joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d560
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4575fb
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, dl
mov esi, ecx
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x414], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42d621
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x430]
push eax
push 0
push str.Common_Programs
push dword [ebp - 0x434]
mov dword [ebp - 0x414], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x434]
test eax, eax
je 0x42d63c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x434], 0
xor eax, eax
mov dword [ebp - 0x418], 7
mov dword [ebp - 0x41c], 0
mov word [ebp - 0x42c], ax
cmp word [ebp - 0x410], ax
jne 0x42d666
xor ecx, ecx
jmp 0x42d67f
lea ecx, [ebp - 0x410]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42d670
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00406c00
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
jb 0x42d6a1
mov esi, dword [esi]
cmp word [esi], 0
jne 0x42d6ab
xor ecx, ecx
jmp 0x42d6bf
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42d6b0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x42c]
call fcn.00405270
cmp dword [ebp - 0x418], 8
mov eax, dword [ebp - 0x42c]
jb 0x42d6e7
mov ecx, eax
test eax, eax
je 0x42d76f
jmp 0x42d6ed
lea ecx, [ebp - 0x42c]
cmp word [ecx], 0
je 0x42d76f
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42d769
lea edx, [ebp - 0x43c]
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x43c], 0
call fcn.0042dda0
mov eax, dword [ebp - 0x438]
and eax, 0xff00
cmp eax, 0x1600
jb 0x42d769
push 0
test bl, bl
mov eax, str.startunpin
mov ecx, str.startpin
cmove ecx, eax
cmp dword [ebp - 0x418], 8
push 0
push 0
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x42c]
cmp dword [ebp - 0x418], 8
jb 0x42d782
push eax
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x42dab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
mov edi, ecx
mov dword [ebp - 0xc], edx
test edi, edi
je 0x42db56
test edx, edx
je 0x42db56
push ebx
mov ebx, dword [edi + 0x3c]
add ebx, edi
je 0x42dadb
lea eax, [ebx + 0x78]
test eax, eax
jne 0x42dae3
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [eax]
add eax, edi
push esi
mov ecx, dword [eax + 0x1c]
mov esi, dword [eax + 0x20]
add ecx, edi
add esi, edi
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
add ecx, edi
mov dword [ebp - 4], esi
xor esi, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x42db3a
lea esp, [esp]
movsx eax, word [ecx + esi*2]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push edx
mov eax, dword [eax + esi*4]
add eax, edi
push eax
call dword [sym.imp.MSVCR110.dll__stricmp]
add esp, 8
test eax, eax
je 0x42db43
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
inc esi
cmp esi, dword [ebp - 8]
jb 0x42db10
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
pop esi
mov eax, dword [ecx + eax*4]
add eax, dword [ebx + 0x34]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42ee20
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
je 0x42f048
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x144], 0x11c
call fcn.0042dcc0
test eax, eax
jne 0x42ee74
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x144], 0x114
call fcn.0042dcc0
test eax, eax
je 0x42f048
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42ee97
lea ecx, [ebp - 0x28]
push ecx
call eax
jmp 0x42eea1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x46e0f4
push 0x14
push esi
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
mov eax, dword [ebp - 0x134]
add esp, 0xc
sub eax, 2
jne 0x42f034
cmp dword [ebp - 0x140], 6
push edi
mov edi, dword [sym.imp.MSVCR110.dll_wcscat_s]
jne 0x42ef4a
cmp dword [ebp - 0x13c], 3
jne 0x42eee7
push 0x46e0fc
push 0x14
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x13c], 2
jne 0x42eefd
push 0x46e104
push 0x14
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x13c], 1
jne 0x42ef20
cmp byte [ebp - 0x2a], 1
jne 0x42ef13
push 0x46e108
jmp 0x42ef18
push 0x46e10c
push 0x14
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x13c], 0
jne 0x42ef43
cmp byte [ebp - 0x2a], 1
jne 0x42ef36
push str.vista
jmp 0x42ef3b
push str.2008
push 0x14
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x140], 6
jb 0x42ef6f
mov ax, word [ebp - 0x28]
cmp ax, 9
jne 0x42ef5d
push str._x64
jmp 0x42ef67
test ax, ax
jne 0x42ef6f
push str._x86
push 0x14
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x140], 5
jne 0x42f033
cmp dword [ebp - 0x13c], 2
jne 0x42effe
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x42ef98
push str.2003_r2
jmp 0x42efbc
mov eax, 0x2000
cmp word [ebp - 0x2c], ax
je 0x42efb7
cmp byte [ebp - 0x2a], 1
jne 0x42efb7
cmp word [ebp - 0x28], 9
jne 0x42efb7
push str.xp_x64
jmp 0x42efbc
push str.2003
push 0x14
push esi
call edi
add esp, 0xc
cmp byte [ebp - 0x2a], 1
je 0x42eff5
mov ax, word [ebp - 0x28]
cmp ax, 6
jne 0x42efdb
push str._ia64
jmp 0x42efed
cmp ax, 9
jne 0x42efe8
push str._x64
jmp 0x42efed
push str._x86
push 0x14
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x140], 5
jne 0x42f033
cmp dword [ebp - 0x13c], 1
jne 0x42f01d
push 0x46e184
push 0x14
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x140], 5
jne 0x42f033
cmp dword [ebp - 0x13c], 0
jne 0x42f033
push str.2000
push 0x14
push esi
call edi
add esp, 0xc
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x430380
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458090
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], edx
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 0
jb 0x4303ca
mov eax, dword [esi]
jmp 0x4303cc
mov eax, esi
test eax, eax
je 0x430514
cmp word [eax], 0
je 0x430514
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
je 0x430514
xor eax, eax
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00406870
push dword [ebp + 0x18]
mov edx, dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.0042f950
add esp, 0xc
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.0042f1b0
test eax, eax
je 0x4304d1
cmp dword [ebp - 0x18], 8
jb 0x430452
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x43048c
jmp 0x430455
lea eax, [ebp - 0x2c]
cmp word [eax], 0
je 0x43048c
push eax
call ebx
cmp eax, 0xffffffff
je 0x43048c
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x14], 8
jb 0x430496
mov eax, dword [esi]
jmp 0x430498
mov eax, esi
test eax, eax
je 0x4304d1
cmp word [eax], 0
je 0x4304d1
push eax
call ebx
cmp eax, 0xffffffff
je 0x4304d1
cmp dword [esi + 0x14], 8
jb 0x4304b4
mov eax, dword [esi]
jmp 0x4304b6
mov eax, esi
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esi + 0x14], 8
jb 0x4304ca
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x44]
push eax
mov ecx, edi
call fcn.00406730
cmp dword [ebp - 0x30], 8
mov esi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
jb 0x4304f0
push dword [ebp - 0x44]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
jb 0x430534
push dword [ebp - 0x2c]
call esi
add esp, 4
jmp 0x430534
xor eax, eax
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push 0x45ec1c
mov ecx, edi
mov word [edi], ax
call fcn.00406c00
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x4323f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45816e
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x47f060]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push 0xc
mov dword [esp + 0x18], ebx
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], ebx
test edi, edi
je 0x43248e
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [edi + 8], ebx
call fcn.00432ab0
mov esi, eax
mov byte [esp + 0x30], 1
mov ebx, 1
push 0x2728
mov ecx, edi
mov dword [esp + 0x18], ebx
call dword [sym.imp.curlpp.dll_public:_void___thiscall_curlpp::OptionBase::constructor_enum_CURLoption_]
mov dword [esp + 0x30], 2
push esi
mov ecx, edi
mov dword [edi], vtable.curlpp::Option_class_std::list_class_utilspp::clone_ptr_class_curlpp::FormPart___class_std::allocator_class_utilspp::clone_ptr_class_curlpp::FormPart____.0
mov dword [edi + 8], 0
call fcn.004329f0
mov dword [edi], vtable.curlpp::OptionTrait_class_std::list_class_utilspp::clone_ptr_class_curlpp::FormPart___class_std::allocator_class_utilspp::clone_ptr_class_curlpp::FormPart_____10024_.0
jmp 0x432490
xor edi, edi
test bl, 1
je 0x4324ab
lea ecx, [esp + 0x1c]
call fcn.00430ee0
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push edx
push ecx
mov dword [ebp - 0x41c], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 8]
cmp ecx, 1
je 0x433ccd
cmp ecx, 2
je 0x433ccd
cmp ecx, 4
jne 0x433d3a
test esi, esi
jne 0x433c86
test eax, eax
jne 0x433d3a
lea eax, [esi + 2]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret 8
cmp eax, 2
je 0x433cdc
test eax, eax
jne 0x433d20
cmp dword [ebp - 0x418], 4
jne 0x433d20
cmp dword [ebp - 0x41c], 4
jne 0x433d20
mov eax, dword [ebp - 0x414]
cmp eax, dword [esi]
je 0x433d3a
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret 8
test esi, esi
je 0x433d36
cmp word [esi], 0
je 0x433d36
cmp eax, 2
jne 0x433cf2
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret 8
test eax, eax
jne 0x433d20
mov eax, dword [ebp - 0x418]
cmp eax, 1
je 0x433d0b
cmp eax, 7
je 0x433d0b
cmp eax, 2
jne 0x433d20
lea eax, [ebp - 0x414]
push esi
push eax
call dword [sym.imp.MSVCR110.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x433d3a
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x433d20
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00452076
mov esp, ebp
pop ebp
ret 8
Function at 0x434500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x628]
push eax
or edx, 1
push edx
push 0
push str.SOFTWAREiSafe
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 0x628], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x434598
push str.SOFTWAREiSafe
push str.HKEY_LOCAL_MACHINE
push 0x45d3b4
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x14
lea eax, [ebp - 0x20c]
push 0
push 0
push eax
push str.SOFTWAREiSafe
push 0
push 0x3010200
call edi
test eax, eax
je 0x434598
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x620]
push eax
push 0
push 0x45d188
push dword [ebp - 0x628]
mov dword [ebp - 0x624], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x434609
cmp word [esi], 0
je 0x434609
cmp eax, 2
je 0x434617
test eax, eax
jne 0x434617
mov eax, dword [ebp - 0x620]
cmp eax, 1
je 0x4345f2
cmp eax, 7
je 0x4345f2
cmp eax, 2
jne 0x434617
lea eax, [ebp - 0x61c]
push esi
push eax
call dword [sym.imp.MSVCR110.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x43460d
jmp 0x434617
test eax, eax
je 0x434617
test esi, esi
je 0x434617
cmp word [esi], 0
jne 0x43465d
push 0x45d188
push str.SOFTWAREiSafe
push str.HKEY_LOCAL_MACHINE
push str._s_s_s
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push 0
push eax
push esi
push 1
push 0x3010201
call edi
test eax, eax
jne 0x434586
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x434680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x830]
push eax
or edx, 1
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalliSafe
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [ebp - 0x830], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.MSVCR110.dll_swprintf_s]
test eax, eax
je 0x43471c
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalliSafe
push str.HKEY_LOCAL_MACHINE
push 0x45d3b4
lea eax, [ebp - 0x20c]
push 0x104
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x20c]
push 0
push 0
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalliSafe
push 0
push 0x2010300
call edi
test eax, eax
je 0x43471c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
push str.uninstall.exe
push ebx
push str._s_s
lea eax, [ebp - 0x414]
push 0x104
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x828]
push eax
push 0
push str.UninstallString
push dword [ebp - 0x830]
mov dword [ebp - 0x82c], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [ebp - 0x414], 0
je 0x4347b4
cmp eax, 2
jne 0x43477e
lea ebx, [eax - 1]
jmp 0x4347bd
test eax, eax
jne 0x4347b8
mov eax, dword [ebp - 0x828]
cmp eax, 1
je 0x434797
cmp eax, 7
je 0x434797
cmp eax, 2
jne 0x4347b8
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.MSVCR110.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x43480c
jmp 0x4347b8
test eax, eax
jne 0x43480c
mov ebx, 2
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalliSafe
push str.HKEY_LOCAL_MACHINE
push str._s_s_s
lea eax, [ebp - 0x20c]
push 0x104
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push 0
push eax
lea eax, [ebp - 0x414]
push eax
movzx eax, bl
shl eax, 0x10
push 1
or eax, 0x2000301
push eax
call edi
test eax, eax
jne 0x434709
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x437510
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0x18]
or eax, 0x20019
push eax
push 0
push str.SoftwareiSafe
push reloc.OLEAUT32.dll_SysReAllocString
xor bl, bl
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43757c
push dword [ebp - 0xc]
lea eax, [ebp + 0xc]
push edi
push eax
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov eax, dword [ebp - 8]
test eax, eax
je 0x43758a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x4378b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458b5b
mov eax, dword fs:[0]
push eax
mov eax, 0x103c
call fcn.00452b30
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x1018]
push eax
push 0
push esi
push dword [edi]
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x1014], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x437a9d
mov ecx, dword [ebp - 0x1018]
cmp ecx, 1
jne 0x4379a5
cmp word [ebp - 0x810], ax
jne 0x437972
xor ecx, ecx
push ecx
lea eax, [ebp - 0x810]
push eax
mov ecx, ebx
call fcn.00406c00
mov eax, edi
jmp 0x437a9d
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
jmp 0x437980
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437980
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
mov ecx, ebx
call fcn.00406c00
mov eax, edi
jmp 0x437a9d
cmp ecx, 2
jne 0x437a98
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x1030]
call fcn.00406d00
lea edx, [ebp - 0x1030]
lea ecx, [ebp - 0x1048]
mov dword [ebp - 4], 0
call fcn.004375a0
cmp dword [eax + 0x14], 8
jb 0x4379e0
mov eax, dword [eax]
push 0x400
lea ecx, [ebp - 0x1010]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [ebp - 0x1034], 8
mov esi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
mov dword [ebp - 0x1014], eax
jb 0x437a19
push dword [ebp - 0x1048]
call esi
mov eax, dword [ebp - 0x1014]
add esp, 4
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x101c], 8
mov dword [ebp - 0x1034], 7
mov dword [ebp - 0x1038], 0
mov word [ebp - 0x1048], cx
jb 0x437a57
push dword [ebp - 0x1030]
call esi
mov eax, dword [ebp - 0x1014]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x101c], 7
mov dword [ebp - 0x1020], 0
mov word [ebp - 0x1030], cx
test eax, eax
je 0x437a91
cmp eax, 0x400
ja 0x437a91
lea eax, [ebp - 0x1010]
push eax
mov ecx, ebx
call fcn.00404f90
mov eax, edi
jmp 0x437a9d
mov eax, 0xea
jmp 0x437a9d
mov eax, 0x3f4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret 8

Function at 0x437c10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
sub edx, edi
sar edx, 1
mov esi, 0x811c9dc5
mov ecx, 0
add edx, edx
je 0x437c41
lea ecx, [ecx]
movzx eax, byte [ecx + edi]
xor esi, eax
inc ecx
imul esi, esi, 0x1000193
cmp ecx, edx
jb 0x437c30
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x439df0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458a5e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x47f060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [edi + 4]
mov dword [ebp - 0x10], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.0041e520
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
lea ecx, [edi + 0x24]
mov dword [ebp - 0x10], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.0041e520
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x439f04
test dl, 0x10
jne 0x439f04
mov eax, 1
jmp 0x439f06
xor eax, eax
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
push dword [esi + 0x18]
call fcn.0041e370
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c