joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438ce0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x438cf3
add esp, 0xfffffff0
call fcn.0040337c
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
test esi, esi
jbe 0x438de6
cmp dword [ebp + 8], 0
jne 0x438d13
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov dword [ebp + 8], eax
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x438d49
mov eax, ebx
call fcn.00438954
mov ecx, 0x438e10
mov dl, 1
mov eax, dword [0x43884c]
call fcn.0040b22c
call fcn.004037e4
push 0
push 0
push 0
push 4
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebx + 0xc], eax
or esi, 0xffffffff
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub edx, 5
sub edx, eax
jl 0x438d86
inc edx
mov ecx, dword [ebx + 0xc]
add ecx, eax
mov ecx, dword [ecx]
inc ecx
cmp ecx, 0x4034b51
jne 0x438d82
mov esi, eax
jmp 0x438d86
inc eax
dec edx
jne 0x438d6e
test esi, esi
jge 0x438db0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub edx, 5
sub edx, eax
jl 0x438db0
inc edx
mov ecx, dword [ebx + 0xc]
add ecx, eax
mov ecx, dword [ecx]
inc ecx
cmp ecx, 0x6054b51
jne 0x438dac
mov esi, eax
jmp 0x438db0
inc eax
dec edx
jne 0x438d98
test esi, esi
jge 0x438dd1
mov eax, ebx
call fcn.00438954
mov ecx, 0x438e28
mov dl, 1
mov eax, dword [0x43884c]
call fcn.0040b22c
call fcn.004037e4
mov eax, dword [ebp + 8]
sub eax, esi
push eax
mov eax, dword [ebx + 0xc]
lea ecx, [eax + esi]
xor edx, edx
mov eax, ebx
call fcn.00438990
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x438dfd
call fcn.004033d4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x438fb4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x43906d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [esi], 0
je 0x439052
mov eax, dword [esi]
call fcn.004040c8
mov edx, dword [esi]
cmp byte [edx + eax - 1], 0x5c
je 0x438ff0
mov eax, esi
mov edx, 0x439084
call fcn.004040d0
mov eax, dword [esi]
call fcn.004080b0
test al, al
je 0x438fff
mov bl, 1
jmp 0x439052
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
call fcn.004040c8
mov ecx, eax
dec ecx
mov eax, dword [esi]
mov edx, 1
call fcn.00404328
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004081c4
cmp dword [ebp - 4], 0
je 0x439042
mov eax, dword [ebp - 4]
call fcn.004080b0
test al, al
jne 0x439042
lea eax, [ebp - 4]
call fcn.00438fb4
test al, al
je 0x439052
push 0
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
je 0x439052
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439074
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e2c
ret
Function at 0x43b9a0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x43b9c7
neg ecx
je 0x43b9c7
not eax
push ebx
test dl, 3
je 0x43b9c9
movzx ebx, byte [edx]
inc edx
xor bl, al
shr eax, 8
xor eax, dword [ebx*4 + 0x454978]
inc ecx
jne 0x43b9ab
pop ebx
not eax
ret
repz ret
sub edx, ecx
add ecx, 8
jg 0x43baaa
push esi
push edi
mov edi, edx
mov edx, eax
mov ebx, dword [ecx + edi - 4]
xor edx, dword [ecx + edi - 8]
movzx esi, bl
mov eax, dword [esi*4 + 0x455578]
movzx esi, bh
xor eax, dword [esi*4 + 0x455178]
shr ebx, 0x10
movzx esi, bl
xor eax, dword [esi*4 + 0x454d78]
movzx esi, bh
xor eax, dword [esi*4 + 0x454978]
movzx esi, dl
xor eax, dword [esi*4 + 0x456578]
movzx esi, dh
xor eax, dword [esi*4 + 0x456178]
shr edx, 0x10
movzx esi, dl
xor eax, dword [esi*4 + 0x455d78]
movzx esi, dh
xor eax, dword [esi*4 + 0x455978]
add ecx, 8
jg 0x43baa6
mov ebx, dword [ecx + edi - 4]
xor eax, dword [ecx + edi - 8]
movzx esi, bl
mov edx, dword [esi*4 + 0x455578]
movzx esi, bh
xor edx, dword [esi*4 + 0x455178]
shr ebx, 0x10
movzx esi, bl
xor edx, dword [esi*4 + 0x454d78]
movzx esi, bh
xor edx, dword [esi*4 + 0x454978]
movzx esi, al
xor edx, dword [esi*4 + 0x456578]
movzx esi, ah
xor edx, dword [esi*4 + 0x456178]
shr eax, 0x10
movzx esi, al
xor edx, dword [esi*4 + 0x455d78]
movzx esi, ah
xor edx, dword [esi*4 + 0x455978]
add ecx, 8
jle 0x43b9da
mov eax, edx
mov edx, edi
pop edi
pop esi
sub ecx, 8
jl 0x43bab3
pop ebx
not eax
ret
movzx ebx, byte [ecx + edx]
xor bl, al
shr eax, 8
xor eax, dword [ebx*4 + 0x454978]
inc ecx
jne 0x43bab3
pop ebx
not eax
ret

Function at 0x43bd38
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
xor esi, esi
mov ecx, 0x454978
mov eax, esi
mov edx, 8
test al, 1
je 0x43bd56
shr eax, 1
xor eax, 0xedb88320
jmp 0x43bd58
shr eax, 1
dec edx
jne 0x43bd49
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x43bd42
mov esi, pe_nt_image_headers32
mov edi, 0x454978
mov eax, dword [edi]
mov edx, 7
lea ecx, [edi + 0x400]
xor ebx, ebx
mov bl, al
mov ebx, dword [ebx*4 + 0x454978]
shr eax, 8
xor ebx, eax
mov eax, ebx
mov dword [ecx], eax
add ecx, 0x400
dec edx
jne 0x43bd80
add edi, 4
dec esi
jne 0x43bd73
pop edi
pop esi
pop ebx
ret
Function at 0x43c500
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004042b8
xor eax, eax
push ebp
push 0x43c606
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0043c614
xor eax, eax
push ebp
push 0x43c57a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004042c8
mov dword [ebx + 4], eax
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0x10], eax
mov word [ebp - 0x14], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43c58b
cmp dword [ebp - 0x10], 0xffffffff
jne 0x43c5a8
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x43c5f0
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x43c5d1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x10]
push eax
call sub.wsock32.dll_connect
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43c5e2
test esi, esi
jge 0x43c5ec
mov byte [ebx + 0xc], 0
jmp 0x43c5f0
mov byte [ebx + 0xc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c60d
lea eax, [ebp - 4]
call fcn.00403e08
ret

Function at 0x43caa8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042b8
xor eax, eax
push ebp
push 0x43cb69
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x43cb47
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00402afc
lea eax, [ebp - 0x122]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00402afc
lea eax, [ebp - 0x122]
mov edx, dword [ebp - 4]
call fcn.004083b4
xor eax, eax
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x122]
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x40
or word [ebp - 0x12], 0x10
or word [ebp - 0x12], 4
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43cb53
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43cb70
lea eax, [ebp - 4]
call fcn.00403e08
ret
Function at 0x43cb7c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042b8
xor eax, eax
push ebp
push 0x43cbf9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00402afc
push 0x400
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004042c8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, ebx
lea edx, [ebp - 0x54]
mov ecx, 0x50
call fcn.00404078
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43cc00
lea eax, [ebp - 4]
call fcn.00403e08
ret

Function at 0x43cf58
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x88], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43d038
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403e08
lea eax, [ebp - 0x81]
push eax
push 0x81
call sub.kernel32.dll_GetLogicalDriveStringsA
test eax, eax
je 0x43d01f
lea esi, [ebp - 0x81]
jmp 0x43d01a
lea eax, [ebp - 0x88]
mov edx, esi
call fcn.00404000
mov edx, dword [ebp - 0x88]
mov eax, ebx
call fcn.004040d0
push esi
call sub.kernel32.dll_GetDriveTypeA
sub eax, 2
je 0x43cfd3
dec eax
je 0x43cfe1
dec eax
je 0x43cfef
dec eax
je 0x43cffd
jmp 0x43d00b
mov eax, ebx
mov edx, 0x43d050
call fcn.004040d0
jmp 0x43d017
mov eax, ebx
mov edx, 0x43d05c
call fcn.004040d0
jmp 0x43d017
mov eax, ebx
mov edx, 0x43d068
call fcn.004040d0
jmp 0x43d017
mov eax, ebx
mov edx, 0x43d074
call fcn.004040d0
jmp 0x43d017
mov eax, ebx
mov edx, 0x43d05c
call fcn.004040d0
add esi, 4
cmp byte [esi], 0
jne 0x43cfa3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d03f
lea eax, [ebp - 0x88]
call fcn.00403e08
ret
Function at 0x43de00
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042b8
xor eax, eax
push ebp
push 0x43deda
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0xc], eax
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x43deb9
mov esi, 4
test edi, edi
je 0x43de5e
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x43de5b
or esi, 0x10
jmp 0x43de5e
or esi, 0x20
push esi
mov eax, dword [ebp - 4]
call fcn.004042c8
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jbe 0x43deb3
cmp edi, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x43dea3
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x43de97
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceA
jmp 0x43dea3
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
call fcn.0043dc18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43dee1
lea eax, [ebp - 4]
call fcn.00403e08
ret
Function at 0x43deec
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x43def5
mov eax, dword [ebp - 4]
add esp, 0xfffff7e0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4820], edx
mov dword [ebp - 0x4824], edx
mov dword [ebp - 0x4818], edx
mov dword [ebp - 0x481c], edx
mov dword [ebp - 0x4814], edx
mov esi, eax
xor eax, eax
push ebp
push 0x43e06a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403e08
push 4
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43e04c
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x4800
lea eax, [ebp - 0x4810]
push eax
push 3
push 0x30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_EnumServicesStatusA
mov edi, dword [ebp - 0xc]
dec edi
test edi, edi
jl 0x43e033
inc edi
lea ebx, [ebp - 0x4810]
lea eax, [ebp - 0x4814]
mov edx, dword [ebx]
call fcn.00404000
mov edx, dword [ebp - 0x4814]
mov eax, esi
call fcn.004040d0
push dword [esi]
push 0x43e080
lea eax, [ebp - 0x481c]
mov edx, dword [ebx]
call fcn.00404000
mov eax, dword [ebp - 0x481c]
lea edx, [ebp - 0x4818]
call fcn.0043dd48
push dword [ebp - 0x4818]
mov eax, esi
mov edx, 3
call fcn.00404188
push dword [esi]
push 0x43e080
lea eax, [ebp - 0x4820]
push eax
lea eax, [ebp - 0x4824]
mov edx, dword [ebx]
call fcn.00404000
mov eax, dword [ebp - 0x4824]
xor ecx, ecx
xor edx, edx
call fcn.0043de00
push dword [ebp - 0x4820]
push 0x43e08c
mov eax, esi
mov edx, 4
call fcn.00404188
add ebx, 0x24
dec edi
jne 0x43df97
cmp dword [ebp - 8], 0
jne 0x43df5f
cmp dword [ebp - 4], 0
jbe 0x43e04c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e071
lea eax, [ebp - 0x4824]
mov edx, 5
call fcn.00403e2c
ret
Function at 0x43e6d8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042b8
xor eax, eax
push ebp
push 0x43e80a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
call fcn.00403e08
lea eax, [ebp - 8]
push eax
push 8
push 0
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x43e820
call fcn.004043b0
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004040c8
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.00404328
mov eax, dword [ebp - 0x1c]
call fcn.004042c8
push eax
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x43e820
call fcn.004043b0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404328
mov eax, dword [ebp - 0x20]
call fcn.0043e0c8
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0xc], 0xff
mov eax, dword [ebp - 0xc]
call fcn.004026d4
mov ebx, eax
xor esi, esi
jmp 0x43e7b7
push dword [ebp - 0x18]
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00404000
push dword [ebp - 0x24]
push 0x43e82c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404188
inc esi
mov dword [ebp - 0xc], 0xff
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
je 0x43e78d
mov eax, edi
mov edx, dword [ebp - 0x18]
call fcn.00403e5c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e811
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00403e2c
lea eax, [ebp - 4]
call fcn.00403e08
ret
Function at 0x43f118
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x43f2a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x18]
mov edx, 0x200
call fcn.004043f8
mov eax, 0x2000
call fcn.0043f0f8
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x43f287
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov dword [ebp - 0xc], 0x200
mov dword [ebp - 0x10], 0x2000
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
call fcn.004042c8
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
test ebx, ebx
jne 0x43f1ce
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0x18]
call fcn.004042c8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 0x18]
call fcn.004042c8
push eax
push esi
call sub.advapi32.dll_RegDeleteValueA
test ebx, ebx
je 0x43f167
xor edi, edi
mov dword [ebp - 0xc], 0x200
mov dword [ebp - 0x10], 0x2000
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
call fcn.004042c8
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x43f269
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
call fcn.004042c8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyA
mov ebx, eax
test ebx, ebx
jne 0x43f269
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x18]
call fcn.004042c8
push eax
push esi
call sub.advapi32.dll_RegCreateKeyA
mov ebx, eax
test ebx, ebx
jne 0x43f260
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.0043f118
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0x18]
call fcn.004042c8
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x43f1d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f28e
mov eax, dword [ebp - 0x1c]
call fcn.004026f4
ret
Function at 0x43f328
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004042b8
mov eax, dword [ebp - 8]
call fcn.004042b8
xor eax, eax
push ebp
push 0x43f3c5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004042c8
mov esi, eax
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x43f3aa
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.004042c8
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyA
test eax, eax
jne 0x43f391
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0043f118
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f3cc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e2c
ret

Function at 0x43f54c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43f697
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 4]
call fcn.00404000
mov eax, dword [ebp - 0x11c]
call fcn.004040c8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43f67e
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
xor edx, edx
lea eax, [ebp - 0x116]
mov byte [eax], dl
inc edx
inc eax
cmp edx, 0x100
jne 0x43f5ac
mov byte [ebp - 0xd], 0
xor esi, esi
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x116]
cmp esi, dword [ebp - 0x14]
jge 0x43f5d6
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + esi]
jmp 0x43f5d8
xor ecx, ecx
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x43f5e0
xor esi, esi
add cl, byte [eax]
add byte [ebp - 0xd], cl
mov cl, byte [eax]
xor ebx, ebx
mov bl, byte [ebp - 0xd]
mov bl, byte [ebp + ebx - 0x116]
mov byte [eax], bl
xor ebx, ebx
mov bl, byte [ebp - 0xd]
mov byte [ebp + ebx - 0x116], cl
inc eax
dec edx
jne 0x43f5c9
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x43f66e
inc eax
xor edx, edx
inc byte [ebp - 0x16]
xor ecx, ecx
mov cl, byte [ebp - 0x16]
mov cl, byte [ebp + ecx - 0x116]
add byte [ebp - 0x15], cl
xor ebx, ebx
mov bl, byte [ebp - 0x15]
mov bl, byte [ebp + ebx - 0x116]
movzx esi, byte [ebp - 0x16]
mov byte [ebp + esi - 0x116], bl
xor ebx, ebx
mov bl, byte [ebp - 0x15]
mov byte [ebp + ebx - 0x116], cl
xor ebx, ebx
mov bl, byte [ebp - 0x16]
add cl, byte [ebp + ebx - 0x116]
mov ebx, dword [ebp - 8]
mov bl, byte [ebx + edx]
and ecx, 0xff
xor bl, byte [ebp + ecx - 0x116]
mov ecx, dword [ebp - 8]
mov byte [ecx + edx], bl
inc edx
dec eax
jne 0x43f610
lea eax, [ebp - 0x116]
mov edx, 0x102
call fcn.004066d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f69e
lea eax, [ebp - 0x11c]
call fcn.00403e08
ret
Function at 0x43f740
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
lea eax, [ebp - 4]
call fcn.004047d4
xor eax, eax
push ebp
push 0x43f853
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov ax, 0x5c
call fcn.0043f6dc
mov esi, eax
test esi, esi
jle 0x43f835
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404744
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004045f8
push eax
push edi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x43f835
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404608
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00404744
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004046c0
jne 0x43f807
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
jmp 0x43f82c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004045f8
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f85a
lea eax, [ebp - 0xc]
call fcn.0040448c
lea eax, [ebp - 4]
call fcn.0040448c
ret

Function at 0x43f904
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
lea eax, [ebp - 4]
call fcn.004047d4
xor eax, eax
push ebp
push 0x43f9c9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov ax, 0x5c
call fcn.0043f6dc
mov esi, eax
test esi, esi
jle 0x43f9ae
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404744
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 8]
call fcn.004045f8
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x43f9ae
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404608
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00404744
mov eax, dword [ebp - 8]
call fcn.004045f8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f9d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044a4
ret