joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4356a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [edi + 0x20]
mov ebx, dword [edi + 0x805c]
cmp dword [eax + 4], 1
jne 0x4356bf
mov ebx, dword [edi]
cmp dword [esi + 0x2700], 0
je 0x435777
call fcn.004351d0
mov eax, dword [edi + 0x8040]
mov dword [ebp - 8], eax
push 0
mov edx, dword [eax + 8]
add edx, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
adc ecx, dword [eax + 0x1c]
mov eax, ecx
mov dword [ebp - 4], ecx
sar eax, 0x1f
lea eax, [ebp - 4]
push eax
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x435711
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4357c1
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push ebx
lea eax, [edi + 0x40]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4357c1
mov ecx, dword [ebp + 8]
cmp ecx, ebx
jne 0x4357c1
mov eax, dword [ebp - 8]
add dword [eax + 0x18], ecx
mov ecx, esi
adc dword [eax + 0x1c], 0
mov eax, dword [ebp + 8]
add dword [esi + 0x5d120], eax
push eax
adc dword [esi + 0x5d124], 0
push edi
call fcn.004357d0
mov ecx, esi
call fcn.004352f0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push ebx
lea eax, [edi + 0x40]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4357c1
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x4357c1
add dword [esi + 0x5d120], eax
mov ecx, esi
push eax
adc dword [esi + 0x5d124], 0
push edi
call fcn.004357d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x439d80
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x439dc2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
push 0x5915dc
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push esi
push eax
call fcn.005419f7
add esp, 0xc
test eax, eax
jne 0x439e9c
push 2
push eax
push dword [ebp - 0x18]
call fcn.0053fcd3
push dword [ebp - 0x18]
call fcn.005400e6
push 0
push 0
push dword [ebp - 0x18]
mov edi, eax
call fcn.0053fcd3
add esp, 0x1c
cmp edi, 0x10
jb 0x439e91
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push 1
xorps xmm0, xmm0
mov dword [ebp - 8], ebx
push 0x10
push eax
movq qword [ebp - 0x10], xmm0
call fcn.0053fb98
add esp, 0x10
cmp dword [ebp - 0x14], 0x10
jne 0x439e91
mov esi, dword [ebp - 0xc]
lea eax, [esi + 0x10]
cmp edi, eax
jne 0x439e91
lea eax, [esi + 2]
push eax
call fcn.0051d4c8
mov edi, eax
add esp, 4
test edi, edi
je 0x439e91
lea eax, [esi + 2]
push eax
push 0
push edi
call fcn.005392b0
push dword [ebp - 0x18]
push esi
push 1
push edi
call fcn.0053fb98
push dword [ebp - 0x24]
mov edx, esi
mov ecx, edi
call fcn.00439ff0
add esp, 0x20
mov ecx, edi
call fcn.0043a0f0
cmp eax, dword [ebp - 8]
jne 0x439e91
mov eax, dword [ebp - 0x1c]
mov ebx, 1
mov dword [eax], edi
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
push dword [ebp - 0x18]
call fcn.0053f443
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret

Function at 0x439ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
movsx eax, bl
push esi
mov esi, ecx
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
test esi, esi
je 0x43a06b
test edx, edx
je 0x43a06b
xor eax, eax
test edx, edx
je 0x43a06b
cmp edx, 0x20
jb 0x43a057
push edi
mov ecx, edx
mov edi, edx
and ecx, 0x1f
sub edi, ecx
lea ecx, [esi + 0x10]
mov edi, edi
movdqu xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm1
movdqu xmmword [ecx - 0x30], xmm0
movdqu xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm1
movdqu xmmword [ecx - 0x20], xmm0
cmp eax, edi
jb 0x43a030
pop edi
cmp eax, edx
jae 0x43a06b
jmp 0x43a060
xor byte [eax + esi], bl
lea ecx, [eax + esi]
inc eax
cmp eax, edx
jb 0x43a060
pop esi
pop ebx
pop ebp
ret

Function at 0x43a090
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
test edi, edi
je 0x43a0e0
push esi
mov esi, 0x7bd3b105
xor eax, eax
nop
imul esi, esi, 0xdd548
mov ecx, eax
and ecx, 0x1f
add esi, 0x92fb05
mov edx, esi
shr edx, 0x10
and edx, 0x7fff
add edx, 0x67183d
xor edx, dword [ecx*4 + 0x58be70]
xor edx, dword [eax + edi]
xor edx, 0xd6312bda
mov dword [eax + edi], edx
add eax, 4
cmp eax, 0x1060
jl 0x43a0a0
pop esi
pop edi
ret
Function at 0x43a0f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x43a202
test edi, edi
je 0x43a202
push 0x3fc
lea eax, [ebp - 0x400]
mov dword [ebp - 0x404], 0
push 0
push eax
call fcn.005392b0
add esp, 0xc
xor ecx, ecx
jmp 0x43a140
mov eax, ecx
shr eax, 1
test cl, 1
je 0x43a14e
xor eax, 0xedb88320
test al, 1
je 0x43a15b
shr eax, 1
xor eax, 0xedb88320
jmp 0x43a15d
shr eax, 1
test al, 1
je 0x43a16a
shr eax, 1
xor eax, 0xedb88320
jmp 0x43a16c
shr eax, 1
test al, 1
je 0x43a179
shr eax, 1
xor eax, 0xedb88320
jmp 0x43a17b
shr eax, 1
test al, 1
je 0x43a188
shr eax, 1
xor eax, 0xedb88320
jmp 0x43a18a
shr eax, 1
test al, 1
je 0x43a197
shr eax, 1
xor eax, 0xedb88320
jmp 0x43a199
shr eax, 1
test al, 1
je 0x43a1a6
shr eax, 1
xor eax, 0xedb88320
jmp 0x43a1a8
shr eax, 1
test al, 1
je 0x43a1b5
shr eax, 1
xor eax, 0xedb88320
jmp 0x43a1b7
shr eax, 1
mov dword [ebp + ecx*4 - 0x404], eax
inc ecx
cmp ecx, 0x100
jb 0x43a140
push esi
or edx, 0xffffffff
xor esi, esi
test edi, edi
je 0x43a1ed
movzx ecx, byte [esi + ebx]
inc esi
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ebp + ecx*4 - 0x404]
cmp esi, edi
jb 0x43a1d5
pop esi
not edx
pop edi
mov eax, edx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
Function at 0x43b370
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57040b
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x8e]
push eax
call fcn.005392b0
mov eax, dword [ebp + 0xc]
movzx esi, ax
lea eax, [ebp - 0x90]
push esi
push str.._c:
push 0x3f
push eax
call fcn.00541843
xor eax, eax
mov dword [ebp - 0xd4], 7
add esp, 0x1c
mov dword [ebp - 0xd8], 0
mov word [ebp - 0xe8], ax
cmp word [ebp - 0x90], ax
jne 0x43b3ff
xor ecx, ecx
jmp 0x43b41f
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
jmp 0x43b410
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43b410
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0xe8]
call fcn.004204e0
push 0x20
lea ecx, [ebp - 0xd0]
mov dword [ebp - 4], 0
cmp dword [ebp - 0xd4], 8
lea eax, [ebp - 0xe8]
push ecx
cmovae eax, dword [ebp - 0xe8]
lea ecx, [ebp - 0xf0]
push ecx
push 0
lea ecx, [ebp - 0xec]
push ecx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, 1
lea eax, [ebp - 0x90]
jne 0x43b4c0
push dword [ebp - 0xec]
push str._08X
push 0x3f
push eax
call fcn.00541843
add esp, 0x10
cmp word [ebp - 0x90], 0
jne 0x43b4a3
xor ecx, ecx
jmp 0x43b591
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43b4b0
jmp 0x43b58d
push esi
push str._c:_
push 0x3f
push eax
call fcn.00541843
add esp, 0x10
cmp word [ebp - 0x90], 0
jne 0x43b4df
xor ecx, ecx
jmp 0x43b4ff
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
jmp 0x43b4f0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43b4f0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0xe8]
call fcn.004204e0
cmp dword [ebp - 0xd4], 8
lea ecx, [ebp - 0xd0]
push 0x20
push ecx
lea ecx, [ebp - 0xf0]
push ecx
push 0
lea ecx, [ebp - 0xec]
push ecx
push 0
lea eax, [ebp - 0xe8]
cmovae eax, dword [ebp - 0xe8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, 1
jne 0x43b5a7
push dword [ebp - 0xec]
lea eax, [ebp - 0x90]
push str._08X
push 0x3f
push eax
call fcn.00541843
add esp, 0x10
cmp word [ebp - 0x90], 0
jne 0x43b579
xor ecx, ecx
jmp 0x43b591
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43b582
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x90]
mov ecx, edi
push eax
call fcn.004204e0
mov esi, 1
jmp 0x43b5a9
xor esi, esi
cmp dword [ebp - 0xd4], 8
jb 0x43b5c0
push dword [ebp - 0xe8]
call fcn.005385cc
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret 8
Function at 0x43dd10
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1308
call fcn.0053af40
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 0x12fc], eax
push esi
push edi
mov edi, edx
test eax, eax
je 0x43df11
test edi, edi
je 0x43df11
test ebx, ebx
je 0x43df11
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x43df11
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x294], ax
lea eax, [ebp - 0x292]
push eax
call fcn.005392b0
add esp, 0xc
push 0x595b1c
call fcn.0043a3e0
push eax
push 0x5933b8
lea eax, [ebp - 0x294]
push 0x103
push eax
call fcn.00541843
add esp, 0x14
mov dword [ebp - 0x12f8], 0
lea eax, [ebp - 0x1300]
mov dword [ebp - 0x1304], 1
mov dword [ebp - 0x1300], 4
push eax
lea eax, [ebp - 0x12f8]
push eax
lea eax, [ebp - 0x1304]
push eax
push edi
lea eax, [ebp - 0x294]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x43ddf2
mov dword [ebp - 0x12f8], 0
jmp 0x43ddff
cmp dword [ebp - 0x12f8], 0x40
jae 0x43df11
push 0x105c
lea eax, [ebp - 0x12f0]
push 0
push eax
call fcn.005392b0
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x12f0], eax
mov eax, dword [ebp + 0x14]
push 0x591530
mov dword [ebp - 0x12e8], eax
lea eax, [ebp - 0x12e4]
push 0x823
push eax
mov dword [ebp - 0x12f4], 0x1060
mov dword [ebp - 0x12ec], esi
call fcn.00541843
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0x12f4]
mov edx, 0x1060
mov dword [ebp - 0x29c], eax
call fcn.0043a0f0
add esp, 0x18
mov dword [ebp - 0x298], eax
lea ecx, [ebp - 0x12f4]
call fcn.0043a090
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x8c], ax
lea eax, [ebp - 0x8a]
push eax
call fcn.005392b0
push dword [ebp - 0x12f8]
lea eax, [ebp - 0x8c]
push dword [ebp - 0x12fc]
push str._s_d
push 0x3f
push eax
call fcn.00541843
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x12f4]
add esp, 0x24
push 0x1060
push eax
push 3
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x294]
push eax
push SysReAllocString
call esi
inc dword [ebp - 0x12f8]
lea eax, [ebp - 0x12f8]
push 4
push eax
push 4
push edi
lea eax, [ebp - 0x294]
push eax
push SysReAllocString
call esi
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
Function at 0x43df30
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
test esi, esi
je 0x43e030
test edx, edx
je 0x43e030
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x28c], ax
lea eax, [ebp - 0x28a]
push eax
call fcn.005392b0
mov eax, dword [0x5c22f0]
add esp, 0xc
test al, 1
jne 0x43df9a
or eax, 1
mov dword [0x5c22f0], eax
call fcn.0043ca80
push 0x5780e0
call fcn.005387a1
add esp, 4
cmp dword [0x5c2324], 8
mov eax, 0x5c2310
push 0x595b1c
cmovae eax, dword [0x5c2310]
push eax
push 0x5933b8
lea eax, [ebp - 0x28c]
push 0x103
push eax
call fcn.00541843
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
call fcn.005392b0
push dword [ebp + 8]
lea eax, [ebp - 0x84]
push esi
push str._s_d
push 0x3f
push eax
call fcn.00541843
add esp, 0x34
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x28c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
mov ecx, 1
cmove edi, ecx
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
Function at 0x43e050
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1300
call fcn.0053af40
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov ebx, ecx
mov eax, edx
xor esi, esi
mov dword [ebp - 0x12fc], eax
push edi
test ebx, ebx
je 0x43e2bb
test eax, eax
je 0x43e2bb
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x294], ax
lea eax, [ebp - 0x292]
push eax
call fcn.005392b0
mov eax, dword [0x5c22f0]
add esp, 0xc
test al, 1
jne 0x43e105
or eax, 1
mov dword [0x5c22f4], 0x595b3c
mov dword [0x5c22f0], eax
xor eax, eax
push 0x5780e0
mov dword [0x5c2304], esi
mov dword [0x5c2308], esi
mov dword [0x5c230c], esi
mov dword [0x5c2324], 7
mov dword [0x5c2320], esi
mov word [0x5c2310], ax
mov dword [0x5c22f8], eax
mov dword [0x5c22fc], eax
mov dword [0x5c2300], eax
call fcn.005387a1
add esp, 4
cmp dword [0x5c2324], 8
mov eax, 0x5c2310
push 0x595b1c
cmovae eax, dword [0x5c2310]
push eax
push 0x5933b8
lea eax, [ebp - 0x294]
push 0x103
push eax
call fcn.00541843
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x8c], ax
lea eax, [ebp - 0x8a]
push eax
call fcn.005392b0
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push ebx
push str._s_d
push 0x3f
push eax
call fcn.00541843
push 0x105c
lea eax, [ebp - 0x12f0]
mov dword [ebp - 0x12f8], 3
push 0
push eax
mov dword [ebp - 0x12f4], esi
call fcn.005392b0
add esp, 0x40
mov dword [ebp - 0x1300], 0x1060
lea eax, [ebp - 0x1300]
push eax
lea eax, [ebp - 0x12f4]
push eax
lea eax, [ebp - 0x12f8]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x294]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43e295
cmp dword [ebp - 0x12f8], 3
jne 0x43e295
push ecx
lea ecx, [ebp - 0x12f4]
call fcn.0043a090
add esp, 4
cmp dword [ebp - 0x12f4], 0x1060
jne 0x43e295
mov edi, dword [ebp - 0x12ec]
cmp edi, 1
jbe 0x43e295
mov esi, dword [ebp - 0x298]
lea ecx, [ebp - 0x12f4]
mov edx, 0x1060
mov dword [ebp - 0x298], 0
call fcn.0043a0f0
cmp esi, eax
jne 0x43e293
dec edi
lea ecx, [ebp - 0x12f4]
mov edx, 0x1060
mov dword [ebp - 0x12ec], edi
call fcn.0043a0f0
push ecx
lea ecx, [ebp - 0x12f4]
mov dword [ebp - 0x298], eax
call fcn.0043a090
add esp, 4
lea eax, [ebp - 0x12f4]
push 0x1060
push eax
push 3
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x294]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
xor esi, esi
push dword [ebp + 8]
mov edx, dword [ebp - 0x12fc]
mov ecx, ebx
call fcn.0043df30
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
Function at 0x43e2d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x43e429
test edi, edi
je 0x43e429
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.005392b0
mov eax, dword [0x5c22f0]
add esp, 0xc
test al, 1
jne 0x43e33a
or eax, 1
mov dword [0x5c22f0], eax
call fcn.0043ca80
push 0x5780e0
call fcn.005387a1
add esp, 4
cmp dword [0x5c2324], 8
mov eax, 0x5c2310
push 0x595b1c
cmovae eax, dword [0x5c2310]
push eax
push 0x5933b8
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00541843
add esp, 0x14
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x214], 4
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x210]
cmp eax, 0x40
jbe 0x43e3ca
mov eax, 0x40
mov dword [ebp - 0x210], eax
jmp 0x43e3ce
test eax, eax
je 0x43e429
push esi
xor esi, esi
test eax, eax
je 0x43e3eb
push esi
mov edx, edi
mov ecx, ebx
call fcn.0043df30
inc esi
add esp, 4
cmp esi, dword [ebp - 0x210]
jb 0x43e3d5
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 4
push edi
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
Function at 0x43e440
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570648
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], edi
test ecx, ecx
je 0x43e510
cmp word [ecx], di
je 0x43e510
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], edi
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x43e50c
xor esi, esi
cmp dword [ebp - 0x34], esi
jle 0x43e505
test esi, esi
je 0x43e4ff
mov edi, dword [ebx + esi*4]
test edi, edi
je 0x43e4fc
cmp word [edi], 0
je 0x43e4fc
push 1
push 0x594b7c
push edi
call fcn.00543f63
add esp, 0xc
test eax, eax
je 0x43e4fc
push edi
lea ecx, [ebp - 0x2c]
call fcn.00420660
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], 0
call fcn.0041bbe0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.0041fca0
mov edi, 1
mov dword [ebp - 0x30], edi
jmp 0x43e4ff
mov edi, dword [ebp - 0x30]
inc esi
cmp esi, dword [ebp - 0x34]
jl 0x43e4a2
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
jmp 0x43e512
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
Function at 0x43e880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
xor eax, eax
test ebx, ebx
je 0x43e988
push 0x206
xor esi, esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.005392b0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x103
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [ebp - 0x210]
call fcn.00538af3
add esp, 4
test eax, eax
jne 0x43e920
push 0x208
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.005392b0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push dword [ebp - 0x210]
call fcn.00538af3
add esp, 4
test eax, eax
je 0x43e927
movzx esi, word [ebp - 0x210]
push esi
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x229]
call fcn.0043a510
cmp dword [ebp - 0x218], edi
je 0x43e96f
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push eax
push 0x591530
push 0x102
push ebx
call fcn.00541843
add esp, 0x10
mov edi, 1
cmp dword [ebp - 0x214], 8
jb 0x43e986
push dword [ebp - 0x228]
call fcn.005385cc
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
Function at 0x43fd00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2884
call fcn.0053af40
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x28]
push ebx
push esi
push edi
mov dword [ebp - 0x2880], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x287c], esi
push 0x2450
push eax
mov word [ebp - 0x2878], ax
xor ebx, ebx
lea eax, [ebp - 0x2874]
push eax
call fcn.005392b0
add esp, 0xc
lea edx, [ebp - 0x2878]
mov ecx, esi
push ebx
call fcn.00431b40
add esp, 4
test eax, eax
je 0x43fed7
push 0x62f18
call fcn.00538625
add esp, 4
test eax, eax
je 0x43fed7
mov ecx, eax
call fcn.004315d0
mov edi, eax
test edi, edi
je 0x43fed7
push 0x1048
lea esi, [edi + 0x5d540]
push ebx
push esi
call fcn.005392b0
add esp, 0xc
push dword [ebp - 0x287c]
push 0x591530
push 0x823
push esi
call fcn.00541843
mov eax, dword [ebp + 0x10]
lea ecx, [edi + 0x62ef0]
mov dword [edi + 0x62ecc], eax
add esp, 0x10
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x26b8], eax
lea eax, [ebp - 0x287c]
mov dword [edi + 0x2468], 1
push eax
mov dword [edi + 0x26a4], 0x43fc00
mov dword [edi + 0x26a0], ebx
mov dword [ebp - 0x287c], ebx
call fcn.004370e0
lea eax, [ebp - 0x287c]
mov dword [ebp - 0x287c], ebx
push eax
lea ecx, [edi + 0x62ef0]
call fcn.004370e0
lea eax, [ebp - 0x287c]
mov dword [ebp - 0x287c], ebx
push eax
lea ecx, [edi + 0x62ef0]
call fcn.004370e0
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.005392b0
mov esi, dword [ebp - 0x2880]
add esp, 0xc
test esi, esi
je 0x43fecf
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.005392b0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x595c10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor eax, eax
cmp ax, word [esi]
je 0x43fecf
push esi
mov ecx, edi
call fcn.00411840
mov ecx, edi
call fcn.00431c40
test eax, eax
je 0x43fecf
push ecx
mov ecx, edi
call fcn.00432080
cmp dword [edi + 0x5d108], 7
mov eax, 1
cmove ebx, eax
mov edx, dword [edi]
mov ecx, edi
push 1
call dword [edx]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
Function at 0x4472b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov dword [edx*4 + 0x5c3800], eax
inc edx
cmp edx, 0x100
jb 0x4472b2
ret

Function at 0x447360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
or eax, 0xffffffff
test esi, esi
je 0x44738b
nop
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x5c3800]
dec esi
jne 0x447370
pop esi
mov esp, ebp
pop ebp
ret 4