joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4041a0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x4041c0
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x409a30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
test eax, eax
je 0x409cdc
test edx, edx
je 0x409cdc
movups xmm0, xmmword [eax]
xorps xmm4, xmm4
lea edx, [edx + 0x10]
cmp ecx, 0x100
je 0x409bf0
cmp ecx, 0xc0
je 0x409b10
cmp ecx, 0x80
jne 0x409ce4
lea ecx, [ecx]
mov ecx, 9
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.00409af6
aeskeygenassist xmm1, xmm0, 2
call fcn.00409af0
aeskeygenassist xmm1, xmm0, 4
call fcn.00409af0
aeskeygenassist xmm1, xmm0, 8
call fcn.00409af0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00409af0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00409af0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00409af0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00409af0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00409af0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00409af0
movups xmmword [edx], xmm0
mov dword [edx + 0x50], ecx
xor eax, eax
ret
movq xmm2, qword [eax + 0x10]
mov ecx, 0xb
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.00409b90
aeskeygenassist xmm1, xmm2, 2
call fcn.00409bd0
aeskeygenassist xmm1, xmm2, 4
call fcn.00409b80
aeskeygenassist xmm1, xmm2, 8
call fcn.00409bd0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00409b80
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00409bd0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00409b80
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00409bd0
movups xmmword [edx], xmm0
mov dword [edx + 0x30], ecx
xor eax, eax
ret
movups xmm2, xmmword [eax + 0x10]
mov ecx, 0xd
lea edx, [edx + 0x10]
movups xmmword [edx - 0x20], xmm0
movups xmmword [edx - 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.00409ca6
aeskeygenassist xmm1, xmm0, 1
call fcn.00409cc0
aeskeygenassist xmm1, xmm2, 2
call fcn.00409ca0
aeskeygenassist xmm1, xmm0, 2
call fcn.00409cc0
aeskeygenassist xmm1, xmm2, 4
call fcn.00409ca0
aeskeygenassist xmm1, xmm0, 4
call fcn.00409cc0
aeskeygenassist xmm1, xmm2, 8
call fcn.00409ca0
aeskeygenassist xmm1, xmm0, 8
call fcn.00409cc0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00409ca0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00409cc0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00409ca0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00409cc0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00409ca0
movups xmmword [edx], xmm0
mov dword [edx + 0x10], ecx
xor eax, eax
ret
mov eax, 0xffffffff
ret
mov eax, 0xfffffffe
ret

Function at 0x409d10
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00409a30
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x409d71
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x409d42
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
xor eax, eax
ret
Function at 0x40a620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x40a698
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x40a670
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x40a678
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0040a69d

Function at 0x40c040
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x40c184
pushfd
cld
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
lea esi, [esp - 0x40]
and esi, 0xffffffc0
lea edi, [edx - 0x7f]
sub edi, esi
neg edi
and edi, 0x3c0
sub esi, edi
mov edi, dword [esp + 0x2c]
xchg esi, esp
add esp, 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebp
call fcn.0040c09f

Function at 0x40c380
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.0040c389

Function at 0x40e280
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.0040e297

Function at 0x40e680
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.0040e697
Function at 0x412e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x412edf
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x412e75
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004125c0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x412e3f
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x412f96
call fcn.00412e87
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x412f37
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004129e0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x412eec
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x412f96
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004129e0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x412f94
jmp 0x412f96
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x413950
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x413a2f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x4139c5
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00413000
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x41398f
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x413ae6
call fcn.004139d7
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x413a87
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004134b0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x413a3c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x413ae6
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004134b0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x413ae4
jmp 0x413ae6
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x415480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov eax, esp
sub esp, 0x94
and esp, 0xffffffc0
lea ebx, [esp + 0x80]
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x10], eax
call fcn.004154b2

Function at 0x42a510
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1586
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x62b370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00585fd0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0042ae90
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x28], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x29], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0042ae90
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x3c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42b220
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1586
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x62b370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00586080
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 0x18
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0042b6c0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x28]
mov byte [edx + 0x28], cl
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x29]
mov byte [edx + 0x29], cl
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp + 8]
add edx, 0x30
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0042b5f0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
mov dword [eax + 0x3c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x40]
mov dword [eax + 0x40], edx
mov eax, dword [ebp + 8]
add eax, 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x43e9b0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x43ea0f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43e9dc
mov eax, 1
jmp 0x43ea2d
push str.RegDeleteKeyTransactedW
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43ea0d
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0xc]
jmp 0x43ea2d
jmp 0x43ea28
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x43ea28
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x43ea2d
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x43f140
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
jne 0x43f149
cmp dword [ebp + 0xc], 0
je 0x43f15c
mov dword [ebp - 4], 1
jmp 0x43f163
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x43f176
mov eax, 0xd
jmp 0x43f1a5
xor edx, edx
jne 0x43f14d
mov eax, dword [ebp + 0xc]
push eax
call fcn.004d915b
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43f1b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
xor eax, eax
jne 0x43f1b9
cmp dword [ebp + 0xc], 0
je 0x43f1cc
mov dword [ebp - 0x10], 1
jmp 0x43f1d3
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x43f1e6
mov eax, 0xd
jmp 0x43f243
xor edx, edx
jne 0x43f1bd
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004d915b
add esp, 4
add eax, 1
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx*2]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax + edx*2]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 1
jne 0x43f1f7
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 7
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x43f250
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x62b370]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], ecx
push 0
lea ecx, [ebp - 0x21c]
call fcn.0043edc0
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.0043f070
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x43f2cf
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x220], edx
lea ecx, [ebp - 0x21c]
call fcn.0043edf0
mov eax, dword [ebp - 0x220]
jmp 0x43f384
mov dword [ebp - 0x210], 0x100
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x43f353
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.0043f250
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x43f347
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x21c]
call fcn.0043edf0
mov eax, dword [ebp - 0x224]
jmp 0x43f384
mov dword [ebp - 0x210], 0x100
jmp 0x43f2d9
lea ecx, [ebp - 0x21c]
call fcn.0043ef60
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20c]
call fcn.0043ee80
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x21c]
call fcn.0043edf0
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484636
mov esp, ebp
pop ebp
ret 4
Function at 0x443070
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x38]
call fcn.0042f120
test al, al
jne 0x44308f
lea ecx, [esi + 0x38]
call fcn.004275c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x50]
call fcn.00427780
lea ecx, [esi + 0x38]
call fcn.00427660
lea ecx, [esi + 0x20]
call fcn.00427660
lea ecx, [esi + 8]
call fcn.00427660
push 0x68
push esi
call fcn.0048467f
add esp, 8
mov eax, esi
pop edi
pop esi
ret 4

Function at 0x4431a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a260b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x62b370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x130], ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x114]
mov ebx, dword [ebp + 0xc]
push 0x104
push 0
push eax
call fcn.004d7c10
add esp, 0xc
mov ecx, edi
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
call fcn.004275c0
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push 0
push 1
call esi
push 0
push 0
push eax
lea eax, [ebp - 0x114]
mov ecx, edi
push eax
push 0xffffffffffffffff
call fcn.004275c0
push eax
push 0
push 1
call esi
mov edi, dword [ebp - 0x130]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x12c]
mov esi, dword [edi + 4]
call fcn.0042d9a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x12c]
mov ecx, dword [esi + 0xc]
push eax
add ecx, 0x50
call fcn.0042f210
lea ecx, [ebp - 0x12c]
mov dword [ebp - 4], 0xffffffff
call fcn.00427780
mov ecx, ebx
call fcn.004275c0
mov ecx, dword [esi + 0xc]
push eax
add ecx, 0x20
call fcn.00427640
mov esi, dword [edi + 4]
lea eax, [ebp - 0x134]
push eax
push 0
push esi
push 0x442fb0
push 0
push 0
mov dword [ebp - 0x134], 0
call fcn.004d9544
add esp, 0x18
mov dword [esi + 0x10], eax
test eax, eax
je 0x4432cf
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4432cf
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [edi + 4]
mov al, byte [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00484636
mov esp, ebp
pop ebp
ret 8