joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016b3
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x402450
push 0xffffffffffffffff
push 0x467030
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_2
push 0
push 0x2d
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0
call sub.MFC42u.DLL_CString::Find_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4024e7
mov edi, dword [sym.imp.MSVCRT.dll__wcsicoll]
inc esi
push 3
lea eax, [esp + 0x14]
push esi
push eax
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::Mid_1
mov ecx, dword [esp + 0x10]
push 0x47578c
push ecx
mov byte [esp + 0x28], 1
call edi
add esp, 8
test eax, eax
je 0x40250d
push esi
push 0x2d
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::Find_1
lea ecx, [esp + 0x10]
mov esi, eax
mov byte [esp + 0x20], 0
call sub.MFC42u.DLL_CString::CString
cmp esi, 0xffffffff
jne 0x40249c
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
add esi, 3
lea edx, [esp + 8]
push esi
push edx
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::Mid
lea ecx, [esp + 8]
mov byte [esp + 0x20], 2
call sub.MFC42u.DLL_CString::TrimLeft
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40258a
mov ax, word [eax]
cmp ax, 0x22
jne 0x40258a
push 0x22
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::TrimLeft_1
push 1
push 0x22
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::Find_1
cmp eax, 0xffffffff
je 0x40258a
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::Left
mov ecx, dword [esp + 0x28]
push eax
mov byte [esp + 0x24], 3
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x40170d
Capabilities:
Create directory

Disassembly:
jmp 0x413ed0
push 0xffffffffffffffff
push 0x468480
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x413ff0
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x413ff0
push esi
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::CString_2
cmp word [esi], 0x5c
mov dword [esp + 0x18], ebx
jne 0x413f40
cmp word [esi + 2], 0x5c
jne 0x413f40
push 3
push 0x5c
lea ecx, [esp + 0x28]
call sub.MFC42u.DLL_CString::Find_1
inc eax
lea ecx, [esp + 0x20]
push eax
push 0x5c
call sub.MFC42u.DLL_CString::Find_1
jmp 0x413f4b
push 0x5c
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::Find
mov esi, eax
cmp esi, 0xffffffff
je 0x413faa
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0xc]
push esi
push eax
lea ecx, [esp + 0x28]
call sub.MFC42u.DLL_CString::Left
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x18], 1
push ecx
call fcn.004010b9
add esp, 4
test eax, eax
jne 0x413f89
mov edx, dword [esp + 0xc]
push ebx
push edx
call edi
test eax, eax
je 0x413fd2
inc esi
lea ecx, [esp + 0x20]
push esi
push 0x5c
call sub.MFC42u.DLL_CString::Find_1
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x18], bl
call sub.MFC42u.DLL_CString::CString
cmp esi, 0xffffffff
jne 0x413f58
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x401721
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x413060
push 0xffffffffffffffff
push 0x468268
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CFileFind::CFileFind
mov eax, dword [esp + 0x30]
push 0
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call sub.MFC42u.DLL_CFileFind::FindFile
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.0041c1f6
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4017f3
Capabilities:
Get hostname
Resolve dns

Disassembly:
jmp 0x408bb0
sub esp, 0x118
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
push pe_nt_image_headers32
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x408bed
xor eax, eax
pop edi
add esp, 0x118
ret 4
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
mov dword [esp + 4], eax
jne 0x408c0a
pop edi
add esp, 0x118
ret 4
mov eax, dword [eax + 0xc]
push ebx
mov ebx, dword [esp + 0x124]
cmp dword [eax], 0
je 0x408c7b
push ebp
push esi
xor ebp, ebp
mov eax, dword [eax + ebp]
mov esi, dword [ebx + 8]
xor edx, edx
push 0xffffffffffffffff
mov ecx, dword [eax]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], edx
mov ecx, ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], edx
lea edx, [esi + 1]
mov dword [esp + 0x1c], 0xffffff
push edx
call fcn.004015d7
mov ecx, dword [ebx + 4]
mov edx, dword [esp + 0x10]
lea eax, [esi + esi*4]
lea esi, [esp + 0x14]
add ebp, 4
lea edi, [ecx + eax*4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov eax, dword [edx + 0xc]
cmp dword [eax + ebp], 0
jne 0x408c1e
pop esi
pop ebp
mov eax, dword [ebx + 8]
pop ebx
pop edi
add esp, 0x118
ret 4
Function at 0x409b90
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x47b5c0]
test eax, eax
jne 0x409c0e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x47b360
mov dword [0x47b5c0], 1
mov dword [0x47b360], 0x114
call esi
mov edx, dword [0x47b370]
xor eax, eax
cmp edx, 2
push 0x47b4a0
sete al
mov dword [0x476af8], eax
mov dword [0x47b4a0], 0x11c
call esi
push 0x476d98
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x476d80
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop esi
mov dword [0x47b5bc], eax
test eax, eax
push 0x47b478
je 0x409c08
call eax
ret
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
ret
Function at 0x41b300
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.004012e9
mov edi, dword [ebp + 8]
test edi, edi
jne 0x41b315
xor eax, eax
jmp 0x41b336
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.0041c560
mov eax, esp
push esi
push edi
push eax
call sub.MFC42u.DLL_AfxW2AHelper
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x41b347
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
mov eax, dword [eax + 0xc]
lea esp, [ebp - 8]
mov ecx, dword [eax]
pop edi
pop esi
mov eax, dword [ecx]
pop ebp
ret

Function at 0x4213d0
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x421429
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x421429
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x421430
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x42140d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x42142b
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x427140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x427190
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x427190
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x427195
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x42717b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x4271a2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x432780
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x43278b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
mov esi, edi
not eax
jb 0x43288d
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x46d6b4]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x46d6b4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x46d6b4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x46d6b4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x46d6b4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x46d6b4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x46d6b4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x46d6b4]
xor eax, edx
inc ecx
dec edi
jne 0x4327a6
test esi, esi
je 0x4328af
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x46d6b4]
xor eax, edx
inc ecx
dec esi
jne 0x432891
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x435640
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x108]
push edi
mov dword [esp + 0x14], ecx
xor edx, edx
xor eax, eax
mov al, byte [edx + 0x46db3c]
mov ecx, eax
and eax, 7
sar ecx, 3
mov bl, byte [eax*2 + 0x46dacc]
mov cl, byte [ecx + esi]
test bl, cl
setne al
mov byte [esp + edx + 0x50], al
inc edx
cmp edx, 0x38
jl 0x435657
mov eax, 0x1e
xor ebx, ebx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x110], 1
je 0x435698
lea eax, [ebx + ebx]
lea edi, [esp + eax*4 + 0x8c]
lea ebp, [esp + eax*4 + 0x88]
xor eax, eax
xor ecx, ecx
mov cl, byte [ebx + 0x46db74]
mov dword [edi], 0
mov esi, ecx
mov dword [ebp], 0
mov edx, esi
cmp edx, 0x1c
jge 0x4356cc
mov cl, byte [esp + edx + 0x50]
jmp 0x4356d0
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x1c
jl 0x4356c1
mov eax, 0x1c
lea edx, [esi + 0x1c]
cmp edx, 0x38
jge 0x4356ee
mov cl, byte [esp + edx + 0x50]
jmp 0x4356f2
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x38
jl 0x4356e3
xor edx, edx
mov eax, 0x46dadc
xor ecx, ecx
mov cl, byte [edx + 0x46db84]
cmp byte [esp + ecx + 0x18], 0
je 0x43571d
mov ecx, dword [eax]
mov esi, dword [ebp]
or esi, ecx
mov dword [ebp], esi
xor ecx, ecx
mov cl, byte [edx + 0x46db9c]
cmp byte [esp + ecx + 0x18], 0
je 0x435734
mov ecx, dword [eax]
mov esi, dword [edi]
or esi, ecx
mov dword [edi], esi
add eax, 4
inc edx
cmp eax, 0x46db3c
jl 0x435704
mov eax, dword [esp + 0x10]
inc ebx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x43568b
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x88]
push edx
call fcn.00435780
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf8
ret 8
Function at 0x437090
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x469fcc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov ecx, edi
call sub.MFC42u.DLL_CString::CString_3
lea ebp, [esi + 0x18]
xor ebx, ebx
mov ecx, ebp
mov dword [esp + 0x1c], ebx
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esi + 0x20]
mov byte [esp + 0x1c], 1
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 2
call fcn.0041c14e
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
mov byte [esp + 0x20], 3
mov dword [esi], 0x46e3b4
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov word [esi + 0x24], 0xffff
call sub.MFC42u.DLL_CString::operator
mov eax, dword [esp + 0x28]
mov cx, word [esp + 0x30]
test eax, 0xffff0000
mov word [esi + 0x24], cx
mov dword [esi + 0x14], eax
je 0x437135
push eax
mov ecx, ebp
call sub.MFC42u.DLL_CString::operator
mov edx, dword [ebp]
mov dword [esi + 0x14], edx
mov eax, dword [esp + 0x2c]
test eax, 0xffff0000
mov dword [esi + 0x1c], eax
je 0x437153
lea edi, [esi + 0x20]
push eax
mov ecx, edi
call sub.MFC42u.DLL_CString::operator
mov eax, dword [edi]
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x43a220
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e3f0
push 0x41c5e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x43a2b2
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x43a2ab
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x43a2ab
cmp word [eax + 0x14], dx
je 0x43a2ab
cmp dword [ebp + 0xc], edx
je 0x43a285
cmp word [eax + 4], 0x14c
jne 0x43a2ab
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a3a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x43a3ed
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43a3ed
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
add eax, ebx
xor edx, edx
mov cx, word [eax + 0x14]
mov dx, word [eax + 6]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x14], esi
jbe 0x43a3ed
lea eax, [esi + 0x10]
mov esi, dword [eax - 4]
cmp edi, esi
jb 0x43a3e5
mov ebp, dword [eax]
add ebp, esi
cmp edi, ebp
jb 0x43a3f4
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x43a3d6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov esi, dword [eax + edx*8 + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [eax + edx*8 + 0x14]
sub eax, esi
add eax, ebx
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x43aca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e400
push 0x41c5e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
mov edi, dword [ebp + 0x14]
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a500
add esp, 0x10
mov esi, eax
cmp esi, ebx
je 0x43ad53
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x20]
push eax
call edi
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 4
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
test eax, eax
je 0x43ad4c
mov dword [esi], edi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 4
push esi
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43b770
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x43b7b1
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x43b7b3
mov esi, edi
test esi, esi
je 0x43b828
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x43b81d
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x43b81d
cmp dword [esp + 0x1c], eax
jbe 0x43b7ee
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x43b81d
cmp esi, edi
je 0x43b80f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x43b828
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x43bb40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46a4ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call sub.MFC42u.DLL_CString::CString_3
mov ecx, dword [esp + 0x34]
mov edi, dword [esi]
mov eax, dword [esi + 4]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x43bbad
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x43bbaf
mov esi, edi
test esi, esi
je 0x43bc79
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43bc6e
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x43bbf1
cmp eax, 2
je 0x43bbf1
cmp eax, 6
je 0x43bbf1
cmp eax, 7
jne 0x43bc6e
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call sub.MFC42u.DLL_operatornew
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x43bc54
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::operator
cmp esi, dword [esp + 0x14]
je 0x43bc49
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call sub.MFC42u.DLL_operatordelete
add esp, 4
jmp 0x43bc8b
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x10]
push 0x47b1f4
call sub.MFC42u.DLL_CString::operator
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x43bc79
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x43bc8b
push eax
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::operator
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_1
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10