joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e4b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45efb0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x47ea94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push 0
push str.IsX64OS
lea ecx, [ebp - 0x1c]
call fcn.00407b80
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
push 0x465c78
push 0x465c8c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41e540
lea ecx, [ebp - 0x40]
push ecx
call dword [ebp - 0x14]
jmp 0x41e54a
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x40]
cmp eax, 9
jne 0x41e55c
mov dword [ebp - 0x18], 1
jmp 0x41e563
mov dword [ebp - 0x18], 0
mov cl, byte [ebp - 0x18]
mov byte [ebp - 0xd], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00407aa0
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x41ea20
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push 0
push 0
push 0
push 0
push str.SHA256HashData
lea ecx, [ebp - 0x10]
call fcn.00407b80
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x20
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp dword [ebp - 4], 0
je 0x41eac2
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0x800c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x41eac2
cmp dword [ebp - 8], 0
je 0x41eac2
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 2
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 4], 0
je 0x41eadb
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0x10]
call fcn.00407aa0
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x41efd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f0d5
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push 0
push str.GetRidString
lea ecx, [ebp - 0x12c]
call fcn.00407b80
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x138]
call fcn.0041f8f0
mov byte [ebp - 4], 1
push 0x20019
push 0x465f00
push SysReAllocString
lea ecx, [ebp - 0x138]
call fcn.00420930
push 0x105
push 0
lea eax, [ebp - 0x118]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x13c], 0x104
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x124], 0x104
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x128]
push eax
push 0
push 0x465efc
mov ecx, dword [ebp - 0x138]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x118]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041f9f0
mov ecx, dword [ebp + 8]
call fcn.004206e0
test eax, eax
jle 0x41f0cb
mov dword [ebp - 0x120], 1
jmp 0x41f0d5
mov dword [ebp - 0x120], 0
mov al, byte [ebp - 0x120]
mov byte [ebp - 0x119], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x138]
call fcn.0041f9b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00407aa0
mov al, byte [ebp - 0x119]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret
Function at 0x420b20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x420b29
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x420b6c
mov eax, dword [ebp - 8]
jmp 0x420bd2
cmp dword [ebp - 0xc], 1
je 0x420b7f
cmp dword [ebp - 0xc], 2
je 0x420b7f
mov eax, 0xd
jmp 0x420bd2
cmp dword [ebp + 0xc], 0
je 0x420bc6
cmp dword [ebp - 4], 0
je 0x420bb5
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x420bac
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x420bb3
mov eax, 0xd
jmp 0x420bd2
jmp 0x420bc6
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x421230
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42125a
jmp 0x4213dd
cmp dword [ebp + 0xc], 0
je 0x421266
cmp dword [ebp + 0x10], 0
jne 0x421270
jmp 0x4213dd
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, 8
shl ecx, 0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0
je 0x4212da
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x4212cf
jmp 0x4212da
mov ecx, dword [ebp - 8]
add ecx, 0x14
mov dword [ebp - 8], ecx
jmp 0x421297
mov edx, dword [ebp - 8]
cmp dword [edx + 0x10], 0
je 0x4213dd
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0
je 0x421371
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
and eax, 0x80000000
cmp eax, 0x80000000
je 0x42134b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
add edx, dword [ecx]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
and eax, 0xffff0000
mov dword [ebp - 0x2c], eax
je 0x421349
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x30]
add edx, 2
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x421349
jmp 0x421371
jmp 0x42135d
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
and ecx, 0xffff
cmp ecx, dword [ebp + 0x10]
jne 0x42135d
jmp 0x421371
mov edx, dword [ebp - 0xc]
add edx, 4
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x10], eax
jmp 0x4212fe
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0
jne 0x42137d
jmp 0x4213dd
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4213ac
jmp 0x4213dd
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004213f0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 4
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x434570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2074
call fcn.0045be30
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2070], 0xffffffff
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2070], eax
cmp dword [ebp - 0x2070], 0xffffffff
jne 0x4345c3
xor eax, eax
jmp 0x434661
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x206c]
push edx
call fcn.004385a0
add esp, 4
mov dword [ebp - 0x2074], 0
push 0
lea eax, [ebp - 0x2074]
push eax
push 0x2000
lea ecx, [ebp - 0x2014]
push ecx
mov edx, dword [ebp - 0x2070]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x434612
jmp 0x43463c
cmp dword [ebp - 0x2074], 0
jne 0x43461d
jmp 0x43463c
mov eax, dword [ebp - 0x2074]
push eax
lea ecx, [ebp - 0x2014]
push ecx
lea edx, [ebp - 0x206c]
push edx
call fcn.00438620
add esp, 0xc
jmp 0x4345e0
mov eax, dword [ebp - 0x2070]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x206c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00438770
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret
Function at 0x4367a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x4367af
cmp dword [ebp + 0x10], 0
jg 0x4367b7
mov eax, dword [ebp + 8]
jmp 0x436954
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jl 0x436915
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x467050]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x467050]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x467050]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x467050]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x467050]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x467050]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x467050]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x467050]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x4367c0
cmp dword [ebp + 0x10], 0
je 0x43694e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x467050]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x43691b
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x436a00
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x412
push 0
lea eax, [ebp - 0x418]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x41c], 0
push 0x208
lea ecx, [ebp - 0x418]
push ecx
call fcn.004379a0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x436a61
mov eax, 0xcb
jmp 0x436ab5
cmp dword [ebp + 8], 0
je 0x436a8c
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x41c]
jb 0x436a8c
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x436a93
mov eax, 0x6f
jmp 0x436ab5
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x436ab3
push 0
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret
Function at 0x4374c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x412
push 0
lea eax, [ebp - 0x418]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x41c], 0
push 0x208
lea ecx, [ebp - 0x418]
push ecx
call fcn.00436a00
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x437518
jmp 0x437536
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret

Function at 0x4384a0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x3c], 0
push 0x14
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4384e4
mov eax, 3
jmp 0x438583
push 4
push str.TSDefenseBt
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x43850f
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 3
jmp 0x438583
lea edx, [ebp - 0x3c]
push edx
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x438544
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 3
jmp 0x438583
mov dword [ebp - 0x38], 1
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 2
je 0x438565
cmp dword [ebp - 0x34], 3
jbe 0x43856c
cmp dword [ebp - 0x34], 5
jbe 0x438565
jmp 0x43856c
mov dword [ebp - 0x38], 2
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret

Function at 0x4385a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x10325476
pop ebp
ret

Function at 0x43a560
Capabilities:
Execute syscall

Disassembly:
mov eax, dword [0x47fc04]
lea edx, [esp + 4]
int 0x2e
ret 0xc
Function at 0x43a570
Capabilities:
Execute syscall

Disassembly:
mov eax, dword [0x47fc08]
lea edx, [esp + 4]
int 0x2e
ret 0x18

Function at 0x43a580
Capabilities:
Execute syscall

Disassembly:
mov eax, dword [0x47fc0c]
lea edx, [esp + 4]
int 0x2e
ret 0x2c
Function at 0x43b030
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x47fcbc], 0
je 0x43b056
mov eax, dword [0x47fcb8]
jmp 0x43b12a
push 0x114
push 0
lea eax, [ebp - 0x118]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x43b099
xor eax, eax
jmp 0x43b12a
cmp dword [ebp - 0x114], 5
ja 0x43b0ba
mov dword [0x47fcbc], 1
mov dword [0x47fcb8], 0
xor eax, eax
jmp 0x43b12a
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
push reloc.OLEAUT32.dll_SysReAllocString
push str.EnableLUA
push 0x47fcb8
call fcn.0043c490
add esp, 0x10
test eax, eax
je 0x43b111
cmp dword [0x47fcb8], 1
jne 0x43b0ef
mov dword [ebp - 0x11c], 2
jmp 0x43b0f9
mov dword [ebp - 0x11c], 1
mov edx, dword [ebp - 0x11c]
mov dword [0x47fcb8], edx
mov dword [0x47fcbc], 1
jmp 0x43b125
mov dword [0x47fcbc], 0
mov dword [0x47fcb8], 0
mov eax, dword [0x47fcb8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret
Function at 0x43bec0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x43bee1
mov eax, 0x57
jmp 0x43bf4d
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43bf08
mov eax, dword [ebp - 8]
jmp 0x43bf4d
mov ecx, dword [ebp + 0x14]
call fcn.00405f70
lea eax, [eax + eax + 2]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00405b40
push eax
push 1
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x43bf4a
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x43bf60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x220], 0
push 0x209
push 0
lea eax, [ebp - 0x210]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x224], 0
cmp dword [ebp + 0xc], 0
jne 0x43bfcd
mov eax, 0x57
jmp 0x43c193
lea edx, [ebp - 0x220]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x43c010
push 0x46793e
mov ecx, dword [ebp + 0x14]
call fcn.00405c10
mov eax, dword [ebp - 0x218]
jmp 0x43c193
mov dword [ebp - 0x21c], 0x208
push 0x209
push 0
lea edx, [ebp - 0x210]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x218], 0
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x214]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xea
jne 0x43c115
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
cmp dword [ebp - 0x224], 4
jbe 0x43c0a3
jmp 0x43c115
mov eax, dword [ebp - 0x21c]
add eax, 0x209
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x214], 0
je 0x43c0e5
lea ecx, [ebp - 0x210]
cmp ecx, dword [ebp - 0x214]
je 0x43c0e5
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x43c110
mov dword [ebp - 0x218], 8
jmp 0x43c115
jmp 0x43c050
cmp dword [ebp - 0x218], 0
jne 0x43c12f
mov ecx, dword [ebp - 0x214]
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.00405c10
jmp 0x43c13c
push 0x46793f
mov ecx, dword [ebp + 0x14]
call fcn.00405c10
cmp dword [ebp - 0x214], 0
je 0x43c16d
lea edx, [ebp - 0x210]
cmp edx, dword [ebp - 0x214]
je 0x43c16d
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [ebp - 0x214], 0
cmp dword [ebp - 0x220], 0
je 0x43c18d
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret