joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463be0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0x664
mov eax, dword [0x4b39fc]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
mov esi, dword [esp + 0x670]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x262]
push ecx
mov word [esp + 0x264], ax
call fcn.00477820
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x476]
push eax
mov word [esp + 0x478], dx
call fcn.00477820
push esi
push 0x4923fc
lea ecx, [esp + 0x480]
push 0x208
push ecx
call fcn.00463bb0
add esp, 0x28
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x463d43
lea ecx, [esp + 8]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x463d35
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [esp + 0x10], 0x10
je 0x463ce6
cmp word [esp + 0x3c], 0x2e
je 0x463d1f
lea edx, [esp + 0x3c]
push edx
push esi
push 0x492408
lea eax, [esp + 0x26c]
push 0x208
push eax
call fcn.00463bb0
add esp, 0x14
push 0x80
lea ecx, [esp + 0x264]
push ecx
call edi
lea edx, [esp + 0x260]
push edx
call fcn.00463be0
add esp, 4
jmp 0x463d1f
lea eax, [esp + 0x3c]
push eax
push esi
push 0x492414
lea ecx, [esp + 0x26c]
push 0x208
push ecx
call fcn.00463bb0
add esp, 0x14
push 0x80
lea edx, [esp + 0x264]
push edx
call edi
lea eax, [esp + 0x260]
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x463c92
pop edi
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x668]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004771de
add esp, 0x664
ret
Function at 0x464410
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x49019b
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push esi
mov eax, dword [0x4b39fc]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x88c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 8]
push edx
call eax
push eax
lea ecx, [esi + 0x8c4]
mov dword [esp + 0x98], 0
call fcn.00402180
lea ecx, [esp + 8]
mov dword [esp + 0x94], 0xffffffff
call fcn.00401f10
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
mov dword [0x4b6950], edx
mov dword [0x4b6920], ecx
mov ecx, dword [eax]
mov dword [0x4b6948], ecx
movzx edx, word [eax + 4]
mov eax, dword [esp + 0xa8]
mov dword [0x4b6944], eax
mov eax, dword [esp + 0xac]
mov word [0x4b694c], dx
mov ecx, dword [eax]
mov dword [0x4b693c], ecx
movzx edx, word [eax + 4]
mov eax, dword [esp + 0xb0]
mov dword [0x4b6938], eax
mov eax, dword [esp + 0xb4]
mov word [0x4b6940], dx
mov ecx, dword [eax]
mov dword [0x4b6930], ecx
movzx edx, word [eax + 4]
mov word [0x4b6934], dx
mov ecx, dword [esi + 0x8a4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x104]
push 0
call edx
push 0
push 0
push 0
push 0x464360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4b6924], eax
mov eax, 1
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x90
ret 0x1c
Function at 0x4655d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48f5fb
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x4b39fc]
xor eax, esp
mov dword [esp + 0x84], eax
push esi
push edi
mov eax, dword [0x4b39fc]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x89c]
lea ecx, [eax + 0x6c0]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
test eax, eax
jl 0x4656db
mov esi, dword [esi + 0x89c]
mov edx, dword [esi + 0x550]
lea ecx, [esi + 0x550]
push eax
mov eax, dword [edx]
call eax
test eax, eax
je 0x4656e0
mov edx, dword [eax + 0x550]
lea ecx, [eax + 0x550]
mov eax, dword [edx]
push 1
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x28]
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call edx
sub esp, 0x84
mov edi, esp
push 0x492884
push 0x104
mov ecx, 0x21
lea esi, [esp + 0x98]
push 0x4b7178
mov dword [esp + 0x12c], 0
rep movsd dword es:[edi], dword [esi]
call fcn.00463bb0
push 0x4b7178
call fcn.00467d80
add esp, 0x94
push 1
lea ecx, [esp + 0x10]
call fcn.00401f50
push eax
push 0
push 0
push 0x492898
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0xc]
mov dword [esp + 0x9c], 0xffffffff
call fcn.00401f10
mov eax, 1
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.004771de
add esp, 0x94
ret
Function at 0x465820
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x48da0b
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4b39fc]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b39fc]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x30]
push str.driverCombo
mov ecx, edi
call fcn.0040a450
push str.CmpNameCntTypeEdit
mov ecx, edi
mov dword [esi + 0x8a8], eax
call fcn.0040a450
push str.IPcntTypeEdit
mov ecx, edi
mov dword [esi + 0x8ac], eax
call fcn.0040a450
push str.opt_ClickComputer
mov ecx, edi
mov dword [esi + 0x8b0], eax
call fcn.0040a450
push str.opt_ClickIpaddress
mov ecx, edi
mov dword [esi + 0x8b4], eax
call fcn.0040a450
mov ecx, dword [esi + 0x8ac]
mov edx, dword [esi + 0x8bc]
mov dword [esi + 0x8b8], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
push edx
call eax
mov ecx, dword [esi + 0x8b0]
mov edx, dword [ecx]
mov eax, dword [esi + 0x8c0]
mov edx, dword [edx + 0x2c]
push eax
call edx
mov ecx, dword [esi + 0x8ac]
mov eax, dword [ecx]
mov edx, dword [eax + 0x104]
push 0
call edx
mov ecx, dword [esi + 0x8b0]
mov eax, dword [ecx]
mov edx, dword [eax + 0x104]
push 0
call edx
mov ebp, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call ebp
xor ecx, ecx
mov edi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00476c60
add esp, 4
push eax
push edi
mov dword [esp + 0x1c], eax
call ebp
mov ebp, 0x5a
mov ebx, ebp
mov edi, dword [esp + 0x14]
cmp word [edi], 0
je 0x46597a
lea ecx, [ecx]
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
movzx eax, word [edi]
cmp ax, bp
je 0x4659dd
mov eax, edi
lea edx, [eax + 2]
jmp 0x465960
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x465960
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 + 2], cx
lea edi, [edi + eax*2 + 2]
jne 0x465940
push 0x568
call fcn.004776e1
add esp, 4
mov dword [esp + 0x18], eax
xor edi, edi
mov dword [esp + 0x68], edi
cmp eax, edi
je 0x46599e
mov ecx, eax
call fcn.00413610
mov edi, eax
push ebx
push 0x492960
lea eax, [esp + 0x24]
push 0x20
push eax
mov dword [esp + 0x78], 0xffffffff
call fcn.004649e0
mov edx, dword [edi]
mov edx, dword [edx + 0x2c]
add esp, 0x10
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call edx
mov eax, dword [esi + 0x8a8]
lea ecx, [eax + 0x550]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push edi
call edx
add ebp, 0xffff
dec ebx
cmp bp, 0x41
jae 0x465933
mov esi, dword [esi + 0x8a8]
mov eax, dword [esi + 0x698]
mov edx, dword [eax + 0xc]
lea ecx, [esi + 0x698]
push 0
push 0
call edx
mov eax, dword [esp + 0x14]
push eax
call fcn.00478198
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004771de
add esp, 0x58
ret
Function at 0x465a40
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0xb8
mov eax, dword [0x4b39fc]
xor eax, esp
mov dword [esp + 0xb4], eax
push esi
xor esi, esi
push edi
mov edi, ecx
push 0x49297c
mov dword [esp + 0x34], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
call fcn.00467d80
mov edi, dword [edi + 0x898]
mov eax, dword [edi + 0x550]
mov edx, dword [eax + 0x20]
lea ecx, [edi + 0x550]
add esp, 4
call edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x18]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x30]
push eax
push 0x1f6
push esi
call sub.NETAPI32.dll_NetShareEnum
test eax, eax
jne 0x465c28
cmp dword [esp + 0x10], 1
mov ecx, dword [esp + 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 0x18], 1
jb 0x465c1e
push ebx
push ebp
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [eax]
push 0xffffffffffffffff
lea edx, [esp + 0x34]
push edx
push 1
push ecx
push esi
call sub.NETAPI32.dll_NetConnectionEnum
test eax, eax
jne 0x465c04
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x14], esi
jbe 0x465bfa
mov ebp, dword [esp + 0x24]
add ebp, 0x10
push 0x40
lea edx, [esp + 0x88]
push esi
push edx
call fcn.00477820
mov eax, dword [ebp - 8]
push eax
push 0x492994
lea ecx, [esp + 0x98]
push 0x40
push ecx
call fcn.004649e0
mov esi, dword [ebp]
mov eax, 0x91a2b3c5
imul esi
add edx, esi
sar edx, 0xb
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x88888889
imul esi
add edx, esi
mov ebx, edi
shl ebx, 4
sar edx, 5
sub ebx, edi
mov eax, edx
shr eax, 0x1f
add ebx, ebx
push 0x40
add eax, edx
add ebx, ebx
lea ecx, [esp + 0x64]
sub eax, ebx
push 0
push ecx
mov dword [esp + 0x58], eax
call fcn.00477820
mov eax, dword [esp + 0x58]
add ebx, eax
mov edx, ebx
shl edx, 4
sub edx, ebx
add edx, edx
add edx, edx
sub esi, edx
push esi
push eax
push edi
push 0x49299c
lea eax, [esp + 0x7c]
push 0x40
push eax
call fcn.004649e0
mov edx, dword [ebp + 4]
add esp, 0x40
lea ecx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [ecx + 0x18]
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x8c]
push eax
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.00464040
mov eax, dword [esp + 0x1c]
inc eax
add ebp, 0x1c
xor esi, esi
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x14]
jb 0x465b22
mov ecx, dword [esp + 0x24]
push ecx
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [esp + 0x20]
add dword [esp + 0x10], 0x28
inc eax
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x18]
jbe 0x465ae0
pop ebp
pop ebx
mov edx, dword [esp + 0x20]
push edx
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.004771de
add esp, 0xb8
ret
Function at 0x466f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48dbab
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4b39fc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00401350
push 0x53
lea ecx, [esi + 0x14]
mov dword [esi + 0x10], vtable.DuiLib::CNotifyPump.0
call fcn.004028b0
mov dword [esi + 0x20], vtable.DuiLib::INotifyUI.0
mov dword [esi + 0x24], vtable.DuiLib::IMessageFilterUI.0
mov dword [esi + 0x28], vtable.DuiLib::IDialogBuilderCallback.0
mov dword [esi + 0x2c], vtable.DuiLib::IQueryControlText.0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.DuiLib::WindowImplBase.5.0
mov dword [esi + 0x10], vtable.DuiLib::WindowImplBase.4.0
mov dword [esi + 0x20], vtable.DuiLib::WindowImplBase.3.0
mov dword [esi + 0x24], vtable.DuiLib::WindowImplBase.2.0
mov dword [esi + 0x28], vtable.DuiLib::WindowImplBase.1.0
mov dword [esi + 0x2c], vtable.DuiLib::WindowImplBase.0
call fcn.00403a10
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x467d00
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x467d6e
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x467d10
sub eax, edx
push edi
mov edi, eax
cmp edi, 1
jl 0x467d6d
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x467d6d
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x467d6d
push esi
lea eax, [edi + 1]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x467d6c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push ebx
push eax
call fcn.004779c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop esi
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
pop ebx
ret

Function at 0x467d90
Capabilities:
Create process on windows

Disassembly:
movzx eax, word [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push 0
push ecx
push edx
push 0x492d04
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x467db0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
mov esi, dword [esp + 0x5c]
test esi, esi
jne 0x467dc3
xor eax, eax
pop esi
add esp, 0x54
ret
push 0x40
lea eax, [esp + 0x1c]
push 0
push eax
mov dword [esp + 0x20], 0
call fcn.00477820
add esp, 0xc
xor eax, eax
xor ecx, ecx
lea edx, [esp + 4]
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push esi
push ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x68], 1
mov word [esp + 0x6c], cx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x467e3c
cmp dword [esp + 0x60], 0
je 0x467e3c
mov ecx, dword [esp + 4]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x467e3c
mov esi, 1
mov eax, esi
pop esi
add esp, 0x54
ret

Function at 0x467f70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0xc], ebx
cmp dword [0x4b77cc], ebx
je 0x467f8a
cmp dword [0x4b77d0], ebx
ja 0x467fe5
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x492d10
mov esi, eax
push 0xb
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4680a9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4680a9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x4b77cc], eax
test eax, eax
je 0x4680a9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x4b77d0], eax
test eax, eax
jbe 0x4680a9
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4680a9
push ebp
push eax
call fcn.00463200
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4680a1
mov byte [ebp + 8], bl
lea edx, [eax + 1]
jmp 0x468010
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x468010
sub eax, edx
mov esi, eax
test esi, esi
jle 0x468098
mov eax, dword [0x4b77cc]
push ebp
push eax
call fcn.00478360
add esp, 8
test eax, eax
je 0x468098
lea ebx, [eax + esi + 1]
push 0x492d20
push ebx
call fcn.00478360
add esp, 8
test eax, eax
jne 0x468056
push eax
push ebx
call fcn.004782a0
add esp, 8
test eax, eax
je 0x468094
sub eax, ebx
inc eax
mov edi, eax
cmp edi, 1
jle 0x468094
push edi
call fcn.00476c60
push edi
mov esi, eax
push 0
push esi
call fcn.00477820
dec edi
push edi
push ebx
push esi
call fcn.004779c0
push esi
call fcn.00463270
add esp, 0x20
mov dword [esp + 0x10], eax
test esi, esi
je 0x468094
push esi
call fcn.00478198
add esp, 4
mov ebx, dword [esp + 0x10]
push ebp
call fcn.00478198
add esp, 4
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x46e390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48e53b
mov eax, dword fs:[0]
push eax
sub esp, 0x890
mov eax, dword [0x4b39fc]
xor eax, esp
mov dword [esp + 0x88c], eax
push esi
push edi
mov eax, dword [0x4b39fc]
xor eax, esp
push eax
lea eax, [esp + 0x89c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x8ac]
mov edi, dword [esp + 0x8b0]
lea ecx, [esp + 0xc]
call fcn.0046e230
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0x81
push 0x96c80000
push 0
push esi
lea ecx, [esp + 0x30]
mov dword [esp + 0x8c8], 0
call fcn.00401370
push str.content
lea ecx, [esp + 0x40]
call fcn.0040a450
test eax, eax
je 0x46e433
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x2c]
push edi
call eax
lea ecx, [esp + 0xc]
call fcn.00401570
push 1
lea ecx, [esp + 0x10]
call fcn.00401440
lea ecx, [esp + 0xc]
mov dword [esp + 0x8a4], 0xffffffff
mov dword [esp + 0xc], vtable.MsgBox.5.0
mov dword [esp + 0x1c], vtable.MsgBox.4.0
mov dword [esp + 0x2c], vtable.MsgBox.3.0
mov dword [esp + 0x30], vtable.MsgBox.2.0
mov dword [esp + 0x34], vtable.MsgBox.1.0
mov dword [esp + 0x38], vtable.MsgBox.0
call fcn.00462f70
mov ecx, dword [esp + 0x89c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x88c]
xor ecx, esp
call fcn.004771de
add esp, 0x89c
ret
Function at 0x46e840
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x124
mov eax, dword [0x4b39fc]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push ebp
mov ebp, dword [esp + 0x138]
push esi
mov esi, dword [esp + 0x134]
push edi
push 0xf4
push 0
push ebp
call fcn.00477820
mov eax, dword [esp + 0x148]
lea edi, [esi + eax]
add esi, 0xc
mov dword [esp + 0x1c], esi
push 0x100
lea eax, [esp + 0x40]
lea esi, [esp + 0x20]
mov dword [esp + 0x28], edi
call fcn.0046e790
mov esi, dword [esp + 0x20]
movzx eax, word [esi]
mov ebx, dword [sym.imp.WS2_32.dll_ntohs]
add esp, 0x10
push eax
add esi, 2
call ebx
movzx eax, word [esi]
push eax
call ebx
movzx eax, word [esi + 6]
add esi, 6
push eax
add esi, 2
call ebx
movzx ecx, ax
mov edx, edi
sub edx, esi
cmp ecx, edx
jle 0x46e8d5
xor eax, eax
jmp 0x46e9e6
movzx eax, byte [esi]
inc esi
test eax, eax
jl 0x46e8ce
cmp eax, 0xa
lea ecx, [eax + eax*8]
lea ecx, [esi + ecx*2]
mov dword [esp + 0x14], ecx
jle 0x46e8f1
mov eax, 0xa
lea edx, [eax + eax*8]
lea eax, [esi + edx*2]
mov dword [esp + 0x10], eax
cmp esi, eax
jae 0x46e98b
mov eax, dword [ebp + 0xec]
mov ecx, eax
inc eax
imul ecx, ecx, 0x17
mov dword [ebp + 0xec], eax
xor eax, eax
mov word [esp + 0x2c], ax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov edx, dword [esi]
mov dword [esp + 0x1c], edx
mov eax, dword [esi + 4]
mov dword [esp + 0x20], eax
lea edi, [ecx + ebp + 6]
mov ecx, dword [esi + 8]
mov dword [esp + 0x24], ecx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x28], edx
mov ax, word [esi + 0x10]
mov word [esp + 0x2c], ax
mov ecx, dword [esp + 0x2c]
push ecx
call ebx
mov word [edi + 0x11], ax
mov dl, byte [esp + 0x2b]
push 0xf
lea eax, [esp + 0x20]
push eax
push edi
mov byte [edi + 0x10], dl
call fcn.004783f0
add esi, 0x12
add esp, 0xc
mov byte [edi + 0xf], 0
cmp esi, dword [esp + 0x10]
jb 0x46e903
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sub edi, ecx
cmp edi, 0x2e
jl 0x46e9c1
mov edx, dword [ecx]
cmp edx, dword [0x493f78]
jne 0x46e9a8
cmp byte [ecx + 4], 0
jne 0x46e9a8
cmp byte [ecx + 5], 0
je 0x46e9c1
mov eax, edx
mov dword [ebp], eax
mov cx, word [ecx + 4]
mov word [ebp + 4], cx
mov dword [ebp + 0xf0], 1
jmp 0x46e9cb
mov dword [ebp + 0xf0], 0
cmp dword [ebp + 0xec], 0
jg 0x46e9e1
cmp dword [ebp + 0xf0], 0
jle 0x46e8ce
mov eax, 1
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004771de
add esp, 0x124
ret
Function at 0x46ea00
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
mov esi, eax
test esi, esi
jne 0x46ea0f
pop esi
add esp, 0x54
ret
push 0x40
lea eax, [esp + 0x1c]
push 0
push eax
mov dword [esp + 0x20], 0
call fcn.00477820
add esp, 0xc
xor eax, eax
xor ecx, ecx
lea edx, [esp + 4]
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push esi
push ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x68], 1
mov word [esp + 0x6c], cx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x46ea88
cmp dword [esp + 0x5c], 0
je 0x46ea88
mov ecx, dword [esp + 4]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x46ea88
mov esi, 1
mov eax, esi
pop esi
add esp, 0x54
ret

Function at 0x46ea90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push eax
push 0x101
push 0
push ecx
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46eae8
mov eax, dword [esp + 4]
test eax, eax
je 0x46eaf7
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 4]
push edx
push 0x4b37b4
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 4]
test eax, eax
je 0x46eaf7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 0xc
ret

Function at 0x46eb00
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
lea ecx, [esp + 8]
push ecx
xor eax, eax
push 0x102
push eax
push edi
push ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call ebp
mov esi, eax
cmp esi, 2
jne 0x46eb61
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0x100
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x46eb90
lea ecx, [esp + 8]
push ecx
push 0x102
push eax
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x46eb90
mov eax, dword [esp + 8]
test eax, eax
je 0x46eb90
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 4
push edx
push 4
push esi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
pop ebp
add esp, 8
ret
Function at 0x46eba0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
lea ecx, [esp + 8]
push ecx
xor eax, eax
push 0x102
push eax
push edi
push ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call ebp
mov esi, eax
cmp esi, 2
jne 0x46ec01
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0x100
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x46ec33
lea ecx, [esp + 8]
push ecx
push 0x102
push eax
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x46ec33
mov eax, dword [esp + 8]
test eax, eax
je 0x46ec33
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push ecx
push 1
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
pop ebp
add esp, 8
ret