joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463ad1
Capabilities:
Encrypt data using dpapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov eax, ecx
mov ebx, edx
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
push esi
push edi
test eax, eax
je 0x463c53
test ebx, ebx
je 0x463c53
mov edi, dword [ebp + 8]
test edi, edi
je 0x463c53
mov dword [ebx], ecx
mov dword [edi], ecx
lea ecx, [ebp - 8]
push ecx
push 0xfffffffffffffffe
pop edx
mov ecx, eax
call fcn.00413cca
mov esi, eax
test esi, esi
jns 0x463b74
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x463c67
test byte [eax + 0x1c], 8
je 0x463c67
cmp byte [eax + 0x19], 2
jb 0x463c67
push esi
push 0x407844
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b540
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.00410eec
jmp 0x463c58
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add eax, 2
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
push 1
xor eax, eax
mov dword [ebp - 0x18], ecx
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x463be4
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x463c58
test byte [eax + 0x1c], 8
je 0x463c58
cmp byte [eax + 0x19], 2
jb 0x463c58
push esi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b540
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xf
pop ecx
call fcn.00412c68
jmp 0x463c58
mov esi, dword [ebp - 0x14]
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp + 8], eax
test eax, eax
jne 0x463c3b
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x463c34
test byte [eax + 0x1c], 8
je 0x463c34
cmp byte [eax + 0x19], 2
jb 0x463c34
push 0x40a1fc
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b540
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.0040f9dc
mov esi, 0x8007000e
jmp 0x463c58
push esi
push dword [ebp - 0x10]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [edi], esi
xor esi, esi
mov dword [ebx], eax
jmp 0x463c58
mov esi, 0x80070057
cmp dword [ebp - 0x10], 0
je 0x463c67
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x463c77
Capabilities:
Encrypt data using dpapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, eax
mov dword [ebp - 0xc], esi
push edi
mov edi, 0x80004001
test ecx, ecx
je 0x463da9
test edx, edx
je 0x463da9
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x463da9
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
push 1
xor eax, eax
mov dword [ebp - 0x10], ecx
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edx
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x463d1b
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x463d88
test byte [eax + 0x1c], 8
je 0x463d88
cmp byte [eax + 0x19], 2
jb 0x463d88
push edi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b540
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.00412c68
jmp 0x463d88
mov esi, dword [ebp - 0xc]
cmp esi, 2
jb 0x463da7
mov eax, dword [ebp - 8]
mov ecx, esi
shr ecx, 1
xor edx, edx
cmp word [eax + ecx*2 - 2], dx
jne 0x463da7
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x463d8f
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x463d83
test byte [eax + 0x1c], 8
je 0x463d83
cmp byte [eax + 0x19], 2
jb 0x463d83
push 0x40a1fc
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b540
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x12
pop ecx
call fcn.0040f9dc
mov edi, 0x8007000e
mov esi, dword [ebp - 0xc]
xor eax, eax
jmp 0x463dae
push esi
push dword [ebp - 8]
push edi
call sub.msvcrt.dll_memcpy
mov esi, dword [ebp - 0xc]
add esp, 0xc
xor eax, eax
mov dword [ebx], edi
mov edi, eax
jmp 0x463dae
xor eax, eax
mov edi, 0x80070057
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x463dc8
test esi, esi
je 0x463dbf
mov byte [ecx], al
inc ecx
dec esi
jne 0x463db9
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x463dd8
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], ecx
and dword [ebp - 4], edi
mov eax, edx
mov dword [ebp - 8], eax
mov esi, 0x80004005
test ecx, ecx
je 0x463f25
test eax, eax
je 0x463f25
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x463f25
and dword [ebx], edi
lea edx, [ebp - 4]
push edx
push edi
push 0x40000001
push eax
push ecx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
jne 0x463e72
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x463f35
test byte [eax + 0x1c], 8
je 0x463f35
cmp byte [eax + 0x19], 2
jb 0x463f35
push esi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b540
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x13
pop ecx
call fcn.00412c68
jmp 0x463f35
mov eax, dword [ebp - 4]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x463eca
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x463ec3
test byte [eax + 0x1c], 8
je 0x463ec3
cmp byte [eax + 0x19], 2
jb 0x463ec3
push 0x40785c
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b540
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x14
pop ecx
call fcn.0040f9dc
mov esi, 0x8007000e
jmp 0x463f35
lea eax, [ebp - 4]
push eax
push edi
push 0x40000001
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
jne 0x463f1f
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x463f2a
test byte [eax + 0x1c], 8
je 0x463f2a
cmp byte [eax + 0x19], 2
jb 0x463f2a
push esi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b540
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x15
pop ecx
call fcn.00412c68
jmp 0x463f2a
mov dword [ebx], edi
xor esi, esi
jmp 0x463f35
mov esi, 0x80070057
test edi, edi
je 0x463f35
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x463f45
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, edx
mov dword [ebp - 8], ecx
xor edx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov esi, 0x80004005
push edi
mov edi, edx
test ecx, ecx
je 0x464099
test eax, eax
je 0x464099
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x464099
push edx
push edx
mov dword [eax], edx
lea eax, [ebp - 4]
push eax
push edx
push 1
push edx
push ecx
mov dword [ebx], edx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x463fe2
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x4640a9
test byte [eax + 0x1c], 8
je 0x4640a9
cmp byte [eax + 0x19], 2
jb 0x4640a9
push esi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b540
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x16
pop ecx
call fcn.00412c68
jmp 0x4640a9
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x464037
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x464030
test byte [eax + 0x1c], 8
je 0x464030
cmp byte [eax + 0x19], 2
jb 0x464030
push 0x40a1fc
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b540
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x17
pop ecx
call fcn.0040f9dc
mov esi, 0x8007000e
jmp 0x4640a9
xor ecx, ecx
lea eax, [ebp - 4]
push ecx
push ecx
push eax
push edi
push 1
push ecx
push dword [ebp - 8]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x46408b
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x46409e
test byte [eax + 0x1c], 8
je 0x46409e
cmp byte [eax + 0x19], 2
jb 0x46409e
push esi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b540
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x18
pop ecx
call fcn.00412c68
jmp 0x46409e
mov eax, dword [ebp - 0xc]
xor esi, esi
mov dword [eax], edi
mov eax, dword [ebp - 4]
mov dword [ebx], eax
jmp 0x4640a9
mov esi, 0x80070057
test edi, edi
je 0x4640a9
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4645d1
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c8
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x1a8], eax
xor esi, esi
lea eax, [ebp - 0x19c]
mov dword [ebp - 0x1a0], esi
push eax
push 0x202
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov dword [ebp - 0x1a4], eax
test eax, eax
jne 0x46466b
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x46472a
test byte [eax + 0x1c], 1
je 0x46472a
cmp byte [eax + 0x19], 2
jb 0x46472a
push ecx
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b59c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.00412c68
jmp 0x46472a
mov ecx, ebx
call fcn.00464768
test eax, eax
jne 0x46472a
cmp dword [ebx + 8], esi
jne 0x464688
cmp dword [ebx + 0xc], esi
je 0x46472a
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c8]
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x1a8]
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x1c8]
mov dword [ebp - 0x1c4], esi
push eax
push esi
push edi
mov dword [ebp - 0x1bc], 6
mov dword [ebp - 0x1c0], 1
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
mov ecx, eax
test ecx, ecx
je 0x46470b
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x46472a
test byte [eax + 0x1c], 1
je 0x46472a
cmp byte [eax + 0x19], 2
jb 0x46472a
push ecx
push edi
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b59c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.0041d87e
jmp 0x46472a
mov edi, dword [ebp - 0x1a0]
test edi, edi
je 0x46473f
test esi, esi
jne 0x46472a
push edi
mov ecx, ebx
call fcn.00464908
mov edi, dword [edi + 0x1c]
mov esi, eax
test edi, edi
jne 0x464715
cmp dword [ebp - 0x1a0], 0
je 0x46473f
push dword [ebp - 0x1a0]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
cmp dword [ebp - 0x1a4], 0
je 0x46474e
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468719
mov esp, ebp
pop ebp
ret 4
Function at 0x464768
Capabilities:
Get local ipv4 addresses

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [edi], esi
je 0x464783
xor eax, eax
jmp 0x4648c8
cmp dword [edi + 4], esi
jne 0x464790
mov eax, dword [edi + 0x28]
jmp 0x4648c8
lea ebx, [edi + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi], esi
jne 0x4648b6
mov ecx, edi
call fcn.004648d4
lea eax, [ebp - 4]
push eax
push dword [edi + 8]
push esi
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
push 0x2e
push 2
call esi
cmp eax, 0x6f
jne 0x4647e4
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [edi + 8], eax
pop ecx
test eax, eax
je 0x46485d
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 0x2e
push 2
call esi
lea esi, [eax - 0xe8]
neg esi
sbb esi, esi
and esi, eax
je 0x46482e
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x4648b6
test byte [eax + 0x1c], 1
je 0x4648b6
cmp byte [eax + 0x19], 2
jb 0x4648b6
push esi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xf
jmp 0x4648ab
and dword [ebp - 4], 0
lea eax, [ebp - 4]
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
push eax
push dword [edi + 0xc]
push 0
push 0x2e
push 0x17
call esi
cmp eax, 0x6f
jne 0x46486f
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [edi + 0xc], eax
pop ecx
test eax, eax
jne 0x464862
push 0xe
pop esi
jmp 0x4648b6
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 0x2e
push 0x17
call esi
lea esi, [eax - 0xe8]
neg esi
sbb esi, esi
and esi, eax
je 0x4648b6
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x4648b6
test byte [eax + 0x1c], 1
je 0x4648b6
cmp byte [eax + 0x19], 2
jb 0x4648b6
push esi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
mov edx, 0x40b59c
pop ecx
call fcn.00412c68
xor ecx, ecx
test esi, esi
push ebx
sete cl
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4654d9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov ebx, edx
xor edi, edi
call fcn.00465114
mov esi, eax
test esi, esi
jne 0x465525
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x46554b
test byte [eax + 0x1c], 8
je 0x46554b
cmp byte [eax + 0x19], 2
jb 0x46554b
call fcn.00464e47
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b650
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x30
pop ecx
call fcn.004110b1
jmp 0x46554b
push 5
movzx eax, bx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x46554b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46554b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x465f0d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, 0x46ba84
mov dword [0x46ba88], eax
call fcn.00466252
mov esi, eax
test esi, esi
jns 0x465f69
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x465f80
test byte [eax + 0x1c], 8
je 0x465f80
cmp byte [eax + 0x19], 2
jb 0x465f80
push esi
push 0x40b720
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b78c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x46
pop ecx
call fcn.00410eec
jmp 0x465f80
mov eax, 0x46ba8c
xor esi, esi
mov dword [0x46ba90], esi
mov dword [0x46ba94], eax
mov dword [0x46ba8c], eax
mov eax, esi
pop esi
ret

Function at 0x466053
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x46aae0]
push ebx
mov ebx, 0x46a020
push esi
mov esi, 0x80004005
push edi
cmp eax, 1
je 0x466076
cmp eax, 3
je 0x466076
mov eax, dword [0x46a020]
jmp 0x4660ec
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x46baac], eax
call fcn.00465f0d
mov esi, eax
test esi, esi
jns 0x4660c7
mov eax, dword [0x46a020]
cmp eax, ebx
je 0x4660e8
test byte [eax + 0x1c], 8
je 0x4660e8
cmp byte [eax + 0x19], 2
jb 0x4660e8
push esi
push 0x40b79c
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b864
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.00410eec
jmp 0x4660e3
mov edi, 0x46baa0
mov dword [0x46aae0], 2
xor eax, eax
xor esi, esi
mov dword [0x46ba98], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x46a020]
test esi, esi
jns 0x46611f
cmp eax, ebx
je 0x46611a
test byte [eax + 0x1c], 1
je 0x46611a
cmp byte [eax + 0x19], 2
jb 0x46611a
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b864
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.004110b1
call fcn.0046612a
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x467165
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp + 8]
xor esi, esi
push eax
push esi
push edx
push ecx
mov dword [ebp - 4], esi
mov dword [edi], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x4671c7
test eax, eax
jg 0x4671a1
mov esi, eax
jmp 0x4671aa
movzx esi, ax
or esi, 0x80070000
test esi, esi
js 0x4671c7
cmp dword [ebp + 8], 4
je 0x4671bb
mov esi, 0x8007000d
jmp 0x4671c7
cmp dword [ebp - 4], 0
jne 0x4671c7
mov dword [edi], 1
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4671d6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push esi
mov esi, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp + 8]
mov dword [esi], 1
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x467211
xor eax, eax
jmp 0x467237
test eax, eax
jle 0x46721f
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x467237
cmp dword [ebp + 8], 4
je 0x46722e
mov eax, 0x8007000d
jmp 0x467237
cmp dword [ebp - 4], 0
jne 0x467237
and dword [esi], 0
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4674e7
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x46bab8]
test esi, esi
jne 0x4675d5
push edi
mov edi, 0x11c
lea eax, [ebp - 0x120]
push edi
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
call edi
test eax, eax
jne 0x46754e
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call edi
mov eax, dword [ebp - 0x110]
mov dword [0x46bab8], esi
pop edi
dec eax
je 0x4675af
dec eax
jne 0x4675d5
cmp dword [ebp - 0x11c], 5
jne 0x46759d
mov eax, dword [ebp - 0x118]
sub eax, esi
je 0x467599
dec eax
je 0x46758e
dec eax
je 0x46757f
push 0x14
pop esi
jmp 0x4675cf
cmp word [ebp - 0xc], 1
jb 0x467589
push 0x10
pop esi
or esi, 4
jmp 0x4675cf
cmp word [ebp - 0xc], 2
jb 0x467589
push 8
jmp 0x467588
push 4
jmp 0x46757c
cmp dword [ebp - 0x11c], 4
ja 0x4675e6
push 2
pop esi
mov dword [0x46bab8], esi
cmp dword [ebp - 0x11c], 4
jne 0x4675d5
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x4675cc
cmp eax, 0xa
je 0x4675cc
cmp eax, 0x5a
jne 0x4675d5
xor esi, esi
inc esi
mov dword [0x46bab8], esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00468719
mov esp, ebp
pop ebp
ret
push 0x20
jmp 0x46757c
Function at 0x4684ec
Capabilities:
Terminate process

Disassembly:
call fcn.00468e48
jmp 0x4684fb
push 0x58
push 0x469170
call fcn.00468abc
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov edi, dword [eax + 4]
mov esi, ebx
mov edx, 0x46bedc
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x46854a
cmp eax, edi
jne 0x46855d
xor esi, esi
inc esi
cmp dword [0x46bee0], 1
jne 0x46856a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4685a0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x468532
cmp dword [0x46bee0], ebx
jne 0x468596
mov dword [0x46bee0], 1
push 0x401030
push 0x401024
call fcn.004686e4
pop ecx
pop ecx
test eax, eax
je 0x4685a0
jmp 0x4686cd
mov dword [0x46ab88], 1
cmp dword [0x46bee0], 1
jne 0x4685c4
push 0x401020
push 0x401004
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x46bee0], 2
test esi, esi
jne 0x4685d1
xor eax, eax
mov ecx, 0x46bedc
xchg dword [ecx], eax
cmp dword [0x46beec], 0
je 0x4685f3
push 0x46beec
call fcn.00468d40
pop ecx
test eax, eax
je 0x4685f3
push ebx
push 2
push ebx
call dword [0x46beec]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x468650
test cl, cl
je 0x46860f
test edi, edi
jne 0x468650
mov al, byte [esi]
test al, al
je 0x46861f
cmp al, 0x20
ja 0x46861f
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x46860f
test byte [ebp - 0x3c], 1
je 0x46862b
movzx eax, word [ebp - 0x38]
jmp 0x46862e
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x46ab84], eax
cmp dword [0x46ab9c], 0
jne 0x4686a9
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x468661
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x468674
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x468600
cmp dword [0x46ab88], 0
jne 0x4686bd
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x46ab84]
mov dword [ebp - 4], 0xfffffffe
jmp 0x4686d9
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00468b01
ret

Function at 0x468c37
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4691b8
call fcn.00468abc
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x468c97
cmp eax, 0xffffffff
je 0x468c97
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x468c90
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x468c90
cmp edx, 0x10000000
jae 0x468c90
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x468c8d
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.00468b01
ret 4
Function at 0x468cf0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x468d2e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x468d26
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x468d30
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x468d16
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x468e10
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x468e26
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x468e41
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x4030eb
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0x2c
push 1
mov ebx, 0x1bc
call fcn.00433b60
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403137
push ebx
call fcn.004327ee
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x403148
add eax, 8
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_GetNativeSystemInfo]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403165
push 6
call fcn.004327d6
add esp, 4
push 0
push 0
push 0
push 0x80000301
push 0
push 3
push reloc.WSOCK32.dll_getpeername
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40318a
mov eax, 0x466391
push eax
push 3
mov ebx, 0x19c
call fcn.004339c0
add esp, 0x28
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, 0x80000101
jne 0x4031be
and eax, 0xff
jmp 0x403209
cmp ecx, 0x80000201
jne 0x4031c9
cwde
jmp 0x403209
cmp ecx, 0x80000301
je 0x403209
cmp ecx, 0x80000401
je 0x403209
mov dword [ebp - 0x1c], eax
cmp ecx, 0x80000501
je 0x4031f9
cmp ecx, 0x80000601
je 0x4031fe
push 2
call fcn.004327d6
add esp, 4
fld dword [ebp - 0x1c]
jmp 0x403204
mov dword [ebp - 0x18], edx
fld qword [ebp - 0x1c]
call fcn.00402ea1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
je 0x403224
cmp dword [ebp - 8], 9
je 0x403224
xor eax, eax
jmp 0x403229
mov eax, 1
jmp 0x40322e
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40323f
push ebx
call fcn.004327ee
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret