joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432ab4
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, ecx
xor eax, eax
push str.WinVNC_Win32_Instance_Mutex
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp], eax
test eax, eax
je 0x432ada
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x432ade
xor eax, eax
pop ebp
ret
mov eax, 1
pop ebp
ret

Function at 0x432ae8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test eax, 0x8000
jne 0x432b20
movzx eax, byte [ebx]
push dword [ebx + 4]
push eax
call fcn.004335bc
push dword [ebx]
push 0x49f740
push 9
push 0x481eac
call fcn.00407ffc
add esp, 0x18
mov byte [ebx + 8], 1
pop ebx
ret
Function at 0x4335bc
Capabilities:
Log keystrokes

Disassembly:
push ebp
movzx ebp, byte [esp + 8]
push 0
push ebp
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx eax, al
push 0
push dword [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.dll_keybd_event]
pop ebp
ret

Function at 0x4335e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test eax, 0x8000
jne 0x4335f4
pop ebx
ret
movzx edx, byte [ebx]
mov eax, dword [ebx + 4]
or eax, 2
push eax
push edx
call fcn.004335bc
push dword [ebx]
push 0x49f750
push 9
push 0x481eac
call fcn.00407ffc
add esp, 0x18
mov byte [ebx + 9], 1
pop ebx
ret

Function at 0x4337f8
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
push ebp
movzx edi, byte [esp + 0xc]
mov ebp, dword [esp + 0x10]
push edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test eax, 0x8000
je 0x433820
test ebp, ebp
jne 0x433895
mov edx, 0x49f7d8
jmp 0x433829
test ebp, ebp
je 0x433895
mov edx, 0x49f8e0
je 0x433832
mov eax, 0x49f7d8
jmp 0x433837
mov eax, 0x49f8e0
push eax
push edx
push edi
push 0x49f880
push 9
push 0x481eac
call fcn.00407ffc
add esp, 0x18
test ebp, ebp
je 0x433856
xor eax, eax
jmp 0x43385b
mov eax, 2
push eax
push edi
call fcn.004335bc
add esp, 8
push edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test eax, 0x8000
je 0x43387a
mov eax, 0x49f7d8
jmp 0x43387f
mov eax, 0x49f8e0
push eax
push edi
push 0x49f900
push 9
push 0x481eac
call fcn.00407ffc
add esp, 0x14
pop ebp
pop edi
ret
Function at 0x4338dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472546
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0x134]
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x138]
push eax
push edx
call fcn.00434ea8
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x10
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x130]
push eax
push edx
call fcn.00434edc
mov dword [ebp - 4], 1
xor edi, edi
lea eax, [edi + edi]
add eax, eax
movzx ebx, byte [edi*8 + 0x47dbe4]
lea esi, [eax + eax + 0x47dbe0]
mov ecx, dword [ebp - 0x24]
push esi
call fcn.00433a80
mov byte [eax], bl
movzx eax, byte [edi*8 + 0x47dbe5]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
add ecx, 0x10
push esi
call fcn.004342f8
mov edx, dword [ebp - 0x14]
inc edi
cmp edi, 0x5a
mov byte [eax], dl
jb 0x433945
lea eax, [ebp - 0x128]
push pe_nt_image_headers32
push 0
push eax
call fcn.0046e690
add esp, 0xc
xor edi, edi
lea esi, [edi + 0x47e420]
movsx eax, byte [edi + 0x47e420]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx edx, ax
cmp edx, 0xffffffff
je 0x433a19
movzx ebx, dl
shr edx, 8
movzx edx, dl
test dl, 1
je 0x4339cf
mov eax, 0x80
jmp 0x4339d1
xor eax, eax
mov byte [ebp - 0x118], al
test dl, 2
je 0x4339e3
mov eax, 0x80
jmp 0x4339e5
xor eax, eax
mov byte [ebp - 0x117], al
test dl, 4
je 0x4339f7
mov eax, 0x80
jmp 0x4339f9
xor eax, eax
mov byte [ebp - 0x116], al
xor ecx, ecx
lea edx, [ebp - 0x128]
lea eax, [ebp - 0x28]
push ecx
push eax
push edx
push ecx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
test eax, eax
jl 0x433a3d
inc edi
cmp edi, 7
jb 0x43399e
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
movzx eax, byte [edi + 0x47e420]
push eax
push eax
push 0x49f75c
push 8
push 0x481eac
call fcn.00407ffc
add esp, 0x14
push esi
mov ecx, 0x493130
call fcn.00434b5c
xor ecx, ecx
lea edx, [ebp - 0x128]
lea eax, [ebp - 0x28]
push ecx
push eax
push edx
push ecx
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
jmp 0x433a19
Function at 0x436b90
Capabilities:
Move file

Disassembly:
push edi
push esi
push ebp
push ebx
mov ebx, ecx
mov edi, dword [ebx + 0x14]
test edi, edi
je 0x436c7e
mov byte [ebx + 4], 1
movzx eax, byte [ebx + 0x18]
test eax, eax
jne 0x436c0e
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x436bbf
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x436bb7
add eax, 5
push eax
call fcn.004639c5
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x436c0e
mov esi, ebp
mov edi, dword [ebx + 0x14]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x436bd6
mov edi, ebp
mov edx, 0x49f990
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x436bf1
push 1
push ebp
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push ebp
call fcn.00463168
pop ecx
mov ecx, ebx
call fcn.00436a70
xor eax, eax
push eax
push 0x80
push 4
push eax
push 1
push 0x40000000
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx + 0x10], eax
cmp eax, 0xffffffff
je 0x436c5e
movzx edx, byte [ebx + 0x18]
test edx, edx
je 0x436c52
xor edx, edx
push 2
push edx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop ebx
pop ebp
pop esi
pop edi
ret
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop ebx
pop ebp
pop esi
pop edi
ret
mov byte [ebx + 5], 1
xor eax, eax
mov byte [ebx + 4], al
push dword [ebx + 0x14]
push 0x49f998
push eax
push ebx
call fcn.00407ffc
add esp, 0x10
mov eax, dword [ebx + 0x10]
jmp 0x436c38
mov byte [ebx + 5], 1
xor eax, eax
mov byte [ebx + 4], al
push 0x49f978
push eax
push ebx
call fcn.00407ffc
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret

Function at 0x436d70
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push edi
push esi
push ebp
sub esp, 8
mov ebp, ecx
mov edi, dword [esp + 0x18]
movzx eax, byte [ebp + 5]
test eax, eax
je 0x436d8b
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movzx eax, byte [ebp + 6]
test eax, eax
je 0x436dbe
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x436daf
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x436da7
lea edx, [esp]
push 0
push edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
movzx eax, byte [ebp + 4]
test eax, eax
je 0x436def
mov ebp, dword [ebp + 0x10]
test ebp, ebp
je 0x436def
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x436ddf
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x436dd7
lea edx, [esp + 4]
push 0
push edx
push eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 8
pop ebp
pop esi
pop edi
ret 4
Function at 0x43879c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4761cc
push 0x46513c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov edx, 4
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
push 1
push 0
push 0x4a0348
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x438834
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push eax
push edx
push ecx
push 0
push 0x4a0360
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x438834
mov eax, dword [ebp - 0x30]
cmp eax, 4
jne 0x438834
mov eax, dword [ebp - 0x2c]
cmp eax, 4
jne 0x438834
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0043885b
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
mov esp, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x439ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
push ebx
sub esp, 8
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov dword [esp], 1
xor ecx, ecx
lea edx, [esp]
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ecx
push edx
push ecx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x439d29
mov eax, dword [esp]
cmp eax, 3
je 0x439ce7
xor eax, eax
add esp, 8
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], pe_nt_image_headers32
push pe_nt_image_headers32
call fcn.004639c5
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x439d29
lea ecx, [esp]
lea edx, [esp + 4]
push edx
push ebx
push ecx
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x439d3b
mov edx, dword [esp]
cmp edx, 3
je 0x439d32
push ebx
call fcn.00463168
pop ecx
xor eax, eax
add esp, 8
pop ebx
pop esi
pop edi
ret
mov eax, ebx
add esp, 8
pop ebx
pop esi
pop edi
ret
push ebx
call fcn.00463168
xor eax, eax
add esp, 0xc
pop ebx
pop esi
pop edi
ret

Function at 0x439e08
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, 4
mov dword [esp], eax
lea ecx, [esp + 8]
lea edx, [esp + 4]
mov dword [esp + 4], eax
lea eax, [esp]
push edx
push ecx
push eax
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x439e4a
mov eax, dword [esp]
cmp eax, 4
jne 0x439e4a
mov eax, dword [esp + 4]
cmp eax, 4
je 0x439e52
mov eax, dword [esp + 0x18]
add esp, 0xc
ret
mov eax, dword [esp + 8]
add esp, 0xc
ret

Function at 0x439f78
Capabilities:
Set registry value

Disassembly:
mov edx, 4
lea eax, [esp + 0xc]
push edx
push eax
push edx
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret

Function at 0x439fe8
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x43a069
mov edx, dword [esp + 4]
cmp edx, 5
jne 0x43a024
cmp dword [esp + 8], 0
jne 0x43a024
mov eax, 1
add esp, 0x94
ret
cmp edx, 5
jne 0x43a03e
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x43a03e
mov eax, 1
add esp, 0x94
ret
cmp edx, 5
jne 0x43a058
mov eax, dword [esp + 8]
cmp eax, 2
jne 0x43a058
mov eax, 1
add esp, 0x94
ret
cmp edx, 4
ja 0x43a06e
mov eax, 3
add esp, 0x94
ret
cmp eax, 1
jne 0x43a08d
cmp dword [esp + 8], 0
jne 0x43a081
mov eax, 5
add esp, 0x94
ret
mov eax, 4
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret

Function at 0x43c304
Capabilities:
Set registry value

Disassembly:
push pe_nt_image_headers32
push dword [esp + 0xc]
push 3
push 0
push 0x4a0e60
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x43c324
Capabilities:
Set registry value

Disassembly:
push 8
push dword [esp + 0xc]
push 3
push 0
push 0x4a0ca0
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8
Function at 0x43cb94
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x108
lea ecx, [esp]
mov dword [esp], 3
lea edx, [esp + 8]
lea eax, [esp + 4]
mov dword [esp + 4], pe_nt_image_headers32
push eax
push edx
push ecx
push 0
push 0x4a0e60
push dword [esp + 0x120]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43cbfc
mov eax, dword [esp + 4]
cmp eax, 0x100
jle 0x43cbe3
add esp, 0x108
ret 8
lea eax, [esp + 8]
push pe_nt_image_headers32
push eax
push dword [esp + 0x118]
call fcn.0046e6c0
add esp, 0xc
add esp, 0x108
ret 8

Function at 0x43cc08
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
push ebx
sub esp, 8
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov dword [esp], 1
xor ecx, ecx
lea edx, [esp]
mov dword [esp + 4], ecx
lea eax, [esp + 4]
push eax
push ecx
push edx
push ecx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43cc86
mov eax, dword [esp]
cmp eax, 1
je 0x43cc4d
xor eax, eax
add esp, 8
pop ebx
pop esi
pop edi
ret 8
push dword [esp + 4]
call fcn.004639c5
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x43cc86
lea ecx, [esp]
lea edx, [esp + 4]
push edx
push ebx
push ecx
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43cc9c
mov edx, dword [esp]
cmp edx, 1
je 0x43cc91
push ebx
call fcn.00463168
pop ecx
xor eax, eax
add esp, 8
pop ebx
pop esi
pop edi
ret 8
mov eax, ebx
add esp, 8
pop ebx
pop esi
pop edi
ret 8
push ebx
call fcn.00463168
xor eax, eax
add esp, 0xc
pop ebx
pop esi
pop edi
ret 8

Function at 0x43ce94
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea ecx, [esp]
mov dword [esp], 3
lea edx, [esp + 8]
lea eax, [esp + 4]
mov dword [esp + 4], 8
push eax
push edx
push ecx
push 0
push 0x4a0ca0
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43ceed
mov eax, dword [esp + 4]
cmp eax, 8
jle 0x43ced8
add esp, 0x10
ret 8
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
mov dword [edx], eax
mov eax, dword [esp + 0x18]
mov dword [eax + 4], ecx
add esp, 0x10
ret 8
Function at 0x4446e0
Capabilities:
Get session user name

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x493618]
cmp eax, 2
jne 0x44478c
call fcn.0044487c
test eax, eax
jne 0x444706
mov eax, dword [0x493618]
jmp 0x44478c
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
test eax, eax
je 0x444761
xor ecx, ecx
lea edx, [esp]
push edx
push ecx
push ecx
push 4
push eax
call dword [sym.imp.USER32.dll_GetUserObjectInformationA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esp], 0
je 0x444824
cmp dword [0x493614], 0
jne 0x444787
mov edi, 0x4971f4
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x444759
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x444751
mov edx, dword [esp + 0x18]
cmp eax, edx
jb 0x444769
xor eax, eax
add esp, 8
pop esi
pop edi
ret
mov esi, dword [esp + 0x14]
mov edi, 0x4971f4
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x444772
mov eax, 1
add esp, 8
pop esi
pop edi
ret
mov eax, dword [0x493618]
cmp eax, 1
jb 0x444761
cmp eax, 2
ja 0x444761
mov eax, dword [esp + 0x18]
lea edx, [esp + 4]
mov dword [esp + 4], eax
push edx
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x44477c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
jne 0x444804
mov edi, 0x4971f4
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4447d6
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4447ce
mov edx, dword [esp + 0x18]
cmp eax, edx
jb 0x4447e6
xor eax, eax
add esp, 8
pop esi
pop edi
ret
mov esi, dword [esp + 0x14]
mov edi, 0x4971f4
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4447ef
mov eax, 1
add esp, 8
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4a2c40
push 0
push 0x481eac
call fcn.00407ffc
xor eax, eax
add esp, 0x18
pop esi
pop edi
ret
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov dword [0x493614], 0
mov edi, 0x4971f4
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x44484b
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x444843
mov edx, dword [esp + 0x18]
cmp eax, edx
jb 0x44485b
xor eax, eax
add esp, 8
pop esi
pop edi
ret
mov esi, dword [esp + 0x14]
mov edi, 0x4971f4
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x444864
mov eax, 1
add esp, 8
pop esi
pop edi
ret
Function at 0x444edc
Capabilities:
Access the windows event log

Disassembly:
push ebx
sub esp, 0x108
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4935e8], eax
push 0x4a2d80
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov ebx, eax
lea edx, [esp]
push dword [0x4935e8]
push 0x4a2d80
push 0x4a2ed8
push pe_nt_image_headers32
push edx
call fcn.00463a0f
add esp, 0x14
test ebx, ebx
je 0x444f63
mov edx, dword [esp + 0x110]
lea ecx, [esp]
mov dword [esp + 0x104], edx
mov dword [esp + 0x100], ecx
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
xor ecx, ecx
lea edx, [esp + 0x100]
push ecx
push edx
push ecx
push 2
push ecx
push ecx
push ecx
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
add esp, 0x108
pop ebx
ret

Function at 0x44512c
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
push ebx
sub esp, 8
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov dword [esp], 1
xor ecx, ecx
lea edx, [esp]
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ecx
push edx
push ecx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4451b7
mov eax, dword [esp]
cmp eax, 3
je 0x445175
xor eax, eax
add esp, 8
pop ebx
pop esi
pop edi
ret 8
mov dword [esp + 4], pe_nt_image_headers32
push pe_nt_image_headers32
call fcn.004639c5
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4451b7
lea ecx, [esp]
lea edx, [esp + 4]
push edx
push ebx
push ecx
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4451cd
mov edx, dword [esp]
cmp edx, 3
je 0x4451c2
push ebx
call fcn.00463168
pop ecx
xor eax, eax
add esp, 8
pop ebx
pop esi
pop edi
ret 8
mov eax, ebx
add esp, 8
pop ebx
pop esi
pop edi
ret 8
push ebx
call fcn.00463168
xor eax, eax
add esp, 0xc
pop ebx
pop esi
pop edi
ret 8

Function at 0x4452a4
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, 4
mov dword [esp], eax
lea ecx, [esp]
lea edx, [esp + 4]
mov dword [esp + 4], eax
lea eax, [esp + 8]
push edx
push eax
push ecx
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4452e6
mov eax, dword [esp]
cmp eax, 4
jne 0x4452e6
mov eax, dword [esp + 4]
cmp eax, 4
je 0x4452f0
mov eax, dword [esp + 0x18]
add esp, 0xc
ret 0xc
mov eax, dword [esp + 8]
add esp, 0xc
ret 0xc

Function at 0x445898
Capabilities:
Set registry value

Disassembly:
mov edx, 4
lea eax, [esp + 0xc]
push edx
push eax
push edx
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc

Function at 0x4461a8
Capabilities:
Initialize winsock library

Disassembly:
push edi
sub esp, 0x190
mov edi, ecx
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x4461d1
mov dword [edi], 0
mov eax, edi
add esp, 0x190
pop edi
ret
movzx edx, word [esp]
mov eax, edi
mov word [0x49364c], dx
mov dword [edi], 0xffffffff
add esp, 0x190
pop edi
ret
Function at 0x4461f8
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push esi
push esi
mov esi, ecx
cmp dword [esi + 4], 0
mov dword [esp], 1
jl 0x446210
mov ecx, esi
call fcn.00446168
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi + 4], eax
test eax, eax
jl 0x446257
lea edx, [esp]
push 4
push edx
push 8
push 0xffff
push eax
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x446240
xor eax, eax
pop ecx
pop esi
ret
lea eax, [esp]
push 4
push eax
push 1
push 6
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x44625c
xor eax, eax
pop ecx
pop esi
ret
mov eax, 0xffffffff
pop ecx
pop esi
ret

Function at 0x446308
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push edi
push ebx
sub esp, 0x10
mov edi, ecx
mov ebx, dword [esp + 0x1c]
cmp dword [edi + 4], 0
jl 0x44638e
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov eax, 2
mov word [esp], ax
push ebx
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [esp + 4], eax
cmp eax, 0xffffffff
jne 0x44635d
push ebx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x44638e
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x44638e
mov eax, dword [eax]
mov dword [esp + 4], eax
movzx eax, word [esp + 0x20]
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 2], ax
lea eax, [esp]
push 0x10
push eax
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
jne 0x44638e
mov eax, 0xffffffff
add esp, 0x10
pop ebx
pop edi
ret 8
xor eax, eax
add esp, 0x10
pop ebx
pop edi
ret 8

Function at 0x4463b8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4731c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov edx, dword [ecx + 4]
test edx, edx
jl 0x44649a
mov dword [ebp - 0x2c], 1
xor eax, eax
push eax
push eax
push edx
call dword [sym.imp.WSOCK32.dll_accept]
mov dword [ebp - 0x14], eax
test eax, eax
jl 0x44649a
mov dword [ebp - 0x28], 0
push 0x2394
call fcn.004639c5
pop ecx
mov dword [ebp - 0x24], eax
test eax, eax
je 0x446496
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
call fcn.004464ac
mov dword [ebp - 0x28], 0
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x446478
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
push 4
push eax
push 1
push 6
push edx
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov eax, ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 2
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.WSOCK32.dll_shutdown]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov edx, dword [ebx + 4]
mov dword [ebp - 0x14], edx
jmp 0x446451
xor ebx, ebx
jmp 0x446440
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret