joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc7f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x2c
mov eax, 0x4cdb03
call fcn.004ae953
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
push 0xffffffffffffffff
xor eax, eax
mov dword [ebp - 0x38], ebx
lea edi, [ebp - 0x34]
push ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
stosd dword es:[edi], eax
call fcn.00495e7f
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x1c], ebx
jbe 0x40cdb0
push 0x3fc
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xff
mov dword [ebp - 4], ebx
call fcn.00489d74
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], ebx
movzx edi, word [ebp - 0x18]
cmp edi, dword [ebp - 0x1c]
jae 0x40cd90
push 0x1fe
push ebx
push esi
call fcn.004ae4c0
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x20], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
jne 0x40cd88
push esi
cmp word [ebp - 0x18], bx
jne 0x40cd7c
lea ecx, [ebp - 0x14]
call fcn.0040253e
lea ebx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040c56d
call fcn.0040c520
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x40cd69
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
push esi
push eax
call fcn.004961de
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402883
xor ebx, ebx
jmp 0x40cd88
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
push eax
call fcn.004961de
inc dword [ebp - 0x18]
jmp 0x40ccf9
or dword [ebp - 4], 0xffffffff
jmp 0x40cda5
cmp esi, ebx
je 0x40cdb0
push esi
call fcn.00489d7f
pop ecx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
call fcn.004ae9f8
ret 8

Function at 0x40ce19
Capabilities:
Get file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or esi, 0xffffffff
cmp eax, esi
je 0x40ce36
not al
movzx esi, al
shr esi, 4
and esi, 1
mov ecx, dword [esp + 8]
add ecx, 0xfffffff0
call fcn.00402883
mov eax, esi
pop esi
ret 4
Function at 0x40e226
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x4cc2c3
call fcn.004ae920
mov ebx, ecx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.00460c64
test al, al
je 0x40e260
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402883
mov eax, esi
jmp 0x40e35c
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
mov byte [ebp - 4], 2
mov esi, 0x104
mov ecx, ebx
mov dword [ebp - 0x10], esi
call fcn.0040266c
push dword [ebp + 0xc]
mov eax, 0x2001f
push dword [ebp + 8]
lea edi, [ebp - 0x1c]
call fcn.00411f8b
mov dword [ebp - 0x14], eax
cmp eax, 5
jne 0x40e2a9
push dword [ebp + 0xc]
mov eax, 0x20019
push dword [ebp + 8]
call fcn.00411f8b
mov dword [ebp - 0x14], eax
xor edi, edi
cmp dword [ebp - 0x14], edi
jne 0x40e336
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
push dword [ebp - 0x1c]
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e325
cmp dword [ebp + 8], 1
je 0x40e2e0
cmp dword [ebp + 8], 2
jne 0x40e325
cmp dword [ebp - 0x10], esi
jbe 0x40e2e8
mov esi, dword [ebp - 0x10]
push esi
mov ecx, ebx
call fcn.0040298b
push dword [ebp + 0x10]
lea ecx, [ebp - 0x1c]
push ecx
lea esi, [ebp - 0x10]
mov edi, eax
call fcn.00411f23
push 0xffffffffffffffff
mov ecx, ebx
mov esi, eax
call fcn.00411fe7
test esi, esi
jne 0x40e325
mov eax, dword [ebx]
cmp dword [eax - 0xc], esi
je 0x40e32c
call fcn.0040c520
mov ebx, eax
call fcn.0040c56d
jmp 0x40e32c
mov ecx, ebx
call fcn.0040266c
lea ecx, [ebp - 0x1c]
call fcn.00411fc7
xor edi, edi
lea ecx, [ebp - 0x1c]
call fcn.00411fc7
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402883
xor eax, eax
cmp dword [ebp - 0x14], edi
sete al
call fcn.004ae9f8
ret 0xc
Function at 0x40e364
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x4cc290
call fcn.004ae920
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp + 0x14]
mov byte [ebp - 4], 2
mov esi, 0x104
mov dword [ebp - 0x14], esi
call fcn.0040266c
push dword [ebp + 0xc]
mov eax, 0x2021f
push dword [ebp + 8]
lea edi, [ebp - 0x20]
call fcn.00411f8b
mov dword [ebp - 0x18], eax
cmp eax, 5
jne 0x40e3bd
push dword [ebp + 0xc]
mov eax, 0x20219
push dword [ebp + 8]
call fcn.00411f8b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x40e453
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
push dword [ebp - 0x20]
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e443
cmp dword [ebp + 8], 1
je 0x40e3f2
cmp dword [ebp + 8], 2
jne 0x40e443
cmp dword [ebp - 0x14], esi
jbe 0x40e3fa
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
push esi
call fcn.0040298b
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
push ecx
lea esi, [ebp - 0x14]
mov edi, eax
call fcn.00411f23
mov esi, dword [ebp + 0x14]
push 0xffffffffffffffff
mov ecx, esi
mov edi, eax
call fcn.00411fe7
cmp edi, ebx
jne 0x40e43f
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
je 0x40e44b
mov ebx, esi
call fcn.0040c520
mov ebx, eax
call fcn.0040c56d
xor ebx, ebx
jmp 0x40e44b
mov ecx, esi
jmp 0x40e446
mov ecx, dword [ebp + 0x14]
call fcn.0040266c
lea ecx, [ebp - 0x20]
call fcn.00411fc7
lea ecx, [ebp - 0x20]
call fcn.00411fc7
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402883
xor eax, eax
cmp dword [ebp - 0x18], ebx
sete al
call fcn.004ae9f8
ret 0x10
Function at 0x40e481
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x4cc290
call fcn.004ae920
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp + 0x14]
mov byte [ebp - 4], 2
mov esi, 0x104
mov dword [ebp - 0x14], esi
call fcn.0040266c
push dword [ebp + 0xc]
mov eax, 0x2011f
push dword [ebp + 8]
lea edi, [ebp - 0x20]
call fcn.00411f8b
mov dword [ebp - 0x18], eax
cmp eax, 5
jne 0x40e4da
push dword [ebp + 0xc]
mov eax, 0x20119
push dword [ebp + 8]
call fcn.00411f8b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x40e570
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
push dword [ebp - 0x20]
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e560
cmp dword [ebp + 8], 1
je 0x40e50f
cmp dword [ebp + 8], 2
jne 0x40e560
cmp dword [ebp - 0x14], esi
jbe 0x40e517
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
push esi
call fcn.0040298b
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
push ecx
lea esi, [ebp - 0x14]
mov edi, eax
call fcn.00411f23
mov esi, dword [ebp + 0x14]
push 0xffffffffffffffff
mov ecx, esi
mov edi, eax
call fcn.00411fe7
cmp edi, ebx
jne 0x40e55c
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
je 0x40e568
mov ebx, esi
call fcn.0040c520
mov ebx, eax
call fcn.0040c56d
xor ebx, ebx
jmp 0x40e568
mov ecx, esi
jmp 0x40e563
mov ecx, dword [ebp + 0x14]
call fcn.0040266c
lea ecx, [ebp - 0x20]
call fcn.00411fc7
lea ecx, [ebp - 0x20]
call fcn.00411fc7
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402883
xor eax, eax
cmp dword [ebp - 0x18], ebx
sete al
call fcn.004ae9f8
ret 0x10
Function at 0x40eca7
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x4d33ca
call fcn.004ae920
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0040253e
and dword [ebp - 4], 0
mov edi, eax
call fcn.00411b13
push eax
lea ecx, [ebp + 8]
call fcn.00402582
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402883
cmp byte [ebp + 0xc], 0
jne 0x40ed87
mov edi, str._syswow64_
push edi
xor ecx, ecx
lea esi, [ebp + 8]
call fcn.004077ca
cmp eax, 0xffffffff
je 0x40ed5d
mov eax, esi
push eax
lea ecx, [ebp + 0xc]
call fcn.00402582
push str._system32_
push edi
lea eax, [ebp + 0xc]
push eax
mov byte [ebp - 4], 3
call fcn.00411974
mov edi, dword [ebp + 0xc]
push edi
call fcn.00410d4b
test eax, eax
jge 0x40ed52
push dword [ebp + 8]
call fcn.00410d4b
mov esi, eax
lea ecx, [edi - 0x10]
call fcn.00402883
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402883
mov eax, esi
call fcn.004ae9f8
ret 8
jne 0x40ed33
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x40ed33
mov ebx, str._system32_
push ebx
xor ecx, ecx
lea esi, [ebp + 8]
call fcn.004077ca
cmp eax, 0xffffffff
je 0x40ed87
mov eax, esi
push eax
lea ecx, [ebp + 0xc]
call fcn.00402582
mov byte [ebp - 4], 4
jmp 0x40edf2
jne 0x40ed35
jmp 0x40ed54
mov edi, str.program_files__x86__
push edi
xor ecx, ecx
lea esi, [ebp + 8]
call fcn.004077ca
cmp eax, 0xffffffff
je 0x40edce
mov eax, esi
push eax
lea ecx, [ebp + 0xc]
call fcn.00402582
push str.program_files_
mov byte [ebp - 4], 5
push edi
lea eax, [ebp + 0xc]
push eax
call fcn.00411974
mov edi, dword [ebp + 0xc]
push edi
call fcn.00410d4b
mov esi, eax
test esi, esi
jge 0x40ed83
jmp 0x40ed2b
mov ebx, str.program_files_
push ebx
xor ecx, ecx
lea esi, [ebp + 8]
call fcn.004077ca
cmp eax, 0xffffffff
je 0x40edf6
mov eax, esi
push eax
lea ecx, [ebp + 0xc]
call fcn.00402582
mov byte [ebp - 4], 6
push edi
push ebx
jmp 0x40edb1
push dword [ebp + 8]
call fcn.00410d4b
mov esi, eax
jmp 0x40ed3d
Function at 0x411f23
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411f87
cmp dword [ebp + 0xc], 1
je 0x411f5f
cmp dword [ebp + 0xc], 2
je 0x411f5f
push 0xd
pop eax
jmp 0x411f87
mov eax, dword [ebp - 4]
test edi, edi
je 0x411f81
test eax, eax
je 0x411f7c
test al, 1
jne 0x411f5a
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x411f81
jmp 0x411f5a
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x42067c
Capabilities:
Query environment variable

Disassembly:
push 0x41c
mov eax, 0x4cd735
call fcn.004ae989
mov eax, dword [ebp + 8]
and dword [ebp - 0x424], 0
mov dword [ebp - 0x428], eax
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0xa
jl 0x420761
lea edi, [ebp + 0xc]
call fcn.00411b13
mov edi, str._userprofile_
push edi
xor ecx, ecx
lea esi, [ebp + 0xc]
call fcn.004077ca
cmp eax, 0xffffffff
je 0x420761
call fcn.0048b151
push eax
lea ecx, [ebp - 0x424]
call fcn.00402821
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 0x428]
mov byte [ebp - 4], 1
push dword [eax + 0x2074]
lea ecx, [eax + 0x2044]
call fcn.004994a5
push 0x207
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x420743
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x424]
call fcn.0040274c
push dword [ebp - 0x424]
mov eax, esi
push edi
push eax
call fcn.00411974
lea eax, [ebp - 0x424]
push eax
mov ecx, ebx
call fcn.00402582
mov ecx, dword [ebp - 0x424]
add ecx, 0xfffffff0
call fcn.00402883
jmp 0x42076c
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call fcn.00402582
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402883
mov eax, ebx
call fcn.004aea0c
ret 8
Function at 0x42aa92
Capabilities:
Persist via run registry key

Disassembly:
push 0xc
mov eax, 0x4cd6c4
call fcn.004ae920
mov esi, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x10]
call fcn.0040253e
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00460c64
lea edi, [esi + 0x2030]
test al, al
je 0x42ab5b
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Common_Programs
call fcn.0040253e
push ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00402582
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], bl
call fcn.0040e481
cmp eax, ebx
je 0x42ab1f
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x42ab1f
lea ecx, [eax - 1]
mov eax, edi
call fcn.00402bdb
cmp ax, 0x5c
je 0x42ab1f
push 0x5257bc
mov ecx, edi
call fcn.00411baa
add esi, 0x2034
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Programs
call fcn.0040253e
push ecx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00402582
push SysReAllocStringLen
mov byte [ebp - 4], bl
call fcn.0040e364
jmp 0x42abee
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Common_Programs
call fcn.0040253e
push ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00402582
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], bl
call fcn.0040e226
cmp eax, ebx
je 0x42abb6
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x42abb6
lea ecx, [eax - 1]
mov eax, edi
call fcn.00402bdb
cmp ax, 0x5c
je 0x42abb6
push 0x5257bc
mov ecx, edi
call fcn.00411baa
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Programs
add esi, 0x2034
call fcn.0040253e
push ecx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00402582
push SysReAllocStringLen
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.0040e226
cmp eax, ebx
je 0x42ac17
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x42ac17
lea ecx, [eax - 1]
mov eax, esi
call fcn.00402bdb
cmp ax, 0x5c
je 0x42ac17
push 0x5257bc
mov ecx, esi
call fcn.00411baa
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402883
call fcn.004ae9f8
ret
Function at 0x42ffd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x55f6c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x58]
push eax
push 1
push 0
push dword [0x568e50]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43002d
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push dword [0x568e58]
mov dword [ebp - 0x5c], 0x50
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43002d
cmp dword [ebp - 0x54], eax
sete al
jmp 0x43002f
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa923
leave
ret
Function at 0x4304b5
Capabilities:
Check if file exists

Disassembly:
push 0x30
mov eax, 0x4cf0a1
call fcn.004ae920
mov edi, 0x56b69c
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.00495dfe
xor ebx, ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.00495dfe
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00495dfe
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00495e7f
push dword [0x568e7c]
mov ecx, edi
call fcn.0046186b
pop ecx
call fcn.0048b151
push eax
lea ecx, [ebp - 0x10]
call fcn.00402821
push 0x12
lea esi, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00406c7d
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
je 0x430546
push eax
call ebx
test eax, eax
je 0x430546
mov eax, esi
push eax
push dword [0x56b6a4]
mov ecx, edi
call fcn.0049618c
push 0x13
lea esi, [ebp - 0x10]
call fcn.00406c7d
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x430570
push eax
call ebx
test eax, eax
je 0x430570
mov eax, esi
push eax
push dword [0x56b6a4]
mov ecx, edi
call fcn.0049618c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402883
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0049602a
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.0049602a
mov eax, edi
call fcn.004ae9f8
ret
Function at 0x4347ae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1d8]
sub esp, 0x258
mov eax, dword [0x55f6c0]
xor eax, ebp
mov dword [ebp + 0x1d4], eax
push esi
xor esi, esi
cmp dword [0x56ade4], esi
jne 0x43487d
push ebx
lea eax, [ebp - 0x78]
push eax
push 0x20019
push esi
xor ebx, ebx
push str.SoftwareMicrosoftPlus_ThemesCurrent
inc ebx
push SysReAllocStringLen
mov dword [0x56ade4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43487c
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push esi
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x104
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x434873
push edi
push 0xb
pop ecx
mov esi, str.Windows_Classic.theme
lea edi, [ebp + 0x1a8]
lea eax, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call esi
mov edi, eax
lea eax, [ebp + 0x1a8]
push eax
call esi
cmp edi, eax
jl 0x434872
lea eax, [ebp + 0x1a8]
push eax
push eax
call esi
sub edi, eax
lea eax, [ebp + edi*2 - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x434872
mov dword [0x56ade0], ebx
pop edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp + 0x1d4]
mov eax, dword [0x56ade0]
xor ecx, ebp
pop esi
call fcn.004aa923
add ebp, 0x1d8
leave
ret
Function at 0x437028
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x437033
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x4370e5
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x52e9f0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x52e9f0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x52e9f0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x52e9f0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x52e9f0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x52e9f0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x52e9f0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x52e9f0]
inc ecx
sub edi, 8
dec esi
jne 0x43704a
pop ebx
test edi, edi
je 0x4370fe
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x52e9f0]
inc ecx
dec edi
jne 0x4370e9
pop esi
not eax
pop edi
ret

Function at 0x437103
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x52e9f0]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x52e9f0]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x437802
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x437832
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43782d
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x43785a
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x437843
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.004b3bd0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret
Function at 0x438473
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebx], 0
push esi
push edi
jne 0x438506
cmp dword [ebx + 4], 0xffffffff
jne 0x438506
lea esi, [ebx + 0x240]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x43849f
sub eax, edx
sar eax, 1
movzx eax, word [ebx + eax*2 + 0x23e]
cmp ax, 0x5c
je 0x4384d6
cmp ax, 0x2f
je 0x4384d6
dec esi
dec esi
mov ax, word [esi + 2]
inc esi
inc esi
test ax, ax
jne 0x4384c3
mov edi, esi
mov esi, 0x5257bc
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.004376f8
pop ecx
pop ecx
test eax, eax
jne 0x4384ed
mov eax, dword [ebp + 8]
jmp 0x43850b
push eax
call fcn.00437a72
mov dword [ebx], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x43850b
mov eax, 0x1000000
pop edi
pop esi
pop ecx
pop ebp
ret 4

Function at 0x4389e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x55f6c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx]
push ebx
mov ebx, dword [ebp + 8]
test ax, ax
je 0x438aba
push esi
push edi
mov edi, ecx
mov edx, ecx
movzx eax, ax
cmp ax, 0x2f
je 0x438a1b
cmp ax, 0x5c
jne 0x438a1d
mov edi, edx
inc edx
inc edx
movzx eax, word [edx]
test ax, ax
jne 0x438a0f
mov eax, edi
cmp edi, ecx
je 0x438a60
mov esi, edi
sub esi, ecx
sar esi, 1
add esi, esi
push esi
push ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.004b3bd0
xor eax, eax
mov word [ebp + esi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004389e0
add esp, 0x14
lea eax, [edi + 2]
lea esi, [ebp - 0x414]
mov ecx, ebx
sub esi, ebx
movzx edx, word [ecx]
mov word [esi + ecx], dx
inc ecx
inc ecx
test dx, dx
jne 0x438a6a
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x438a7a
sub eax, edx
lea edi, [ebp - 0x414]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x438a8e
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x414]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004aa923
leave
ret
Function at 0x43a1d4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, eax
push esi
lea eax, [ebx - 1]
push edi
mov esi, ecx
cmp eax, 7
jbe 0x43a1ed
mov dword [esi + 0x6afa4], str.bad_pack_level
xor edi, edi
lea ecx, [esi + 0x6af70]
lea eax, [esi + 0x6af78]
mov dword [eax], edi
cmp dword [ecx], edi
jne 0x43a20d
mov dword [eax], 1
mov dword [ecx], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
push edi
push eax
mov dword [esi + 0x6af6c], edi
call fcn.004ae4c0
mov eax, ebx
shl eax, 3
movzx ecx, word [eax + 0x52d1c2]
mov dword [esi + 0x6af98], ecx
movzx ecx, word [eax + 0x52d1c0]
mov dword [esi + 0x6af9c], ecx
movzx ecx, word [eax + 0x52d1c4]
mov dword [esi + 0x6afa0], ecx
movzx eax, word [eax + 0x52d1c6]
add esp, 0xc
cmp ebx, 2
mov dword [esi + 0x6af94], eax
jg 0x43a270
mov eax, dword [esp + 0x10]
or word [eax], 4
jmp 0x43a27d
cmp ebx, 8
jl 0x43a27d
mov eax, dword [esp + 0x10]
or word [eax], 2
push 0x10000
lea ebx, [esi + 0x1af70]
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
cmp eax, edi
je 0x43a2e5
cmp eax, 0xffffffff
je 0x43a2e5
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x43a2bd
call fcn.0043a47d
mov dword [esi + 0x6af7c], edi
movzx eax, byte [ebx + edi]
mov ecx, dword [esi + 0x6af7c]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
inc edi
mov dword [esi + 0x6af7c], eax
cmp edi, 2
jb 0x43a2c3
jmp 0x43a2f5
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
ret