joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48628c
Capabilities:
Hide graphical window
Manipulate console buffer

Disassembly:
add esp, 0xfffffef8
call sub.KERNEL32.DLL_AllocConsole
mov eax, dword [0x48e664]
cmp byte [eax], 0
jne 0x4862d0
push 0x104
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetConsoleTitleA
push 0
lea eax, [esp + 8]
push eax
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x48e5cc]
mov eax, dword [eax]
call fcn.0047d704
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
mov edx, dword [0x48e744]
mov dword [edx], eax
mov word [esp], 0x1f4
mov word [esp + 2], 0x32
push dword [esp]
mov eax, dword [0x48e744]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_SetConsoleScreenBufferSize
mov word [esp], 0
mov word [esp + 2], 0
push dword [esp]
mov eax, dword [0x48e744]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_SetConsoleCursorPosition
add esp, 0x108
ret

Function at 0x486320
Capabilities:
Hide graphical window

Disassembly:
add esp, 0xfffffefc
mov eax, dword [0x48e664]
cmp byte [eax], 0
jne 0x48635f
push 0x104
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetConsoleTitleA
push 0
lea eax, [esp + 4]
push eax
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x48e5cc]
mov eax, dword [eax]
call fcn.0047d704
add esp, 0x104
ret
Function at 0x486f64
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, 0x1f4
mov eax, ebx
mov edx, 0x1f4
call fcn.00405150
mov word [ebp - 4], 0
mov word [ebp - 2], di
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
mov eax, ebx
call fcn.0040501c
push eax
mov eax, dword [0x48e744]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_ReadConsoleOutputCharacterA
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4870b0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48719b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403528
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 2
mov ecx, dword [0x48e504]
mov ecx, dword [ecx]
lea eax, [ebp - 0x60]
mov edx, 0x4871b4
call fcn.00404e10
mov eax, dword [ebp - 0x60]
call fcn.00404fc4
mov dword [ebp - 0x40], eax
mov eax, dword [0x48e700]
push dword [eax]
push 0x4871d0
mov eax, dword [0x48e504]
push dword [eax]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404e84
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [0x48e700]
mov eax, dword [eax]
call fcn.00404fc4
push eax
push 0
push 0x4000000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404fc4
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4871a2
lea eax, [ebp - 0x60]
call fcn.00404b04
lea eax, [ebp - 4]
call fcn.00404b04
ret
Function at 0x488748
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.00404fc4
mov edi, eax
push edi
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
test ebx, 1
jbe 0x48876e
dec ebx
push ebx
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
pop edi
pop esi
pop ebx
ret

Function at 0x488774
Capabilities:
Create process on windows
Create process suspended
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404fb4
xor eax, eax
push ebp
push 0x488890
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403528
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 2
mov eax, 0x4888a0
mov dword [ebp - 0x40], eax
mov eax, dword [0x48e504]
mov edx, dword [ebp - 4]
call fcn.00404b58
lea eax, [ebp - 4]
call fcn.00481eb8
mov eax, dword [0x48e700]
mov eax, dword [eax]
call fcn.00409c10
mov eax, dword [ebp - 4]
call fcn.00488748
push 0
push 0x4888a0
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [0x48e700]
mov eax, dword [eax]
call fcn.00404fc4
push eax
push 0
call fcn.00481cb0
add eax, 0x4000000
push eax
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404fc4
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
mov eax, dword [0x48e3ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x480]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov edx, eax
xor dl, 1
lea eax, [ebp - 0x5c]
call fcn.0048846c
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
cmp dword [ebp - 8], 0
jne 0x488878
mov bl, 1
jmp 0x48887a
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488897
lea eax, [ebp - 4]
call fcn.00404b04
ret

Function at 0x488a44
Capabilities:
Hide graphical window
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
call sub.KERNEL32.DLL_AllocConsole
push 0x104
lea eax, [ebp - 0x108]
push eax
call sub.KERNEL32.DLL_GetConsoleTitleA
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x48e5cc]
mov eax, dword [eax]
call fcn.0047d704
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
mov dword [0x48fd30], eax
mov word [ebp - 4], 0x1f4
mov word [ebp - 2], 0x32
push dword [ebp - 4]
mov eax, dword [0x48fd30]
push eax
call sub.KERNEL32.DLL_SetConsoleScreenBufferSize
mov word [ebp - 4], 0
mov word [ebp - 2], 0
push dword [ebp - 4]
mov eax, dword [0x48fd30]
push eax
call sub.KERNEL32.DLL_SetConsoleCursorPosition
mov eax, dword [0x48fd28]
mov eax, dword [eax + 0x344]
xor edx, edx
call fcn.0048023c
mov eax, dword [0x48fd28]
mov eax, dword [eax + 0x350]
xor edx, edx
call fcn.0048023c
mov esp, ebp
pop ebp
ret
Function at 0x488af0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x488cb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0xc], 0
mov word [ebp - 0xa], 0
xor eax, eax
mov dword [ebp - 8], eax
call fcn.00488a44
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00485b28
xor eax, eax
call fcn.00482438
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x368]
call fcn.00405b58
mov esi, eax
test esi, esi
jl 0x488c1f
inc esi
xor ebx, ebx
mov edi, ebx
shl edi, 3
sub edi, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x368]
cmp byte [eax + edi*4], 0
jne 0x488c17
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x368]
mov edx, dword [eax + edi*4 + 4]
mov eax, dword [ebp - 4]
call fcn.00488774
test al, al
je 0x488b97
push ebp
mov dl, 1
mov eax, ebx
call fcn.004888c0
pop ecx
jmp 0x488ba2
push ebp
xor edx, edx
mov eax, ebx
call fcn.004888c0
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x368]
call fcn.00405b50
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
lea eax, [ebx + 1]
mov dword [ebp - 0x24], eax
fild dword [ebp - 0x24]
fdivrp st(1)
fmul dword [0x488cc8]
call fcn.00402f88
mov edx, eax
mov eax, dword [0x48fd28]
mov eax, dword [eax + 0x350]
call fcn.0048023c
mov eax, dword [0x48fd28]
mov eax, dword [eax + 0x348]
xor edx, edx
call fcn.0045ce54
push dword [ebp - 0xc]
mov eax, dword [0x48fd30]
push eax
call sub.KERNEL32.DLL_SetConsoleCursorPosition
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 0x5dc
push 0
mov eax, dword [0x48fd30]
push eax
call sub.KERNEL32.DLL_FillConsoleOutputCharacterA
inc ebx
dec esi
jne 0x488b57
mov eax, dword [0x48fd28]
mov eax, dword [eax + 0x344]
mov edx, 0x64
call fcn.0048023c
mov eax, dword [0x48fd28]
mov eax, dword [eax + 0x350]
mov edx, 0x64
call fcn.0048023c
mov al, 1
call fcn.00482438
mov eax, dword [0x48fd28]
mov eax, dword [eax + 0x324]
mov dl, 1
call fcn.0045d5b8
mov eax, dword [0x48fd28]
mov eax, dword [eax + 0x330]
mov dl, 1
call fcn.0045d5b8
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x18]
mov al, 1
call fcn.00485b28
mov edx, dword [ebp - 0x28]
mov eax, dword [0x48fd28]
mov eax, dword [eax + 0x330]
call fcn.0045d6c8
call sub.KERNEL32.DLL_FreeConsole
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488cbe
lea eax, [ebp - 0x28]
call fcn.00404b04
lea eax, [ebp - 0x1c]
call fcn.00404b04
ret
Function at 0x48a8f4
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x48a99d
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00404fc4
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov esi, eax
test esi, 1
jbe 0x48a982
push 0x24
lea edx, [ebp - 4]
mov eax, 0x48a9b4
call fcn.004836fc
mov eax, dword [ebp - 4]
call fcn.00404fc4
push eax
lea edx, [ebp - 8]
mov eax, 0x48a9cc
call fcn.004836fc
mov eax, dword [ebp - 8]
call fcn.00404fc4
mov edx, eax
mov eax, dword [0x48e5cc]
mov eax, dword [eax]
pop ecx
call fcn.0047ddcc
cmp eax, 6
jne 0x48a980
dec esi
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00404fc4
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov bl, 1
jmp 0x48a982
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a9a4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b28
ret

Function at 0x48bd0c
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov esi, eax
lea edi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x48be34
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x418]
mov eax, dword [0x48e5cc]
mov eax, dword [eax]
call fcn.0047e2fc
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x14]
call fcn.00409ad4
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00404fc4
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48be0c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, esi
call fcn.00404fc4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48bdee
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
push 0x400
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x414]
mov ecx, dword [edi]
mov eax, ebx
call fcn.0041c9a0
cmp dword [edi], 0
jne 0x48bda9
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bdf5
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x401a50
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x404c29
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4090c8]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
mov eax, dword [0x4090c8]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov ebx, 1
push ebx
push str.SoftwareApple_Inc.
mov esi, ecx
push 0x80000002
lea ecx, [esp + 0x2c]
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], 0
call fcn.00401740
mov eax, dword [esp + 0x24]
push ebx
push esi
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x24c], ebx
mov dword [esp + 0x20], 0x208
call fcn.00401740
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.InstallDir
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
mov byte [esp + 0x240], bl
lea ecx, [esp + 0xc]
je 0x401b16
call fcn.00401830
push esi
push str..YSLoader.cpp
push 0xad
call fcn.00401650
cmp dword [esp + 0x1c], ebx
je 0x401b28
call fcn.00401830
mov esi, 0x65e
jmp 0x401b06
mov edx, dword [esp + 0x14]
shr edx, 1
cmp word [esp + edx*2 + 0x2a], 0
je 0x401b42
call fcn.00401830
mov esi, 0xea
jmp 0x401b06
call fcn.00401830
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
mov byte [esp + 0x240], 0
call fcn.00401830
mov eax, edi
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00403f84
add esp, 0x238
ret
Function at 0x404000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x495af5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4b8658]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov ecx, 0xf
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x68], ecx
mov dword [esi + 0x64], eax
mov byte [esi + 0x54], al
mov dword [esi + 0x84], ecx
mov dword [esi + 0x80], eax
mov byte [esi + 0x70], al
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xb8], ecx
mov dword [esi + 0xb4], eax
mov byte [esi + 0xa4], al
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov dword [esi + 0xe8], ecx
mov dword [esi + 0xe4], eax
mov byte [esi + 0xd4], al
mov dword [esi + 0xec], eax
mov dword [esi + 0xf0], eax
mov dword [esi + 0xf4], eax
mov dword [esi + 0xf8], eax
lea ecx, [esi + 0x100]
mov byte [esp + 0x14], 5
mov dword [esi + 0xfc], eax
call fcn.0044b700
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4099b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4962e5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4b8658]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi], 0x4a1540
mov dword [esp + 0x18], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov eax, dword [0x4b7104]
mov dword [esi + 0x3c], eax
mov ecx, dword [0x4b7104]
mov dword [esi + 0x40], ecx
lea ecx, [esi + 0x44]
mov byte [esp + 0x18], 6
call fcn.00460350
lea ecx, [esi + 0x8c]
mov byte [esp + 0x18], 7
call fcn.00460350
mov byte [esi + 0x38], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x40a440
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x499198
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4b8658]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.00409c60
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a4a0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00409e60
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], di
call fcn.00409c60
cmp dword [esp + 0x28], 8
jb 0x40a4eb
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00463b29
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x40aa90
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [0x4a04b4]
push esi
mov esi, eax
mov eax, dword [esi]
push edi
push eax
call ebp
mov ecx, dword [esi + 4]
push ecx
mov edi, eax
call ebp
mov esi, eax
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x14]
xor ebx, ebx
sub eax, edx
mov dword [esp + 0x10], eax
jmp 0x40aac4
mov eax, dword [esp + 0x10]
lea eax, [eax + ebx*4]
mov ecx, dword [esp + eax + 0x14]
push ecx
call ebp
mov dword [esp + ebx*4 + 0x14], eax
add ebx, 1
cmp ebx, 4
jl 0x40aac0
mov ecx, dword [esp + 0x20]
mov eax, 0xe3779b90
mov dword [esp + 0x10], 0x10
jmp 0x40aaf0
mov ebx, edi
shl ebx, 4
add ebx, dword [esp + 0x1c]
mov edx, edi
shr edx, 5
add edx, ecx
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
sub esi, edx
mov edx, esi
shr edx, 5
add edx, dword [esp + 0x18]
mov ebx, esi
shl ebx, 4
add ebx, dword [esp + 0x14]
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
sub edi, edx
add eax, 0x61c88647
sub dword [esp + 0x10], 1
jne 0x40aaf0
push edi
mov edi, dword [0x4a04b0]
call edi
mov ebx, dword [esp + 0x2c]
push esi
mov dword [ebx], eax
call edi
pop edi
pop esi
pop ebp
mov dword [ebx + 4], eax
pop ebx
add esp, 0x14
ret
Function at 0x40ca30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x496523
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b8658]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], 0x4a1a30
xor ebx, ebx
mov dword [esi + 4], 0x65
mov dword [esi + 8], 0x12dd668
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], 0x34
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], ebx
mov dword [esi + 0x58], eax
call fcn.0040c770
mov ecx, dword [eax]
mov dword [esi + 0x48], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x4c], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x50], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x54], edx
call fcn.0043caf0
lea edi, [eax + 4]
push edi
mov dword [esp + 0x18], 0x4a1a2c
mov dword [esp + 0x1c], eax
call dword [0x4a0304]
mov ecx, dword [esi + 0x58]
push esi
mov byte [esp + 0x28], 1
call fcn.0043ce70
push edi
mov dword [esi + 0x5c], eax
mov byte [esp + 0x28], bl
call dword [0x4a0300]
mov ecx, dword [esi + 0x58]
push esi
call fcn.0043f0c0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x40cd10
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [0x4a0024]
ret 8

Function at 0x40cd30
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, ecx
jne 0x40cd46
push 0x80004005
call fcn.00408ca0
push esi
call dword [0x4a0318]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [edi]
push esi
push ecx
push 0
push edx
push eax
call dword [0x4a0024]
pop edi
pop esi
ret 0xc

Function at 0x40cd70
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esp + 4], ecx
jne 0x40cd88
push 0x80004005
call fcn.00408ca0
push ebx
mov ebx, dword [0x4a0318]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x40cd95
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [0x4a0024]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
Function at 0x40d4f0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4b8658]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, dword [esp + 0x19c]
push esi
call dword [0x4a0314]
cmp eax, 1
jne 0x40d53f
xor ecx, ecx
mov ch, byte [esp + 0x1a4]
lea eax, [esp + 4]
push eax
mov cl, byte [esp + 0x1a4]
push ecx
call dword [0x4a04b8]
push eax
add esi, 4
push esi
call dword [0x4a02e4]
mov ecx, dword [esp + 0x194]
pop esi
xor ecx, esp
call fcn.00463af0
add esp, 0x194
ret

Function at 0x40dfd0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4b8658]
xor eax, esp
mov dword [esp + 0x218], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x22c]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
call dword [0x4a0028]
mov ecx, dword [esp + 0xc]
mov esi, eax
test esi, esi
jne 0x40e03e
test ecx, ecx
je 0x40e030
push ecx
call dword [0x4a0030]
test eax, eax
mov ecx, dword [esp + 0x14]
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x40e04c
test ecx, ecx
je 0x40e0f1
push ecx
jmp 0x40e0eb
mov esi, dword [0x4a001c]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push 0
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x40e0be
jmp 0x40e080
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.0040dfd0
mov edi, eax
test edi, edi
jne 0x40e10d
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x40e080
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40e0d5
push eax
call dword [0x4a0030]
mov dword [esp + 0xc], 0
mov edx, dword [ebp]
push edi
push edx
call dword [0x4a0034]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40e0f1
push eax
call dword [0x4a0030]
mov eax, esi
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00463af0
add esp, 0x21c
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40e11c
push eax
call dword [0x4a0030]
mov eax, edi
jmp 0x40e0f3

Function at 0x40e7b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4965fb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4b8658]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
lea esi, [edi + 0xc]
mov dword [edi + 4], 0
mov ecx, esi
mov dword [edi], 0x4a1ec8
call fcn.0041cc10
mov eax, dword [esp + 0x20]
mov dword [esi], 0x4a1e5c
mov dword [esi + 4], 0x4a1e48
mov dword [esi + 8], 0x4a1e28
mov dword [esi + 0x30], 0x4a1dec
mov dword [esi + 0x34], 0x4a1dc4
mov dword [esi + 0x38], eax
mov ecx, dword [0x4baa6c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
mov dword [esp + 0x18], 0
call eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4