joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cee0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov dword [esp], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
test edi, edi
jne 0x42cf07
mov eax, 0xa0
add esp, 0xc
ret
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x42cf16
mov dword [ebx], 0
push esi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push ecx
push closesocket
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x42cf46
cmp esi, 2
je 0x42cf9f
pop esi
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0xc]
push edx
push 0
lea eax, [esp + 0x18]
push eax
push 0
push str.LaunchPermission
push ecx
call ebx
mov esi, eax
test esi, esi
je 0x42cf71
cmp esi, 0x7a
jne 0x42cf9b
mov edx, dword [esp + 0xc]
push edx
call fcn.005c40dd
add esp, 4
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
push 0
mov dword [edi], eax
mov eax, dword [esp + 0x18]
push str.LaunchPermission
push eax
call ebx
mov esi, eax
mov ebx, dword [esp + 0x18]
test esi, esi
je 0x42cfcf
mov eax, dword [edi]
test eax, eax
je 0x42cfb2
push eax
call fcn.005c4000
add esp, 4
mov dword [edi], 0
test ebx, ebx
je 0x42cfcf
mov ecx, edi
call fcn.0042d530
mov esi, eax
test esi, esi
jne 0x42cfcf
mov dword [ebx], 1
mov eax, dword [esp + 8]
test eax, eax
je 0x42cfde
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x42cff0
Capabilities:
Get user security identifier

Disassembly:
sub esp, 0x210
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x20c], eax
push edi
xor eax, eax
push 0x1fe
mov edi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.005c8fb0
add esp, 0xc
mov ecx, esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0xff
call fcn.0042d6b0
test eax, eax
je 0x42d054
xor eax, eax
pop edi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.005c397a
add esp, 0x210
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
mov eax, dword [edi]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
push esi
push 0
call ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x7a
jne 0x42d0c3
mov ecx, dword [esp + 0xc]
push ecx
xor ebx, ebx
call fcn.005c40dd
add esp, 4
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
push ecx
push eax
push esi
push ebx
mov dword [edi], eax
mov dword [esp + 0x2c], 0xff
call ebp
test eax, eax
jne 0x42d0c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [esp + 0x218]
pop ebp
mov eax, ebx
pop ebx
pop edi
xor ecx, esp
call fcn.005c397a
add esp, 0x210
ret
Function at 0x42d4b0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0x6ca128
push 0
push edx
push closesocket
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x42d50e
push edi
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
push eax
mov eax, dword [esp + 8]
push edi
push 3
push esi
push str.LaunchPermission
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x42d51d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x42d8a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x118
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
mov dword [esp + 0x10], 0x11c
call fcn.005c8fb0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42d915
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x42d90e
mov eax, dword [esp + 0xc]
cmp eax, 1
jb 0x42d910
jne 0x42d900
cmp word [esp + 0x118], 2
jmp 0x42d90e
cmp eax, 2
jne 0x42d915
cmp word [esp + 0x118], 1
jae 0x42d915
mov esi, 1
mov ecx, dword [esp + 0x120]
mov eax, esi
pop esi
xor ecx, esp
call fcn.005c397a
add esp, 0x120
ret
Function at 0x42fec0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6106bb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 8]
lea esi, [ebx + 4]
push esi
push edi
push edi
push edi
push edi
push str.FopdMonPort
call sub.FLTLIB.DLL_FilterConnectCommunicationPort
test eax, eax
jne 0x42fffe
push 4
push edi
push edi
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [ebx + 8], eax
cmp eax, edi
je 0x42fffe
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x18], edi
lea esp, [esp]
cmp dword [ebp - 0x18], 2
jae 0x42ffe2
push 0x2c
call fcn.005c39f5
add esp, 4
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x42ff59
push eax
call fcn.0042f540
mov edi, eax
jmp 0x42ff5b
xor edi, edi
mov byte [ebp - 4], 0
mov dword [ebp - 0x1c], edi
mov eax, 0x48c560
mov dword [edi + 0x28], eax
mov eax, dword [edi]
lea ecx, [eax + 0x220]
push ecx
push 0x220
push eax
mov edx, dword [esi]
push edx
call sub.FLTLIB.DLL_FilterGetMessage
push edi
cmp eax, 0x800703e5
jne 0x42ffcc
mov eax, dword [esi]
mov dword [edi + 0xc], eax
mov ecx, dword [ebx + 8]
mov dword [edi + 8], ecx
call fcn.0042f630
push 0
push 0
push edi
push 0x42fd80
push 0
push 0
call fcn.005c4af6
add esp, 0x18
mov dword [edi + 4], eax
lea edi, [ebx + 0xc]
lea ebx, [ebp - 0x1c]
call fcn.004bd110
mov byte [ebp - 0x11], 1
mov ebx, dword [ebp + 8]
inc dword [ebp - 0x18]
jmp 0x42ff30
call fcn.0042f5d0
push edi
call fcn.005c396f
add esp, 4
inc dword [ebp - 0x18]
jmp 0x42ff30
cmp byte [ebp - 0x11], 0
je 0x42fffe
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
jmp 0x430017
mov esi, ebx
call fcn.0042fcd0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x433a20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x604bc1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], 0
mov ecx, dword [eax]
lea edx, [esp + 0xc]
call fcn.00433970
mov dword [esp + 0x30], 1
cmp dword [eax + 0x18], 8
jb 0x433a72
mov eax, dword [eax + 4]
jmp 0x433a75
add eax, 4
push esi
mov ecx, eax
call fcn.0040b990
mov dword [esp + 8], 1
mov byte [esp + 0x30], 0
cmp dword [esp + 0x24], 8
jb 0x433a9e
mov ecx, dword [esp + 0x10]
push ecx
call fcn.005c396f
add esp, 4
xor edx, edx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], dx
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x433b60
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, eax
test edi, edi
je 0x433d2d
test esi, esi
je 0x433d2d
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x433d2d
mov ebx, dword [esp + 0x20]
mov eax, ebx
call fcn.00433ad0
cmp dword [ebp], eax
jl 0x433d2d
mov eax, 0x55555556
imul ebx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ecx*4]
mov eax, 0x6bca1af3
imul edx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
xor eax, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], ecx
mov ebp, 0x13
mov dword [esp + 0x14], eax
test ebx, ebx
jl 0x433ca1
cmp eax, ebx
jne 0x433bfd
mov edx, ebx
imul edx, edx, 0x4c
lea eax, [ecx*4]
sub eax, edx
cdq
and edx, 3
add eax, edx
mov ebp, eax
sar ebp, 2
test ebp, ebp
jle 0x433c6b
mov eax, ebp
movzx ecx, byte [edi]
movzx edx, byte [edi + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [edi + 2]
shl ecx, 8
or ecx, edx
shl ecx, 8
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF_]
mov byte [esi], dl
shl ecx, 6
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF_]
shl ecx, 6
mov byte [esi + 1], dl
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF_]
shr ecx, 0x14
and ecx, 0x3f
mov byte [esi + 2], dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF_]
mov byte [esi + 3], cl
add edi, 3
add esi, 4
sub eax, 1
jne 0x433c03
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
lea eax, [edx + ebp*4]
add eax, 2
mov byte [esi], 0xd
inc esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
inc eax
mov byte [esi], 0xa
inc esi
cmp eax, ebx
mov dword [esp + 0x14], eax
jle 0x433be2
cmp dword [esp + 0x10], 0
je 0x433ca1
sub esi, 2
sub dword [esp + 0x10], 2
lea eax, [ecx + ecx*2]
mov ecx, dword [esp + 0x20]
sub ecx, eax
je 0x433d16
lea ebp, [ecx + 1]
test ebp, ebp
je 0x433d16
xor eax, eax
test ecx, ecx
jle 0x433cbd
movzx eax, byte [edi]
inc edi
shl eax, 8
cmp ecx, 1
jle 0x433ccb
movzx edx, byte [edi]
or eax, edx
inc edi
shl eax, 8
cmp ecx, 2
jle 0x433cd8
movzx ecx, byte [edi]
or eax, ecx
shl eax, 8
test ebp, ebp
jle 0x433cf7
mov ecx, ebp
mov edx, eax
shr edx, 0x1a
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF_]
mov byte [esi], dl
inc esi
shl eax, 6
sub ecx, 1
jne 0x433ce1
add dword [esp + 0x10], ebp
mov edi, 4
sub edi, ebp
test edi, edi
jle 0x433d12
push edi
push 0x3d
push esi
call fcn.005c8fb0
add esp, 0xc
add dword [esp + 0x10], edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x4345d0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x604a1a
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x808], eax
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x81c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x82c]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0
mov esi, 1
mov dword [esp + 0x824], esi
lea eax, [esp + 0x18]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [esp + 0x830]
cmp dword [eax - 4], esi
jle 0x43465d
mov ecx, dword [eax - 0xc]
push ecx
lea edx, [esp + 0x834]
push edx
call fcn.0040de10
mov eax, dword [esp + 0x830]
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x434660
lea edi, [esp + 0x18]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x434674
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
lea ecx, [esp + 0x1c]
call fcn.0040b990
mov dword [esp + 0x10], 1
mov byte [esp + 0x824], 0
lea ecx, [esp + 0x830]
call fcn.0040ba40
mov eax, ebp
mov ecx, dword [esp + 0x81c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.005c397a
add esp, 0x818
ret
Function at 0x434990
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x608b81
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x824]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x834]
lea eax, [esp + 0x1c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [esp + 0x1c], 0
lea esi, [esp + 0x1c]
je 0x434a7c
mov edx, dword [0x728f58]
mov eax, dword [edx + 0xc]
mov ecx, 0x728f58
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x82c], 1
push esi
push 0x6d0bac
lea edi, [esp + 0x20]
call fcn.0042a2d0
mov ebx, edi
add esp, 8
mov edi, ebp
call fcn.00424a30
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x434a34
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
mov dword [esp + 0x82c], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434a72
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp word [esi], 0
jne 0x4349f2
mov ecx, dword [esp + 0x824]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.005c397a
add esp, 0x81c
ret
Function at 0x434ab0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x608b31
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x828]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esi + 0x10]
mov dword [esp + 0x18], esi
cmp dword [esi + 0xc], ebx
jbe 0x434b03
call fcn.005c475a
mov edi, dword [esi + 0xc]
mov eax, dword [esi]
mov dword [esp + 0x10], eax
cmp edi, dword [esi + 0x10]
jbe 0x434b16
call fcn.005c475a
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
push ebx
push ecx
push edi
push eax
push esi
lea ebx, [esp + 0x24]
call fcn.004460f0
lea edx, [esp + 0x1c]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [esp + 0x1c], 0
lea esi, [esp + 0x1c]
je 0x434c05
lea ebx, [ebx]
mov eax, dword [0x728f58]
mov edx, dword [eax + 0xc]
mov ecx, 0x728f58
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov ebx, 1
mov dword [esp + 0x830], ebx
push esi
push 0x6d0bac
lea edi, [esp + 0x18]
call fcn.0042a2d0
mov edi, dword [esp + 0x18]
add esp, 8
cmp dword [edi - 4], ebx
jle 0x434b9f
mov eax, dword [edi - 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.0040de10
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x434bbc
mov edi, dword [esp + 0x18]
lea ebx, [esp + 0x10]
call fcn.00424a30
mov edi, dword [esp + 0x10]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x434bc1
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
mov dword [esp + 0x830], 0xffffffff
lea eax, [edi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x434bfb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp word [esi], 0
jne 0x434b50
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.005c397a
mov esp, ebp
pop ebp
ret
Function at 0x435140
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x5ffce4
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28c]
mov dword [esp + 0x280], 0
lea eax, [esp + 0x288]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ebx, 0x6d0648
call fcn.0041e2b0
add esp, 8
mov byte [esp + 0x280], 1
mov eax, dword [eax]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
mov byte [esp + 0x280], 0
lea ecx, [esp + 0x1c]
call fcn.0040ba40
cmp ebp, 0xffffffff
je 0x435309
mov ecx, 0x6d0bfc
lea eax, [esp + 0x50]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x435208
test dx, dx
je 0x435204
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x435208
add eax, 4
add ecx, 4
test dx, dx
jne 0x4351e2
xor eax, eax
jmp 0x43520d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4352ee
mov ecx, 0x6d0c00
lea eax, [esp + 0x50]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x435246
test dx, dx
je 0x435242
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x435246
add eax, 4
add ecx, 4
test dx, dx
jne 0x435220
xor eax, eax
jmp 0x43524b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4352ee
lea eax, [esp + 0x288]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ebx, 0x6ca140
call fcn.0041e2b0
mov byte [esp + 0x288], 2
push eax
lea edx, [esp + 0x20]
push edx
lea ebx, [esp + 0x60]
call fcn.0041e2b0
add esp, 0x10
mov bl, 4
mov byte [esp + 0x280], bl
lea ecx, [esp + 0x18]
call fcn.0040ba40
lea edi, [esp + 0x14]
call fcn.0040bd70
test byte [esp + 0x24], 0x10
je 0x4352d0
push esi
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
mov ecx, edi
push ecx
push eax
call fcn.0040b930
mov byte [esp + 0x288], 5
mov byte [esp + 0x288], bl
call fcn.00435140
add esp, 8
jmp 0x4352dd
mov eax, dword [esp + 0x44]
add dword [esi], eax
mov ecx, dword [esp + 0x40]
adc dword [esi + 4], ecx
mov byte [esp + 0x280], 0
lea ecx, [esp + 0x14]
call fcn.0040ba40
lea edx, [esp + 0x24]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4351d9
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0x280], 0xffffffff
lea ecx, [esp + 0x288]
call fcn.0040ba40
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.005c397a
add esp, 0x270
ret
Function at 0x435350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fa408
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x4353c2
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x40]
call fcn.0040ba40
mov eax, esi
mov edx, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x40]
call fcn.0040ba40
xor eax, eax
xor edx, edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x4353f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5ffc89
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040b700
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x30]
push ebx
push ebx
push 3
push ebx
push ebx
push closesocket
push eax
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4354d0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
inc eax
push eax
call fcn.005c40dd
mov edx, dword [esp + 0x18]
add esp, 4
push ebx
lea ecx, [esp + 0x18]
push ecx
push edx
mov esi, eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov byte [esi + eax], bl
cmp esi, ebx
jne 0x43548e
xor eax, eax
jmp 0x43549c
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x435493
sub eax, edx
mov ebx, dword [esp + 0x2c]
mov edi, eax
push esi
mov eax, ebx
call fcn.0040f900
push esi
call fcn.005c4000
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4354f0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5fa3e0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], 1
xor bl, bl
mov dword [esp + 0xc], 0
mov dword [esp + 0x20], eax
cmp eax, 0x80000001
jne 0x435556
lea eax, [esp + 0x20]
push eax
push 0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4355eb
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 2
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4355a3
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
push 4
lea ecx, [esp + 0x30]
push ecx
push 4
push edx
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [esp + 0xc]
push ecx
call esi
test bl, bl
je 0x4355ba
mov edx, dword [esp + 0x20]
push edx
call esi
mov eax, dword [0x72a524]
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x24]
call fcn.0040ba40
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.0040ba40
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
mov dword [esp + 0x20], closesocket
jmp 0x435556