joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432019
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x446cfc
je 0x4320d5
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4320bd
mov esi, dword [ebx + 4]
jmp 0x4320b7
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4320a7
cmp dword [ebp - 0xc], 4
jne 0x4320a7
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x43209f
or dword [eax + 0x9c], ecx
jmp 0x4320a7
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x43206b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x43204e
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x4324a6
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x436033
call fcn.0041b960
sub esp, 0x110
mov eax, dword [0x4476d4]
xor eax, dword [ebp + 4]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x432561
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, 0xff
jmp 0x43252a
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402550
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
call fcn.004324a6
mov ecx, dword [ebp - 0x1c]
mov esi, eax
test esi, esi
setne byte [ebp - 0x11]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401eb0
cmp byte [ebp - 0x11], 0
jne 0x43253f
push ebx
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x18]
call edi
mov esi, eax
test esi, esi
je 0x4324ee
cmp esi, 0x103
pop edi
pop ebx
je 0x432551
cmp esi, 0x3f2
jne 0x432561
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
mov eax, esi
pop esi
call fcn.00419d0f
leave
ret 8

Function at 0x432ca5
Capabilities:
Get thread local storage value

Disassembly:
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x432cc2
mov ecx, dword [esp + 4]
cmp ecx, dword [eax + 8]
jge 0x432cc2
mov eax, dword [eax + 0xc]
mov eax, dword [eax + ecx*4]
jmp 0x432cc4
xor eax, eax
ret 4
Function at 0x432dbc
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x432df0
call fcn.004271da
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x432e58
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x432e86
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jl 0x432f21
cmp dword [esp + 0x14], ebx
je 0x432f21
jmp 0x432ec3
push 0x10
call fcn.00432b6a
cmp eax, ebx
je 0x432e9c
mov ecx, eax
call fcn.00432db3
mov esi, eax
jmp 0x432e9e
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ebx, [edi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
push ebx
mov dword [edi + 0x14], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x432eda
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x432eea
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
mov dword [esi + 0xc], eax
jne 0x432ef6
call fcn.004271da
mov eax, dword [esi + 8]
mov ecx, dword [edi + 0xc]
sub ecx, eax
shl ecx, 2
push ecx
mov ecx, dword [esi + 0xc]
lea eax, [ecx + eax*4]
push ebx
push eax
call fcn.0041b980
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax + edx*4], ecx
pop ebx
ret 8
Function at 0x40118e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4011e7
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4011d8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4011d4
cmp esi, ecx
jae 0x4011d8
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x4011c4
cmp esi, ecx
jb 0x4011dc
xor eax, eax
jmp 0x4011e6
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4050c9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47081a
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4932e0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x4932e0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
or ebx, 0xffffffff
cmp dword [ebp + 8], ebx
jne 0x405115
xor eax, eax
jmp 0x405297
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x405143
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x405143
mov eax, dword [ebp + 8]
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x405297
cmp dword [esi + 0x50], 0
je 0x405295
mov ecx, esi
call fcn.004061e5
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [esi + 0x40], ecx
jne 0x405177
push dword [esi + 0x50]
movsx eax, al
push eax
call fcn.004190a3
pop ecx
cmp eax, ebx
cmovne ebx, dword [ebp + 8]
pop ecx
jmp 0x405295
push ecx
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x2c], cl
push 8
lea ecx, [esp + 0x30]
mov byte [esp + 0x1b], al
mov dword [esp + 0x44], 0xf
call fcn.00405c93
and dword [esp + 0x50], 0
lea eax, [esi + 0x48]
mov dword [esp + 0x24], eax
mov edi, dword [esp + 0x3c]
mov esi, dword [esi + 0x40]
cmp edi, 0x10
mov edi, dword [esi]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x2c]
cmovae ecx, dword [esp + 0x2c]
lea edx, [esp + 0x2c]
cmovae edx, dword [esp + 0x2c]
add eax, ecx
push eax
push edx
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x27]
push eax
push dword [esp + 0x3c]
mov ecx, esi
call dword [edi + 0x1c]
test eax, eax
js 0x40528c
cmp eax, 1
jg 0x40526d
mov edi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp edi, 0x10
lea eax, [esp + 0x28]
cmovae eax, ecx
sub edx, eax
mov dword [esp + 0x1c], edx
je 0x40523a
push dword [esi + 0x50]
lea eax, [esp + 0x2c]
push edx
cmp edi, 0x10
cmovae eax, ecx
push 1
push eax
call fcn.00419e59
mov edx, dword [esp + 0x2c]
add esp, 0x10
cmp edx, eax
jne 0x40528c
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0x13]
mov byte [esi + 0x45], 1
cmp dword [esp + 0x20], eax
jne 0x405268
test edx, edx
jne 0x4051a7
cmp dword [esp + 0x38], 0x20
jae 0x40528c
push edx
push 8
lea ecx, [esp + 0x30]
call fcn.00405ba5
jmp 0x4051a3
mov ebx, dword [ebp + 8]
jmp 0x40528c
cmp eax, 3
jne 0x40528c
mov eax, dword [esp + 0x14]
push dword [eax + 0x50]
movsx eax, byte [esp + 0x17]
push eax
call fcn.004190a3
pop ecx
cmp eax, ebx
cmovne ebx, dword [ebp + 8]
pop ecx
lea ecx, [esp + 0x28]
call fcn.004022e0
mov eax, ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004183ae
mov esp, ebp
pop ebp
ret 4
Function at 0x40604d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4707a2
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4932e0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x4932e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x40619a
cmp byte [esi + 0x45], bl
je 0x40619a
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4060b1
xor al, al
jmp 0x40619c
push ebx
push 8
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00405c93
lea eax, [esi + 0x48]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
cmp ecx, 0x10
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
mov ecx, dword [ecx + 0x40]
push eax
mov eax, dword [esp + 0x34]
lea edi, [esp + 0x24]
cmovae edi, edx
lea esi, [esp + 0x24]
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
push dword [esp + 0x24]
call dword [edx + 0x20]
sub eax, ebx
je 0x40611b
dec eax
jne 0x406180
mov esi, dword [esp + 0x14]
jmp 0x406122
mov esi, dword [esp + 0x14]
mov byte [esi + 0x45], bl
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp ecx, 0x10
lea eax, [esp + 0x20]
cmovae eax, edx
sub edi, eax
je 0x406161
push dword [esi + 0x50]
cmp ecx, 0x10
push edi
lea eax, [esp + 0x28]
cmovae eax, edx
push 1
push eax
call fcn.00419e59
add esp, 0x10
cmp edi, eax
jne 0x406189
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x20]
cmp byte [esi + 0x45], 0
je 0x406187
test edi, edi
jne 0x4060e0
push ebx
push 8
lea ecx, [esp + 0x28]
call fcn.00405ba5
jmp 0x4060d8
dec eax
dec eax
jne 0x40618d
inc eax
jmp 0x40618b
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x20]
call fcn.004022e0
mov al, bl
jmp 0x40619c
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004183ae
mov esp, ebp
pop ebp
ret

Function at 0x407151
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x4932e0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
xor ebx, ebx
push 0x124
lea eax, [ebp - 0x130]
push ebx
push eax
mov dword [ebp - 0x134], ebx
call fcn.0041f000
add esp, 0xc
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x134]
push eax
push esi
mov dword [ebp - 0x134], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x4071c9
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp + 8]
call fcn.0040817a
test eax, eax
je 0x4071cf
lea eax, [ebp - 0x134]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4071a8
jmp 0x4071d1
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00401253
mov ecx, dword [ebp - 8]
pop esi
movzx eax, bl
xor ecx, ebp
pop ebx
call fcn.004183ae
leave
ret
Function at 0x4090bc
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4932e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x103
push esi
lea eax, [ebp - 0x107]
push 0
push eax
mov ebx, ecx
mov byte [ebp - 0x108], 0
call fcn.0041f000
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x108]
push eax
mov edi, 0x480d18
lea eax, [ebx + 0x14]
push edi
push eax
call fcn.00402ba1
push esi
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.0041f000
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 0x18
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
call esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea eax, [ebx + 0x18]
push edi
push eax
call fcn.00402ba1
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.0041f000
add esp, 0x18
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
call esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebx + 0x1c]
push edi
push eax
call fcn.00402ba1
mov esi, 0x103
push esi
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.0041f000
add esp, 0x18
mov ecx, ebx
push 0x47fd1c
call fcn.00402506
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x108]
push eax
push 0x104
call edi
lea eax, [ebp - 0x108]
push eax
push str._sfsi
push ebx
call fcn.00402ba1
push esi
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.0041f000
add esp, 0x18
lea esi, [ebx + 0xc]
push 0x47fd1c
mov ecx, esi
call fcn.00402506
lea eax, [ebp - 0x108]
push eax
push 0x104
call edi
push str.4561
lea eax, [ebp - 0x108]
push eax
push str._sfsi_s.exe
push esi
call fcn.00402ba1
mov esi, str.4561
push esi
lea eax, [ebx + 4]
push str._s.exe
push eax
call fcn.00402ba1
push esi
lea eax, [ebx + 8]
push 0x480d18
push eax
call fcn.00402ba1
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.0041f000
add esp, 0x34
lea esi, [ebx + 0x10]
push 0x47fd1c
mov ecx, esi
call fcn.00402506
lea eax, [ebp - 0x108]
push eax
push 0x104
call edi
lea eax, [ebp - 0x108]
push eax
push str._sfsiconfig.ini
push esi
call fcn.00402ba1
add esp, 0xc
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x4092c3
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, ebx
call fcn.00409734
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004183ae
leave
ret
Function at 0x40b552
Capabilities:
Reference http user-agent string

Disassembly:
push 0xc
mov eax, 0x470fbc
call fcn.00463870
mov esi, 0x4941e8
push esi
lea ecx, [ebp - 0x14]
call fcn.0040255b
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x10]
call fcn.0040255b
mov byte [ebp - 4], 1
call fcn.00432af0
mov ebx, eax
test ebx, ebx
je 0x40b63d
push ecx
mov ecx, dword [0x497b7c]
add ecx, 0xfffffff0
mov esi, esp
call fcn.0040280e
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040b4e8
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00402374
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00401253
push str.User_Agent:_Mozilla_5.0__Windows_NT_10.0__WOW64__Trident_7.0__rv:11.0__like_Gecko
push 0
call fcn.00432a30
push str.Content_Type:_application_x_www_form_urlencoded
push eax
call fcn.00432a30
push eax
push 0x2727
push ebx
call fcn.00432b50
mov esi, dword [ebp - 0x10]
add esp, 0x1c
push esi
push 0x2712
push ebx
call fcn.00432b50
add esp, 0xc
push ebx
call fcn.00432b30
pop ecx
mov edi, eax
push edi
push edi
call fcn.00432f80
pop ecx
push eax
lea eax, [ebp - 0x14]
push str._s___d_
push eax
call fcn.00402ba1
add esp, 0x10
test edi, edi
jne 0x40b634
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x497b6c
call fcn.00402374
push ebx
call fcn.00432ad0
pop ecx
jmp 0x40b640
mov esi, dword [ebp - 0x10]
lea ecx, [esi - 0x10]
call fcn.00401253
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00401253
call fcn.0046383e
ret

Function at 0x40b659
Capabilities:
Reference http user-agent string

Disassembly:
push 0xc
mov eax, 0x471133
call fcn.00463870
and dword [ebp - 4], 0
push 3
call fcn.00432b80
call fcn.00432af0
lea ecx, [ebp - 0x10]
mov esi, eax
mov dword [esp], 0x47fd1c
call fcn.00402312
mov byte [ebp - 4], 1
test esi, esi
je 0x40b75a
push 0x481464
mov edx, 0x497b6c
lea ecx, [ebp - 0x18]
call fcn.00408bc3
lea ecx, [ebp + 8]
push ecx
mov edx, eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00408b6e
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00402374
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00401253
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00401253
push str.User_Agent:_Mozilla_5.0__Windows_NT_10.0__WOW64__Trident_7.0__rv:11.0__like_Gecko
push 0
call fcn.00432a30
push str.Content_Type:_application_x_www_form_urlencoded
push eax
call fcn.00432a30
push eax
push 0x2727
push esi
call fcn.00432b50
add esp, 0x1c
cmp dword [ebp + 0xc], 0
jne 0x40b71a
push dword [ebp - 0x10]
push 0x2712
push esi
call fcn.00432b50
add esp, 0xc
jmp 0x40b74c
cmp dword [ebp + 0xc], 1
jne 0x40b74c
push dword [0x497b6c]
push 0x2712
push esi
call fcn.00432b50
push dword [ebp + 8]
push 0x271f
push esi
call fcn.00432b50
push 1
push 0x2f
push esi
call fcn.00432b50
add esp, 0x24
push esi
call fcn.00432b30
push esi
call fcn.00432ad0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00401253
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00401253
xor eax, eax
call fcn.0046383e
ret 0xc
Function at 0x40bfc7
Capabilities:
Persist via run registry key

Disassembly:
push 4
mov eax, 0x471232
call fcn.00463870
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.0040c49e
and dword [ebp - 4], 0
push 0x4941e8
lea ecx, [ebx + 0x30]
call fcn.0040255b
push 0x4941e8
lea ecx, [ebx + 0x34]
mov byte [ebp - 4], 1
call fcn.0040255b
lea ecx, [ebx + 0x38]
push 0x4941e8
mov byte [ebp - 4], 2
call fcn.0040255b
lea ecx, [ebx + 0x3c]
push 0x4941e8
mov byte [ebp - 4], 3
call fcn.0040255b
lea ecx, [ebx + 0x40]
push 0x4941e8
mov byte [ebp - 4], 4
call fcn.0040255b
lea ecx, [ebx + 0x44]
push 0x4941e8
mov byte [ebp - 4], 5
call fcn.0040255b
lea ecx, [ebx + 0x48]
push 0x4941e8
mov byte [ebp - 4], 6
call fcn.0040255b
lea ecx, [ebx + 0x4c]
push 0x4941e8
mov byte [ebp - 4], 7
call fcn.0040255b
lea ecx, [ebx + 0x50]
push 0x4941e8
mov byte [ebp - 4], 8
call fcn.0040255b
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [ebx + 0x30]
mov byte [ebp - 4], 9
call fcn.00402506
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x54], 1
mov dword [ebx + 0x28], reloc.WS2_32.dll_accept
mov dword [ebx + 0x5c], 0xf003f
mov dword [ebx + 0x2c], reloc.WS2_32.dll_bind
call fcn.00402506
mov dword [ebx + 0x58], 4
mov eax, ebx
call fcn.0046383e
ret
Function at 0x40c129
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x4932e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0xfe
lea eax, [ebp - 0x103]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x308], ebx
mov byte [ebp - 0x104], bl
call fcn.0041f000
push 0xfe
lea eax, [ebp - 0x203]
push ebx
push eax
mov byte [ebp - 0x204], bl
call fcn.0041f000
push 0xfe
lea eax, [ebp - 0x303]
push ebx
push eax
mov byte [ebp - 0x304], bl
call fcn.0041f000
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax - 0xc]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30c], ecx
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x104]
push 0xff
push eax
call fcn.0041a563
mov eax, dword [ebp + 0x10]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.0041a563
mov eax, dword [ebp + 0x14]
add esp, 0x44
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x304]
push 0xff
push eax
call fcn.0041a563
add esp, 0x10
lea eax, [ebp - 0x308]
push eax
push dword [esi + 0x5c]
lea eax, [ebp - 0x104]
push ebx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c24b
mov eax, dword [ebp - 0x30c]
inc eax
push eax
lea eax, [ebp - 0x304]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x204]
push ebx
push eax
push dword [ebp - 0x308]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x308]
test eax, eax
je 0x40c243
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c24b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00401253
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00401253
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.00401253
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004183ae
leave
ret 0x14
Function at 0x40c27f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x310
mov eax, 0x47128c
call fcn.004638a3
mov esi, ecx
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x318], eax
push 0xfe
xor ebx, ebx
lea eax, [ebp - 0x30f]
inc ebx
push 0
mov dword [ebp - 4], ebx
push eax
mov byte [ebp - 0x310], 0
call fcn.0041f000
push 0xfe
lea eax, [ebp - 0x20f]
push 0
push eax
mov byte [ebp - 0x210], 0
call fcn.0041f000
push 0xfe
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.0041f000
mov eax, dword [ebp + 0xc]
mov ecx, 0xff
mov dword [ebp - 0x31c], ecx
push dword [eax - 0xc]
push eax
push ecx
lea eax, [ebp - 0x310]
push eax
call fcn.0041a563
mov eax, dword [ebp + 0x10]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x210]
push 0xff
push eax
call fcn.0041a563
add esp, 0x44
lea eax, [ebp - 0x314]
push eax
push dword [esi + 0x5c]
lea eax, [ebp - 0x310]
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c391
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x314]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c391
push dword [ebp - 0x314]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x318]
lea eax, [ebp - 0x110]
push eax
call fcn.00402506
jmp 0x40c393
xor bl, bl
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00401253
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00401253
mov al, bl
call fcn.00463852
ret 0x14

Function at 0x40c7fc
Capabilities:
Get session user name

Disassembly:
push 0x10c
mov eax, 0x471463
call fcn.0046390f
mov esi, ecx
push 0xfe
lea eax, [ebp - 0x113]
push 0
push eax
mov byte [ebp - 0x114], 0
call fcn.0041f000
and dword [ebp - 4], 0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x118], 0xff
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp eax, 1
jne 0x40c863
lea ecx, [ebp - 0x114]
push ecx
mov ecx, esi
call fcn.00402506
mov al, 1
jmp 0x40c871
push str.NULL
mov ecx, esi
call fcn.00402506
xor al, al
call fcn.00463861
ret

Function at 0x40c87d
Capabilities:
Get hostname

Disassembly:
push 0x10c
mov eax, 0x471420
call fcn.0046390f
mov esi, ecx
push 0xfe
lea eax, [ebp - 0x113]
push 0
push eax
mov byte [ebp - 0x114], 0
call fcn.0041f000
and dword [ebp - 4], 0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x118], 0xff
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp eax, 1
jne 0x40c8e5
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [esi + 4]
call fcn.00402506
mov al, 1
jmp 0x40c8f4
push str.NULL
lea ecx, [esi + 4]
call fcn.00402506
xor al, al
call fcn.00463861
ret