joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b730
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x5ffae8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov al, byte [esp + 0x3c]
xor esi, esi
mov dword [esp + 0x28], esi
cmp byte [esp + 0x38], 0
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], esi
je 0x43b78b
cmp byte [0x72a7bc], 0
je 0x43b784
test al, al
je 0x43b784
mov ebp, 0x20119
jmp 0x43b7a2
mov ebp, 0x20019
jmp 0x43b7a2
cmp byte [0x72a7bc], 0
je 0x43b79d
mov ebp, 0x20106
test al, al
jne 0x43b7a2
mov ebp, 0x20006
lea eax, [esp + 0x18]
push eax
call fcn.0040b8d0
mov byte [esp + 0x28], 1
lea ecx, [esp + 0x38]
push ecx
call fcn.0040b8d0
mov byte [esp + 0x28], 2
mov edx, dword [esp + 0x34]
push 0x5c
push edx
call fcn.005c6653
add esp, 8
cmp eax, esi
je 0x43b7e0
sub eax, dword [esp + 0x34]
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
jne 0x43b7ef
lea eax, [esp + 0x34]
lea edi, [esp + 0x38]
call fcn.0040ddb0
jmp 0x43b850
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
lea edx, [esp + 0x38]
call fcn.00442dc0
mov byte [esp + 0x28], 3
lea edi, [esp + 0x18]
call fcn.0040ddb0
mov byte [esp + 0x28], 2
lea ecx, [esp + 0x1c]
call fcn.0040ba40
mov ecx, dword [esp + 0x34]
mov ecx, dword [ecx - 0xc]
lea edx, [esp + 0x1c]
sub ecx, esi
push edx
lea eax, [esp + 0x38]
dec ecx
push eax
call fcn.00442d10
mov byte [esp + 0x28], 4
lea edi, [esp + 0x38]
call fcn.0040ddb0
mov byte [esp + 0x28], 2
lea ecx, [esp + 0x1c]
call fcn.0040ba40
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43b8ab
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x43b89b
cmp eax, 2
jne 0x43b8a0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
push eax
push 0
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x43b8a0
mov byte [esp + 0x13], 1
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x28], 1
lea ecx, [esp + 0x38]
call fcn.0040ba40
mov byte [esp + 0x28], 0
lea ecx, [esp + 0x18]
call fcn.0040ba40
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.0040ba40
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x43bc20
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x60878d
mov eax, dword fs:[0]
push eax
sub esp, 0x880
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x878], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x894]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x8a4]
xor ebx, ebx
push 0x3ff
lea eax, [esp + 0x491]
push ebx
mov dword [esp + 0x24], ebx
push eax
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x498], bl
call fcn.005c8fb0
add esp, 0xc
push 0x3ff
lea ecx, [esp + 0x91]
push ebx
push ecx
mov byte [esp + 0x98], bl
call fcn.005c8fb0
add esp, 0xc
lea ecx, [esp + 0x8c]
call fcn.00438510
xor eax, eax
lea edx, [esp + 0x8c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
push edx
mov eax, 0x400
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
call fcn.004519f0
add esp, 4
lea esi, [esp + 0x24]
lea edi, [esp + 0x7c]
call fcn.00451a90
movzx eax, byte [esp + 0x8b]
movzx ecx, byte [esp + 0x8a]
movzx edx, byte [esp + 0x89]
push eax
movzx eax, byte [esp + 0x8c]
push ecx
movzx ecx, byte [esp + 0x8f]
push edx
movzx edx, byte [esp + 0x92]
push eax
movzx eax, byte [esp + 0x95]
push ecx
movzx ecx, byte [esp + 0x98]
push edx
movzx edx, byte [esp + 0x9b]
push eax
movzx eax, byte [esp + 0x9e]
push ecx
movzx ecx, byte [esp + 0xa1]
push edx
movzx edx, byte [esp + 0xa4]
push eax
movzx eax, byte [esp + 0xa7]
push ecx
movzx ecx, byte [esp + 0xaa]
push edx
movzx edx, byte [esp + 0xad]
push eax
movzx eax, byte [esp + 0xb0]
push ecx
push edx
push eax
push str._02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X
lea ecx, [esp + 0x4d0]
push 0x400
push ecx
call fcn.005c3fc1
add esp, 0x4c
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x490]
call fcn.0040b760
mov esi, 1
mov dword [esp + 0x89c], esi
lea eax, [esp + 0x18]
push eax
push ebp
call fcn.00433a20
add esp, 8
mov dword [esp + 0x1c], esi
mov byte [esp + 0x89c], bl
lea ecx, [esp + 0x18]
call fcn.0040b810
mov eax, ebp
mov ecx, dword [esp + 0x894]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.005c397a
add esp, 0x88c
ret
Function at 0x43c370
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x6043cb
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x820]
mov dword fs:[0], eax
mov esi, dword [esp + 0x830]
xor ebx, ebx
mov dword [esp + 0x828], ebx
mov edx, dword [esp + 0x834]
mov ecx, esi
mov dword [esp + 0x10], ebx
call fcn.0043c1b0
mov eax, dword [esp + 0x834]
cmp dword [eax - 4], 1
jle 0x43c3f1
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x838]
push ecx
call fcn.0040de10
mov eax, dword [esp + 0x834]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43c495
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x30]
push eax
push ebx
push ebx
push ebx
push ecx
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor esi, esi
cmp dword [esp + 0x14], ebx
jbe 0x43c48a
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x43c440
mov eax, dword [esp + 0x10]
push 0x400
lea edx, [esp + 0x20]
push edx
push esi
push eax
call edi
test eax, eax
jne 0x43c483
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ecx
lea ecx, [esp + 0x24]
call fcn.0040b990
mov byte [esp + 0x82c], 1
mov edx, dword [esp + 0x14]
push edx
mov byte [esp + 0x830], bl
call fcn.0043c370
add esp, 8
inc esi
cmp esi, dword [esp + 0x14]
jb 0x43c440
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x828], 0xffffffff
mov eax, dword [esp + 0x834]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c4c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x820]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.005c397a
add esp, 0x81c
ret
Function at 0x43c4f0
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x6086f8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov al, byte [esp + 0x40]
mov dword [esp + 0x2c], 0
cmp byte [esp + 0x3c], 0
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], 0
je 0x43c551
cmp byte [0x72a7bc], 0
je 0x43c54a
test al, al
je 0x43c54a
mov ebx, 0x20119
jmp 0x43c568
mov ebx, 0x20019
jmp 0x43c568
cmp byte [0x72a7bc], 0
je 0x43c563
mov ebx, 0x20106
test al, al
jne 0x43c568
mov ebx, 0x20006
lea eax, [esp + 0x18]
push eax
call fcn.0040b8d0
mov byte [esp + 0x2c], 1
lea ecx, [esp + 0x3c]
push ecx
call fcn.0040b8d0
mov byte [esp + 0x2c], 2
mov edx, dword [esp + 0x38]
push 0x5c
push edx
call fcn.005c6653
add esp, 8
test eax, eax
je 0x43c5a6
sub eax, dword [esp + 0x38]
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
jne 0x43c5b5
lea eax, [esp + 0x38]
lea edi, [esp + 0x3c]
call fcn.0040ddb0
jmp 0x43c616
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
lea edx, [esp + 0x3c]
call fcn.00442dc0
mov byte [esp + 0x2c], 3
lea edi, [esp + 0x18]
call fcn.0040ddb0
mov byte [esp + 0x2c], 2
lea ecx, [esp + 0x1c]
call fcn.0040ba40
mov ecx, dword [esp + 0x38]
mov ecx, dword [ecx - 0xc]
lea edx, [esp + 0x1c]
sub ecx, esi
push edx
lea eax, [esp + 0x3c]
dec ecx
push eax
call fcn.00442d10
mov byte [esp + 0x2c], 4
lea edi, [esp + 0x3c]
call fcn.0040ddb0
mov byte [esp + 0x2c], 2
lea ecx, [esp + 0x1c]
call fcn.0040ba40
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x14]
push ecx
push ebx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43c6ae
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push ecx
push edx
xor bl, bl
call edi
test eax, eax
je 0x43c69e
lea ebx, [ebx]
cmp eax, 5
jne 0x43c6a3
test bl, bl
jne 0x43c6a3
mov eax, dword [esp + 0x3c]
push ecx
mov esi, esp
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x24], esi
call fcn.0040fb70
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x30], 6
mov eax, dword [esp + 0x18]
push eax
mov byte [esp + 0x34], 2
call fcn.0043c370
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x1c]
add esp, 8
push ecx
push edx
mov bl, 1
call edi
test eax, eax
jne 0x43c650
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x2c], 1
lea ecx, [esp + 0x3c]
call fcn.0040ba40
mov byte [esp + 0x2c], 0
lea ecx, [esp + 0x18]
call fcn.0040ba40
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x38]
call fcn.0040ba40
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x43d8e0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x604273
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x28], ebx
mov ebp, dword [esp + 0x5c]
push ebp
call fcn.0040b8d0
mov dword [esp + 0x54], ebx
lea eax, [esp + 0x2c]
push eax
push esi
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
je 0x43dabd
lea ebx, [esp + 0x24]
call fcn.004438c0
mov dword [esp + 0x54], 1
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp]
push eax
push edi
xor ebx, ebx
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43da85
mov eax, dword [ebp]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.0043db40
add esp, 8
mov byte [esp + 0x54], 2
mov edx, dword [esp + 0x40]
sub edx, dword [esp + 0x3c]
xor esi, esi
sar edx, 2
test edx, edx
jbe 0x43da76
jmp 0x43d9a0
lea eax, [esp + 0x18]
push eax
call fcn.0040b8d0
mov byte [esp + 0x54], 3
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov edx, ecx
sub edx, eax
sar edx, 2
cmp esi, edx
jb 0x43d9cf
call fcn.005c475a
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
sub ecx, eax
sar ecx, 2
lea edi, [eax + esi*4]
cmp esi, ecx
jb 0x43d9e4
call fcn.005c475a
mov eax, dword [esp + 0x3c]
movzx ecx, word [edi + 2]
movzx edx, word [eax + esi*4]
push 0x6d1514
push ecx
push edx
push str.StringFileInfo_04x_04x_s
lea edi, [esp + 0x28]
call fcn.0042a2d0
add esp, 0x10
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov eax, dword [ebp]
push ecx
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43da38
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
je 0x43da38
mov eax, dword [esp + 0x20]
cmp eax, ebx
ja 0x43da5c
mov byte [esp + 0x54], 2
lea ecx, [esp + 0x18]
call fcn.0040ba40
mov edx, dword [esp + 0x40]
sub edx, dword [esp + 0x3c]
inc esi
sar edx, 2
cmp esi, edx
jb 0x43d9a0
jmp 0x43da76
push eax
mov eax, dword [esp + 0x60]
push ecx
push eax
call fcn.004122f0
mov byte [esp + 0x54], 2
lea ecx, [esp + 0x18]
call fcn.0040ba40
mov byte [esp + 0x54], 1
lea ecx, [esp + 0x30]
push ecx
call fcn.00484970
mov byte [esp + 0x54], bl
add dword [ebp + 8], 0xffffffff
jne 0x43daa5
xor edi, edi
mov esi, ebp
call fcn.004c24f0
push ebp
call fcn.005c396f
add esp, 4
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
mov eax, ebp
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x43e450
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x608500
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, edx
lea edx, [esp + 0x18]
push edx
push 9
xor esi, esi
push esi
push ecx
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x43e5a4
mov edx, dword [esp + 0x18]
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x30]
push ecx
push esi
push esi
push esi
push edx
mov dword [esp + 0x44], esi
mov dword [esp + 0x4c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x43e599
cmp dword [esp + 0x14], esi
je 0x43e599
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x43e599
lea ebx, [eax + 1]
lea eax, [esp + 0x24]
call fcn.004307e0
mov dword [esp + 0x50], esi
cmp dword [esp + 0x14], esi
jbe 0x43e566
mov eax, dword [esp + 0x28]
mov ebx, 8
cmp dword [esp + 0x3c], ebx
jae 0x43e517
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
push ecx
push eax
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x43e55f
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x3c], ebx
jae 0x43e53b
lea ecx, [esp + 0x28]
lea eax, [esp + 0x20]
push eax
call fcn.0040b990
mov byte [esp + 0x50], 1
lea ebx, [esp + 0x20]
call fcn.00424a30
mov byte [esp + 0x50], 0
mov ecx, ebx
call fcn.0040ba40
inc esi
cmp esi, dword [esp + 0x14]
jb 0x43e504
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x3c], 8
jb 0x43e582
mov ecx, dword [esp + 0x28]
push ecx
call fcn.005c396f
add esp, 4
xor edx, edx
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], dx
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005c397a
mov esp, ebp
pop ebp
ret
Function at 0x43e5d0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x6040b9
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x60], ebx
mov eax, dword [esp + 0x68]
mov edi, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
xor ecx, ecx
mov eax, edi
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], cx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x43e630
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [esp + 0x3c]
call fcn.0040d7f0
mov esi, 1
mov dword [esp + 0x60], esi
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
push ebx
push edi
call ebp
mov edx, dword [esp + 0x14]
mov ebx, eax
push edx
add ebx, 2
call fcn.0040b8d0
xor eax, eax
mov dword [esp + 0x18], esi
push eax
lea esi, [esp + 0x20]
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
call fcn.00430320
mov byte [esp + 0x60], 2
mov eax, dword [esp + 0x20]
mov esi, 8
cmp dword [esp + 0x34], esi
jae 0x43e6ab
lea eax, [esp + 0x20]
push ebx
push eax
push edi
call ebp
test eax, eax
je 0x43e6eb
cmp dword [esp + 0x34], esi
jb 0x43e6c6
mov eax, dword [esp + 0x20]
mov edi, eax
test eax, eax
jne 0x43e6ca
jmp 0x43e6df
lea edi, [esp + 0x20]
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43e6d0
sub eax, edx
sar eax, 1
mov ebx, eax
mov eax, dword [esp + 0x14]
push edi
call fcn.0040fac0
mov byte [esp + 0x60], 1
cmp dword [esp + 0x34], esi
jb 0x43e703
mov ecx, dword [esp + 0x20]
push ecx
call fcn.005c396f
add esp, 4
xor ebx, ebx
mov edi, 7
xor edx, edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], dx
mov byte [esp + 0x60], bl
cmp dword [esp + 0x50], esi
jb 0x43e730
mov eax, dword [esp + 0x3c]
push eax
call fcn.005c396f
add esp, 4
xor ecx, ecx
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], cx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.005c397a
add esp, 0x50
ret
Function at 0x43ec00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x610459
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x98]
xor ebx, ebx
mov dword [esp + 0x20], eax
xor esi, esi
xor eax, eax
xor edi, edi
mov dword [esp + 0x24], ebx
cmp ecx, ebx
ja 0x43ec65
cmp edx, 0x400
jb 0x43ec89
cmp esi, 5
jae 0x43ec89
mov eax, edx
shrd edx, ecx, 0xa
shr ecx, 0xa
and eax, 0x3ff
xor edi, edi
inc esi
cmp ecx, ebx
ja 0x43ec65
jb 0x43ec89
cmp edx, 0x400
jae 0x43ec65
mov dword [esp + 0x14], eax
mov eax, edi
and eax, 0x7fffffff
mov dword [esp + 0x18], eax
fild qword [esp + 0x14]
mov dword [esp + 0x14], ebx
and edi, 0x80000000
mov dword [esp + 0x18], edi
fild qword [esp + 0x14]
mov eax, ecx
mov dword [esp + 0x14], edx
fchs
and ecx, 0x7fffffff
faddp st(1)
mov dword [esp + 0x18], ecx
and eax, 0x80000000
fmul qword [0x6dc5b0]
fild qword [esp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
fild qword [esp + 0x14]
fchs
faddp st(1)
faddp st(1)
fld qword [0x6dc550]
fmul st(1), st(0)
fxch st(1)
fadd qword [0x6dc548]
call fcn.005c9610
mov dword [esp + 0x14], eax
fidivr dword [esp + 0x14]
sub esp, 8
lea ecx, [esp + 0x4c]
fstp qword [esp]
push ecx
call fcn.0043eb20
add esp, 0xc
mov dword [esp + 0x8c], 1
push 0x6d15b4
push eax
lea edx, [esp + 0x30]
push edx
call fcn.0044bdd0
add esp, 0xc
mov byte [esp + 0x8c], 2
mov ecx, dword [esi*4 + 0x716a58]
push ecx
push eax
lea edx, [esp + 0x68]
push edx
call fcn.0044bdd0
add esp, 0xc
mov byte [esp + 0x8c], 4
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x43ed6f
mov eax, dword [esp + 0x2c]
push eax
call fcn.005c396f
add esp, 4
mov edi, 0xf
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov byte [esp + 0x8c], 5
cmp dword [esp + 0x5c], esi
jb 0x43ed9b
mov ecx, dword [esp + 0x48]
push ecx
call fcn.005c396f
add esp, 4
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
cmp dword [esp + 0x78], esi
jae 0x43edb5
lea ecx, [esp + 0x64]
lea edx, [esp + 0x14]
push edx
call fcn.0040b760
mov byte [esp + 0x8c], 6
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.00433a20
add esp, 8
mov dword [esp + 0x24], 1
mov byte [esp + 0x8c], 5
lea ecx, [esp + 0x14]
call fcn.0040b810
mov byte [esp + 0x8c], bl
cmp dword [esp + 0x78], esi
jb 0x43ee0c
mov edx, dword [esp + 0x64]
push edx
call fcn.005c396f
add esp, 4
mov dword [esp + 0x78], edi
mov dword [esp + 0x74], ebx
mov byte [esp + 0x64], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.005c397a
add esp, 0x80
ret
Function at 0x43ee40
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6084d2
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
push eax
call fcn.00443eb0
mov dword [ebp - 4], edi
mov eax, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
push str.sandbox2.jrdesklabs.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
cmp ebx, edi
je 0x43eef4
xor esi, esi
mov dword [ebp - 0x20], esi
cmp esi, 0x64
jae 0x43eef4
mov ecx, dword [ebx + 0xc]
cmp dword [ecx + esi*4], edi
je 0x43eef1
mov edx, ecx
mov eax, dword [edx + esi*4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
lea edx, [ebp - 0x14]
push edx
mov ecx, eax
call fcn.0040b760
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], edi
je 0x43eee5
lea ebx, [ebp - 0x14]
mov edi, dword [ebp + 8]
call fcn.004441a0
mov ebx, dword [ebp - 0x1c]
xor edi, edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0040b810
inc esi
jmp 0x43eea0
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ef20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5fda49
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x30], ebp
mov esi, ecx
mov dword [esp + 0x20], ebp
lea edi, [esi + 4]
xor eax, eax
mov dword [esp + 0x14], 2
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
mov dword [esp + 0x24], esi
mov word [edi], ax
mov dword [esp + 0x30], ebp
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x43f056
cmp dword [esi + 0x18], 8
jb 0x43efaf
mov eax, dword [edi]
jmp 0x43efb1
mov eax, edi
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esp + 0x24]
push eax
push ebp
push str.BootExecute
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x43f01a
mov ebx, dword [esp + 0x14]
mov ecx, dword [esi + 0x14]
inc ebx
cmp ebx, ecx
ja 0x43efea
or eax, 0xffffffff
call fcn.0040b490
jmp 0x43eff6
mov eax, ebx
push ebp
sub eax, ecx
mov ebx, esi
call fcn.004455d0
cmp dword [esi + 0x18], 8
jb 0x43effe
mov edi, dword [edi]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x24]
push eax
push ebp
push str.BootExecute
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x43f044
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x43f031
cmp eax, 2
je 0x43f031
cmp eax, 7
jne 0x43f044
mov eax, dword [esp + 0x14]
cmp eax, ebp
jbe 0x43f044
shr eax, 1
mov ecx, esi
call fcn.00442750
jmp 0x43f04b
mov eax, esi
call fcn.0040b600
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret