joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ba50
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4464c6
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x456020]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x20], 0x449e70
push str.for_
lea ecx, [ebp - 0x14]
call fcn.0040f5f0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040f5f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x48]
call fcn.0043b170
neg eax
sbb eax, eax
and eax, 0x100
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
or edx, 0x20019
push edx
push 0
mov eax, dword [ebp - 0x20]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43bb04
mov dword [ebp - 0x3c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0040fa10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040fa10
mov eax, dword [ebp - 0x3c]
jmp 0x43bc66
mov dword [ebp - 0x24], 0
jmp 0x43bb16
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x28]
call fcn.0040fa30
mov byte [ebp - 4], 2
mov dword [ebp - 0x30], 0x104
lea edx, [ebp - 0x30]
push edx
push 0xff
lea ecx, [ebp - 0x28]
call fcn.00408540
push eax
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x2c], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
call fcn.0041cf70
cmp dword [ebp - 0x2c], 0
jne 0x43bb74
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040fa10
jmp 0x43bc37
lea ecx, [ebp - 0x28]
call fcn.00404e70
cmp eax, 0xa
jl 0x43bc26
push 0
lea ecx, [ebp - 0x14]
call fcn.00433de0
push eax
lea ecx, [ebp - 0x28]
call fcn.0041ca20
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffff
je 0x43bc26
lea ecx, [ebp - 0x14]
call fcn.00404e70
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x1c]
call fcn.00404e70
push eax
mov edx, dword [ebp - 0x34]
push edx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x28]
call fcn.00432b60
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.0041f150
add esp, 8
movzx eax, al
test eax, eax
je 0x43bc1e
mov dword [ebp - 0x40], 1
lea ecx, [ebp - 0x38]
call fcn.0040fa10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040fa10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0040fa10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040fa10
mov eax, dword [ebp - 0x40]
jmp 0x43bc66
lea ecx, [ebp - 0x38]
call fcn.0040fa10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040fa10
jmp 0x43bb0d
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0040fa10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040fa10
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x43c180
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446557
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x456020]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x10]
call fcn.0040fa30
mov dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.00433780
mov ecx, eax
call fcn.00432e30
push 0x449a34
lea ecx, [ebp - 0x10]
call fcn.00411f00
push 0x449a40
lea ecx, [ebp - 0x10]
call fcn.00411f00
lea ecx, [ebp - 0x10]
call fcn.00433de0
push eax
push 0
push 0x449a60
push 0x449a70
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43c224
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040fa10
mov eax, dword [ebp - 0x18]
jmp 0x43c24e
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040fa10
mov eax, dword [ebp - 0x1c]
jmp 0x43c24e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x43c380
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x456020]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jne 0x43c437
cmp dword [ebp - 0x120], 1
jne 0x43c437
cmp dword [ebp - 0x11c], 0x1db0
jbe 0x43c3e4
push str.win7_sp1
mov ecx, dword [ebp - 0x12c]
add ecx, 0x3d0
call fcn.0040f670
cmp dword [ebp - 0x11c], 0x1db0
ja 0x43c432
push str.KB2454826
mov ecx, dword [ebp - 0x12c]
call fcn.0043ba50
test eax, eax
je 0x43c41c
push str.win7_sp0_1
mov ecx, dword [ebp - 0x12c]
add ecx, 0x3d0
call fcn.0040f670
jmp 0x43c432
push str.win7_sp0_2
mov ecx, dword [ebp - 0x12c]
add ecx, 0x3d0
call fcn.0040f670
jmp 0x43c4f8
cmp dword [ebp - 0x124], 6
jne 0x43c464
cmp dword [ebp - 0x120], 0
jne 0x43c464
push str.winvista
mov ecx, dword [ebp - 0x12c]
add ecx, 0x3d0
call fcn.0040f670
jmp 0x43c4f8
cmp dword [ebp - 0x124], 5
jne 0x43c48e
cmp dword [ebp - 0x120], 1
jne 0x43c48e
push str.winxp
mov ecx, dword [ebp - 0x12c]
add ecx, 0x3d0
call fcn.0040f670
jmp 0x43c4f8
cmp dword [ebp - 0x124], 5
jne 0x43c4b8
cmp dword [ebp - 0x120], 2
jne 0x43c4b8
push str.win2003
mov ecx, dword [ebp - 0x12c]
add ecx, 0x3d0
call fcn.0040f670
jmp 0x43c4f8
cmp dword [ebp - 0x124], 6
jne 0x43c4e2
cmp dword [ebp - 0x120], 2
jne 0x43c4e2
push str.win8
mov ecx, dword [ebp - 0x12c]
add ecx, 0x3d0
call fcn.0040f670
jmp 0x43c4f8
push 0x44a0bc
mov ecx, dword [ebp - 0x12c]
add ecx, 0x3d0
call fcn.0040f670
mov ecx, dword [ebp - 0x12c]
call fcn.0043b170
test eax, eax
je 0x43c519
mov ecx, dword [ebp - 0x12c]
mov dword [ecx + 0x3d8], 0x40
jmp 0x43c529
mov edx, dword [ebp - 0x12c]
mov dword [edx + 0x3d8], 0x20
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a53a
mov esp, ebp
pop ebp
ret
Function at 0x43c570
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x43c540
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3b0], eax
mov esp, ebp
pop ebp
ret

Function at 0x43c5a0
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1888
call fcn.00445f40
mov eax, dword [0x456020]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1888], ecx
mov dword [ebp - 0x82c], 0
mov word [ebp - 0x828], 0
push 0x81e
push 0
lea eax, [ebp - 0x826]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x820
lea ecx, [ebp - 0x828]
push ecx
push str.ProgramFilesDir
push 0x44a0f0
push closesocket
call fcn.0041ecd0
mov ecx, eax
call fcn.00441190
test eax, eax
je 0x43c62c
push 0x44a144
mov ecx, dword [ebp - 0x1888]
add ecx, 0x3d4
call fcn.0040f670
jmp 0x43c816
push str.Internet_Exploreriexplore.exe
lea edx, [ebp - 0x828]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [ebp - 0x187c], 0
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43c674
push 0x44a194
mov ecx, dword [ebp - 0x1888]
add ecx, 0x3d4
call fcn.0040f670
jmp 0x43c816
mov word [ebp - 0x1878], 0
push 0x103e
push 0
lea ecx, [ebp - 0x1876]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x830], 0
lea edx, [ebp - 0x830]
push edx
lea eax, [ebp - 0x828]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
je 0x43c6d5
cmp dword [ebp - 0x834], 0x103f
jbe 0x43c6f0
push 0x44a1a4
mov ecx, dword [ebp - 0x1888]
add ecx, 0x3d4
call fcn.0040f670
jmp 0x43c816
lea ecx, [ebp - 0x1878]
push ecx
mov edx, dword [ebp - 0x834]
push edx
push 0
lea eax, [ebp - 0x828]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43c758
lea ecx, [ebp - 0x1884]
push ecx
lea edx, [ebp - 0x1880]
push edx
push 0x44a0ec
lea eax, [ebp - 0x1878]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43c758
mov ecx, dword [ebp - 0x1880]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0x187c], 1
cmp dword [ebp - 0x82c], 8
jne 0x43c77c
push 0x44a1b4
mov ecx, dword [ebp - 0x1888]
add ecx, 0x3d4
call fcn.0040f670
jmp 0x43c816
cmp dword [ebp - 0x82c], 9
jne 0x43c79d
push 0x44a1bc
mov ecx, dword [ebp - 0x1888]
add ecx, 0x3d4
call fcn.0040f670
jmp 0x43c816
cmp dword [ebp - 0x82c], 0xa
jne 0x43c7be
push str.IE10
mov ecx, dword [ebp - 0x1888]
add ecx, 0x3d4
call fcn.0040f670
jmp 0x43c816
cmp dword [ebp - 0x82c], 6
jne 0x43c7df
push 0x44a1d0
mov ecx, dword [ebp - 0x1888]
add ecx, 0x3d4
call fcn.0040f670
jmp 0x43c816
cmp dword [ebp - 0x82c], 7
jne 0x43c800
push 0x44a1d8
mov ecx, dword [ebp - 0x1888]
add ecx, 0x3d4
call fcn.0040f670
jmp 0x43c816
push str.others
mov ecx, dword [ebp - 0x1888]
add ecx, 0x3d4
call fcn.0040f670
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a53a
mov esp, ebp
pop ebp
ret
Function at 0x43c9b0
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1888
call fcn.00445f40
mov eax, dword [0x456020]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1888], ecx
mov dword [ebp - 0x82c], 0
mov word [ebp - 0x828], 0
push 0x81e
push 0
lea eax, [ebp - 0x826]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x820
lea ecx, [ebp - 0x828]
push ecx
push 0x449d00
push 0x449d20
push closesocket
call fcn.0041ecd0
mov ecx, eax
call fcn.00441190
test eax, eax
je 0x43ca37
push 1
push 0xa
mov ecx, dword [ebp - 0x1888]
call fcn.0043c8d0
xor eax, eax
jmp 0x43cb92
push 0x449d74
lea edx, [ebp - 0x828]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [ebp - 0x187c], 0
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43ca7e
push 2
push 0xa
mov ecx, dword [ebp - 0x1888]
call fcn.0043c8d0
mov eax, dword [ebp - 0x187c]
jmp 0x43cb92
mov word [ebp - 0x1878], 0
push 0x103e
push 0
lea ecx, [ebp - 0x1876]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x830], 0
lea edx, [ebp - 0x830]
push edx
lea eax, [ebp - 0x828]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
je 0x43cadf
cmp dword [ebp - 0x834], 0x103f
jbe 0x43caf5
push 3
push 0xa
mov ecx, dword [ebp - 0x1888]
call fcn.0043c8d0
xor eax, eax
jmp 0x43cb92
lea ecx, [ebp - 0x1878]
push ecx
mov edx, dword [ebp - 0x834]
push edx
push 0
lea eax, [ebp - 0x828]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43cb5d
lea ecx, [ebp - 0x1884]
push ecx
lea edx, [ebp - 0x1880]
push edx
push 0x449db4
lea eax, [ebp - 0x1878]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43cb5d
mov ecx, dword [ebp - 0x1880]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0x187c], 1
cmp dword [ebp - 0x82c], 9
jne 0x43cb6f
mov eax, 1
jmp 0x43cb92
cmp dword [ebp - 0x82c], 0xa
jne 0x43cb81
mov eax, 1
jmp 0x43cb92
push 4
push 0xa
mov ecx, dword [ebp - 0x1888]
call fcn.0043c8d0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a53a
mov esp, ebp
pop ebp
ret
Function at 0x43cbd0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x61c
mov eax, dword [0x456020]
xor eax, ebp
mov dword [ebp - 0x3c4], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x628], ecx
push 0
push 3
mov ecx, dword [ebp - 0x628]
call fcn.0043c8d0
lea ecx, [ebp - 0x3bc]
call fcn.0040fa30
mov dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x3bc]
push eax
call fcn.00433780
mov ecx, eax
call fcn.00432e30
lea ecx, [ebp - 0x3b8]
call fcn.0040fa30
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x628]
mov edx, dword [ecx + 0x3c0]
push edx
mov eax, dword [ebp - 0x3bc]
push eax
push 0x449c7c
lea ecx, [ebp - 0x3b8]
push ecx
call fcn.0040f3e0
add esp, 0x10
lea ecx, [ebp - 0x3b8]
call fcn.00433de0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43cdca
mov ecx, dword [ebp - 0x628]
call fcn.0043b270
mov dword [ebp - 0x5dc], 0
xor edx, edx
mov dword [ebp - 0x5d8], edx
mov dword [ebp - 0x5d4], edx
mov dword [ebp - 0x5d0], edx
mov dword [ebp - 0x624], 0
push 0x40
push 0
lea eax, [ebp - 0x620]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x624], 0x44
push str.__quiet__norestart
lea ecx, [ebp - 0x3b8]
call fcn.00411f00
mov word [ebp - 0x5cc], 0
push 0x206
push 0
lea ecx, [ebp - 0x5ca]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x3b8]
call fcn.00433de0
push eax
lea edx, [ebp - 0x5cc]
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy]
add esp, 8
lea eax, [ebp - 0x5dc]
push eax
lea ecx, [ebp - 0x624]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x5cc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
jne 0x43cd6b
push 1
mov ecx, dword [ebp - 0x628]
call fcn.0041f4e0
mov eax, dword [ebp - 0x628]
mov dword [eax + 0x3a8], 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x5dc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x5d8], 0
je 0x43cdaa
mov edx, dword [ebp - 0x5d8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x5d8], 0
cmp dword [ebp - 0x5dc], 0
je 0x43cdca
mov eax, dword [ebp - 0x5dc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x5dc], 0
lea ecx, [ebp - 0x3b4]
call fcn.0041ef90
mov byte [ebp - 4], 2
push 1
lea ecx, [ebp - 0x3b4]
call fcn.0041f060
push 0
push 0
lea ecx, [ebp - 0x3b4]
call fcn.0041f360
mov dword [ebp - 0x10], eax
push 1
mov ecx, dword [ebp - 0x628]
call fcn.0041f4e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3b4]
call fcn.0041efc0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3b8]
call fcn.0040fa10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3bc]
call fcn.0040fa10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x3c4]
xor ecx, ebp
call fcn.0043a53a
mov esp, ebp
pop ebp
ret
Function at 0x43cfa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00433d10
mov ecx, dword [ebp - 4]
call fcn.0043b380
push 0
push 0x12c
push 1
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00433d30
mov ecx, dword [ebp - 4]
call fcn.0043c570
push 0
push 2
mov ecx, dword [ebp - 4]
call fcn.0043c8d0
mov esp, ebp
pop ebp
ret

Function at 0x43d000
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x456020]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jne 0x43d09d
cmp dword [ebp - 0x120], 1
jne 0x43d09d
cmp dword [ebp - 0x11c], 0x1db0
jbe 0x43d05c
mov dword [ebp - 4], 1
cmp dword [ebp - 0x11c], 0x1db0
ja 0x43d09b
push 0x449b88
mov ecx, dword [ebp - 0x12c]
call fcn.0043ba50
test eax, eax
je 0x43d085
mov dword [ebp - 4], 1
jmp 0x43d09b
push 2
push 8
mov ecx, dword [ebp - 0x12c]
call fcn.0043c8d0
xor eax, eax
jmp 0x43d15d
jmp 0x43d0b3
push 1
push 8
mov ecx, dword [ebp - 0x12c]
call fcn.0043c8d0
xor eax, eax
jmp 0x43d15d
mov ecx, dword [ebp - 0x12c]
call fcn.0043c9b0
test eax, eax
je 0x43d0d8
push 3
push 8
mov ecx, dword [ebp - 0x12c]
call fcn.0043c8d0
xor eax, eax
jmp 0x43d15d
call fcn.00440840
test eax, eax
je 0x43d0f4
push 4
push 8
mov ecx, dword [ebp - 0x12c]
call fcn.0043c8d0
xor eax, eax
jmp 0x43d15d
mov ecx, dword [ebp - 0x12c]
call fcn.0043c830
test eax, eax
je 0x43d116
push 5
push 8
mov ecx, dword [ebp - 0x12c]
call fcn.0043c8d0
xor eax, eax
jmp 0x43d15d
mov ecx, dword [ebp - 0x12c]
call fcn.0043c180
test eax, eax
je 0x43d138
push 7
push 8
mov ecx, dword [ebp - 0x12c]
call fcn.0043c8d0
xor eax, eax
jmp 0x43d15d
mov ecx, dword [ebp - 0x12c]
call fcn.0043bec0
test eax, eax
jne 0x43d15a
push 6
push 8
mov ecx, dword [ebp - 0x12c]
call fcn.0043c8d0
xor eax, eax
jmp 0x43d15d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043a53a
mov esp, ebp
pop ebp
ret
Function at 0x43d750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x456020]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x220], ecx
mov dword [ebp - 8], 0x208
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x220]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x43d7b4
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043a53a
mov esp, ebp
pop ebp
ret 8

Function at 0x43d7d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
lea ecx, [eax + eax + 1]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x43e6b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x456020]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], 0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x43e6fa
jmp 0x43e785
push 1
push 0x23
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43e748
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43e733
jmp 0x43e785
push str.All_UsersApplication_Data
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR80.dll_wcscat]
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.MSVCR80.dll_wcscat]
add esp, 8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
cmp eax, dword [ebp + 0x10]
jae 0x43e785
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR80.dll_wcscat]
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043a53a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4404a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x440620
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x44063c
mov eax, dword [ebp - 4]
jmp 0x440717
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x4406f2
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov edi, edi
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x44a840]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x44a840]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x44a840]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x44a840]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x44a840]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x44a840]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x44a840]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x44a840]
dec ebp
jne 0x44065c
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x44070e
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x44a840]
dec ecx
jne 0x4406fc
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440d80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x1c]
ja 0x440e39
mov eax, dword [ebp + 0x1c]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043a3f2
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x1c]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x440e18
mov edx, dword [ebp + 0x18]
sub edx, 1
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.004114d0
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x440e37
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 8], 0
jmp 0x440e60
lea edx, [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x440e60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x18