joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420606
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
not dword [ebp + 8]
sub esp, 0x10
cmp dword [ebp + 0xc], 8
push esi
push edi
mov esi, 0xff
jb 0x4206c9
mov edx, dword [ebp + 0xc]
shr edx, 3
movzx edi, byte [ecx]
mov eax, dword [ebp + 8]
xor edi, eax
and edi, esi
shr eax, 8
xor eax, dword [edi*4 + 0x459c78]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, esi
shr eax, 8
xor eax, dword [edi*4 + 0x459c78]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, esi
shr eax, 8
xor eax, dword [edi*4 + 0x459c78]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, esi
shr eax, 8
xor eax, dword [edi*4 + 0x459c78]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, esi
shr eax, 8
xor eax, dword [edi*4 + 0x459c78]
movzx edi, byte [ecx + 5]
xor edi, eax
sub dword [ebp + 0xc], 8
and edi, esi
shr eax, 8
xor eax, dword [edi*4 + 0x459c78]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, esi
shr eax, 8
xor eax, dword [edi*4 + 0x459c78]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, esi
shr eax, 8
xor eax, dword [edi*4 + 0x459c78]
add ecx, 8
dec edx
mov dword [ebp + 8], eax
jne 0x420626
mov dword [ebp - 0x10], 0x3e
mov dword [ebp - 8], 0x20
mov dword [ebp - 4], 0x32
mov dword [ebp - 0xc], 0x30
mov edi, dword [ebp - 4]
imul edi, edi, 0xc
add edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
cdq
push ebx
push 0xffffffffffffff9c
pop ebx
idiv ebx
mov edx, dword [ebp - 4]
shl edi, 2
push 0xffffffffffffffb4
sub eax, edi
sub eax, edx
mov edx, dword [ebp - 0xc]
sub eax, edx
mov edx, dword [ebp - 0xc]
sub eax, edx
mov edx, dword [ebp - 4]
lea eax, [eax + edx - 0x1a]
add eax, dword [ebp - 0x10]
pop edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
sub edx, eax
add edx, dword [ebp - 4]
pop ebx
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
sub eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
imul eax, edx
imul eax, eax, 0x1a
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
add dword [ebp - 4], 0xffffffa3
mov eax, dword [ebp - 0x10]
add eax, 0x15
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
imul eax, edx
cmp dword [ebp + 0xc], 0
mov dword [ebp - 4], eax
je 0x42078e
movzx eax, byte [ecx]
xor eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
and eax, esi
shr edx, 8
xor edx, dword [eax*4 + 0x459c78]
inc ecx
dec dword [ebp + 0xc]
mov dword [ebp + 8], edx
jne 0x420770
mov eax, dword [ebp + 8]
pop edi
not eax
pop esi
leave
ret
Function at 0x43b07f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, eax
push edi
lea eax, [ebp - 0xc]
push eax
mov eax, esi
mov dword [ebp - 0xc], 0x25
call fcn.004088e5
cmp eax, 0xffffffff
je 0x43b140
cmp dword [esi + 0x14], 8
jb 0x43b0af
mov eax, dword [esi]
jmp 0x43b0b1
mov eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push eax
call edi
mov ebx, eax
test ebx, ebx
je 0x43b124
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004105bb
cmp dword [esi + 0x14], 8
pop ecx
mov dword [ebp - 4], eax
jb 0x43b0e6
mov eax, dword [esi]
jmp 0x43b0e8
mov eax, esi
push ebx
push dword [ebp - 4]
push eax
call edi
test eax, eax
je 0x43b104
push dword [ebp - 4]
call fcn.00411f4e
pop ecx
mov ecx, dword [ebp - 4]
call fcn.00405129
push dword [ebp - 4]
call fcn.00411d4c
fld qword [0x473890]
fstp qword [ebp - 8]
pop ecx
fld qword [ebp - 8]
fadd qword [0x473888]
fstp qword [ebp - 8]
jmp 0x43b140
call fcn.0043fdd1
push eax
push dword [0x47a250]
push dword [0x47a22c]
push 1
call fcn.0043de0f
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43e477
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x43
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
imul ecx, eax
mov eax, dword [ebp - 4]
cdq
push esi
push 0x26
pop esi
idiv esi
sub ecx, eax
mov eax, dword [ebp - 4]
sub ecx, eax
mov eax, dword [ebp - 4]
sub ecx, eax
mov eax, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
imul eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
imul eax, ecx
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
pop esi
leave
ret

Function at 0x44149a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0x3e
mov dword [ebp - 8], 0x20
mov dword [ebp - 4], 0x32
mov dword [ebp - 0xc], 0x30
push esi
mov esi, dword [ebp - 4]
imul esi, esi, 0xc
add esi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
cdq
push edi
push 0xffffffffffffff9c
pop edi
idiv edi
mov edx, dword [ebp - 4]
shl esi, 2
push 0xffffffffffffffb4
sub eax, esi
sub eax, edx
mov edx, dword [ebp - 0xc]
sub eax, edx
mov edx, dword [ebp - 0xc]
sub eax, edx
mov edx, dword [ebp - 4]
lea eax, [eax + edx - 0x1a]
add eax, dword [ebp - 0x10]
pop edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
sub edx, eax
add edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
sub eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
imul eax, edx
imul eax, eax, 0x1a
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
add dword [ebp - 4], 0xffffffa3
mov eax, dword [ebp - 0x10]
add eax, 0x15
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
imul eax, edx
mov dword [ebp - 4], eax
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x441552
xor eax, eax
jmp 0x4415d8
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x44154b
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x10], 0x1c
mov dword [ebp - 0xc], 0x24
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 8], 0x35
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
push 3
mov dword [ebp - 8], edx
mov edx, dword [ebp - 0x10]
add edx, 6
mov dword [ebp - 8], edx
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
imul edx, esi
mov esi, dword [ebp - 0x10]
imul esi, esi, 0x26
add edx, esi
mov esi, dword [ebp - 8]
sub edx, esi
add edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
lea edx, [edx + esi + 0x4a]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 8]
pop esi
sub esi, edx
add esi, dword [ebp - 0x14]
mov eax, dword [eax + ecx + 0x98]
mov dword [ebp - 0x10], esi
test eax, eax
je 0x44154b
add eax, ecx
pop edi
pop esi
leave
ret
Function at 0x40bd59
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40bd68
pop dword [ebp - 0x2c]
mov eax, 0x68168fbe
sub eax, 0x67d5d256
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xb037528b
add dword [ebp - 0x3c], 0x9e1af2c0
mov dword [ebp - 0x38], 0x2158dc38
sub dword [ebp - 0x38], 0xef258ff3
mov dword [ebp - 0x34], 0xb31ed1a1
add dword [ebp - 0x34], 0x992d728d
mov dword [ebp - 0x30], 0x762e5462
add dword [ebp - 0x30], 0x89d1ab9e
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x67c72e3a
add dword [ebp - 0x3c], 0xcab3b1c
mov dword [ebp - 0x38], 0xb611514b
add dword [ebp - 0x38], 0x8b5b102a
mov dword [ebp - 0x34], 0xa35c214a
sub dword [ebp - 0x34], 0x3fecb4de
mov dword [ebp - 0x30], 0x4afc1a89
add dword [ebp - 0x30], 0xb503e577
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xc4adf0c2
add eax, 0x3b97bfbe
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x4ee8e
push 0
call eax
mov ecx, 0x23ba742b
add ecx, 0xdc45d922
xor edx, edx
add edx, eax
mov edi, 0x476000
add edi, dword [ebp - 0x2c]
mov esi, 0xca1ff2d6
sub esi, 0x50fa284e
add dword [ebp - 0x10], eax
mov ebx, dword [edi]
sub dword [ebp - 0x20], esi
xor ebx, esi
xor dword [ebp - 4], 0xdb013407
mov dword [edx], ebx
xor dword [ebp - 8], 0x73809e81
add edx, 0x80efbb90
sub edx, 0x80efbb8c
add edi, 0xddf084d7
sub edi, 0xddf084d3
loop 0x40be81
add eax, 0x12807
mov ebx, eax
add eax, 0x2d0031fb
add eax, 0xd2ffce0a
mov ecx, 0xdccdf9d9
sub ecx, 0xdc8df9d9
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x402ee4
pop dword [ebp - 8]
mov eax, 0xa5bb6730
add eax, 0x5a84c7b4
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x72b8028d
sub dword [ebp - 0x18], 0x2465bd42
mov dword [ebp - 0x14], 0x9dec534c
sub dword [ebp - 0x14], 0x6bb90707
mov dword [ebp - 0x10], 0x85cb9984
sub dword [ebp - 0x10], 0x397f5556
mov dword [ebp - 0xc], 0xb9d1dd02
add dword [ebp - 0xc], 0x462e22fe
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x358234ce
add dword [ebp - 0x18], 0x3ef03488
mov dword [ebp - 0x14], 0x1f7a2b7c
sub dword [ebp - 0x14], 0xde0dca07
mov dword [ebp - 0x10], 0x478ce368
add dword [ebp - 0x10], 0x1be28904
mov dword [ebp - 0xc], 0xd3761a39
sub dword [ebp - 0xc], 0xd3761a39
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x86221d35
sub eax, 0x85e19c35
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x384df
push 0
call eax
mov ecx, 0x4d13
mov edx, eax
mov edi, 0xfb1dd8fc
add edi, 0x5290b04
add edi, dword [ebp - 8]
mov esi, 0xc1026aef
mov dword [ebp - 4], 0x5ebdb7f
mov ebx, dword [edi]
add dword [ebp - 4], 0x8e26b926
xor ebx, esi
mov dword [edx], ebx
xor dword [ebp - 4], edx
add edx, 0x24feb317
add edx, 0xdb014ced
add edi, 4
loop 0x402ff5
add eax, 0x1271f
xor ebx, ebx
add ebx, eax
add eax, 0x3139f489
sub eax, 0x3139f484
mov ecx, 0x2e6f8dfb
sub ecx, 0x2e2f8dfb
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x404834
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x547008], 0x8088405
inc edx
mov dword [ebx + 0x547008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41c4cc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41c525
test eax, edx
je 0x41c528
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41c4e3
movzx eax, word [eax]
sub eax, ecx
jmp 0x41c50a
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41c50b
add ecx, 4
js 0x41c4fb
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41c508
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41c50a
xor eax, eax
ret
test eax, eax
je 0x41c534
test edx, edx
jne 0x41c4d4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4227fc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4228d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040731c
lea eax, [ebp - 4]
call fcn.004074b8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004078d4
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4228bc
mov eax, ebx
call fcn.00404424
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4228b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004078d4
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x42289f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4228e4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x42289f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4228bc
mov eax, dword [ebp - 0x10]
call fcn.00404440
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4228d9
lea eax, [ebp - 4]
call fcn.00406f14
ret
Function at 0x4234ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004073c4
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a5f8
mov edi, eax
cmp edi, 0x104
jbe 0x423457
mov eax, edi
add eax, eax
call fcn.00404424
mov esi, eax
jmp 0x423459
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a5f8
push esi
call fcn.0040c388
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x423492
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42347c
mov eax, esp
cmp esi, eax
je 0x42349f
mov eax, esi
call fcn.00404440
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4234d8
cmp bl, 0
je 0x4234d4
cmp bl, 0x41
jl 0x4234cf
cmp bl, 0x5a
jg 0x4234cf
or bl, 0x20
xor al, bl
inc esi
jmp 0x4234b3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x423418

Function at 0x423b58
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, eax
mov edx, esp
mov eax, dword [edi + 0x20]
call fcn.004237ec
mov eax, dword [esp]
inc dword [eax + 0xc]
mov eax, dword [esp]
cmp dword [eax + 0xc], 1
seta bl
call fcn.0040bd7c
cmp eax, dword [edi + 0x24]
je 0x423bc2
test bl, bl
jne 0x423bc2
mov eax, edi
call fcn.004239a0
jmp 0x423bb6
lea eax, [edi + 0xc]
call fcn.0041c308
mov esi, eax
cmp esi, 0xffff
jne 0x423ba8
mov eax, edi
call fcn.00423994
push 0
call sub.KERNEL32.DLL_TlsSetValue
mov eax, edi
call fcn.004239a0
lea eax, [edi + 0xc]
call fcn.0041c318
test eax, eax
jle 0x423b8f
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x429f24
Capabilities:
Clear file content
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
push ebx
call sub.KERNEL32.DLL_ResumeThread
call fcn.00429df8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
call fcn.00429df8
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
inc eax
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x42a15c
Capabilities:
Clear file content
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
mov dword [ebp - 0x308], ecx
mov ebx, edx
mov dword [ebp - 0x304], eax
test byte [ebx + 1], 0x20
jne 0x42a186
mov eax, 0x80070057
call fcn.00429df8
movzx eax, word [ebx]
mov edx, eax
and dx, 0xfff
cmp dx, 0xc
jne 0x42a30d
test ah, 0x40
je 0x42a1ac
mov eax, dword [ebx + 8]
mov eax, dword [eax]
mov dword [ebp - 0x314], eax
jmp 0x42a1b5
mov eax, dword [ebx + 8]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
movzx eax, word [eax]
mov dword [ebp - 0x310], eax
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x42a23a
inc ebx
xor edi, edi
lea esi, [ebp - 0x300]
mov eax, esi
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
add eax, 4
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_ResumeThread
call fcn.00429df8
lea eax, [ebp - 0x30c]
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
call fcn.00429df8
mov eax, dword [ebp - 0x320]
mov edx, dword [ebp - 0x30c]
sub edx, dword [eax + 4]
inc edx
mov eax, dword [ebp - 0x320]
mov dword [eax], edx
inc edi
add esi, 8
dec ebx
jne 0x42a1d8
lea eax, [ebp - 0x300]
push eax
mov eax, dword [ebp - 0x310]
push eax
push 0xc
call sub.KERNEL32.DLL_ResetEvent
mov esi, eax
test esi, esi
jne 0x42a25a
call fcn.00429b50
mov eax, dword [ebp - 0x304]
call fcn.0042a0b4
mov eax, dword [ebp - 0x304]
mov word [eax], 0x200c
mov eax, dword [ebp - 0x304]
mov dword [eax + 8], esi
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x42a29e
inc ebx
lea eax, [ebp - 0x2fc]
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
mov dword [edx], ecx
add edx, 4
add eax, 8
dec ebx
jne 0x42a291
push ebp
mov ebx, dword [ebp - 0x310]
dec ebx
mov eax, ebx
call fcn.0042a0d0
pop ecx
test al, al
je 0x42a2fe
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_SetErrorMode
call fcn.00429df8
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x100]
push eax
push esi
call sub.KERNEL32.DLL_SetErrorMode
call fcn.00429df8
mov eax, dword [ebp - 0x318]
mov edx, eax
mov eax, dword [ebp - 0x31c]
call dword [ebp - 0x308]
push ebp
mov eax, ebx
call fcn.0042a100
pop ecx
test al, al
jne 0x42a29e
jmp 0x42a31f
push ebx
mov eax, dword [ebp - 0x304]
push eax
call sub.KERNEL32.DLL_RaiseException
call fcn.00429df8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44fe38
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x44ff08
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040731c
mov eax, dword [ebp - 4]
call fcn.0044fb94
mov ebx, eax
test bl, bl
jne 0x44fe87
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00407cd8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004078d4
push eax
mov edx, ebx
mov eax, esi
call fcn.0044fe20
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, esi
call fcn.0044fd94
mov ebx, eax
test bl, bl
je 0x44fece
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegConnectRegistryW
jmp 0x44fef2
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [0x54b914]
mov dl, 1
mov eax, dword [0x44e9b8]
call fcn.004219e0
call fcn.00406618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ff0f
lea eax, [ebp - 4]
call fcn.00406f14
ret
Function at 0x450234
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4503af
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040731c
mov eax, dword [ebp - 4]
call fcn.0044fb94
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x450286
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00407cd8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00450e28
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x450365
xor eax, eax
push ebp
push 0x45035e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0044fe34
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004503e4
test al, al
je 0x45033c
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040707c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x45033c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.004078d4
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0044fd94
test al, al
je 0x450336
mov eax, dword [ebp - 8]
call fcn.004078d4
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00407934
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00450234
dec ebx
cmp ebx, 0xffffffff
jne 0x4502e5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450365
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0044fe34
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegConnectRegistryW
ret
mov eax, dword [ebp - 4]
call fcn.004078d4
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0044fe20
push eax
call sub.advapi32.dll_RegDeleteValueW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0044fd94
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4503b6
lea eax, [ebp - 0x3c]
call fcn.00406f14
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406f74
ret
Function at 0x450450
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x450508
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004503e4
test al, al
je 0x4504ea
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040707c
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x4504ea
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004078d4
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueW
mov eax, dword [ebp - 4]
call fcn.004078d4
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00407934
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4504a3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45050f
lea eax, [ebp - 0x2c]
call fcn.00406f14
lea eax, [ebp - 4]
call fcn.00406f14
ret