joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401387
Capabilities:
Get user security identifier

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp edi, ebx
je 0x401437
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x401437
push 0xff
lea eax, [ebp - 0x6f]
push ebx
push eax
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x70], bl
call fcn.0044f270
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp - 0x78]
push eax
push ebx
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], 0x100
mov dword [ebp - 0x7c], 8
call esi
cmp dword [ebp - 0x78], ebx
je 0x401432
push dword [ebp - 0x78]
call fcn.0044e956
pop ecx
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push eax
push edi
push ebx
mov dword [ebp - 0x74], eax
call esi
test eax, eax
jne 0x401432
push dword [ebp - 0x74]
call fcn.0044ea3d
pop ecx
mov dword [ebp - 0x74], ebx
mov eax, dword [ebp - 0x74]
jmp 0x401439
xor eax, eax
mov ecx, dword [ebp + 0x90]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f6d0
add ebp, 0x94
leave
ret

Function at 0x4014c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, 0x104
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x110], ecx
test eax, eax
jne 0x401502
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x401513
push ecx
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.0044f7b0
add esp, 0xc
mov ecx, edi
lea edi, [ebp - 0x10c]
call fcn.00401387
mov edi, eax
test edi, edi
je 0x401544
push dword [esi + 0x24]
call fcn.0044ea3d
pop ecx
push 0
mov dword [esi + 0x24], edi
push edi
add esi, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
xor eax, eax
inc eax
jmp 0x401546
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044f6d0
leave
ret 8
Function at 0x40158e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp + 0x98], eax
test byte [ebp + 0xb4], 1
mov edx, dword [ebp + 0xb0]
mov eax, dword [ebp + 0xa4]
mov ecx, dword [ebp + 0xa8]
push ebx
push esi
mov esi, dword [ebp + 0xac]
push edi
mov dword [ebp - 0x7c], edx
mov edi, 0x20019
je 0x4015dc
mov edi, 0x20119
jmp 0x4015ea
test byte [ebp + 0xb4], 2
je 0x4015ea
mov edi, 0x20219
lea edx, [ebp - 0x70]
push edx
push edi
xor ebx, ebx
push ebx
push ecx
push eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401659
push 0x103
xor edi, edi
lea eax, [ebp - 0x6b]
push ebx
inc edi
push eax
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x78], 0x104
mov byte [ebp - 0x6c], bl
call fcn.0044f270
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401650
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x6c]
push eax
call fcn.0042f2c0
mov dword [ebp - 0x74], edi
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x98]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f6d0
add ebp, 0x9c
leave
ret

Function at 0x401b85
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.0044f270
mov ax, word [ebp + 0xc]
push 0x10
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
call fcn.0044f270
mov ecx, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call fcn.0042fba0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401bf3
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x401bee
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x401bf5
xor eax, eax
pop esi
leave
ret
Function at 0x401bf8
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp + 0xa8], eax
mov eax, dword [ebp + 0xb8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xb4]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x80]
push eax
xor ebx, ebx
push edi
mov dword [ebp - 0x80], ebx
xor esi, esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x5c], eax
cmp eax, ebx
jbe 0x401d45
push eax
call fcn.0044e956
pop ecx
mov dword [ebp - 0x64], eax
cmp eax, ebx
je 0x401d45
push eax
push dword [ebp - 0x5c]
push dword [ebp - 0x80]
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jle 0x401d3c
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x70]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x64]
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x70], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401d3c
push 0xff
lea eax, [ebp - 0x57]
push ebx
push eax
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x60], ebx
mov byte [ebp - 0x58], bl
call fcn.0044f270
mov eax, dword [ebp - 0x70]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x58]
push str.StringFileInfo_04x_04xProductVersion
push eax
call fcn.0044fbbf
add esp, 0x1c
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x64]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401d3c
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x74]
push eax
push str._d._d._d._d
push dword [ebp - 0x68]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x5c], ebx
call fcn.0044f24a
movzx esi, byte [ebp - 0x6c]
mov eax, dword [ebp - 0x74]
shl eax, 8
or esi, eax
movzx eax, byte [ebp - 0x7c]
shl esi, 8
or esi, eax
mov eax, dword [ebp - 0x5c]
shl esi, 0xc
and eax, 0xfff
add esp, 0x18
or esi, eax
cmp dword [ebp - 0x78], ebx
je 0x401d3c
push dword [ebp - 0x60]
push dword [ebp - 0x68]
push dword [ebp - 0x78]
call fcn.0044f7b0
add esp, 0xc
push dword [ebp - 0x64]
call fcn.0044f1d5
pop ecx
mov ecx, dword [ebp + 0xa8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f6d0
add ebp, 0xac
leave
ret
Function at 0x401d5f
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1a8]
sub esp, 0x228
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp + 0x1a4], eax
mov eax, dword [ebp + 0x1b0]
push ebx
push esi
mov esi, dword [ebp + 0x1c0]
push edi
push str.Shell32.dll
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
mov dword [ebp - 0x6c], eax
mov edi, 0x207
cmp eax, ebx
je 0x401e84
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHGetSpecialFolderLocation
push eax
call esi
push str.SHGetPathFromIDListW
push dword [ebp - 0x6c]
mov dword [ebp - 0x68], eax
call esi
push str.SHGetMalloc
push dword [ebp - 0x6c]
mov dword [ebp - 0x74], eax
call esi
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x68], ebx
je 0x401e78
cmp dword [ebp - 0x74], ebx
je 0x401e78
cmp eax, ebx
je 0x401e78
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x1b4]
mov dword [ebp - 0x70], ebx
push ebx
call dword [ebp - 0x68]
test eax, eax
jne 0x401e78
push 0x104
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
push esi
push dword [ebp - 0x70]
call dword [ebp - 0x74]
push edi
lea eax, [ebp - 0x63]
push ebx
push eax
mov byte [ebp - 0x64], bl
call fcn.0044f270
add esp, 0xc
push ebx
push ebx
push 0x208
lea eax, [ebp - 0x64]
push eax
push 0xffffffffffffffff
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x64]
push eax
call fcn.0042f2c0
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], ebx
call dword [ebp - 0x80]
test eax, eax
jl 0x401e78
mov eax, dword [ebp - 0x68]
push dword [ebp - 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x78]
mov ecx, esi
call fcn.00401005
test al, al
je 0x401ec3
push edi
lea eax, [ebp - 0x63]
push ebx
push eax
mov byte [ebp - 0x64], bl
call fcn.0044f270
add esp, 0xc
push ebx
push dword [ebp + 0x1b4]
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x401ec3
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
call fcn.0042f2c0
mov ecx, esi
call fcn.00401005
test al, al
jne 0x401ef7
mov ecx, esi
call fcn.0042ef80
dec eax
cmp byte [esi + 7], 0xff
mov ecx, esi
jne 0x401ee0
mov ecx, dword [esi]
cmp byte [ecx + eax], 0x5c
je 0x401ef2
push 0x4726c4
mov ecx, esi
call fcn.0042f620
xor eax, eax
inc eax
jmp 0x401ef9
xor eax, eax
mov ecx, dword [ebp + 0x1a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f6d0
add ebp, 0x1a8
leave
ret
Function at 0x4020a3
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
lea ebp, [esp - 0x2d4]
sub esp, 0x354
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp + 0x2d0], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x2dc]
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp + 0x1cd]
push ebx
push eax
mov byte [ebp + 0x1cc], bl
call fcn.0044f270
push esi
lea eax, [ebp + 0xc9]
push ebx
push eax
mov byte [ebp + 0xc8], bl
call fcn.0044f270
push edi
call fcn.0044f070
add esp, 0x1c
cmp byte [eax + edi - 1], 0x5c
push edi
lea eax, [ebp + 0xc8]
push eax
je 0x402138
call fcn.0044f8e0
lea eax, [ebp + 0xc8]
push 0x4727ac
push eax
call fcn.0044f8f0
lea eax, [ebp + 0x1cc]
push edi
push eax
call fcn.0044f8e0
push 0x4726c4
jmp 0x402160
call fcn.0044f8e0
lea eax, [ebp + 0xc8]
push 0x4727a8
push eax
call fcn.0044f8f0
lea eax, [ebp + 0x1cc]
push edi
push eax
call fcn.0044f8e0
push 0x4727a6
lea eax, [ebp + 0x1cc]
push eax
call fcn.0044f8f0
add esp, 0x20
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x7c], eax
cmp eax, 0xffffffff
jne 0x40218f
xor eax, eax
jmp 0x402291
lea eax, [ebp + 0x1cc]
push eax
lea eax, [ebp + 0xc8]
push eax
mov dword [ebp - 0x80], 1
call fcn.0044f8e0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
pop ecx
pop ecx
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40226a
lea eax, [ebp - 0x4c]
push 0x4727a4
push eax
call fcn.0044ebb0
pop ecx
pop ecx
test eax, eax
je 0x402278
lea eax, [ebp - 0x4c]
push 0x4727a0
push eax
call fcn.0044ebb0
pop ecx
pop ecx
test eax, eax
je 0x402278
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x1cc]
push eax
call fcn.0044f8f0
test byte [ebp - 0x78], 0x10
pop ecx
pop ecx
je 0x40221d
lea eax, [ebp + 0x1cc]
push eax
call fcn.004020a3
pop ecx
jmp 0x402243
test byte [ebp - 0x78], 1
je 0x402236
lea eax, [ebp + 0x1cc]
push 0x80
push eax
call fcn.0044fc3c
pop ecx
pop ecx
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x402253
push 4
push ebx
lea eax, [ebp + 0x1cc]
push eax
call esi
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp + 0x1cc]
push eax
call fcn.0044f8e0
pop ecx
pop ecx
jmp 0x402278
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4022a9
mov dword [ebp - 0x80], ebx
cmp dword [ebp - 0x80], ebx
jne 0x4021b1
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp + 0x2d0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f6d0
add ebp, 0x2d4
leave
ret
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x402188
Function at 0x402f50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x402f75
mov dword [ebp - 0x10c], 0x472928
jmp 0x402f7f
mov dword [ebp - 0x10c], 0x472924
mov eax, dword [ebp - 0x10c]
push eax
push 0x472920
lea ecx, [ebp - 0x108]
push ecx
call fcn.0044fbbf
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
call fcn.0044f070
add esp, 4
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push str.SoftwareRealNetworks_rnadminPreferencesModified
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f6d0
mov esp, ebp
pop ebp
ret

Function at 0x405fce
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x40c92c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
leave
ret 8

Function at 0x40e8a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e4
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push edi
xor edi, edi
push edi
mov ebx, 0x40e660
push ebx
mov dword [ebp - 0x130], ecx
mov dword [0x481ee4], edi
call esi
cmp dword [0x481ee4], edi
je 0x40ea1d
mov ecx, dword [ebp - 0x130]
add ecx, 0x1e8
push str.false
mov dword [ebp - 0x134], ecx
call fcn.0042f2c0
push dword [ebp - 0x130]
lea ecx, [ebp - 0x2e4]
call fcn.0040aa10
push 1
push 0xb1
lea ecx, [ebp - 0x2e4]
call fcn.0040a9c5
cmp eax, 3
jne 0x40ea12
mov ecx, dword [ebp - 0x134]
push str.true
call fcn.0042f2c0
push edi
push 0x40e708
call esi
push edi
push ebx
mov dword [0x481ee4], edi
call esi
cmp dword [0x481ee4], edi
je 0x40e959
push edi
push 0x40e7c0
call esi
push edi
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
cmp eax, 0xffffffff
je 0x40ea12
push 0x124
lea eax, [ebp - 0x128]
push edi
push eax
call fcn.0044f270
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x130]
mov ebx, 0x128
mov dword [ebp - 0x12c], ebx
call sub.KERNEL32.dll_Process32First
jmp 0x40ea0e
lea eax, [ebp - 0x108]
push eax
push str.ieuser.exe
call fcn.0044fb6d
pop ecx
pop ecx
test eax, eax
je 0x40e9d2
lea eax, [ebp - 0x108]
push eax
push str.iexplore.exe
call fcn.0044fb6d
pop ecx
pop ecx
test eax, eax
jne 0x40e9f6
push dword [ebp - 0x124]
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x40e9f6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x130]
mov dword [ebp - 0x12c], ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40e9a4
lea ecx, [ebp - 0x2e4]
call fcn.0040aaea
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0044f6d0
leave
ret
Function at 0x421b63
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x290]
sub esp, 0x310
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp + 0x28c], eax
mov eax, dword [ebp + 0x298]
push ebx
push edi
mov edi, dword [ebp + 0x2a0]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x29c]
xor ebx, ebx
mov dword [ebp - 0x7c], eax
cmp edi, ebx
je 0x421d32
push esi
push 8
pop eax
mov esi, 0xff
push esi
mov word [edi], ax
lea eax, [ebp + 0x18d]
push ebx
push eax
mov dword [edi + 8], ebx
mov byte [ebp + 0x18c], bl
call fcn.0044f270
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp + 0x18c]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x80]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
lea eax, [ebp - 0x73]
push ebx
push eax
mov byte [ebp - 0x74], bl
call fcn.0044f270
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x74]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x7c]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 5
lea eax, [ebp + 0x18c]
push str.HKCR_
push eax
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
call fcn.004699e6
add esp, 0xc
test eax, eax
jne 0x421c32
mov dword [ebp - 0x7c], SysReAllocStringLen
push str.HKCR_
jmp 0x421c80
push 5
lea eax, [ebp + 0x18c]
push str.HKCU_
push eax
call fcn.004699e6
add esp, 0xc
test eax, eax
jne 0x421c5a
mov dword [ebp - 0x7c], SysReAllocStringLen
push str.HKCU_
jmp 0x421c80
push 5
lea eax, [ebp + 0x18c]
push str.HKLM_
push eax
call fcn.004699e6
add esp, 0xc
test eax, eax
jne 0x421c90
mov dword [ebp - 0x7c], reloc.OLEAUT32.dll_SysReAllocString
push str.HKLM_
call fcn.0044f070
lea eax, [ebp + eax + 0x18c]
pop ecx
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x80]
push eax
push 0xf003f
push ebx
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x421d31
push esi
lea eax, [ebp + 0x8d]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], esi
mov byte [ebp + 0x8c], bl
call fcn.0044f270
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x8c]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x421d28
mov eax, dword [ebp - 0x78]
inc eax
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ecx, dword [ebp - 0x78]
lea ecx, [ecx + ecx + 2]
push ecx
push ebx
push eax
mov dword [edi + 8], eax
call fcn.0044f270
add esp, 0xc
push dword [ebp - 0x78]
lea eax, [ebp + 0x8c]
push dword [edi + 8]
push dword [ebp - 0x78]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp + 0x28c]
pop edi
xor ecx, ebp
pop ebx
call fcn.0044f6d0
add ebp, 0x290
leave
ret 0xc
Function at 0x421e5f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 0x398], eax
jne 0x421e8c
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x41ac81
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x398], eax
pop esi
leave
ret

Function at 0x4222d4
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor eax, eax
cmp esi, eax
je 0x422303
push 3
pop ecx
push eax
mov dword [esi + 8], eax
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
mov word [esi], cx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x422303
mov dword [esi + 8], 1
pop esi
pop ebp
ret 4

Function at 0x422600
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc0]
sub esp, 0x140
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp + 0xbc], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc8]
mov esi, 0xff
xor ebx, ebx
push esi
lea eax, [ebp - 0x43]
push ebx
push eax
mov byte [ebp - 0x44], bl
call fcn.0044f270
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 7
lea eax, [ebp - 0x44]
push 0x473d9c
push eax
call fcn.004699e6
add esp, 0xc
test eax, eax
je 0x42267c
push 8
lea eax, [ebp - 0x44]
push 0x475d74
push eax
call fcn.004699e6
add esp, 0xc
test eax, eax
jne 0x4226cd
push 0x38
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.0044f270
lea eax, [ebp - 0x44]
mov dword [ebp - 0x70], eax
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x440
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], str.open
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4226cd
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xbc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f6d0
add ebp, 0xc0
leave
ret 8
Function at 0x42cb40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.0044f270
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 6
push 0xc
jb 0x42cbb8
call fcn.0044ffe4
add esp, 4
test eax, eax
je 0x42cbac
mov ecx, eax
call fcn.0042cf40
push eax
mov ecx, esi
call fcn.0042ca40
jmp 0x42cbd7
xor eax, eax
push eax
mov ecx, esi
call fcn.0042ca40
jmp 0x42cbd7
call fcn.0044ffe4
add esp, 4
test eax, eax
je 0x42cbcd
mov ecx, eax
call fcn.0042e030
jmp 0x42cbcf
xor eax, eax
push eax
mov ecx, esi
call fcn.0042cac0
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
xor ecx, ebp
add eax, 0x8007000e
pop esi
call fcn.0044f6d0
mov esp, ebp
pop ebp
ret

Function at 0x431490
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x473618
push eax
call fcn.004508f8
mov esi, eax
add esp, 8
test esi, esi
je 0x431514
push esi
call fcn.00453be4
add esp, 4
test eax, eax
jne 0x43150b
lea esp, [esp]
push esi
push 0x200
lea eax, [ebp - 0x204]
push 1
push eax
call fcn.00453eec
add esp, 0x10
test eax, eax
jle 0x4314fe
push edi
push eax
lea ecx, [ebp - 0x204]
push 1
push ecx
call fcn.00454129
add esp, 0x10
push esi
call fcn.00453be4
add esp, 4
test eax, eax
je 0x4314d0
push esi
call fcn.0045069c
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0044f6d0
mov esp, ebp
pop ebp
ret

Function at 0x433020
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x48332c], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov esi, ecx
je 0x433050
call ebx
sub eax, dword [0x48332c]
cmp eax, 0xc8
jae 0x433050
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x1c]
push edi
xor edi, edi
test eax, eax
je 0x4330b8
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], edi
mov ecx, dword [eax]
push 0x475f0c
push eax
mov eax, dword [ecx]
call eax
cmp dword [ebp - 4], edi
je 0x4330b8
call ebx
mov edx, dword [ebp + 8]
mov dword [0x48332c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov edi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x433099
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp edi, 0x80040088
jne 0x4330b8
mov eax, dword [esi + 0x44]
test eax, eax
je 0x4330b8
push eax
call fcn.0045069c
add esp, 4
mov dword [esi + 0x44], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4