 0x41baf3
or dword [ecx + 0x60], ebx
invalid
call fcn.0045216e
test al, al
je 0x41bb14
mov ebp, 0x498c1225
aaa
cmp cl, byte [ebp - 0x63]
pop ebx
add dh, byte [ecx]
pop ebx
pushal
sbb esp, dword [edx + 0x1b]
xchg byte [edx + 0x1f], ah
enter 0xffffffffffffc4ce, 0x68
or byte [edx], al
add byte [eax], al
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00480640
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41bb53
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.0041c460
dec dword [ebp - 0x20b7b]
call dword [eax - 0x18]
or eax, 0xe8000009
mov ah, 0x67
add eax, dword [eax]
call fcn.0045230c
test al, al
je 0x41bb6e
cmp dl, ch
aaa
stc
sar byte [edx + 0x34], 0xc1
clc
jno 0x41bb46
inc eax
or byte [esi - 0x32da97d4], 0x8b
dec ebp
cld
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d81d
mov esp, ebp
pop ebp
ret
Function at 0x41f420
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de307
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x67432c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41f471
mov eax, dword [esi]
jmp 0x41f473
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], ecx
cmp dword [esi + 0x2c], 8
mov dword [ebp - 4], ecx
jb 0x41f490
mov eax, dword [esi + 0x18]
jmp 0x41f493
lea eax, [esi + 0x18]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], ecx
cmp dword [esi + 0x44], 8
jb 0x41f4ad
mov eax, dword [esi + 0x30]
jmp 0x41f4b0
lea eax, [esi + 0x30]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x48]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f4ca
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x60]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f4e4
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x78]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f4fe
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x90]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f51b
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xa8]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f538
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xc0]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f555
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xd8]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f572
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push 0xc
push str.WanNengWBIME
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.00402ad0
push 5
push str.WHost
lea ecx, [esi + 0x18]
call fcn.00402ad0
push 0xc
push str.WHostService
lea ecx, [esi + 0x30]
call fcn.00402ad0
push 0
push 0x5e6948
lea ecx, [esi + 0x48]
call fcn.00402ad0
push 0
push 0x5e6948
lea ecx, [esi + 0x60]
call fcn.00402ad0
push 0
push 0x5e6948
lea ecx, [esi + 0x78]
call fcn.00402ad0
push 0
push 0x5e6948
lea ecx, [esi + 0xc0]
call fcn.00402ad0
push 0
push 0x5e6948
lea ecx, [esi + 0xd8]
call fcn.00402ad0
push 0
push 0x5e6948
lea ecx, [esi + 0xa8]
call fcn.00402ad0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420a80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.004524aa
test al, al
je 0x420aa2
invalid
call fcn.004521f8
test al, al
je 0x420ac2
shl byte [ebx], 0x10
dec edi
out 0xf0, eax
cmp al, 0x83
and byte [edi + 0x7e6ae5d5], al
int1
xchg edi, eax
inc eax
inc edi
pop edx
mov dword [0x1de8140e], eax
push ss
add eax, dword [eax]
call fcn.004520e4
test al, al
je 0x420aea
inc edi
into
push es
dec edx
mov al, 0xbb
outsb dx, byte [esi]
pop esp
lea edx, [eax + 0x5ad59ed]
sar dword [eax], 1
stc
mov ecx, 0x116f7448
stosd dword es:[edi], eax
sti
std
ror dword [esi], cl
push ecx
xchg ebx, eax
cld
inc edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x420c2e
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.WHost
push dword [ebp - 8]
call esi
test eax, eax
jne 0x420c2e
call fcn.0045205a
test al, al
je 0x420b5c
pop esp
in eax, dx
ret 0x4317
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call fcn.0045216e
test al, al
je 0x420b94
and eax, 0x450efed5
cmp esp, dword [edi]
mov ebx, 0xc0ea2384
push 0xffffffffffffffbb
mov ebx, 0x4be8e37b
adc eax, 0xc0840003
call fcn.004520e4
test al, al
je 0x420bb3
iretd
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x420bc3
push eax
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x420bcd
push eax
call esi
call fcn.004524aa
test al, al
je 0x420be6
xchg ebp, eax
and byte [esi + 0x1e], ch
insd dword es:[edi], dx
leave
and eax, 0xa336ea19
sar dword [edi - 0x178fb318], 1
or eax, 0x84000316
sal byte [edi + edx + 0x3e], 0xb
push 0x5a26cbe2
mov dword [0x289cb845], eax
inc esi
loopne 0x420c6f
call fcn.004521f8
test al, al
je 0x420c06
or ebp, dword ds:[eax - 0x1e]
retf
sub cl, byte [ebx + edi*2]
cdq
int3
call fcn.004520e4
test al, al
je 0x420c2e
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmpsb byte [esi], byte es:[edi]
adc dl, byte gs:[esp + ecx*2 - 0x52]
inc esp
fmul dword [edi + eax*8 - 0x2103413b]
int3
Function at 0x421050
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.0045205a
test al, al
je 0x42107b
push ss
retf
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4211b4
call fcn.004521f8
test al, al
je 0x4210c6
mov al, byte [0xc202a2b2]
xchg ebp, eax
mov esp, 0xeeb07bd4
stosb byte es:[edi], al
or ebx, dword [edx + 0x49]
in al, 0xd8
cmpsd dword [esi], dword es:[edi]
je 0x421100
fcomp st(1)
cmc
out dx, al
xor dh, byte [edi - 0x71]
popal
mul cl
scasb al, byte es:[edi]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.WHost
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4210fd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00452603
add eax, dword [eax]
test al, al
je 0x421121
and byte [ebp + 0x23], al
cmp dh, 0xf1
add eax, 0xf2d13c74
sub dword [ebx], eax
in al, 0x50
mov eax, 0x3169a6db
push eax
mov ecx, 0x91e3b613
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
call fcn.00452129
test al, al
je 0x421171
mov byte [0x3f399c6], al
cmp al, cl
das
cmpsd dword [esi], dword es:[edi]
into
pop ebx
mov ecx, dword [esi]
pop esi
loope 0x42119c
call 0xe8b473a7
adc al, byte gs:[ebx]
add byte [eax + eax*8 - 0x462e38c], al
call fcn.004523db
test al, al
je 0x421196
popfd
sti
bnd jnp 0x4211be
pushal
stosb byte es:[edi], al
jge 0x421198
cmp dword [esi - 0x3f], ecx
cli
mov bh, 0x26
pop esi
adc dword [edx - 0x20], esp
xchg esp, eax
loope 0x421166
pop ds
mov cl, 0xc9
adc byte [eax - 0x79], dh
call fcn.00452603
test al, al
je 0x4211b4
adc al, 3
add byte [eax + eax*8 + 0x112d1574], al
sal byte [ebp + edx + 0x2d], 0x11
sub eax, 0xd0d0ae11
scasb al, byte es:[edi]
rcl al, 1
xor al, 0x3c
salc
and al, 0x2d
in eax, dx
xlatb
dec esi
mov esi, dword [ecx + 0x13e07917]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
int3
Function at 0x42ff90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x808], 0
push 0
push eax
call fcn.00480640
add esp, 0xc
mov dword [ebp - 0x814], 0x800
mov dword [ebp - 0x818], 1
mov dword [ebp - 0x80c], 0
call fcn.00452603
add byte [eax], al
add bh, al
test esp, esi
idiv edi
inc dword [eax]
add byte [eax], al
add al, ch
sbb ah, byte [esi]
add al, byte [eax]
test al, al
je 0x430000
xchg ebx, eax
push edx
push 0xc
pop eax
pop ebp
pop eax
invalid
call fcn.00452579
test al, al
je 0x430024
push 0xffffffffffffff92
fild qword [edx + 0xe]
push cs
xlatb
dec eax
out dx, eax
jno 0x42ffd7
cwde
sbb byte [ebp + 0x4ee05f26], dl
mov ah, byte [eax + 0x48]
popfd
push 0x56
mov esp, 0xe83fa81e
or esp, dword [0xc0840002]
call fcn.00452534
test al, al
je 0x430046
test dword [edi - 0x1d], 0x46b08a7b
mov ah, 1
insd dword es:[edi], dx
jns 0x43000d
test byte [edi + 0x40], dh
push cs
in al, 0x2c
pop eax
int 0x74
div byte [edi]
pop esi
sahf
lea eax, [ebp - 0x808]
push eax
push 0xf013f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x810], eax
call fcn.00452534
test al, al
je 0x43008f
aaa
pop edx
retf 0xbd7e
cmp dword [ebp - 0x810], 0
jne 0x430109
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.B2A6906E_67AA_4613_B7ED_1CEB63834F37
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, str.WanNengWB_Shell_Extension
lea eax, [ebp - 0x804]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4300f6
test dx, dx
je 0x4300f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4300f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4300d0
xor eax, eax
jmp 0x4300fb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x430154
mov dword [ebp - 0x80c], 1
call fcn.00452603
test al, al
je 0x43012d
mov ebp, 0x49b30bf9
out dx, eax
mov dword [0xe19bb98e], eax
in eax, 0x8d
xor al, 0x3a
push ds
les ecx, [ecx + 0x7c786938]
ret
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x80c], 0
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.0046d81d
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x80c], 0
jmp 0x43012d
Function at 0x437cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.00480640
push esi
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSet_services_s
push eax
call fcn.00407f60
add esp, 0x18
call fcn.004524aa
test al, al
je 0x437d0c
mov dh, 0xd6
adc eax, 0x69ba7eb
mov ebp, 0x39481c24
invalid
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x437d45
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d81d
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x218]
mov dword [ebp - 0x214], 0
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], 4
push eax
push 0
push 0
push str.Start
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004523db
test al, al
je 0x437dac
je 0x437dbb
sbb eax, 0x2c319bf5
mov ebp, 0x6c32b3e8
adc ebp, ebp
arpl word [edx], di
stosb byte es:[edi], al
or byte [bx], cl
dec edx
pop ecx
mov bl, 0xb0
push 0x40
fucompi st(0)
mov word [ecx + eax + 0x74c08400], fs
adc eax, 0x7e5e7d91
imul esp, dword [edi], 0xffffffac
call fcn.0045223d
test al, al
je 0x437dca
xchg ecx, eax
jge 0x437e16
jle 0x437e25
daa
lodsb al, byte [esi]
inc eax
sub ch, al
or bl, dl
cmp eax, 0x299ca087
jle 0x437df3
cdq
call fcn.00452396
test al, al
je 0x437de5
sub eax, 0x7b7ac399
in al, 0x64
sahf
cmp dword [esi + esi + 0x46], esp
hlt
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x214], 2
pop edi
sete al
xor ecx, ebp
xchg esp, eax
sal byte [ebx], 0xcd
pop esi
pop ebx
call fcn.0046d81d
mov esp, ebp
pop ebp
ret 4
add al, 0
add byte [ecx + 0x67432c], ah
Function at 0x437e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.00480640
push esi
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSet_services_s
push eax
call fcn.00407f60
add esp, 0x18
call fcn.004521f8
test al, al
je 0x437e75
and eax, 0xccde5ce5
cmpsd dword [esi], dword es:[edi]
inc edx
popfd
xchg esp, eax
test byte [eax], 0x7d
invalid
call fcn.0045209f
test al, al
je 0x437e9c
inc ecx
pushfd
add eax, dword [ebp + 0x616c12a9]
hlt
lea eax, [ebp - 0x418]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x437fe8
push 0x208
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00480640
add esp, 0xc
mov dword [ebp - 0x41c], 0x208
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push str.ImagePath
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00452351
test al, al
je 0x437f32
call dword [eax - 0x73]
test esp, ebp
sti
invalid
aam 0x95
cmp al, 0x79
retf 0x12f5
call fcn.004520e4
test al, al
je 0x437f53
xor esp, dword [esi + 0x31]
into
cmp ah, 0xa6
add byte [0xd248e16e], bh
inc eax
push esi
rcl byte [eax + 0x2a]
add ebp, eax
add eax, 0xe8acb937
push ss
mov byte [0xc0840001], al
call fcn.0045216e
test al, al
je 0x437f74
add dl, 0xde
cli
push cs
loope 0x437ee8
pop esp
dec ebp
mov al, 0xcd
salc
cld
adc eax, dword [esp + ebp*2 + 0x17]
in al, dx
hlt
lea eax, [ebp - 0x414]
push eax
call fcn.0048d19c
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x437fac
test dx, dx
je 0x437fa8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x437fac
add eax, 4
add ecx, 4
test dx, dx
jne 0x437f86
xor eax, eax
jmp 0x437fb1
sbb eax, eax
or eax, 1
test eax, eax
jne 0x437fcd
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d81d
mov esp, ebp
pop ebp
ret 8
call fcn.0045230c
test al, al
je 0x437fe8
imul eax, dword [ecx], 0xa32ad990
iretd
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d81d
mov esp, ebp
pop ebp
ret 8
Function at 0x444dd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0f18
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx

Function at 0x447ce0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e16f3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x67432c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x6794b4
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x6794b4
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x5e674a
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0044b920
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44e540
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x67d9a0], ecx
inc eax
cmp eax, 0x100
jb 0x44e542
cmp eax, 0x800
jae 0x44e613
nop
mov edx, dword [eax*4 + 0x67d5a0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x67d9a0]
mov dword [eax*4 + 0x67d9a0], edx
inc eax
cmp eax, 0x800
jb 0x44e5f0
mov dword [0x6794c0], 0x44f3b0
call fcn.0044f1e0
mov ecx, dword [0x6794c0]
test eax, eax
mov edx, 0x44f450
cmove ecx, edx
mov dword [0x6794c0], ecx
ret
Function at 0x44f730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x44f750
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x44f782
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x44f77f
inc esi
cmp esi, edx
jb 0x44f770
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x44f8ac
cmp ecx, 3
jbe 0x44f7c2
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x44f800
cmp cl, 0xff
je 0x44f800
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x44f764
dec ecx
shl eax, cl
and eax, 7
je 0x44f79a
movzx ecx, byte [eax + 0x5eb254]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x5eb24c], 0
mov cl, byte [edx + 4]
je 0x44f7ea
test cl, cl
je 0x44f7ea
cmp cl, 0xff
jne 0x44f79a
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x44f764
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x44f82e
lea edx, [edi + ebx]
add edx, esi
jmp 0x44f834
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x44f872
movzx edi, byte [eax + 0x5eb254]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x44f85e
cmp cl, 0xff
jne 0x44f872
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x44f821
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x44f764
pop edi
pop esi
cmp ecx, 3
jbe 0x44f8c1
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret