joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b1d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1210
call fcn.0043c7d0
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x1210], eax
xor eax, eax
push esi
push edi
cmp dword [0x635560], eax
jne 0x42b298
call fcn.004262d8
test al, al
je 0x42b22e
and eax, 0xf77f672b
sub al, 0xc8
cmp dl, 0xc9
cmp byte [edi], dl
in al, 0x73
fld qword [edx]
outsd dx, dword [esi]
mov dh, 0x7e
push ebx
push esp
xchg edi, eax
sbb dl, byte [edi - 0x177624d8]
dec esp
scasd eax, dword es:[edi]
invalid
call fcn.0042617f
test al, al
je 0x42b255
xor bl, ah
out 0x85, eax
or al, 0x23
into
xchg dword [ecx], ebx
push 0x37e7356b
adc al, 0x90
invalid
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00447ad0
lea eax, [ebp - 0x20c]
push str.C:LogResLog.dll
push eax
call fcn.00456213
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x635560], eax
test eax, eax
je 0x42b377
xor eax, eax
mov ecx, dword [ebp - 0x1210]
push eax
push 0x5a98a4
call fcn.00402110
call fcn.00426431
test al, al
je 0x42b2c9
mov esp, 0x16483c74
stosb byte es:[edi], al
xchg ebp, eax
fsubr qword [eax]
and al, 0x4a
xor edx, dword [esi - 0x1f3030f2]
adc eax, 0xc97810a8
jle 0x42b2b2
call fcn.004261c4
test al, al
imul byte [esi - 0x3f7b0001]
je 0x42b2ea
jg 0x42b2f5
or dword [edx - 0x36], esp
xlatb
mov dh, 0x7a
add eax, ecx
jmp 0x182225ad
call fcn.0042624e
test al, al
je 0x42b30b
mov al, 5
salc
mov ds, word [edi]
mov dword [eax + edi*2 + 0x14f51e97], edi
invalid
push 0x800
lea eax, [ebp - 0x120c]
push eax
push dword [ebp + 8]
push dword [0x635560]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x42b35c
cmp word [ebp - 0x120c], 0
jne 0x42b338
xor eax, eax
jmp 0x42b345
lea eax, [ebp - 0x120c]
push eax
call fcn.004561c7
pop ecx
mov ecx, dword [ebp - 0x1210]
push eax
lea eax, [ebp - 0x120c]
push eax
call fcn.00402110
mov al, 1
jmp 0x42b379
call fcn.004263ec
test al, al
je 0x42b377
and al, 0x91
adc dword [ecx - 0x6c129a05], eax
hlt
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c551
mov esp, ebp
pop ebp
ret

Function at 0x42b38a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00447ad0
push 0x5a9d7c
lea eax, [ebp - 0x20c]
push str.C:log_s.log
push eax
call fcn.00408eb0
add esp, 0x18
call fcn.00426026
test al, al
je 0x42b3e4
pushfd
inc esp
inc esp
fld qword [ebx + esi + 0x121a659b]
xor eax, 0x5be0829f
arpl word [ebp - 0x20b7b], cx
call dword [eax - 1]
adc eax, sym.imp.SHLWAPI.dll_PathFileExistsW
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.0043c551
mov esp, ebp
pop ebp
ret
Function at 0x42b4cd
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.0043c7d0
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x200c], edi
mov dword [ebp - 0x2008], eax
call fcn.0042b38a
test eax, eax
je 0x42b677
xor ebx, ebx
push ebx
call fcn.0044b407
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0x2018]
push eax
mov dword [ebp - 0x2014], edx
call fcn.004545aa
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp - 0x2008]
mov ecx, dword [esi + 0x10]
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x2004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.0042b1bb
add esp, 0x28
call fcn.004263ec
test al, al
je 0x42b585
push edx
int 9
and byte [ebp - 0x6b], 0x8e
add cl, byte [ecx]
nop
push 0x5d
xchg esi, eax
test eax, 0x8bc9707c
mov ebp, 0xffffdff4
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
inc esi
test eax, eax
cmovne ebx, esi
mov dword [ebp - 0x200c], ebx
call fcn.00426659
test al, al
je 0x42b5b6
sal byte [ebx + edx - 0x6e], 0x82
shl dword [ebx + 0x34], cl
test al, 0x3c
cmp dword [esi - 0x63983b96], 0x33006aca
test byte [esi + 0x68], 0xf0
rcr dword [edx], 0x57
xchg edx, eax
adc bl, 0x63
xor al, 0xa8
cmp al, 0x81
mov esi, 0x9c67c46a
retf 0x6a
push 0x5ac1f0
push edi
call fcn.00454cf7
mov ebx, eax
mov dword [ebp - 0x2010], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x42b677
cmp dword [ebp - 0x200c], 0
jne 0x42b5f9
push ebx
push 2
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], 0xfeff
push esi
push eax
call fcn.0045610b
add esp, 0x10
call fcn.0042658a
test al, al
je 0x42b61a
xchg edx, eax
neg dword [edi + 0x2bcb0886]
lcall 0x6e70, 0xcfc0e42b
lea esp, [edx]
jnp 0x42b5a0
popfd
invalid
lea eax, [ebp - 0x2004]
push eax
call fcn.004561c7
push ebx
add eax, eax
push eax
lea eax, [ebp - 0x2004]
push 1
push eax
call fcn.0045610b
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xd
push 1
push eax
call fcn.0045610b
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xa
push 1
push eax
call fcn.0045610b
push ebx
call fcn.00454af5
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c551
mov esp, ebp
pop ebp
ret
Function at 0x42ba8a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x218], eax
xor eax, eax
push eax
push 0x1a
push ecx
push eax
mov dword [ebp - 0x210], ebx
call fcn.0042ce88
lea eax, [ebp - 0x20c]
push eax
call fcn.004561c7
add esp, 0x14
mov dword [ebp - 0x214], eax
call fcn.0042613a
test al, al
je 0x42bb01
dec eax
mov dword [edi - 0x12], ebp
je 0x42bb01
inc esp
pop esp
mov dword [eax], ebp
cmp edi, dword [ebx + 0x4bae533a]
cmc
call 0x341a7c43
sahf
push edx
mov ebx, dword [ebp - 0x210]
cmp dword [ebp - 0x214], 0
je 0x42bc0d
mov esi, 0x5a9ce8
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004561e2
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004561e2
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004561e2
add esp, 0x18
call fcn.004266e3
test al, al
je 0x42bb61
movsb byte es:[edi], byte [esi]
retf
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42bb7f
lea eax, [ebp - 0x20c]
push eax
call fcn.0042b959
pop ecx
call fcn.00426209
test al, al
je 0x42bb9c
jmp 0x42bbe6
call fcn.004264bb
test al, al
je 0x42bbc1
aaa
mov dword [0x3aa73d53], eax
aaa
invalid
call fcn.004266e3
test al, al
je 0x42bbdf
jae 0x42bc4a
or al, 0x4a
cwde
push edi
sub byte [eax - 0x6b], al
fsub qword [0x724106d0]
imul edi, dword [edi - 0x7c9913fb], 0xfffdf4bd
inc dword [eax]
cmp word [ebp - 0x20c], 0
add byte [ebp + 4], dh
jne 0x42bbed
xor eax, eax
jmp 0x42bbfa
lea eax, [ebp - 0x20c]
push eax
call fcn.004561c7
pop ecx
mov ecx, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00402110
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c551
mov esp, ebp
pop ebp
ret
invalid
Function at 0x42c7d0
Capabilities:
Get common file path

Disassembly:
sbb eax, 0x85000196
sal byte [eax + edx - 1], 0x36
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x42c7cb
mov al, 1
jmp 0x42c7cd
xor al, al
pop esi
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x635570], 0
push ebx
push esi
push edi
je 0x42c858
call fcn.00426209
test al, al
je 0x42c80c
push edx
sub bl, byte [ebx + 0x58ec68d8]
popfd
mov esp, 0xa058af2a
inc ecx
push edx
inc eax
loop 0x42c7f8
xchg ebx, eax
invalid
call fcn.004264bb
test al, al
je 0x42c831
mov dword [edi - 0x59fb3eb9], ecx
popfd
mov dl, 0x60
jae 0x42c7b3
invalid
call fcn.004266e3
test al, al
je 0x42c94f
lahf
sub al, 0x3b
enter 0xffffffffffffa5d3, 0x5a
xchg ecx, eax
push eax
aaa
inc ebx
retf
call fcn.004266e3
test al, al
je 0x42c87c
in eax, 0x6c
or al, byte gs:[esi + ebx*2]
jb 0x42c7ff
add al, 0x13
invalid
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00447ad0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42c8ec
lea eax, [ebp - 0x20c]
push eax
call fcn.0045427d
lea eax, [ebp - 0x20c]
mov dword [esp], 0x5ab174
push eax
call fcn.00447cdd
pop ecx
pop ecx
test eax, eax
jne 0x42c8e5
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.00447cdd
pop ecx
pop ecx
test eax, eax
je 0x42c8ec
mov byte [0x635570], 1
call fcn.00426545
test al, al
je 0x42c907
sub byte [ebp + 0x28], al
pop esp
aam 0x24
dec ebx
or edx, ecx
inc eax
out 0xba, al
jmp 0x42c921
call fcn.00426209
test al, al
je 0x42c92b
mov ah, 0x69
or bl, byte [eax + 0x3fbbb1b1]
pop ss
out dx, eax
cmp byte [edx + 0x2b], ch
sbb al, 7
in al, 0x6d
mov word [esi - 0x5e], cs
ret 0x6dfd
call fcn.00426209
test al, al
je 0x42c94f
inc edi
nop
scasb al, byte es:[edi]
add byte [ebp + 0x66], cl
rcr byte [esi - 0xb], 0xad
and dword [ebx - 0x5c], ebx
int 0xcd
sahf
rol byte [eax - 0x68], 0xfe
lds eax, [ecx - 0x14]
arpl word [ecx], di
or dh, byte [edi - 0x75]
dec ebp
cld
mov ecx, dword [ebp - 4]
mov al, byte [0x635570]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0043c551
mov esp, ebp
pop ebp
ret
Function at 0x42c965
Capabilities:
Get common file path

Disassembly:
push pe_nt_image_headers32
mov eax, 0x5a6330
call fcn.0043caa9
mov al, byte [0x635571]
test al, al
jne 0x42ca2e
push 0x104
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.00447ad0
add esp, 0xc
lea eax, [ebp - 0x114]
xor edi, edi
inc edi
push edi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x42ca29
push str.config_systemprofile
lea ecx, [ebp - 0x12c]
call fcn.004070b0
lea eax, [ebp - 0x114]
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0x144]
call fcn.004070b0
push dword [ebp - 0x11c]
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
push esi
cmovae eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x144]
push eax
call fcn.00408d10
movzx ecx, byte [0x635571]
cmp eax, 0xffffffff
push esi
cmovne ecx, edi
mov byte [0x635571], cl
lea ecx, [ebp - 0x144]
push edi
call fcn.0040c130
push esi
push edi
lea ecx, [ebp - 0x12c]
call fcn.0040c130
mov al, byte [0x635571]
call fcn.0043ca64
ret

Function at 0x42ce88
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.0042c7d0
xor edi, edi
inc edi
test al, al
je 0x42cf25
call fcn.0042624e
test al, al
je 0x42cec4
lea esi, [ebp - 0x6acbdc36]
jmp 0x42ce9a
call fcn.004261c4
test al, al
je 0x42cee5
ljmp 0x2a8d:0x93467771
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
call fcn.0042c638
pop ecx
test al, al
je 0x42cf25
push dword [ebp + 0xc]
push edi
push dword [ebp - 8]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmove ebx, edi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x42cf70
call fcn.004262d8
test al, al
je 0x42cf4d
stosb byte es:[edi], al
cwde
dec esp
retf 0x67f6
xor eax, 0xca444f09
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp - 4]
test eax, eax
push 1
movzx ecx, dl
pop eax
cmovne ecx, eax
mov byte [ebp - 4], cl
call fcn.004266e3
test al, al
je 0x42cf94
mov esi, edi
salc
mov al, byte [0x3ee99a9]
add eax, 0x7e28ab84
fidiv word [edx]
mov bl, 0x3d
rcr dh, cl
inc esi
wait
jns 0x42cf48
mov cl, 0xb3
push ebx
cmp cl, byte [ebx - 0x3d7503ab]
mov edx, dword [ebp - 4]
mov al, dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d297
Capabilities:
Delete file

Disassembly:
push 0
mov eax, 0x5a63b0
call fcn.0043ca75
and dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42d396
call fcn.004265cf
test al, al
je 0x42d2db
inc eax
mov edi, 0xeafcc1a5
sal byte [edx + 0x42], cl
invalid
call fcn.004262d8
test al, al
je 0x42d303
inc edi
mov edi, 0x70d168e5
rcr dword [0x5adc0689], 0xf6
and eax, 0xbb728b1e
xor esp, eax
aas
sbb ebx, ebp
push esi
xchg edx, eax
and edx, dword [esp + eax]
sub ebx, dword [ebx - 0x721218]
inc dword [eax + eax*8 - 0x773e98c]
sbb eax, 0x487d4390
das
xchg byte [ebx - 0x53950217], dl
cmp al, 0x4b
aam 0
pop eax
fmul dword [ecx - 0x6a]
call fcn.004260f5
test al, al
je 0x42d322
in eax, dx
invalid
invalid
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call int.004273ad
pop ecx
call fcn.004266e3
test al, al
je 0x42d350
in eax, dx
mov bh, 0x4e
add eax, 0xfe05dd8a
retf
call fcn.00426659
test al, al
je 0x42d374
sar byte [edi - 0x7a], 0x13
aas
ror byte [eax - 0x73e5f86d], 0xe9
in al, dx
add eax, 0x9474b092
js 0x42d399
stosb byte es:[edi], al
jno 0x42d38a
mov dword [0x9be8d36a], eax
xchg edx, eax
invalid
call fcn.00426614
test al, al
je 0x42d396
jge 0x42d304
in eax, dx
inc esi
mov edx, 0xeda8e005
xlatb
xor edi, dword [edi - 0x7f]
out 0xcd, al
fild qword [ebx - 7]
fimul dword [ebx + 0x7f8f990b]
jmp fcn.0042d401
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004254f0
xor eax, eax
inc eax
add dword [ebp + 0x4ee8084d], ecx
cmp edi, 0x40c033ff
call fcn.0043ca4f
ret
Function at 0x42db31
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x11c

Function at 0x42dd84
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00447ad0
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.004264bb
test al, al
je 0x42ddf7
mov al, 0x9a
psadbw mm1, qword [edi]
add eax, 0x2eab731
scasb al, byte es:[edi]
xchg esp, eax
ret
call fcn.004265cf
test al, al
je 0x42de1e
pop ebx
cld
add edi, dword [edx]
push es
pop eax
fistp dword [eax + 0x20]
je 0x42dda7
cdq
in al, dx
fimul dword [ebp - 0x5fd738f1]
add dh, byte [ecx]
jb 0x42de47
or byte [esi - 0x52], 0x65
push ebp
sub cl, ah
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x118]
call fcn.0042617f
test al, al
je 0x42de52
add eax, 0xb6d77400
xchg esp, eax
mov dh, 0x7e
push 0xffffffffffffffca
or dword [esi], 0x12c49708
out dx, eax
cmp dword [bx + di], eax
cmpsb byte [esi], byte es:[edi]
xchg bl, cl
xor eax, 0xc4638b4e
add dword [esi + 0x4e35cb86], esp
mov esp, dword [ebx - 0x3c]
push cs
imul eax, dword [ebx + 0xa7f05ff], 0xffffff83
inc byte [edx]
cmp edi, 5
jg 0x42de61
cmp esi, 2
jg 0x42de61
xor eax, eax
inc eax
jmp 0x42de63
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c551
mov esp, ebp
pop ebp
ret
Function at 0x431979
Capabilities:
Enumerate processes

Disassembly:
push 0x268
mov eax, 0x5a6941
call fcn.0043caa9
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x26c]
xor ebx, ebx
push 0x22c
push ebx
push eax
mov dword [ebp - 0x270], ebx
call fcn.00447ad0
add esp, 0xc
lea ecx, [ebp - 0x40]
push esi
call fcn.00403700
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.0042a914
pop ecx
call fcn.0042658a
test al, al
je 0x4319db
jne 0x431a18
or byte [edi - 0x6604858f], al
xchg ebx, eax
mov ebx, 0x177370b1
not byte [esi]
cld
add byte [ebx], dh
fist dword [ebx + 0x6a]
add ch, al
adc dword [edx - 0x7a760002], ebx
invalid
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
je 0x431b00
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
jmp 0x431ae6
call fcn.00426431
test al, al
je 0x431a2e
wait
and eax, 0x340562b
loop 0x431a79
xor dword [esi], ebp
int3
call fcn.004261c4
test al, al
je 0x431a4f
aam 0x8a
add byte [edi + edx*8], al
int 0x9d
aad 0x76
pop eax
or eax, 0xfe8eb81d
cmp eax, 0x9eaab4
xchg byte [esi + 0x47fae8ac], ah
invalid
call fcn.0042624e
test al, al
je 0x431a70
jo 0x4319f8
xchg ebx, eax
sahf
lcall 0x8128, 0x17ec6dd1
xlatb
push ds
cmp byte [edx + 0x49], ch
dec esi
call 0xf3741896
adc byte [0x45c7c033], ah
in al, dx
pop es
add byte [eax], al
add byte [ebx], dh
invalid
xor eax, eax
mov dword [ebp - 0x14], 7
xor ebx, ebx
mov word [ebp - 0x28], ax
mov dword [ebp - 0x18], ebx
cmp word [ebp - 0x248], ax
je 0x431a98
lea eax, [ebp - 0x248]
push eax
call fcn.004561c7
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402110
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0042a914
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00428511
lea ecx, [ebp - 0x28]
test eax, eax
je 0x431b14
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.004254f0
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x274]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x431a0e
mov ebx, dword [ebp - 0x270]
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.004254f0
mov eax, ebx
call fcn.0043ca64
ret
xor ebx, ebx
inc ebx
push 0
push ebx
call fcn.004254f0
jmp 0x431af4
Function at 0x431db7
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x5a699a
call fcn.0043caa9
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
and dword [ebp - 0x24c], 0
push 0x208
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00447ad0
add esp, 0xc
call fcn.004263ec
test al, al
je 0x431e0a
fbld tbyte [ecx*8 + 0x70e3817d]
sub esp, dword [edx + 0x13]
or eax, 0xf66a463b
xchg esp, eax
pop esi
mov eax, 0x10468
add byte [ebp - 0x2177b], cl
push dword [ebx]
not byte [eax + 0x56]
push 0x104
lea eax, [ebp - 0x218]
xor esi, esi
push eax
push esi
jmp 0x431f12
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x431f04
call fcn.004264bb
test al, al
je 0x431e54
sbb byte [eax], ah
pop eax
movsb byte es:[edi], byte [esi]
or al, 0xe1
je 0x431e8f
stosd dword es:[edi], eax
shl dword [edx + 0x15], 0xf0
xchg esp, eax
xor al, 0x45
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x431e84
lea eax, [ebp - 0x218]
push eax
call fcn.004561c7
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402110
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0042aadb
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.004254f0
cmp dword [ebp - 0x234], 0x10
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
push dword [ebp - 0x250]
call fcn.00432e72
pop ecx
pop ecx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
push 0
push 1
call fcn.0040c130
std
invalid
push 0x104
lea eax, [ebp - 0x218]
inc esi
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x431e1e
call fcn.0043ca64
ret

Function at 0x4323f1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x5a6a6b
call fcn.0043ca75
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0042de74
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.0042df3a
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x432431
mov edi, 0xf003f
push edi
push esi
push 0x5ab274
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432491
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x43246c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x432491
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0042de87
call fcn.0043ca4f
ret
Function at 0x43314a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.004266e3
test al, al
je 0x433184
dec esi
out dx, ax
adc eax, 0xc645dc6c
pop ebp
out dx, al
add eax, 0x3f0e260e
invalid
lea eax, [ebp - 0xc]
mov esi, 0xf013f
push eax
push esi
push ebx
push 0x5ab274
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4332ba
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4332b1
call fcn.00426545
test al, al
je 0x4331e0
push 0x235f2ed
adc ah, byte [ebx + 0x6e9778d6]
push eax
pushfd
push ebp
pushal
loopne 0x43325d
inc eax
call fcn.00426209
test al, al
je 0x433204
lea ebx, [ebp - 0x2aac1fad]
add bh, cl
invalid
call fcn.00426209
test al, al
je 0x433228
test byte [edx - 0x1e], dl
invalid
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf013f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x43325a
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
salc
jmp 0x4332ba
push dword [ebp + 0x14]
call fcn.004561c7
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042613a
test al, al
je 0x4332a8
jle 0x4332bc
test al, 0x36
stosd dword es:[edi], eax
jge 0x433257
sar dword [ebp - 0x6a], cl
adc byte gs:[bx + di + 0xe43], ah
inc ebx
sal dword [edi + 0x7d], 1
lodsd eax, dword [esi]
xor al, 0x96
adc esi, dword [ebx]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434543
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.00447ad0
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x2c], eax
mov eax, 0x200
lea ecx, [eax + 0x40]
cmovne eax, ecx
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], eax
call fcn.0042dd84
test eax, eax
mov ecx, str.runas
lea eax, [ebp - 0x3c]
cmovne ecx, dword [ebp - 0x30]
push eax
mov dword [ebp - 0x30], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4345b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, edi
cmove eax, ecx
jmp 0x4345c9
cmp dword [ebp + 0x10], 0
je 0x4345c7
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret