joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4070e8
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x41b4b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push esi
mov esi, ecx
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push 0x1f
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x96c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
lea ecx, [esp + 0x28]
push edx
call fcn.0040d940
mov dword [esp + 0x60], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
lea eax, [esp + 0x28]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x421d44
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x421d78]
lea edx, [esp + 0x30]
push 0x421d44
mov dword [esp + 0x3c], ecx
mov dword [0x421d78], edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x421d18]
push 0
push 0x40d6f0
push edi
push 0xe0
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
mov dword [esp + 0x2c], 0
jne 0x407233
lea edi, [esi + 0x54c]
push 0
push 0
push 0x41f698
mov ecx, edi
call fcn.00402000
lea eax, [esp + 0x44]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, 0x4219a0
call fcn.0040e060
mov edx, dword [0x420f60]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [0x420f60]
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4071fa
push 0
push 0
push 0x41f61c
mov ecx, edi
call fcn.00402000
jmp 0x407233
mov eax, dword [0x421674]
push 0
test eax, eax
push 0
je 0x407215
push 0x42189b
mov ecx, edi
call fcn.00402000
jmp 0x407233
push 0x41f688
mov ecx, edi
call fcn.00402000
mov edx, dword [esi + 0x96c]
lea ecx, [esp + 0x44]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea ecx, [esp + 0x28]
mov dword [esp + 0x60], 0xffffffff
call fcn.0040dc20
mov ecx, dword [esp + 0x58]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x5c
ret 0x10
Function at 0x4080ce
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
push esi
cmp eax, 0xf020
mov esi, ecx
je 0x4080ce
mov eax, dword [esp + 0x14]
pop esi
mov dword [eax], 0
xor eax, eax
ret 0x10
push 1
push str.AutoTray
call fcn.0040eea0
add esp, 8
test eax, eax
je 0x4080f3
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10
mov edx, dword [esp + 0x14]
xor eax, eax
pop esi
mov dword [edx], 0
ret 0x10
Function at 0x409820
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x41b603
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
push 0xa8
call fcn.004131a8
add esp, 4
mov dword [esp + 0x10], eax
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x30], ebx
je 0x4098df
mov esi, dword [esp + 0x40]
mov eax, dword [0x41f0c8]
push ecx
cmp esi, ebx
mov edi, esp
mov dword [esp + 0x18], esp
mov dword [edi], eax
je 0x4098b3
mov ecx, esi
shr ecx, 0x10
jne 0x409888
and esi, 0xffff
mov ecx, edi
push esi
call fcn.0040d350
jmp 0x4098b3
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
cmp ebp, ebx
je 0x4098b3
push ebp
mov ecx, edi
call fcn.004066d0
test eax, eax
je 0x4098b3
mov edi, dword [edi]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
mov byte [esp + 0x3c], 1
call fcn.00406510
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x38], bl
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00409990
mov esi, eax
jmp 0x4098e1
xor esi, esi
lea edx, [esi + 8]
push esi
push edx
push 0x421d10
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.0040b170
mov eax, dword [0x421d18]
push ebx
push 0x40d6f0
push ebx
push 0xe2
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebp, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x11
call ebp
push 0x10
mov edi, eax
call ebp
mov ecx, dword [esp + 0x1c]
push 1
push ebx
push ebx
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
sub edi, ebx
lea edx, [edi + ecx + 0x12]
mov ecx, dword [esp + 0x2c]
sub eax, ecx
push edx
add eax, ebp
push eax
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esi + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 0xc
Function at 0x40adb0
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov al, byte [esp + 8]
push ebx
push ebp
push esi
test al, al
push edi
mov dword [esp + 0x10], ecx
je 0x40ae8d
mov al, byte [0x4216cc]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test al, al
jne 0x40ade6
mov al, byte [0x4216cd]
test al, al
jne 0x40ade6
mov al, byte [0x4216ce]
test al, al
je 0x40adf5
mov eax, dword [ecx + 0x370]
push 5
push eax
call ebx
mov ecx, dword [esp + 0x10]
lea esi, [ecx + 0x50c]
xor ebp, ebp
cmp word [esi + 0x34], bp
jle 0x40ae26
lea edi, [esi + 0x24]
mov ecx, dword [edi]
push 0
mov edx, dword [ecx + 4]
push edx
call ebx
mov dword [edi], 0
inc ebp
movsx eax, word [esi + 0x34]
add edi, 4
cmp ebp, eax
jl 0x40ae06
mov ecx, dword [esp + 0x10]
xor eax, eax
mov word [esi + 0x34], ax
mov word [esi + 0x36], ax
mov word [esi + 0x20], ax
mov al, byte [0x4216cc]
test al, al
je 0x40ae4f
movsx eax, word [esi + 0x34]
lea edx, [ecx + 0x470]
mov dword [esi + eax*4 + 0x24], edx
inc word [esi + 0x34]
movsx eax, word [esi + 0x34]
lea edx, [ecx + 0x338]
mov dword [esi + eax*4 + 0x24], edx
inc word [esi + 0x34]
mov al, byte [0x4216ce]
test al, al
je 0x40ae7c
movsx eax, word [esi + 0x34]
lea edx, [ecx + 0x408]
mov dword [esi + eax*4 + 0x24], edx
inc word [esi + 0x34]
mov al, byte [0x4216cd]
test al, al
je 0x40aef2
add ecx, 0x43c
jmp 0x40aee6
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
lea esi, [ecx + 0x50c]
xor ebp, ebp
cmp word [esi + 0x34], bp
jle 0x40aec4
lea edi, [esi + 0x24]
mov eax, dword [edi]
push 0
mov ecx, dword [eax + 4]
push ecx
call ebx
mov dword [edi], 0
inc ebp
movsx edx, word [esi + 0x34]
add edi, 4
cmp ebp, edx
jl 0x40aea4
mov ecx, dword [esp + 0x10]
xor eax, eax
mov word [esi + 0x34], ax
mov word [esi + 0x36], ax
mov word [esi + 0x20], ax
push eax
mov eax, dword [ecx + 0x370]
push eax
call ebx
mov ecx, dword [esp + 0x10]
add ecx, 0x338
movsx edx, word [esi + 0x34]
mov dword [esi + edx*4 + 0x24], ecx
inc word [esi + 0x34]
push 2
push 0x69
mov ecx, esi
call fcn.00405190
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x40b070
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x144
push ebx
mov ebx, dword [esp + 0x14c]
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
mov byte [ebx], 0
mov dword [esp + 0xc], esi
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x40b0ec
push eax
push 0x26
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp byte [ebx], 0
je 0x40b0ec
push edi
mov edi, str.Internet_ExplorerIEXPLORE.EXE
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
pop edi
test esi, esi
je 0x40b0ec
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 8]
test eax, eax
je 0x40b0fa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
test esi, esi
pop esi
pop ebx
setne al
add esp, 0x144
ret 4
Function at 0x40de60
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
push 0
call fcn.004130cc
push eax
call fcn.0041346c
add esp, 8
mov ecx, esi
push 0
push 2
push 0
call fcn.0040feb0
test eax, eax
jne 0x40debf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x276d
jne 0x40dea6
lea eax, [esp + 4]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
push 2
push 0
mov ecx, esi
call fcn.0040feb0
test eax, eax
jne 0x40debf
pop esi
add esp, 0x190
ret
mov eax, 1
pop esi
add esp, 0x190
ret
Function at 0x40e110
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows

Disassembly:
mov eax, 0x1074
call fcn.004131c0
push ebx
push esi
xor eax, eax
push edi
xor ebx, ebx
mov dword [esp + 0x24], eax
mov ecx, 0x10
lea edi, [esp + 0x40]
mov edx, dword [esp + 0x1088]
mov dword [esp + 0x3c], ebx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x34], ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x38], ecx
mov dword [edx], ebx
push ebx
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0xc
mov dword [esp + 0x38], 1
mov dword [esp + 0x34], ebx
call esi
lea eax, [esp + 0x20]
push ebx
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call esi
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x3c]
push ecx
push edx
push ebx
push ebx
push ebx
push 1
push ebx
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x2c]
push ebx
push str.IPCONFIG.EXE__all
push ebx
mov dword [esp + 0x64], 0x44
mov dword [esp + 0x90], 0x101
mov word [esp + 0x94], bx
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40e20a
pop edi
pop esi
pop ebx
add esp, 0x1074
ret 8
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
mov eax, 0x1000
lea edx, [esp + 0x1c]
push ebx
sub eax, esi
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + esi + 0x88]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x40e24d
add esi, dword [esp + 0x1c]
jmp 0x40e226
mov eax, dword [esp + 0x1084]
lea ecx, [esp + 0x80]
push eax
push ecx
mov byte [esp + esi + 0x88], bl
call fcn.00413880
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x40e2f9
push str.DHCP
push esi
call fcn.00413880
add esp, 8
cmp eax, ebx
je 0x40e2f9
mov edx, eax
sub edx, esi
cmp edx, 0x100
jg 0x40e2f9
push 0x3a
push eax
call fcn.004137c0
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x40e2f9
lea ecx, [esp + 0x80]
sub eax, ecx
cmp eax, 0xffa
ja 0x40e2f9
push 0x41fce8
push esi
mov byte [esi + 6], bl
call fcn.00413880
add esp, 8
test eax, eax
je 0x40e2d9
mov edx, dword [esp + 0x1088]
mov dword [edx], 1
jmp 0x40e2f4
push 0x41fce4
push esi
call fcn.00413880
add esp, 8
test eax, eax
je 0x40e2f9
mov eax, dword [esp + 0x1088]
mov dword [eax], ebx
mov ebx, 1
mov ecx, dword [esp + 0x2c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x1074
ret 8
Function at 0x40e4d0
Capabilities:
Get local ipv4 addresses

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x41b7eb
push eax
mov eax, 0x2014
mov dword fs:[0], esp
call fcn.004131c0
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x7f02
mov dword [esp + 0x1c], ecx
push ebx
mov dword [esp + 0x18], 0x41c4b0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov esi, eax
call dword [sym.imp.USER32.dll_GetCursor]
cmp eax, esi
je 0x40e52a
mov ebp, dword [sym.imp.USER32.dll_SetCursor]
push esi
call ebp
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x40e536
mov ebp, dword [sym.imp.USER32.dll_SetCursor]
mov dword [esp + 0x14], ebx
mov edi, ebx
lea eax, [esp + 0x20]
lea ecx, [esp + 0x24]
mov esi, 0x1000
push eax
push ecx
mov dword [esp + 0x2034], ebx
mov dword [esp + 0x28], esi
call sub.iphlpapi.dll_GetInterfaceInfo
test eax, eax
je 0x40e566
cmp edi, ebx
je 0x40e644
jmp 0x40e641
lea edx, [esp + 0x1c]
lea eax, [esp + 0x1024]
push edx
push eax
mov dword [esp + 0x24], esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
je 0x40e58d
cmp edi, ebx
je 0x40e644
jmp 0x40e641
cmp dword [esp + 0x24], ebx
jle 0x40e63d
lea ebp, [esp + 0x28]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x11c0]
cmp eax, ecx
lea esi, [esp + 0x1024]
je 0x40e5be
mov esi, dword [esi]
test esi, esi
je 0x40e624
cmp eax, dword [esi + 0x19c]
jne 0x40e5b0
mov ecx, dword [esp + 0x18]
push esi
call fcn.0040e330
test eax, eax
je 0x40e624
lea edi, [esi + 0x1b0]
push 3
push 0x41fd30
push edi
call fcn.00413900
add esp, 0xc
test eax, eax
je 0x40e61a
mov esi, str.0.0.0.0
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40e611
test cl, cl
je 0x40e60d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40e611
add eax, 2
add esi, 2
test cl, cl
jne 0x40e5ed
xor eax, eax
jmp 0x40e616
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e620
push ebp
call sub.iphlpapi.dll_IpRenewAddress
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
inc ebx
add ebp, 0x104
cmp ebx, eax
jl 0x40e59b
mov ebp, dword [sym.imp.USER32.dll_SetCursor]
test edi, edi
je 0x40e644
push edi
call ebp
mov ecx, dword [esp + 0x2024]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2020
ret

Function at 0x40e830
Capabilities:
Get mac address on windows

Disassembly:
mov eax, 0x1004
call fcn.004131c0
lea eax, [esp]
push esi
lea ecx, [esp + 8]
push eax
push ecx
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 0x1000
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x40e8a2
mov eax, dword [esp + 0x100c]
mov ecx, dword [esp + 0x1a4]
cmp eax, ecx
je 0x40e87a
mov esi, dword [esi]
test esi, esi
je 0x40e8a2
cmp eax, dword [esi + 0x19c]
jne 0x40e86c
mov edx, dword [esp + 0x1010]
add esi, 0x194
mov eax, dword [esi]
mov dword [edx], eax
mov eax, 1
mov cx, word [esi + 4]
pop esi
mov word [edx + 4], cx
add esp, 0x1004
ret 8
xor eax, eax
pop esi
add esp, 0x1004
ret 8
Function at 0x40e8b0
Capabilities:
Get local ipv4 addresses

Disassembly:
mov eax, 0x1004
call fcn.004131c0
lea eax, [esp]
push esi
lea ecx, [esp + 8]
push eax
push ecx
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 0x1000
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x40e90c
mov eax, dword [0x4219b8]
mov ecx, dword [esp + 0x1a4]
cmp eax, ecx
je 0x40e8f8
mov esi, dword [esi]
test esi, esi
je 0x40e90c
cmp eax, dword [esi + 0x19c]
jne 0x40e8ea
add esi, 0x1b0
push esi
call sub.WS2_32.dll_inet_addr
pop esi
add esp, 0x1004
ret
xor eax, eax
pop esi
add esp, 0x1004
ret

Function at 0x40eaf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [0x421d14]
push ebx
push ebp
push esi
push eax
push ecx
push edx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
test ebp, ebp
jne 0x40eb1a
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10
mov eax, dword [0x421d14]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
jne 0x40eb39
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40eba9
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x40eb75
mov ecx, dword [0x421d14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x20]
push esi
mov bl, 1
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret 0x10
mov eax, dword [esp + 0x20]
mov ecx, dword [0x421d14]
push ebp
push ecx
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp esi, eax
jl 0x40eba5
mov ecx, esi
mov esi, edi
mov edi, dword [esp + 0x1c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov bl, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret 0x10

Function at 0x40ec70
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push str.SoftwareVtionDialer
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40eca5
mov ecx, dword [esp + 8]
mov edx, dword [esp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x40eea0
Capabilities:
Check if file exists

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push 4
push eax
push 4
push edi
mov dword [esp + 0x14], 0
call fcn.0040eef0
add esp, 0x10
test eax, eax
jne 0x40eee4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40eee4
push esi
mov esi, dword [esp + 0x14]
push esi
push edi
call fcn.0040ecb0
add esp, 8
mov eax, esi
pop esi
pop edi
pop ecx
ret
mov eax, dword [esp + 4]
pop edi
pop ecx
ret
Function at 0x40eef0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push str.SoftwareVtionDialer
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40ef12
xor eax, eax
add esp, 0xc
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 4]
push esi
mov dword [esp + 8], edx
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
sete al
pop esi
add esp, 0xc
ret

Function at 0x40ef70
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push str.SoftwareVtionDialer
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40ef8e
xor eax, eax
pop ecx
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret
Function at 0x40f320
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x8a8
push ebx
push ebp
push esi
push edi
mov edi, str.SystemCurrentControlSetServicesClassNetTrans
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xe8]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xe8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x1c], 7
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 0x18]
push ecx
push edx
push reloc.WS2_32.dll_bind
call edi
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x4d0]
push 0x3e8
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x40f44c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x4d0]
lea eax, [esp + 0xe8]
push edx
push str.SystemCurrentControlSetServicesClassNetTrans_
push str._s_s
push eax
mov dword [esp + 0x24], 0xc8
call fcn.004131ef
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0xe8]
push ecx
push edx
push reloc.WS2_32.dll_bind
call edi
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push str.NTEContextList
push eax
call esi
test eax, eax
jne 0x40f4f0
mov ecx, dword [esp + 0x8bc]
lea edx, [esp + 0x22]
push edx
mov ebp, dword [ecx + 0x19c]
call fcn.0041370e
add esp, 4
cmp ebp, eax
je 0x40f464
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x4d0]
inc ebx
push 0x3e8
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x40f39e
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x8a8
ret
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push str.IPAddress
push eax
mov dword [esp + 0x2c], 0xc8
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, str.0.0.0.0
lea eax, [esp + 0x20]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40f4d7
test cl, cl
je 0x40f4c1
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40f4d7
add eax, 2
add esi, 2
test cl, cl
jne 0x40f49d
xor eax, eax
xor ecx, ecx
test eax, eax
pop edi
pop esi
sete cl
pop ebp
mov eax, ecx
pop ebx
add esp, 0x8a8
ret
sbb eax, eax
pop edi
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x8a8
ret
mov edx, dword [esp + 0x8bc]
pop edi
pop esi
pop ebp
mov eax, dword [edx + 0x1a4]
pop ebx
add esp, 0x8a8
ret