joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425e00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x425e59
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x425e59
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x425e4a
cmp esi, edx
jae 0x425e59
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x425e38
cmp esi, edx
jae 0x425e59
cmp word [esi], 0
je 0x425e59
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x427260
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4f68
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4d63e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x10], 0
je 0x427386
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0x10], 0
je 0x427386
cmp dword [eax + 0x14], 8
jb 0x4272a9
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x14]
call fcn.00424e20
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x4272c1
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x10]
call fcn.00424e20
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push 0x2001f
push 0
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x427334
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42731e
cmp dword [ebp - 0x1c], 4
mov ecx, 0xd
cmovne eax, ecx
mov esi, dword [ebp + 0x14]
test eax, eax
cmove esi, dword [ebp - 0x20]
test edi, edi
je 0x427337
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x427337
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427354
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x427373
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42e6c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5ab0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4d63e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, word [ebp + 8]
mov edi, dword [ebp + 0xc]
add eax, 0xffffff96
cmp eax, 0xf
ja case.0x42e703.107
movzx eax, byte [eax + 0x42e7f8]
jmp dword [eax*4 + 0x42e7e0]
mov eax, dword [esi]
push edi
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x42e7d8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret 8
push edi
call fcn.0042eda0
jmp 0x42e712
push edi
call fcn.0042ebd0
jmp 0x42e712
movzx eax, word [esi + 0xc]
lea ebx, [esi + 0xc]
test ax, ax
jne 0x42e76b
push 0
push 0x1a
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
movzx eax, word [ebx]
test ax, ax
je case.0x42e703.107
mov ecx, esi
call fcn.0042f370
push eax
lea ecx, [ebp - 0x58]
call fcn.00403490
push str.Kingsoft_
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.00401780
push edi
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.00410a20
add esp, 0x18
mov ecx, edi
push eax
call fcn.004071b0
lea ecx, [ebp - 0x28]
call fcn.00402340
lea ecx, [ebp - 0x40]
call fcn.00402340
lea ecx, [ebp - 0x58]
call fcn.00402340
mov al, 1
jmp 0x42e71c
push edi
call fcn.0042e3a0
test al, al
je case.0x42e703.107
mov al, 1
jmp 0x42e71c
Function at 0x42ebd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5b83
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4d63e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp word [ecx + 0x4bc], 0
lea esi, [ecx + 0x4bc]
mov edi, dword [ebp + 8]
je 0x42ecc6
mov ecx, esi
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ec30
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00402e30
push 0x5c
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00417380
push edi
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00410a20
add esp, 0x18
mov ecx, edi
push eax
call fcn.004071b0
lea ecx, [ebp - 0x40]
call fcn.00402340
lea ecx, [ebp - 0x58]
call fcn.00402340
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x42ed6e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42ed64
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ed8d
jmp 0x42ed64
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x42ecec
push 0x208
push eax
push esi
call fcn.0046edf0
add esp, 0xc
xor al, al
jmp 0x42ed70
mov ecx, esi
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ed05
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00402e30
push 0x5c
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00417380
push edi
push eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push eax
call fcn.00410a20
add esp, 0x18
mov ecx, edi
push eax
call fcn.004071b0
lea ecx, [ebp - 0x70]
call fcn.00402340
lea ecx, [ebp - 0x88]
jmp 0x42ec84
push edx
push ecx
call fcn.0046c40b
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret 4
call fcn.00477ce9
int3
Function at 0x42eda0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5b83
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4d63e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp word [ecx + 0x2b4], 0
lea esi, [ecx + 0x2b4]
mov edi, dword [ebp + 8]
je 0x42ee96
mov ecx, esi
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ee00
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00402e30
push 0x5c
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00417380
push edi
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00410a20
add esp, 0x18
mov ecx, edi
push eax
call fcn.004071b0
lea ecx, [ebp - 0x40]
call fcn.00402340
lea ecx, [ebp - 0x58]
call fcn.00402340
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x42ef6a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42ef60
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ef89
jmp 0x42ef60
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x42eee8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x42eed1
push 0x208
push 0
push esi
call fcn.0046edf0
add esp, 0xc
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x42eee8
push 0x208
push 0
push esi
call fcn.0046edf0
add esp, 0xc
xor al, al
jmp 0x42ef6c
mov ecx, esi
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ef01
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00402e30
push 0x5c
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00417380
push edi
push eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push eax
call fcn.00410a20
add esp, 0x18
mov ecx, edi
push eax
call fcn.004071b0
lea ecx, [ebp - 0x70]
call fcn.00402340
lea ecx, [ebp - 0x88]
jmp 0x42ee54
push edx
push ecx
call fcn.0046c40b
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret 4
call fcn.00477ce9
int3

Function at 0x42f370
Capabilities:
Get common file path

Disassembly:
cmp word [ecx + 0xc], 0
push esi
lea esi, [ecx + 0xc]
jne 0x42f388
push 0
push 0x1a
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, esi
pop esi
ret
Function at 0x430b80
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5e68
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4d63e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor bl, bl
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 0x29], bl
mov dword [ebp - 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x430d4b
xor edi, edi
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x38], edi
jle 0x430d44
mov edx, dword [eax + edi*4]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430c03
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00402e30
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edx, 8
mov ecx, dword [ebp - 0x18]
cmovae eax, ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], eax
cmp ecx, 0x10
jb 0x430c91
add ecx, 0xfffffff1
lea ecx, [eax + ecx*2]
mov dword [ebp - 0x3c], ecx
sub ecx, eax
sar ecx, 1
je 0x430c8b
lea esp, [esp]
cmp word [eax], 0x2f
je 0x430c60
add eax, 2
sub ecx, 1
jne 0x430c50
jmp 0x430c8b
mov edx, str._startup_source
mov edi, eax
mov esi, 0x10
sub edi, edx
mov edi, edi
mov cx, word [edi + edx]
cmp cx, word [edx]
jne 0x430cdd
add edx, 2
sub esi, 1
jne 0x430c70
sub eax, dword [ebp - 0x40]
sar eax, 1
cmp eax, 0xffffffff
jne 0x430ce8
mov edi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x430ccc
lea ecx, [edx*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x430cc2
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x430d69
push ecx
push ebx
call fcn.0046c40b
add esp, 8
mov eax, dword [ebp - 0x34]
inc edi
mov dword [ebp - 0x30], edi
cmp edi, dword [ebp - 0x38]
jge 0x430d41
jmp 0x430be7
mov ecx, dword [ebp - 0x3c]
add eax, 2
jmp 0x430c46
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x28]
cmp edx, eax
je 0x430d07
cmp dword [ebp - 0x14], 8
mov ecx, edx
push dword [ebp - 0x18]
cmovae eax, ebx
push eax
call fcn.00402e30
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 0x29], 1
cmp ecx, 8
jb 0x430d3e
lea ecx, [ecx*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x430d34
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x430d69
push ecx
push ebx
call fcn.0046c40b
add esp, 8
mov eax, dword [ebp - 0x34]
mov bl, byte [ebp - 0x29]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret
call fcn.00477ce9
int3
Function at 0x432f90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6120
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4d63e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
lea edi, [eax + 0x2c]
mov eax, dword [edi]
test eax, eax
jne 0x43300e
push dword [0x4d61cc]
call fcn.00432870
add esp, 4
mov ecx, dword [edi]
mov dword [ebp - 4], 0
mov dword [edi], eax
test ecx, ecx
je 0x432fed
push ecx
mov ecx, edi
call fcn.00432850
mov eax, dword [edi]
mov dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x43300e
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x14
call fcn.0046c3db
mov esi, eax
mov dword [ebp - 0x10], eax
add esp, 4
mov dword [ebp - 0x18], esi
xor ecx, ecx
mov dword [ebp - 4], 1
push ecx
mov dword [eax], ecx
push ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
push ecx
mov dword [eax + 0xc], ecx
push ecx
mov dword [eax + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp + 0xc]
mov eax, esi
mov byte [ebp - 4], 2
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ecx
mov eax, dword [edi]
test eax, eax
jne 0x433083
push dword [0x4d61cc]
call fcn.00432870
add esp, 4
mov ecx, dword [edi]
mov byte [ebp - 4], 3
mov dword [edi], eax
test ecx, ecx
je 0x43307f
push ecx
mov ecx, edi
call fcn.00432850
mov eax, dword [edi]
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x10]
push edi
push 0
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4330b1
mov eax, dword [ebp + 8]
push eax
push str._ld_not_overlapped
call fcn.00409d70
add esp, 8
mov byte [ebp + 0xb], 1
jmp 0x4330da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x433112
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 8]
push eax
push str._ld_readfile_failed:__ld
call fcn.00409d70
add esp, 0xc
mov byte [ebp + 0xb], 0
test ebx, ebx
je 0x4330ea
cmp ebx, 0xffffffff
je 0x4330ea
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [ebp + 0xb]
test esi, esi
je 0x4330fc
push 0x14
push esi
call fcn.0046c40b
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x14]
xor esi, esi
add ecx, 0xc
mov dword [ebp - 0x18], esi
mov dword [ebp + 8], edi
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x433130
mov dword [eax], edi
add dword [ecx + 4], 4
jmp 0x43313a
lea edx, [ebp + 8]
push edx
push eax
call fcn.00409980
mov ecx, dword [ebp - 0x14]
add ecx, 0x18
mov dword [ebp - 0x1c], esi
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x433158
mov dword [eax], ebx
mov bl, 1
add dword [ecx + 4], 4
jmp 0x4330ed
lea edx, [ebp + 8]
push edx
push eax
call fcn.00409980
mov bl, 1
jmp 0x4330ed
Function at 0x4336e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43374c
mov esi, dword [ebp + 0x18]
mov dword [ebp - 8], 3
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 3
jne 0x43374c
mov eax, dword [ebp - 0xc]
push dword [ebp - 4]
mov dword [esi], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x433760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43378f
mov eax, dword [ebp + 0x14]
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x14]
test esi, esi
pop esi
cmove eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4337e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
call fcn.0047ecb9
add esp, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x433847
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x433900
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a619b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x4d63e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
test ebx, ebx
je 0x433b2b
push 0x2a
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.0046edf0
mov ecx, ebx
add esp, 0xc
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433956
sub ecx, edx
sar ecx, 1
lea eax, [ecx - 0xd]
xor ecx, ecx
test eax, eax
cmovns ecx, eax
movzx eax, word [ebx + ecx*2]
lea edi, [ebx + ecx*2]
test ax, ax
je 0x4339b4
mov ecx, eax
lea ecx, [ecx]
movzx ecx, cx
lea edi, [edi + 2]
lea eax, [ecx - 0x41]
cmp eax, 0x19
lea edx, [ecx + 0x20]
movzx eax, word [edi]
cmova edx, ecx
shl esi, 4
add edx, esi
mov ecx, eax
mov esi, edx
shr esi, 0x17
and esi, 0x1e0
xor esi, edx
and esi, 0xfffffff
test ax, ax
jne 0x433980
push esi
push 0x4affec
lea eax, [ebp - 0x3c]
push 0x14
push eax
call fcn.0042d790
push 0
lea eax, [ebp - 0x3c]
push eax
push str.SoftwareKingsoftOffice6.0CommonResourceManagerImages
push 0x80000001
call fcn.00433760
add esp, 0x20
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov edi, eax
call fcn.0047ecb9
push 0
push esi
push edx
push eax
call fcn.0047ecf9
fld qword [0x4b3408]
add esp, 0x14
fcompi st(1)
jbe 0x433a31
mov eax, 0x10624dd3
mul edi
shr edx, 6
mov dword [ebp - 0x64], edx
fild dword [ebp - 0x64]
test edx, edx
jns 0x433a1f
fadd qword [0x4b3410]
fstp qword [ebp - 0x68]
fld qword [ebp - 0x68]
fcompi st(1)
fstp st(0)
ja 0x433b2b
jmp 0x433a33
fstp st(0)
call fcn.004335f0
test al, al
jne 0x433ac7
lea ecx, [ebp - 0x98]
call fcn.00432a80
mov esi, dword [ebp - 0x58]
mov dword [ebp - 4], 0
test esi, esi
je 0x433a7e
cmp dword [esi + 4], 0
je 0x433a7e
push ebx
lea ecx, [ebp - 0x54]
call fcn.00403490
push esi
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x98]
call fcn.00433540
jmp 0x433a9a
push ebx
lea ecx, [ebp - 0x54]
call fcn.00403490
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x98]
call fcn.00433170
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.00402340
lea ecx, [ebp - 0x98]
call fcn.00433590
lea ecx, [ebp - 0x98]
call fcn.00433b50
lea ecx, [ebp - 0x98]
call fcn.00432bd0
push 0
call fcn.0047ecb9
add esp, 4
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareKingsoftOffice6.0CommonResourceManagerImages
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x433b2b
push 4
lea eax, [ebp - 0x60]
push eax
push 4
push 0
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret
Function at 0x436c10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x436d41
test al, 3
jne 0x436d41
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x436cfc
cmp edi, 8
jb 0x436cc5
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x436c74
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x436d00
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x436ce2
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x436d04
xor edi, edi
jmp 0x436d04
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x436d18
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x436e04
cmp ecx, 0x20
jb 0x436de5
mov esi, ecx
add eax, 0x10
and esi, 0xffffffe0
xorps xmm3, xmm3
mov dword [esp + 0x1c], esi
xorps xmm2, xmm2
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
nop dword [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edi + ebx]
add edi, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x436d80
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x436e04
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x436df4
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret