joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42abc0
Capabilities:
Get common file path
Set registry value

Disassembly:
sub esp, 0x238
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x234], eax
cmp byte [esp + 0x23c], 0
lea eax, [esp + 0x130]
je 0x42ac00
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x130]
push ecx
push 0x516080
jmp 0x42ac19
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x130]
push ecx
push 0x516064
call fcn.00404690
add esp, 4
push eax
lea edx, [esp + 0x34]
push edx
call fcn.004b79a8
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push 0x516038
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5132e0
mov dword [esp + 0x28], 0
call fcn.00404690
add esp, 4
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x42adc7
cmp dword [esp + 8], 2
jne 0x42acb3
push 0x516020
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
call fcn.00423620
push 0x516010
call fcn.00404690
add esp, 4
lea edx, [esp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x42acc4
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42acd5
push esi
sub eax, edx
push eax
lea eax, [esp + 0x14]
push eax
push 1
push 0
push 0x516000
call fcn.00404690
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 4
push eax
push ecx
call esi
lea edx, [esp + 0x10]
push 0
push edx
call fcn.004bae4f
add esp, 8
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push 0x515fec
mov dword [esp + 0x1c], 1
call fcn.00404690
mov ecx, dword [esp + 0x18]
add esp, 4
push eax
push ecx
call esi
lea eax, [esp + 0x30]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42ad42
sub eax, ecx
inc eax
push eax
lea edx, [esp + 0x34]
push edx
push 2
push 0
push 0x515fdc
call fcn.00404690
add esp, 4
push eax
mov eax, dword [esp + 0x18]
push eax
call esi
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push 0x515fd0
mov dword [esp + 0x1c], 3
call fcn.00404690
mov edx, dword [esp + 0x18]
add esp, 4
push eax
push edx
call esi
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push 0x515fc4
mov dword [esp + 0x1c], 1
call fcn.00404690
mov ecx, dword [esp + 0x18]
add esp, 4
push eax
push ecx
call esi
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.004b6da3
add esp, 0x238
ret
Function at 0x42c870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18c
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x20
mov dword [esp + 0x9c], ecx
lea esi, [edx + 0xce4]
lea edi, [esp + 0x110]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 5
mov dword [esp + 0x1c], 6
mov dword [esp + 0x20], 0xe
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x28], 0x1b
mov dword [esp + 0x2c], 0x1c
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], 4
mov dword [esp + 0x38], 7
mov dword [esp + 0x3c], 0xd
mov dword [esp + 0x40], 0x10
mov dword [esp + 0x44], 0x1a
mov dword [esp + 0x48], 0x1d
mov dword [esp + 0x4c], 0x2a
mov dword [esp + 0x50], 3
mov dword [esp + 0x54], 8
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0x11
mov dword [esp + 0x60], 0x19
mov dword [esp + 0x64], 0x1e
mov dword [esp + 0x68], 0x29
mov dword [esp + 0x6c], 0x2b
mov dword [esp + 0x70], 9
mov dword [esp + 0x74], 0xb
mov dword [esp + 0x78], 0x12
mov dword [esp + 0x7c], 0x18
mov dword [esp + 0x80], 0x1f
mov dword [esp + 0x84], 0x28
mov dword [esp + 0x88], 0x2c
mov dword [esp + 0x8c], 0x35
mov dword [esp + 0x90], 0xa
mov dword [esp + 0x94], 0x13
mov dword [esp + 0x98], 0x17
mov dword [esp + 0xa0], 0x27
mov dword [esp + 0xa4], 0x2d
mov dword [esp + 0xa8], 0x34
mov dword [esp + 0xac], 0x36
mov dword [esp + 0xb0], 0x14
mov dword [esp + 0xb4], 0x16
mov dword [esp + 0xb8], 0x21
mov dword [esp + 0xbc], 0x26
mov dword [esp + 0xc0], 0x2e
mov dword [esp + 0xc4], 0x33
mov dword [esp + 0xc8], 0x37
mov dword [esp + 0xcc], 0x3c
mov dword [esp + 0xd0], 0x15
mov dword [esp + 0xd4], 0x22
mov dword [esp + 0xd8], 0x25
mov dword [esp + 0xdc], 0x2f
mov dword [esp + 0xe0], 0x32
mov dword [esp + 0xe4], 0x38
mov dword [esp + 0xe8], 0x3b
mov dword [esp + 0xec], 0x3d
mov dword [esp + 0xf0], 0x23
mov dword [esp + 0xf4], 0x24
mov dword [esp + 0xf8], 0x30
mov dword [esp + 0xfc], 0x31
mov dword [esp + 0x100], 0x39
mov dword [esp + 0x104], 0x3a
mov dword [esp + 0x108], 0x3e
mov dword [esp + 0x10c], 0x3f
lea ecx, [esp + 0x18]
lea eax, [esp + 0x114]
mov esi, 8
jmp 0x42cb20
movzx ebx, word [eax - 4]
mov edi, dword [ecx - 8]
mov word [edx + edi*2 + 0xce4], bx
movzx ebx, word [eax - 2]
mov edi, dword [ecx - 4]
mov word [edx + edi*2 + 0xce4], bx
movzx ebx, word [eax]
mov edi, dword [ecx]
mov word [edx + edi*2 + 0xce4], bx
movzx ebx, word [eax + 2]
mov edi, dword [ecx + 4]
mov word [edx + edi*2 + 0xce4], bx
movzx ebx, word [eax + 4]
mov edi, dword [ecx + 8]
mov word [edx + edi*2 + 0xce4], bx
movzx ebx, word [eax + 6]
mov edi, dword [ecx + 0xc]
mov word [edx + edi*2 + 0xce4], bx
movzx ebx, word [eax + 8]
mov edi, dword [ecx + 0x10]
mov word [edx + edi*2 + 0xce4], bx
movzx ebx, word [eax + 0xa]
mov edi, dword [ecx + 0x14]
add eax, 0x10
add ecx, 0x20
sub esi, 1
mov word [edx + edi*2 + 0xce4], bx
jne 0x42cb20
mov ecx, dword [esp + 0x194]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004b6da3
mov esp, ebp
pop ebp
ret
Function at 0x42fe20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x410
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
mov edi, dword [esp + 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x42ff3b
mov ecx, dword [esp + 0x420]
and ecx, 0xff
lea edx, [ecx*8]
sub edx, ecx
lea eax, [edx + 0x46]
inc edx
mov byte [esp + 0x15], cl
lea ecx, [edx*8]
sub ecx, edx
mov dword [esp + 0x10], eax
lea eax, [ecx + 0x46]
inc ecx
push ebx
mov byte [esp + 0x18], 2
mov edx, 4
test esi, esi
jle 0x42fec5
push ebp
mov ebp, edi
lea ebx, [esp + 0x20]
sub ebp, ebx
mov dword [esp + 0x10], esi
lea esp, [esp]
lea esi, [ecx*8]
sub esi, ecx
mov ecx, esi
mov bl, cl
lea esi, [edx + ebp]
add bl, 0x46
xor bl, byte [esp + esi + 0x1c]
inc edx
mov byte [esp + edx + 0x1b], bl
inc ecx
sub dword [esp + 0x10], 1
jne 0x42fea0
pop ebp
lea ebx, [edx - 4]
mov ecx, ebx
sar ecx, 8
xor cl, byte [esp + 0x14]
push ebx
mov byte [esp + edx + 0x1c], 0
xor al, bl
push 0
push edi
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], al
call fcn.004b6dc0
add ebx, 4
add esp, 0xc
xor esi, esi
test ebx, ebx
jle 0x42ff1f
movzx ecx, byte [esp + esi + 0x18]
push ecx
lea edx, [esp + 0x14]
push str._02X
push edx
call fcn.004b79a8
push 2
lea eax, [esp + 0x20]
push eax
push edi
call fcn.004b8952
inc esi
add esp, 0x18
cmp esi, ebx
jl 0x42fef5
mov eax, edi
pop ebx
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
call fcn.004b6da3
add esp, 0x410
ret 8
mov eax, edi
jmp 0x42ff22

Function at 0x42ff40
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
xor eax, eax
push esi
mov byte [esp + 0x10], 0
mov word [esp + 0x11], ax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
xor edi, edi
test ebx, ebx
jle 0x42ff9a
push ebp
mov ebp, esi
jmp 0x42ff70
push 2
lea ecx, [esp + 0x14]
push ebp
push ecx
call fcn.004b8a4f
push 0x10
lea edx, [esp + 0x20]
push 0
push edx
call fcn.004b8fb7
mov byte [edi + esi], al
inc edi
add esp, 0x18
add ebp, 2
cmp edi, ebx
jl 0x42ff70
pop ebp
test esi, esi
jne 0x42ffa7
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
cmp byte [esi], 2
jne 0x430012
movsx ecx, byte [esi + 1]
lea eax, [ecx*8]
sub eax, ecx
mov cl, al
add cl, 0x46
xor byte [esi + 2], cl
movzx edi, byte [esi + 2]
lea ecx, [eax + 1]
lea eax, [ecx*8]
sub eax, ecx
mov dl, al
add dl, 0x46
xor byte [esi + 3], dl
movzx ecx, byte [esi + 3]
shl edi, 8
inc eax
or edi, ecx
mov ecx, 0
jle 0x43000e
lea ebx, [ebx]
lea edx, [eax*8]
sub edx, eax
mov eax, edx
mov dl, al
add dl, 0x46
xor dl, byte [ecx + esi + 4]
inc ecx
mov byte [ecx + esi - 1], dl
inc eax
cmp ecx, edi
jl 0x42fff0
mov byte [edi + esi], 0
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x430020
Capabilities:
Copy file
Delete file
Enumerate files on windows

Disassembly:
sub esp, 0x374
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x370], eax
push ebx
push esi
mov esi, dword [esp + 0x380]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x175]
push ebx
push eax
mov byte [esp + 0x17], 1
mov byte [esp + 0x17c], bl
call fcn.004b6dc0
push 0x103
lea ecx, [esp + 0x285]
push ebx
push ecx
mov byte [esp + 0x28c], bl
call fcn.004b6dc0
xor eax, eax
push 0x516868
mov byte [esp + 0x16c], bl
mov dword [esp + 0x16d], eax
mov dword [esp + 0x171], eax
mov dword [esp + 0x175], eax
mov dword [esp + 0x179], eax
mov dword [esp + 0x17d], eax
mov dword [esp + 0x181], eax
mov dword [esp + 0x185], eax
mov byte [esp + 0x189], al
call fcn.00404690
add esp, 0x1c
lea edx, [esp + 0x150]
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4300d0
push 2
push ebx
push esi
call fcn.004b5870
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x430241
push edi
lea edx, [esp + 0x14]
push edx
push 0x51685c
call fcn.00404690
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esp, 4
push eax
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x43013c
lea eax, [esp + 0x14]
push eax
push 0x516848
call fcn.00404690
add esp, 4
push eax
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x43013c
mov byte [esp + 0xf], bl
jmp 0x430233
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea esp, [esp]
lea ecx, [esp + 0x44]
push ecx
push 0x50f684
call fcn.00404690
add esp, 4
push eax
lea edx, [esp + 0x180]
push edx
call fcn.004b79a8
add esp, 0xc
push ebx
lea eax, [esp + 0x17c]
push eax
lea ecx, [esp + 0x4c]
push ecx
call ebp
test eax, eax
je 0x4301a8
push 2
push ebx
lea edx, [esp + 0x180]
push edx
mov eax, edx
push eax
push esi
call fcn.004b6a20
add esp, 0x14
lea ecx, [esp + 0x178]
push ecx
jmp 0x430201
lea edx, [esp + 0x44]
push edx
push 0x50f670
call fcn.00404690
add esp, 4
push eax
lea eax, [esp + 0x284]
push eax
call fcn.004b79a8
add esp, 0xc
push ebx
lea ecx, [esp + 0x17c]
push ecx
lea edx, [esp + 0x284]
push edx
call ebp
test eax, eax
je 0x430203
push 2
push ebx
lea eax, [esp + 0x180]
push eax
mov ecx, eax
push ecx
push esi
call fcn.004b6a20
add esp, 0x14
lea edx, [esp + 0x178]
push edx
call edi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x430150
push 2
push ebx
lea edx, [esp + 0x160]
push edx
mov eax, edx
push eax
push esi
call fcn.004b6a20
add esp, 0x14
pop ebp
push esi
call fcn.004b6ae0
mov bl, byte [esp + 0x13]
add esp, 4
pop edi
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x430251
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x378]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.004b6da3
add esp, 0x374
ret 4
Function at 0x430e80
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0x28
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x24], eax
push ebp
push esi
mov esi, dword [esp + 0x34]
cmp byte [esi], 0
mov ebp, ecx
jne 0x430eb3
pop esi
mov eax, 0x64
pop ebp
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004b6da3
add esp, 0x28
ret 4
cmp dword [0x54a138], 0
jne 0x430ec6
push 0
call fcn.004ae310
add esp, 4
cmp byte [esi + 0x6b9], 0
lea edx, [esi + 0x6b9]
je 0x430ede
cmp byte [esi + 0x739], 0
jne 0x430f0a
mov eax, 0x54a170
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x430ee5
mov eax, 0x54a1f0
lea edx, [esi + 0x739]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x430f00
cmp byte [esi + 0x7b9], 0
lea edx, [esi + 0x7b9]
jne 0x430f2a
mov eax, 0x54a13c
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x430f20
cmp byte [esi + 0x7ea], 0
lea edx, [esi + 0x7ea]
jne 0x430f4a
mov eax, 0x54a270
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x430f40
cmp byte [esi + 0x80a], 0
lea eax, [esi + 0x80a]
push ebx
push edi
je 0x430f64
cmp byte [esi + 0x82a], 0
jne 0x430f8f
lea ecx, [esp + 0x10]
push ecx
mov edi, 0x20
push eax
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea edx, [esp + 0x10]
push edx
lea eax, [esi + 0x82a]
push eax
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp byte [esi + 0x6a0], 0
lea ebx, [esi + 0x6a0]
jne 0x430fe1
lea edi, [ebp + 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp + 0x52]
movzx edx, word [ebp + 0x50]
movzx eax, word [ebp + 0x4e]
push ecx
movzx ecx, word [ebp + 0x4c]
push edx
movzx edx, word [ebp + 0x4a]
push eax
movzx eax, word [ebp + 0x46]
push ecx
movzx ecx, word [edi]
push edx
push eax
push ecx
push 0x516924
call fcn.00404690
add esp, 4
push eax
push ebx
call fcn.004b79a8
add esp, 0x24
cmp byte [esi + 0x84a], 0
lea ecx, [esi + 0x84a]
pop edi
pop ebx
jne 0x43102c
xor eax, eax
lea edx, [esp + 0xc]
push edx
push ecx
mov byte [esp + 0x14], 0
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov word [esp + 0x31], ax
mov byte [esp + 0x33], al
call fcn.004ab330
add esp, 8
mov ecx, dword [esp + 0x2c]
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.004b6da3
add esp, 0x28
ret 4
Function at 0x437810
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x244
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x240], eax
mov ecx, dword [esp + 0x248]
push esi
lea eax, [esp + 0x140]
push eax
push ecx
mov ecx, dword [0x53c038]
call fcn.00408840
push 0
push 0x80
push 3
push 0
push 3
push closesocket
lea edx, [esp + 0x158]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x437881
xor eax, eax
pop esi
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004b6da3
add esp, 0x244
ret 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0xc]
push eax
push 0x40
lea ecx, [esp + 0x110]
push ecx
push esi
call edi
mov edx, 0x5a4d
cmp word [esp + 0x104], dx
je 0x4378b6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4378f2
mov eax, dword [esp + 0x140]
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0xf8
lea edx, [esp + 0x18]
push edx
push esi
call edi
cmp dword [esp + 0xc], 0x4550
push esi
jne 0x4378ac
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x248]
pop edi
pop esi
xor ecx, esp
call fcn.004b6da3
add esp, 0x244
ret 4
Function at 0x437f30
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov esi, edi
cmp byte [0x54a134], 0
je 0x437f58
cmp esi, 0x70000000
jmp 0x437f5e
cmp esi, 0xb0000000
ja 0x4381c8
push 0x1c
lea eax, [esp + 0x1c]
push eax
push esi
push ebp
call dword [0x5385ec]
cmp eax, 0x1c
jne 0x4381c8
mov ecx, dword [esp + 0x24]
test edi, edi
je 0x437f9f
cmp edi, esi
jne 0x437f9f
cmp dword [esp + 0x28], 0x1000
je 0x437fad
mov dword [esp + 0x10], 2
jmp 0x4381c8
cmp dword [esp + 0x28], 0x1000
jne 0x438194
mov eax, dword [esp + 0x30]
cmp eax, 0x1000000
je 0x437fc3
cmp eax, 0x20000
jne 0x438194
test dword [esp + 0x2c], 0x100
jne 0x438194
mov eax, dword [esp + 0x1c]
cmp esi, eax
jne 0x438194
cmp ecx, 0x1000
jne 0x438194
test edi, edi
je 0x437ff5
cmp edi, eax
jne 0x4381c8
mov dword [esp + 0x14], 0
test ebx, ebx
je 0x43800a
push ebx
call fcn.004b97a6
add esp, 4
push 0x200
call fcn.004b97b1
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4381d5
cmp dword [0x537c84], 0
je 0x43802f
call fcn.00492260
lea ecx, [esp + 0x14]
push ecx
push 0x200
push ebx
push esi
push ebp
call dword [0x5385e0]
test eax, eax
je 0x438184
mov eax, dword [esp + 0x14]
test eax, eax
je 0x438184
cmp eax, 0x200
jne 0x438184
mov edx, 0x5a4d
cmp word [ebx], dx
jne 0x43815d
mov edi, dword [ebx + 0x3c]
add edi, ebx
cmp dword [edi], 0x4550
jne 0x43815d
mov eax, dword [edi + 8]
cmp eax, dword [0x53c280]
jne 0x4380c3
cmp esi, dword [0x53c264]
je 0x43815d
push 0x517584
call fcn.00404690
add esp, 4
push eax
push esi
push ebp
call fcn.00410130
test eax, eax
je 0x43815d
mov eax, dword [edi + 8]
push eax
push esi
push 0x517568
jmp 0x4381aa
cmp eax, dword [0x53c284]
jne 0x4380ff
cmp esi, dword [0x53c268]
je 0x43815d
push 0x517550
call fcn.00404690
add esp, 4
push eax
push esi
push ebp
call fcn.00410130
test eax, eax
je 0x43815d
mov ecx, dword [edi + 8]
push ecx
push esi
push 0x517530
jmp 0x4381aa
cmp eax, dword [0x53c288]
jne 0x438134
cmp esi, dword [0x53c270]
je 0x43815d
push 0x517518
call fcn.00404690
add esp, 4
push eax
push esi
push ebp
call fcn.00410130
test eax, eax
je 0x43815d
mov edx, dword [edi + 8]
push edx
push esi
push 0x5174fc
jmp 0x4381aa
cmp eax, dword [0x53c28c]
jne 0x43815d
cmp esi, dword [0x53c278]
je 0x43815d
push 0x5174f0
call fcn.00404690
add esp, 4
push eax
push esi
push ebp
call fcn.00410130
test eax, eax
jne 0x4381a0
mov edx, dword [0x548d5c]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
push 0
push edx
lea esi, [ecx + eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4381c8
mov edi, dword [esp + 0x3c]
jmp 0x437f47
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
lea esi, [ecx + eax]
jmp 0x437f47
mov edx, dword [esp + 0x18]
lea esi, [edx + ecx]
jmp 0x437f47
mov eax, dword [edi + 8]
push eax
push esi
push 0x5174d4
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
mov dword [esp + 0x20], 1
add esp, 0x10
test ebx, ebx
je 0x4381d5
push ebx
call fcn.004b97a6
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x439160
Capabilities:
Resume thread

Disassembly:
push ecx
push ebp
xor ebp, ebp
cmp byte [0x54a134], 0
mov dword [esp + 4], ebp
jne 0x439176
xor eax, eax
pop ebp
pop ecx
ret
push edi
mov edi, dword [esp + 0x10]
push ebp
push ebp
push edi
call 0x52ced9
test al, 8
je 0x43918d
pop edi
xor eax, eax
pop ebp
pop ecx
ret
push esi
call 0x52cecd
mov esi, eax
push ebp
mov eax, fcn.00439160
sub eax, 0x439140
add eax, 3
push eax
push 0x439140
push ebp
push edi
push ebp
mov dword [esi], 1
call 0x52cf68
mov dword [esp + 0xc], eax
cmp eax, 0xe1c2f3b4
jne 0x43923c
test byte [esi + 4], 8
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x439200
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esi + 0x18]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4391fa
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [esi + 0x18]
push edx
call edi
test byte [esi], 4
je 0x439212
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
push eax
push ecx
call edx
test byte [esi + 4], 8
je 0x439225
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
push eax
push ecx
call edx
mov eax, dword [esi + 0x10]
push eax
call edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x43923c
cmp eax, 0xe1c2f3b1
jae 0x43923c
mov ebp, eax
pop esi
pop edi
mov eax, ebp
pop ebp
pop ecx
ret

Function at 0x43bed0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x43bf13
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x43bf13
movzx ecx, word [eax + 0x18]
mov edx, 0x10b
cmp cx, dx
jne 0x43bf01
mov dword [eax + 0x34], 0
ret
mov edx, 0x20b
cmp cx, dx
jne 0x43bf13
xor ecx, ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
ret

Function at 0x43d250
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
cmp byte [0x537e32], 0
mov dword [esp + 8], 4
jne 0x43d30b
cmp byte [0x53c918], 0
jne 0x43d30b
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x519504
mov byte [0x53c918], 1
call fcn.00404690
add esp, 4
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x43d30b
cmp dword [esp + 4], 2
jne 0x43d301
lea edx, [esp + 8]
push edx
push 0x53c914
push eax
push eax
push 0x5194f8
call fcn.00404690
add esp, 4
push eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [0x53c914]
test eax, eax
je 0x43d301
push eax
push 0x5194e0
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x53c914]
add esp, 0xc
ret

Function at 0x43d320
Capabilities:
Terminate process

Disassembly:
cmp byte [0x537dfe], 0
jne 0x43d346
cmp byte [0x54a134], 0
je 0x43d33c
call fcn.004284b0
jmp fcn.00418810
call fcn.004034b0
jmp fcn.00418810
ret
Function at 0x43d8d0
Capabilities:
Copy file
Get common file path
Move file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x53c058
push 0x519740
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0
push 0x53c058
call fcn.004ba516
add esp, 0x14
cmp eax, 0xffffffff
jne 0x43d94c
push 0x53c058
push 0x519728
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004b6da3
add esp, 0x20c
ret
push esi
push edi
push 0x104
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004b6dc0
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [0x54a138]
cmp eax, 0x4e2a
jne 0x43d9aa
push 0x519714
call fcn.00404690
add esp, 4
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d990
lea edi, [esp + 8]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x43d9a0
jmp 0x43d9d8
cmp eax, 0x4e22
jne 0x43d9e8
push 0x519704
call fcn.00404690
add esp, 4
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d9c0
lea edi, [esp + 8]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x43d9d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [esp + 8]
push 0
push edx
call fcn.004ba516
add esp, 8
cmp eax, 0xffffffff
jne 0x43da0b
lea eax, [esp + 8]
push eax
push 0x5196e4
jmp 0x43dadf
push 0x103
lea ecx, [esp + 0x111]
push 0
push ecx
mov byte [esp + 0x118], 0
call fcn.004b6dc0
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x53c058]
mov byte [esp + eax + 0x10c], cl
inc eax
test cl, cl
jne 0x43da30
push 0x5196dc
call fcn.00404690
add esp, 4
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43da51
lea edi, [esp + 0x10c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x43da62
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 1
lea edx, [esp + 0x110]
mov ecx, eax
push edx
and ecx, 3
push 0x53c058
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x43dad3
push 0
push 0x53c058
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x43dab7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5196c4
jmp 0x43dadf
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004b6da3
add esp, 0x20c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5196a8
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
mov ecx, dword [esp + 0x21c]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.004b6da3
add esp, 0x20c
ret