joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f1d2
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18], 0x43584146
xor ebx, ebx
mov dword [ebp - 0x14], 0x5245564f
mov byte [ebp - 0x3c], bl
lea edi, [ebp - 0x3b]
stosd dword es:[edi], eax
mov edx, SysReAllocString
push ecx
push ecx
push 0x80
stosd dword es:[edi], eax
push 3
push ecx
push 1
stosd dword es:[edi], eax
mov dword [ebp - 0x10], 0x5245562d
mov dword [ebp - 0xc], 0x77353030
mov dword [ebp - 8], 0x87
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0041d0d6
mov esi, eax
cmp esi, 0xffffffff
jne 0x41f256
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x409868
call fcn.0041e5c8
pop ecx
pop ecx
jmp 0x41f286
push ebx
lea eax, [ebp - 0x40]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41f299
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x409898
call fcn.0041e5c8
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x40], 0x24
jne 0x41f27f
lea edx, [ebp - 0x18]
lea edi, [ebp - 0x3c]
mov ecx, dword [edx + ebx*4]
cmp ecx, dword [edi + ebx*4]
jne 0x41f27f
inc ebx
cmp ebx, 5
jne 0x41f2a5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x41f288
Function at 0x41f2c4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x214], ax
mov ebx, edx
lea eax, [ebp - 0x212]
mov edi, ecx
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41f32b
test byte [eax + 0x1c], 2
je 0x41f32b
cmp byte [eax + 0x19], 5
jb 0x41f32b
push dword [eax + 0x14]
mov edx, 0x409afc
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.00414ca8
lea eax, [ebp - 0x214]
push eax
push esi
push esi
push edi
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
jns 0x41f370
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41f3b8
test byte [eax + 0x1c], 2
je 0x41f3b8
cmp byte [eax + 0x19], 2
jb 0x41f3b8
push edi
push dword [eax + 0x14]
mov edx, 0x409afc
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.00414ccb
jmp 0x41f3b8
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x214]
push eax
mov ecx, ebx
call fcn.0041b6c9
mov edi, eax
test edi, edi
jns 0x41f3c4
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x41f3b8
test byte [ecx + 0x1c], 2
je 0x41f3b8
cmp byte [ecx + 0x19], 2
jb 0x41f3b8
movzx eax, di
mov edx, 0x409afc
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xc
pop ecx
call fcn.00414ccb
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x41f3c7
xor esi, esi
inc esi
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret 4
Function at 0x41f3e1
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x63c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x638], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x208
push edi
mov word [esp + 0x434], ax
xor ebx, ebx
lea eax, [esp + 0x436]
mov esi, ecx
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push edi
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov word [esp + 0x228], ax
lea eax, [esp + 0x22a]
push 0x206
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x14], 0x20a
xor eax, eax
test esi, esi
je 0x41f5e0
push 1
push 1
mov edx, 0x409614
mov word [esi], ax
mov ecx, SysReAllocString
call fcn.0041be9e
mov edi, eax
test edi, edi
je 0x41f5de
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
push 0x4098c4
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x41f4cb
cmp ebx, 2
jne 0x41f5de
mov edi, 0x4098e0
mov ebx, 0x105
jmp 0x41f521
cmp dword [esp + 0xc], 1
je 0x41f4dd
cmp dword [esp + 0xc], 2
jne 0x41f5de
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
lea edi, [esp + 0x18]
mov ebx, 0x105
push eax
mov edx, ebx
mov ecx, edi
call fcn.0041db46
test eax, eax
js 0x41f521
mov eax, dword [esp + 0x10]
push 0x5c
pop ecx
cmp word [esp + eax*2 + 0x16], cx
je 0x41f521
push 0x408fe0
mov edx, ebx
mov ecx, edi
call fcn.0041c967
test eax, eax
js 0x41f5d4
push ebx
push 5
lea edx, [esp + 0x438]
pop ecx
call fcn.0041f2c4
test eax, eax
jne 0x41f54d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x409914
call fcn.0041e5c8
pop ecx
pop ecx
jmp 0x41f5de
lea eax, [esp + 0x430]
mov edx, ebx
push eax
mov ecx, esi
call fcn.0041b6c9
test eax, eax
js 0x41f5d4
push 0x5c
pop eax
cmp word [edi], ax
je 0x41f57c
push 0x408fe0
mov edx, ebx
mov ecx, esi
call fcn.0041c967
test eax, eax
js 0x41f5d4
push edi
mov edx, ebx
mov ecx, esi
call fcn.0041c967
test eax, eax
js 0x41f5d4
lea eax, [esp + 0x228]
push eax
push 0x409950
push 0
push 0
push 0x8005
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
test eax, eax
js 0x41f5d4
push 0x93d
push 0x409988
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.SHELL32.dll_SHSetLocalizedName]
test eax, eax
js 0x41f5d4
mov ecx, esi
call fcn.0041dd77
xor eax, eax
inc eax
jmp 0x41f5e0
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [esp + 0x644]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00468ba0
mov esp, ebp
pop ebp
ret
Function at 0x41fe63
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, edx
push 0x206
push eax
mov word [ebp - 0x214], ax
mov edi, ecx
lea eax, [ebp - 0x212]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x475014]
push 2
pop ebx
cmp eax, 0x475014
je 0x41feca
test byte [eax + 0x1c], bl
je 0x41feca
cmp byte [eax + 0x19], 5
jb 0x41feca
push dword [eax + 0x14]
mov edx, 0x409afc
push dword [eax + 0x10]
push 0x1f
pop ecx
call fcn.00414ca8
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xef67
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x41ff73
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41ff24
test byte [eax + 0x1c], bl
je 0x41ff24
cmp byte [eax + 0x19], bl
jb 0x41ff24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x475014]
mov edx, 0x409afc
push 0xef67
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x20
pop ecx
call fcn.0041f1a3
push 1
push 0x409a84
push 0
push 0x409ab4
push 0x409544
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, eax
cmp ecx, 0x20
ja 0x41ff98
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41ff6f
test byte [eax + 0x1c], bl
je 0x41ff6f
cmp byte [eax + 0x19], bl
jb 0x41ff6f
push ecx
push dword [eax + 0x14]
mov edx, 0x409afc
push dword [eax + 0x10]
push 0x21
pop ecx
call fcn.00414ccb
xor eax, eax
jmp 0x41ff9b
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x41ff24
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret 4

Function at 0x4202cb
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, dword [0x475014]
mov esi, 0x475014
mov edi, 0x409b0c
cmp eax, esi
je 0x420311
test byte [eax + 0x1c], 2
je 0x420311
cmp byte [eax + 0x19], 5
jb 0x420311
push dword [eax + 0x14]
mov edx, edi
push dword [eax + 0x10]
push 0xf
pop ecx
call fcn.00414ca8
push 0x110
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x420377
mov eax, dword [0x475014]
cmp eax, esi
je 0x420373
test byte [eax + 0x1c], 2
je 0x420373
cmp byte [eax + 0x19], 2
jb 0x420373
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x475014]
mov edx, edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.00414ccb
xor eax, eax
jmp 0x420381
cmp dword [ebp - 0x11c], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00468ba0
mov esp, ebp
pop ebp
ret
Function at 0x421d54
Capabilities:
Get common file path

Disassembly:
push 0xa24
mov eax, 0x46a94b
call fcn.00468ea6
mov dword [ebp - 0xa2c], edx
mov eax, dword [0x475014]
mov ebx, 0x475014
mov edi, 0x100
cmp eax, ebx
je 0x421d9a
test dword [eax + 0x1c], edi
je 0x421d9a
cmp byte [eax + 0x19], 4
jb 0x421d9a
push dword [eax + 0x14]
mov edx, 0x409fa8
push dword [eax + 0x10]
push 0x1b
pop ecx
call fcn.00414ca8
lea eax, [ebp - 0x224]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x421ded
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x475014]
cmp ecx, ebx
je 0x421de6
test dword [ecx + 0x1c], edi
je 0x421de6
cmp byte [ecx + 0x19], 2
jb 0x421de6
push esi
push 0x409dc4
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x1c
mov edx, 0x409fa8
pop ecx
call fcn.00414cf4
mov eax, esi
jmp 0x421f33
call dword [sym.imp.msvcrt.dll_rand]
mov esi, eax
call dword [sym.imp.msvcrt.dll_rand]
imul esi, eax
call dword [sym.imp.msvcrt.dll_rand]
imul eax, esi
mov dword [ebp - 0xa28], eax
lea ebx, [eax + 1]
cmp ebx, eax
je 0x421f30
and dword [ebp - 4], 0
push 0x40949c
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [ebp - 0xa2c]
push eax
push 0x4094a4
lea eax, [ebp - 0x224]
push eax
push 0x409ddc
push esi
call dword [sym.imp.MFC42u.dll_CString::Format]
or dword [ebp - 4], 0xffffffff
add esp, 0x1c
push 0
push 0x180
push 1
push 0
push 1
push 0x40000000
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x421eb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x50
jne 0x421e83
mov eax, dword [ebp - 0xa28]
inc ebx
jmp 0x421e10
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x421de6
test dword [eax + 0x1c], edi
je 0x421de6
cmp byte [eax + 0x19], 2
jb 0x421de6
push esi
push 0x409dfc
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1e
jmp 0x421ddb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x421f33
push 0x1f
pop eax
call fcn.00468de4
ret
Function at 0x421f3e
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x421f7b
test dword [eax + 0x1c], 0x100
je 0x421f7b
cmp byte [eax + 0x19], 4
jb 0x421f7b
push dword [eax + 0x14]
mov edx, 0x409fa8
push dword [eax + 0x10]
push 0x1f
pop ecx
call fcn.00414ca8
mov edi, dword [ebp + 0x10]
mov edx, edi
call fcn.00421d54
mov esi, eax
test esi, esi
je 0x421fd2
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x422078
test dword [ecx + 0x1c], 0x100
je 0x422078
cmp byte [ecx + 0x19], 2
jb 0x422078
push esi
push 0x409e14
push dword [ecx + 0x14]
mov edx, 0x409fa8
push dword [ecx + 0x10]
push 0x20
pop ecx
call fcn.00414cf4
jmp 0x422078
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.00435ab7
mov esi, eax
test esi, esi
je 0x42200e
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x42206c
test dword [eax + 0x1c], 0x100
je 0x42206c
cmp byte [eax + 0x19], 2
jb 0x42206c
push esi
push 0x409e38
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x21
jmp 0x422061
push dword [edi]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.FXSAPI.dll_FaxGetMessageTiffW]
test eax, eax
jne 0x422078
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00436fba
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x42206c
test dword [eax + 0x1c], 0x100
je 0x42206c
cmp byte [eax + 0x19], 2
jb 0x42206c
push esi
push 0x409e7c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x22
mov edx, 0x409fa8
pop ecx
call fcn.00414cf4
test esi, esi
je 0x422078
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x422143
Capabilities:
Get geographical location

Disassembly:
push 0x16c
mov eax, 0x46a978
call fcn.00468ea6
mov esi, ecx
mov dword [ebp - 0x178], esi
mov eax, dword [0x475014]
mov ebx, 0x100
cmp eax, 0x475014
je 0x422189
test dword [eax + 0x1c], ebx
je 0x422189
cmp byte [eax + 0x19], 4
jb 0x422189
push dword [eax + 0x14]
mov edx, 0x409fa8
push dword [eax + 0x10]
push 0x2d
pop ecx
call fcn.00414ca8
mov edx, dword [ebp + 8]
mov eax, edx
mov ecx, dword [ebp + 0xc]
add eax, 0xffffffff
mov dword [ebp - 0x174], eax
mov eax, ecx
adc eax, 0xffffffff
test eax, eax
ja 0x4221b8
jb 0x4221b1
cmp dword [ebp - 0x174], 0x3fe
ja 0x4221b8
xor edx, edx
inc edx
xor ecx, ecx
jmp 0x4221bf
shrd edx, ecx, 0xa
shr ecx, 0xa
and dword [ebp - 4], 0
push ecx
push edx
push 0x409ed8
push esi
call dword [sym.imp.MFC42u.dll_CString::Format]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x170]
add esp, 0x10
push 0x64
push eax
push 0
push dword [esi]
mov esi, 0x400
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
test eax, eax
jne 0x422238
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x422231
test dword [ecx + 0x1c], ebx
je 0x422231
cmp byte [ecx + 0x19], 2
jb 0x422231
push esi
push 0x409f04
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x2f
mov edx, 0x409fa8
pop ecx
call fcn.00414cf4
mov eax, esi
jmp 0x42238e
push 0xa
lea eax, [ebp - 0x28]
push eax
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x42227c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x422231
test dword [ecx + 0x1c], ebx
je 0x422231
cmp byte [ecx + 0x19], 2
jb 0x422231
push esi
push 0x409f24
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x30
jmp 0x422226
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x422298
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov dword [ebp - 4], 2
push 0x7e
push eax
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0xa6]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [0x476b3c], 0
je 0x4222cf
mov eax, 0x202d
mov word [ebp - 0xa8], ax
push 0x409f40
push 0x40
pop edx
lea ecx, [ebp - 0xa8]
call fcn.0041c967
mov esi, eax
test esi, esi
jns 0x42232f
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x4222f7
movzx esi, si
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x422231
test dword [ecx + 0x1c], ebx
je 0x422231
cmp byte [ecx + 0x19], 2
jb 0x422231
push esi
push 0x409f4c
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x31
jmp 0x422226
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0xa8]
push eax
push dword [ebp - 0x178]
call dword [sym.imp.MFC42u.dll_CString::Format]
add esp, 0xc
xor eax, eax
jmp 0x42238e
call fcn.00468de4
ret 8
Function at 0x42825b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [0x475014]
mov ebx, 0x100
cmp eax, 0x475014
je 0x428293
test dword [eax + 0x1c], ebx
je 0x428293
cmp byte [eax + 0x19], 4
jb 0x428293
push dword [eax + 0x14]
mov edx, 0x40ae20
push dword [eax + 0x10]
push 0x5d
pop ecx
call fcn.00414ca8
push 0x20006
push 1
mov edx, 0x40ad98
mov ecx, SysReAllocString
xor esi, esi
call fcn.0041be9e
mov edi, eax
test edi, edi
je 0x4282e4
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 4
push esi
mov ebx, 0x40add8
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4282db
mov edx, eax
mov ecx, ebx
call fcn.0041c20b
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x428327
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x42831f
test dword [eax + 0x1c], ebx
je 0x42831f
cmp byte [eax + 0x19], 2
jb 0x42831f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x475014]
mov edx, 0x40ae20
push 0x408964
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x5e
pop ecx
call fcn.00414cf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428335
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov edx, 0x40ad98
push esi
push edi
xor edi, edi
mov ecx, SysReAllocString
neg eax
sbb eax, eax
and eax, 6
add eax, 0x20019
push eax
push 1
call fcn.0041be9e
mov esi, eax
test esi, esi
je 0x4283ae
push ebx
mov ebx, 0x40adfc
mov ecx, esi
mov edx, ebx
call fcn.0041c1e6
cmp dword [ebp + 8], 0
mov edi, eax
je 0x4283a6
test edi, edi
jne 0x4283a6
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 4
push edi
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4283a6
mov edx, eax
mov ecx, ebx
call fcn.0041c20b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x434918
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
push edi
mov edi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x43495b
test dword [eax + 0x1c], 0x100
je 0x43495b
cmp byte [eax + 0x19], 4
jb 0x43495b
push dword [eax + 0x14]
mov edx, 0x40c648
push dword [eax + 0x10]
push 0x6a
pop ecx
call fcn.00414ca8
call fcn.00416549
mov ebx, eax
test ebx, ebx
jne 0x4349a3
push 6
pop esi
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x434b24
test dword [eax + 0x1c], 0x100
je 0x434b24
cmp byte [eax + 0x19], 2
jb 0x434b24
push esi
push 0x40c5cc
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6b
jmp 0x434b19
cmp dword [ebx + 0x768], esi
jne 0x434b24
mov ecx, dword [ebp + 8]
call fcn.0041e207
test eax, eax
je 0x4349c5
call fcn.0041d836
jmp 0x434a77
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.FXSAPI.dll_FaxConnectFaxServerW]
test eax, eax
jne 0x434a1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x434b24
test dword [ecx + 0x1c], 0x100
je 0x434b24
cmp byte [ecx + 0x19], 2
jb 0x434b24
push esi
push 0x40c228
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x6c
jmp 0x434b19
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.FXSAPI.dll_FaxGetReportedServerAPIVersion]
test eax, eax
jne 0x434a6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x434b24
test dword [eax + 0x1c], 0x100
je 0x434b24
cmp byte [eax + 0x19], 2
jb 0x434b24
push esi
push 0x40c5dc
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6d
jmp 0x434b19
cmp dword [ebp - 8], 0x30000
sbb eax, eax
inc eax
test eax, eax
je 0x434b24
push 0x2001f
push 1
mov edx, 0x408934
mov ecx, SysReAllocString
call fcn.0041be9e
mov edi, eax
test edi, edi
je 0x434ae8
mov edx, 0x408984
mov ecx, edi
call fcn.0041c1e6
test eax, eax
jne 0x434b24
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 4
push esi
push 0x408984
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x434ad7
mov edx, eax
mov ecx, 0x408984
call fcn.0041c20b
mov dword [ebx + 0x768], 1
call fcn.0041a530
jmp 0x434b24
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x434b24
test dword [eax + 0x1c], 0x100
je 0x434b24
cmp byte [eax + 0x19], 2
jb 0x434b24
push esi
push 0x408964
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6e
mov edx, 0x40c648
pop ecx
call fcn.00414cf4
cmp dword [ebp - 4], 0
je 0x434b33
push dword [ebp - 4]
call dword [sym.imp.FXSAPI.dll_FaxClose]
test edi, edi
je 0x434b3e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x434b4e
Capabilities:
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5f0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x5ec], eax
lea eax, [ebp - 0x5dc]
push eax
push 0x202
and dword [edi], 0
mov dword [ebp - 0x5e0], 0x1c
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, eax
mov dword [ebp - 0x5e4], ebx
test ebx, ebx
je 0x434bad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x434cc8
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x448]
push eax
push 0
push 0x17
push esi
call dword [sym.imp.WS2_32.dll_WSAStringToAddressW]
test eax, eax
je 0x434bff
lea eax, [ebp - 0x5e0]
mov dword [ebp - 0x5e0], 0x10
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
push 2
push esi
call dword [sym.imp.WS2_32.dll_WSAStringToAddressW]
mov esi, eax
test esi, esi
jne 0x434ccc
lea eax, [ebp - 0x42c]
jmp 0x434c05
lea eax, [ebp - 0x448]
push 8
mov edx, 0x104
lea ecx, [ebp - 0x41c]
push edx
push ecx
push edx
lea ecx, [ebp - 0x214]
push ecx
push dword [ebp - 0x5e0]
push eax
call dword [sym.imp.WS2_32.dll_GetNameInfoW]
test eax, eax
je 0x434c3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x434ccc
push 0x2e
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x434c52
xor ecx, ecx
mov word [eax], cx
and dword [ebp - 0x5e8], 0
lea eax, [ebp - 0x5e8]
push eax
mov edx, SysReAllocString
lea ecx, [ebp - 0x214]
call fcn.0041db46
mov esi, eax
test esi, esi
js 0x434cc5
mov ebx, dword [ebp - 0x5e8]
inc ebx
lea ecx, [ebx + ebx]
call fcn.0041c805
mov dword [edi], eax
test eax, eax
je 0x434cba
lea ecx, [ebp - 0x214]
mov edx, ebx
push ecx
mov ecx, eax
call fcn.0041b6c9
mov ecx, dword [edi]
test eax, eax
js 0x434cb0
call fcn.0041e207
mov ecx, dword [ebp - 0x5ec]
mov dword [ecx], eax
jmp 0x434cbf
call fcn.0041c919
and dword [edi], 0
jmp 0x434cbf
mov esi, 0x8007000e
mov ebx, dword [ebp - 0x5e4]
movzx esi, si
test ebx, ebx
jne 0x434cd2
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret 0xc