joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a800
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x43c014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x41a898
push reloc.OLEAUT32.dll_SysReAllocString
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x41a878
xor eax, eax
push ebp
push 0x41a871
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x41a8b4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a878
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
ret
mov ax, word [0x43c014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x43c014], ax
mov esp, ebp
pop ebp
ret

Function at 0x41b36c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x43d03c], 0
je 0x41b3cd
cmp word [0x43d210], 0xd7b2
jne 0x41b395
cmp dword [0x43d218], 0
jbe 0x41b395
mov eax, 0x43d20c
call dword [0x43d228]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x43c05c
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x41b3f4
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
pop edx
ret
cmp byte [0x43c020], 0
jne 0x41b3e9
push 0
push 0x43c054
push 0x43c05c
push 0
call sub.USER32.dll_MessageBoxA
pop edx
ret

Function at 0x41c378
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x41c3de
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0041b730
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0041a6f4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x41c3c8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c3e5
lea eax, [ebp - 0x10]
call fcn.0041b4e8
ret

Function at 0x41d5d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x41d670
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.0041ba30
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.0041b9a0
lea edx, [ebp + 0x30]
mov byte [eax + esi - 1], dl
dec esi
test ebx, ebx
jne 0x41d5fc
cmp byte [esp], 0
je 0x41d641
mov eax, edi
call fcn.0041b9a0
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x41d67c
mov eax, edi
call fcn.0041b9a0
push eax
mov eax, edi
call fcn.0041b9a0
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.0041a5cc
mov edx, ebx
mov eax, edi
call fcn.0041ba30
jmp 0x41d67c
mov eax, edi
mov edx, 0x41d68c
call fcn.0041b53c
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41dcd4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041b938
xor eax, eax
push ebp
push 0x41dd36
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0041b53c
mov eax, ebx
call fcn.0041b998
mov eax, dword [ebx]
call fcn.0041b748
test eax, eax
jle 0x41dd20
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x41dd15
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dd3d
lea eax, [ebp - 4]
call fcn.0041b4e8
ret

Function at 0x41e380
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x41e3c8
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov edi, esi
push edi
call sub.KERNEL32.dll_IsBadReadPtr
test eax, eax
jne 0x41e3be
cmp word [edi], 0x5a4d
jne 0x41e3be
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x41e3be
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41e3d4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41e50c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x134], ebx
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0041b938
xor eax, eax
push ebp
push 0x41e6ff
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
test ebx, ebx
je 0x41e6de
mov eax, ebx
call fcn.0041e380
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41e6c9
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, ebx
mov edi, eax
test edi, edi
je 0x41e6c9
mov eax, dword [edi + 0x18]
dec eax
test eax, eax
jl 0x41e6c9
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x134]
mov edx, dword [edi + 0x20]
add edx, ebx
mov ecx, dword [ebp - 0x10]
mov edx, dword [edx + ecx*4]
add edx, ebx
call fcn.0041b6c4
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.0041b894
jne 0x41e6bd
mov eax, dword [edi + 0x24]
add eax, ebx
mov edx, dword [ebp - 0x10]
mov si, word [eax + edx*2]
movzx eax, si
mov edx, dword [edi + 0x1c]
add edx, ebx
mov edi, dword [edx + eax*4]
cmp byte [ebp - 5], 0
jne 0x41e5e0
mov eax, dword [ebp - 0xc]
cmp edi, dword [eax + 0x50]
jbe 0x41e6b0
add edi, ebx
mov dword [ebp - 0x24], edi
cmp dword [0x43c2ec], 0
je 0x41e603
lea eax, [ebp - 0x24]
call dword [0x43c2ec]
test al, al
je 0x41e603
mov esi, dword [ebp - 0x24]
jmp 0x41e6c9
xor edi, edi
push 0x104
lea eax, [ebp - 0x12d]
push eax
push ebx
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push closesocket
lea eax, [ebp - 0x12d]
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x41e6b0
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.dll_CreateFileMappingA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41e6a7
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.dll_MapViewOfFile
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x41e69e
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0041e4b8
add eax, dword [ebp - 0x20]
mov edi, eax
mov edx, dword [edi + 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0041e4b8
add eax, dword [ebp - 0x20]
movzx edx, si
mov edi, dword [eax + edx*4]
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.dll_UnmapViewOfFile
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.dll_CloseHandle
mov edx, edi
mov eax, ebx
call fcn.0041e408
mov esi, eax
jmp 0x41e6c9
inc dword [ebp - 0x10]
dec dword [ebp - 0x28]
jne 0x41e58b
test esi, esi
jne 0x41e6de
mov eax, dword [ebp - 4]
call fcn.0041b948
push eax
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e706
lea eax, [ebp - 0x134]
call fcn.0041b4e8
lea eax, [ebp - 4]
call fcn.0041b4e8
ret
Function at 0x42164c
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call sub.KERNEL32.dll_VirtualQuery
cmp eax, 0x1c
jne 0x4216c8
cmp dword [esp + 0x10], 0x1000
jne 0x4216c8
cmp dword [esp + 4], 0
je 0x4216c8
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetModuleFileNameA
test eax, eax
je 0x4216c8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x4216c8
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x4216c8
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4248ac
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x424963
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, 0x42497c
call fcn.0041dcd4
push dword [ebp - 0xc]
push 0x424990
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
mov cl, byte [ebp - 1]
mov eax, 0x42499c
call fcn.00424770
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0041b808
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
call fcn.0041b948
push eax
call fcn.0042448c
mov esi, eax
test esi, esi
je 0x424948
push 0
push 0
push 0
push 4
push esi
call sub.KERNEL32.dll_MapViewOfFile
test eax, eax
je 0x424942
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov ecx, dword [eax]
mov dword [edx], ecx
push eax
call sub.KERNEL32.dll_UnmapViewOfFile
mov bl, 1
push esi
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42496a
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0041b50c
ret

Function at 0x424bf4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
xor esi, esi
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x424c65
mov ebx, 0x5f040000
jmp 0x424c53
cmp dword [esp + 0x10], 0x10000
jne 0x424c31
push 0x40
push 0x2000
push edi
mov eax, dword [esp + 0xc]
push eax
call sub.KERNEL32.dll_VirtualAlloc
mov esi, eax
jmp 0x424c65
cmp dword [esp + 0xc], 0x10000
jae 0x424c45
mov dword [esp + 0xc], 0x10000
jmp 0x424c4d
and dword [esp + 0xc], 0xffff0000
mov eax, dword [esp + 0xc]
add ebx, eax
push 0x1c
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.dll_VirtualQuery
cmp eax, 0x1c
je 0x424c11
push 0x40
push 0x1000
push edi
push esi
call sub.KERNEL32.dll_VirtualAlloc
mov esi, eax
mov eax, esi
add esp, 0x1c
pop edi
pop esi
pop ebx
ret

Function at 0x424dcc
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
pushfd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [0x43cb7c]
cmp eax, 0x1c
jne 0x424e47
cmp dword [ebp - 0xc], 0x1000
jne 0x424e42
cmp dword [ebp - 0x18], 0
je 0x424e42
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
je 0x424e42
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x424e21
mov eax, dword [ebp - 0x18]
cmp eax, 0x80000000
jae 0x424e47
push 2
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x43cb4c]
cmp eax, 0
je 0x424e42
push edi
push esi
mov eax, dword [ebp - 0x18]
push eax
call dword [0x43cb94]
add ebx, dword [ebp - 0x10]
jmp 0x424de3
popfd
popal
add esp, 0x20
pop ebp
ret 0xc
Function at 0x427228
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
mov byte [ebp - 1], 0
test ebx, ebx
je 0x42733d
mov eax, ebx
call fcn.0041e380
mov esi, eax
test esi, esi
je 0x42733d
cmp ebx, edi
jae 0x42733d
mov eax, dword [esi + 0x50]
add eax, ebx
cmp eax, edi
jbe 0x42733d
push 0x104
lea eax, [ebp - 0x115]
push eax
push ebx
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push closesocket
lea eax, [ebp - 0x115]
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x42733d
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_CreateFileMappingA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x427334
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_MapViewOfFile
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42732b
mov edx, edi
sub edx, ebx
mov eax, esi
call fcn.0041e4b8
mov ebx, eax
mov eax, dword [ebp - 0x10]
call fcn.0041e380
mov esi, eax
test esi, esi
je 0x427322
cmp ebx, dword [esi + 0x50]
jae 0x427322
mov eax, edi
mov ecx, eax
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10]
add edx, ebx
mov esi, edx
cmp ecx, dword [esi]
jne 0x42731d
add eax, 2
mov ax, word [eax]
add edx, 2
cmp ax, word [edx]
jne 0x42731d
xor eax, eax
jmp 0x42731f
mov al, 1
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_UnmapViewOfFile
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_CloseHandle
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4286b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x428895
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, 0x4288b0
call fcn.004214c4
mov dword [0x43d6dc], eax
xor edx, edx
mov eax, 0x4288d4
call fcn.004214c4
mov dword [0x43d6e0], eax
lea eax, [ebp - 8]
mov edx, 5
call fcn.0041ba30
lea eax, [ebp - 8]
call fcn.0041b9a0
mov byte [eax], 0x72
lea eax, [ebp - 8]
call fcn.0041b9a0
mov byte [eax + 1], 0x64
lea eax, [ebp - 8]
call fcn.0041b9a0
mov byte [eax + 2], 0x65
lea eax, [ebp - 8]
call fcn.0041b9a0
mov byte [eax + 3], 0x63
lea eax, [ebp - 8]
call fcn.0041b9a0
mov byte [eax + 4], 0x20
lea edx, [ebp - 0xc]
mov eax, 0x4288fc
call fcn.0041dcd4
push dword [ebp - 0xc]
push 0x42890c
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0041d968
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 4
call fcn.0041b808
mov eax, dword [ebp - 8]
call fcn.0041b948
push eax
push 0
push 0
call fcn.0041c808
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x42887a
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [0x43d6d0], esi
mov dword [0x43d6d4], edi
cmp dword [0x43d6dc], 0
je 0x4287cc
cmp dword [0x43d6e0], 0
jne 0x42884c
mov eax, 0x428918
call fcn.004215c0
mov esi, eax
cmp dword [esi], 0x4244c8b
jne 0x42885e
lea eax, [esi + 4]
mov eax, dword [eax]
and eax, 0xffffff
cmp eax, 0x241c8b
jne 0x42885e
lea eax, [esi + 7]
cmp byte [eax], 0x51
jne 0x42885e
lea eax, [esi + 8]
cmp byte [eax], 0x53
jne 0x42885e
lea eax, [esi + 9]
cmp byte [eax], 0xe8
jne 0x42885e
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea eax, [esi + 0xa]
push eax
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x42885e
lea edx, [esi + 0xe]
lea eax, [esi + 0xa]
add edx, dword [eax]
mov dword [0x43d6d8], edx
mov edx, 0x428660
sub edx, esi
sub edx, 0xe
mov dword [eax], edx
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 4]
push edx
push 4
push eax
call sub.KERNEL32.dll_VirtualProtect
mov bl, 1
jmp 0x42885e
push 0x42860c
push 1
call dword [0x43d6dc]
test eax, eax
setne bl
test bl, bl
jne 0x42887a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42889c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0041b50c
ret
Function at 0x428934
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
cmp dword [0x43d6dc], 0
je 0x42894c
cmp dword [0x43d6e0], 0
jne 0x4289a3
mov eax, 0x4289bc
call fcn.004215c0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea esi, [ebx + 0xa]
push esi
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x428989
mov eax, dword [0x43d6d8]
sub eax, ebx
sub eax, 0xe
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push 4
push esi
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
jmp 0x4289ae
push 0x42860c
call dword [0x43d6e0]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x42af1c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0041b938
xor eax, eax
push ebp
push 0x42afdc
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
setne bl
xor eax, eax
mov dword [ebp - 8], eax
test bl, bl
jne 0x42afc6
cmp dword [ebp - 4], 0
jne 0x42af69
lea edx, [ebp - 8]
mov eax, esi
call fcn.0042ad08
test al, al
je 0x42afc6
call sub.KERNEL32.dll_GetCurrentProcess
lea edx, [ebp - 0xc]
call fcn.0042ad08
test al, al
je 0x42afb7
cmp dword [ebp - 4], 0
je 0x42af97
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_EqualSid
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x42afae
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
call sub.ADVAPI32.dll_EqualSid
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_LocalFree
cmp dword [ebp - 8], 0
je 0x42afc6
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42afe3
lea eax, [ebp - 4]
call fcn.0041b4e8
ret

Function at 0x42b0a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
push 0
push 0
push 3
push 0
push 1
push closesocket
push eax
call sub.KERNEL32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x42b149
push 0
push esi
call sub.KERNEL32.dll_GetFileSize
mov ebx, eax
push ebx
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov edi, eax
test edi, edi
je 0x42b143
push 0
lea eax, [esp + 4]
push eax
push ebx
push edi
push esi
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x42b13d
cmp ebx, dword [esp]
jne 0x42b13d
xor ebx, ebx
mov eax, dword [esp]
dec eax
shr eax, 1
test eax, eax
jl 0x42b127
inc eax
xor edx, edx
movzx ecx, word [edi + edx*2]
add ebx, ecx
test ebx, 0xffff0000
je 0x42b123
mov ecx, ebx
and ecx, 0xffff
shr ebx, 0x10
add ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x42b106
mov eax, ebx
and ax, 0xffff
shr ebx, 0x10
add ax, bx
movzx eax, ax
mov ebx, eax
mov ebp, dword [esp]
add ebp, ebx
push edi
call sub.KERNEL32.dll_LocalFree
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebp
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42b154
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42b232
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
push ebx
call sub.KERNEL32.dll_GetSystemDirectoryW
test eax, eax
jne 0x42b193
mov word [ebx], 0x2e
mov word [ebx + 2], 0
push ebx
call sub.KERNEL32.dll_lstrlenW
cmp word [ebx + eax*2 - 2], 0x5c
je 0x42b1ac
push 0x42b240
push ebx
call sub.KERNEL32.dll_lstrcatW
lea edx, [ebp - 0x44]
mov eax, 0x42b24c
call fcn.0041dcd4
push dword [ebp - 0x44]
push 0x42b25c
lea edx, [ebp - 0x48]
mov eax, 0x42b268
call fcn.0041dcd4
push dword [ebp - 0x48]
push 0x42b27c
lea edx, [ebp - 0x4c]
mov eax, 0x42b288
call fcn.0041dcd4
push dword [ebp - 0x4c]
lea eax, [ebp - 4]
mov edx, 5
call fcn.0041b808
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 4]
call fcn.0041b948
push eax
call fcn.00423b6c
lea eax, [ebp - 0x40]
push eax
push ebx
call sub.KERNEL32.dll_lstrcatW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b239
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.0041b50c
lea eax, [ebp - 4]
call fcn.0041b4e8
ret

Function at 0x42b28c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041b938
xor eax, eax
push ebp
push 0x42b312
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 4]
mov al, byte [ebx]
mov byte [ebp - 5], al
inc ebx
mov edx, dword [ebx]
mov eax, edi
call fcn.0041ba30
add ebx, 4
mov esi, dword [edi]
mov al, byte [ebx]
cmp al, byte [ebp - 5]
jne 0x42b2e9
inc ebx
mov eax, ebx
inc eax
movzx eax, byte [eax]
test eax, eax
jle 0x42b2e4
mov dl, byte [ebx]
xor dl, 0x55
mov byte [esi], dl
inc esi
dec eax
jne 0x42b2d9
add ebx, 2
jmp 0x42b2ef
xor al, 0x55
mov byte [esi], al
inc esi
inc ebx
mov eax, dword [edi]
call fcn.0041b748
add eax, dword [edi]
cmp eax, esi
ja 0x42b2c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b319
lea eax, [ebp - 4]
call fcn.0041b4e8
ret
Function at 0x42c5a8
Capabilities:
Delete file
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], eax
xor eax, eax
push ebp
push 0x42c7cf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
lea edx, [ebp - 0x220]
mov eax, 0x42c7e8
call fcn.0041dcd4
push dword [ebp - 0x220]
push 0x42c814
lea edx, [ebp - 0x224]
mov eax, 0x42c820
call fcn.0041dcd4
push dword [ebp - 0x224]
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.0041b808
mov eax, dword [ebp - 0x21c]
call fcn.0041b948
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x42c6e5
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
lea edx, [ebp - 0x228]
mov eax, 0x42c834
call fcn.0041dcd4
mov eax, dword [ebp - 0x228]
call fcn.0041b948
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x42c69b
cmp dword [ebp - 8], 4
je 0x42c6a2
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x42c6ab
cmp dword [ebp - 4], 0
jbe 0x42c6ab
dec dword [ebp - 4]
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
mov eax, 0x42c834
lea edx, [ebp - 0x22c]
call fcn.0041dcd4
mov eax, dword [ebp - 0x22c]
call fcn.0041b948
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegCloseKey
jmp 0x42c6ea
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42c7af
call fcn.0042bd78
test al, al
je 0x42c7b1
push 0xf003f
push 0
push 0
call dword [0x43d70c]
mov esi, eax
test esi, esi
je 0x42c7b1
push 0x101ff
lea edx, [ebp - 0x234]
mov eax, 0x42c820
call fcn.0041dcd4
mov eax, dword [ebp - 0x234]
lea ecx, [ebp - 0x230]
mov dl, 1
call fcn.0041dd44
mov eax, dword [ebp - 0x230]
push eax
push esi
call dword [0x43d710]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42c799
mov eax, dword [ebp - 4]
push eax
call dword [0x43d708]
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x42c78d
mov word [ebp - 0x216], 0
lea eax, [ebp - 0x216]
call fcn.0042b154
lea eax, [ebp - 0x216]
push eax
call sub.KERNEL32.dll_DeleteFileW
mov eax, dword [ebp - 4]
push eax
call dword [0x43d700]
jmp 0x42c7a6
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x424
sete bl
push esi
call dword [0x43d700]
jmp 0x42c7b1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c7d6
lea eax, [ebp - 0x234]
mov edx, 7
call fcn.0041b50c
ret