joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4077b0
Capabilities:
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
mov ebx, dword [ecx]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edx
mov edi, dword [edi]
mov edx, dword [eax]
mov dword [ebp - 0x118], ecx
xor ecx, ecx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 8], edx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 4], edi
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x40], ecx
test ebx, 0x800
je 0x40875e
mov dword [ebp - 0x24], 1
test ebx, 0x200
jne 0x408766
xor eax, eax
mov dword [ebp - 0xa0], eax
xor eax, 1
mov dword [ebp - 0xe4], eax
movsx eax, bl
and eax, 1
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x68], 0xfffffffe
mov dword [ebp - 0x74], 0xfffffffe
mov dword [ebp - 0x58], 0xfffffffe
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x90], eax
movzx esi, word [edi]
fld qword [0x4b69f8]
test esi, esi
je 0x407cd4
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 0x3c]
mov eax, dword [eax + 0x10]
lea eax, [eax + ecx*2]
add eax, 0xffffff38
cmp dword [ebp + 0x2c], 0
je 0x407a39
cmp edx, eax
ja 0x482315
mov eax, dword [ebp - 0xb0]
cmp edx, eax
jb 0x408770
mov ecx, edx
sub ecx, eax
mov eax, dword [ebp + 0x2c]
sar ecx, 1
mov edx, dword [eax]
mov eax, 0x7fffffeb
sub eax, edx
cmp eax, ecx
jl 0x482012
lea eax, [edx + ecx]
mov ecx, dword [ebp + 0x2c]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x407b9f
cmp ecx, dword [ebp - 0xb8]
jbe 0x407bad
mov eax, dword [ebp - 8]
fstp st(0)
mov edi, dword [ebp - 0xb8]
sub eax, ecx
and eax, 0xfffffffe
push eax
push ecx
push edi
call 0x425f80
fld qword [0x4b69f8]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
sub ecx, edi
sar ecx, 1
add esp, 0xc
neg ecx
mov dword [ebp - 0x20], edi
mov edi, dword [ebp - 4]
lea edx, [edx + ecx*2]
mov dword [ebp - 8], edx
mov dword [ebp - 0xb0], edx
cmp dword [ebp - 0x34], 0
jne 0x47f59f
and ebx, 8
jne 0x47f626
cmp esi, 0x2a
je 0x407f5d
cmp esi, 0x3f
je 0x407f5d
cmp esi, 0x2b
je 0x407f5d
cmp esi, 0x7b
je 0x47f71f
xor ecx, ecx
cmp dword [ebp - 0x88], ecx
jne 0x47f737
mov eax, dword [ebp - 0xc]
test eax, 0x4000
jne 0x47f77d
cmp esi, 0x5f
jae 0x407a4a
cmp esi, 0x2f
invalid
sbb edi, 1
invalid
Function at 0x421d84
Capabilities:
Encode data using xor

Disassembly:
or al, ch
mov edi, edi
mov dword [ebp + 0x59], 0x6ac35d59
or al, 0x68
enter 0x4b6a, 0
call 0xcd0e6afe
xor eax, eax
cmp dword [ebp + 8], eax
setne al
test eax, eax
jne 0x421dbb
call fcn.00427c4c
mov dword [eax], 0x77cf7416
call 0xa8426e4e
push ebp
enter 0xffffffffffffebff, 0x63
call 0x89da4e54
add eax, 0x20
push eax
push 1
call fcn.00424e99
pop ecx
pop ecx
and dword [ebp - 4], 0
call 0x89da4e54
add eax, 0x20
push eax
call 0x4518828
pop ecx
mov esi, eax
Function at 0x4011b5
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0xfb8]
mov eax, 0x1038
call fcn.0040f1a0
mov eax, dword [0x43b2e4]
xor eax, ebp
mov dword [ebp + 0xfb4], eax
push edi
mov edi, dword [ebp + 0xfc0]
lea eax, [ebp - 0x7c]
push eax
call fcn.00406ef8
pop ecx
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
jne 0x4011fa
push 5
call fcn.00409761
pop ecx
jmp 0x4012e6
push esi
call fcn.00407fd1
push eax
push 0x5c
call fcn.00408945
push eax
push 0x43505c
mov esi, 0x400
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00407f99
push dword [ebp - 0x7c]
lea eax, [ebp + 0x7ac]
push 0x43506c
push esi
push eax
call fcn.00407f99
and dword [ebp - 0x64], 0
lea eax, [ebp + 0x7ac]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
mov dword [ebp - 0x74], str.JavaWSSplashScreen
mov dword [ebp - 0x70], 0x43509c
mov dword [ebp - 0x68], edi
call fcn.0040889f
add esp, 0x34
test eax, eax
jne 0x4012dd
mov word [ebp - 0x64], ax
lea edi, [ebp - 0x62]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401295
push 6
jmp 0x4012df
push 0
push 6
lea eax, [ebp + 0xfac]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 6
je 0x4012b0
push 7
jmp 0x4012df
lea eax, [ebp + 0xfac]
push eax
call fcn.0040f260
pop ecx
mov dword [0x435054], eax
test eax, eax
jg 0x4012ca
push 8
jmp 0x4012df
push esi
call fcn.00407d98
push dword [ebp - 0x78]
call fcn.00407d98
pop ecx
xor eax, eax
jmp 0x4012e4
push 0
call fcn.00409761
pop ecx
pop esi
mov ecx, dword [ebp + 0xfb4]
xor ecx, ebp
pop edi
call fcn.0040ee3b
add ebp, 0xfb8
leave
ret
Function at 0x406c3b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1198]
mov eax, 0x1218
call fcn.0040f1a0
mov eax, dword [0x43b2e4]
xor eax, ebp
mov dword [ebp + 0x1194], eax
push edi
push 0x436b74
push 0x436ba4
push 0xffffffffffffffff
lea eax, [ebp - 0x74]
push 0x1000
push eax
call fcn.004101a8
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x74]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406c9d
xor eax, eax
jmp 0x406d21
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xf8c]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push str.Path
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
test eax, eax
je 0x406cd2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406c96
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], 1
jne 0x406c96
mov eax, dword [esi + 4]
test eax, eax
je 0x406cec
push eax
call fcn.0040f26b
pop ecx
push edi
call fcn.0040f372
lea ecx, [esi + 8]
push ecx
push eax
mov dword [esi + 4], eax
call fcn.00406979
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x406d0f
push eax
call fcn.0040f26b
pop ecx
lea eax, [ebp + 0xf8c]
push eax
call fcn.0040f372
mov dword [esi], eax
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp + 0x1194]
xor ecx, ebp
call fcn.0040ee3b
add ebp, 0x1198
leave
ret
Function at 0x406d36
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [0x43b2e4]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
mov eax, dword [ebp + 0x1d0]
push ebx
push esi
xor ebx, ebx
push str.FORCED_FX_ROOT
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], 0x1fe
xor esi, esi
mov dword [ebp - 0x6c], ebx
call fcn.0040fa3b
add esp, 0xc
cmp dword [ebp - 0x6c], ebx
je 0x406dc4
cmp eax, ebx
jne 0x406dc4
push 0x34
push 1
call fcn.0040ee4a
push str.2.0
mov esi, eax
call fcn.0040f372
lea ecx, [esi + 8]
push ecx
push eax
mov dword [esi + 4], eax
call fcn.00406979
push dword [ebp - 0x6c]
call fcn.0040f372
mov dword [esi], eax
push dword [ebp - 0x6c]
call fcn.0040f26b
add esp, 0x1c
jmp 0x406e7f
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push ebx
push str.SoftwareOracleJavaFX
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406de9
xor eax, eax
jmp 0x406e81
push edi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x406e62
cmp dword [ebp - 0x78], ebx
je 0x406e1e
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x78]
call fcn.00406bda
pop ecx
pop ecx
jmp 0x406e21
xor eax, eax
inc eax
cmp eax, ebx
je 0x406e62
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00406979
pop ecx
pop ecx
cmp esi, ebx
je 0x406e4d
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00406a1d
pop ecx
pop ecx
test eax, eax
je 0x406e62
jmp 0x406e5a
push 0x34
push 1
call fcn.0040ee4a
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x3c]
call fcn.00406c3b
inc dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x1fe
cmp dword [ebp - 0x80], ebx
je 0x406dea
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
mov ecx, dword [ebp + 0x1c4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ee3b
add ebp, 0x1c8
leave
ret
Function at 0x406ef8
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x43b2e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
xor eax, eax
push esi
push edi
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x1c], 0x10
call fcn.00407cf9
push 2
pop eax
push 0x436c18
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 0
push 1
push 2
mov dword [ebp - 0x10], eax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
jne 0x406f58
mov eax, edi
jmp 0x406fa8
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, edi
jne 0x406f72
push esi
call fcn.00407d98
pop ecx
jmp 0x406f54
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_getsockname]
cmp eax, edi
je 0x406f69
push SysReAllocString
push esi
call dword [sym.imp.WSOCK32.dll_listen]
cmp eax, edi
je 0x406f69
push dword [ebp - 0x12]
call dword [sym.imp.WSOCK32.dll_ntohs]
mov ecx, dword [ebp - 0x18]
movzx eax, ax
mov dword [ecx], eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040ee3b
leave
ret

Function at 0x407050
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43b2e4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
push edi
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.00407cf9
push 2
pop eax
push dword [ebp + 8]
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_htons]
push 0x436c30
mov word [ebp - 0x12], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 0
push 1
push 2
mov dword [ebp - 0x10], eax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
jne 0x4070b0
mov eax, edi
jmp 0x4070cc
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, edi
jne 0x4070ca
push esi
call fcn.00407d98
pop ecx
jmp 0x4070ac
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040ee3b
leave
ret
Function at 0x4071b7
Capabilities:
Send data
Send data on socket

Disassembly:
cmp dword [esp + 8], 0
jne 0x4071c1
xor eax, eax
ret
mov eax, dword [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4071c8
sub eax, edx
sar eax, 1
push esi
lea esi, [eax + eax + 6]
lea eax, [esi + esi]
push edi
push eax
call fcn.0040f4d4
mov edi, eax
pop ecx
test edi, edi
je 0x407237
push dword [esp + 0x10]
push str._s_r_n
push esi
push edi
call fcn.00407f99
mov eax, edi
add esp, 0x10
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x407205
sub eax, ecx
sar eax, 1
push 0
add eax, eax
push eax
push edi
push dword [esp + 0x18]
call dword [sym.imp.WSOCK32.dll_send]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push edi
mov esi, ecx
call fcn.0040f26b
pop ecx
mov eax, esi
pop edi
pop esi
ret

Function at 0x40723a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, 0x448bb0
xor ebx, ebx
mov esi, edi
push 0
push 2
push esi
push dword [esp + 0x1c]
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
je 0x407281
test eax, eax
je 0x407285
movzx eax, word [esi]
cmp eax, 0xa
je 0x407285
cmp eax, 0xd
je 0x40726f
inc ebx
add esi, 2
cmp esi, 0x4493ae
jl 0x407246
xor eax, eax
mov word [0x4493ae], ax
jmp 0x40728f
xor eax, eax
jmp 0x407291
xor eax, eax
mov word [ebx*2 + 0x448bb0], ax
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x407cf9
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x43b2e4]
xor eax, esp
mov dword [esp + 0x190], eax
cmp dword [0x44fc48], 0
jne 0x407d83
push esi
push edi
xor edi, edi
push str.ws2_32.dll
inc edi
call fcn.0040aec1
mov esi, eax
pop ecx
test esi, esi
jne 0x407d4d
push str.wsock32.dll
call fcn.0040aec1
mov esi, eax
xor edi, edi
pop ecx
test esi, esi
jne 0x407d4d
push 0xd
call fcn.00409761
pop ecx
push eax
call fcn.00407c5a
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x407d62
push 0xe
jmp 0x407d41
test edi, edi
je 0x407d77
push str.WSASendDisconnect
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44fc44], eax
pop edi
mov dword [0x44fc48], 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0040ee3b
add esp, 0x194
ret
Function at 0x408118
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.0040f1a0
mov eax, dword [0x43b2e4]
xor eax, ebp
mov dword [ebp + 0xf94], eax
mov eax, dword [ebp + 0xfa0]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x438418
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x7c], 0x400
mov dword [ebp - 0x70], 1
call esi
test eax, eax
jne 0x408219
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x794]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.CurrentVersion
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40819f
and dword [ebp - 0x70], 0
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4081b0
and dword [ebp - 0x70], 0
lea eax, [ebp + 0x794]
push eax
push str.SoftwareJavaSoftJava_Runtime_Environment
push 0x43840c
lea eax, [ebp - 0x6c]
push 0x400
push eax
call fcn.0041018a
add esp, 0x14
lea eax, [ebp - 0x74]
push eax
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
push edi
call esi
test eax, eax
jne 0x408219
lea eax, [ebp + 0xfa4]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x4384e8
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x408209
mov dword [ebp - 0x70], ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x408219
mov dword [ebp - 0x70], ebx
mov ecx, dword [ebp + 0xf94]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ee3b
add ebp, 0xf98
leave
ret

Function at 0x40833b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40838a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x4084f8
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x43b2e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x40852e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040ee3b
leave
ret
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x408554
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x408520
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp + 8]
je 0x40856e
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
jmp 0x408545
mov esi, dword [ebp - 0x218]
jmp 0x408549

Function at 0x408576
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4085cd
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 0
push 0
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
test eax, eax
jne 0x4085c7
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret
Function at 0x4094d1
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x43b2e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 9
pop ecx
mov dword [ebp - 0x10], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x40], esi
lea edi, [ebp - 0x3c]
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00406ef8
pop ecx
mov dword [0x450470], eax
cmp eax, 0xffffffff
jne 0x409525
push 5
call fcn.00409761
pop ecx
push eax
call fcn.004093e7
cmp dword [ebp + 8], esi
jg 0x40952e
push 0x13
jmp 0x409519
push dword [ebp + 8]
call fcn.00407050
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
jne 0x409542
push 0x11
jmp 0x409519
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push 0x438960
push 0xffffffffffffffff
push 6
pop edi
push edi
push eax
call fcn.00412f20
add esp, 0x14
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, edi
je 0x409571
push 0x14
jmp 0x409519
push ebx
call fcn.00407d98
pop ecx
cmp dword [ebp - 0x10], esi
je 0x409641
mov ebx, dword [ebp - 0x14]
push 0x7f00
push esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x409437
mov dword [ebp - 0x30], ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0x438964
call dword [sym.imp.USER32.dll_RegisterClassW]
push esi
push ebx
push esi
push esi
mov eax, SysReAllocString
push eax
push eax
push eax
push eax
push 0xcf0000
push str.Win32Splash
push str.SplashDummy
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x409431
push 0x4e20
mov edi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
jne 0x4095f6
push 0x15
jmp 0x409519
call fcn.00409377
push dword [ebp - 0x10]
call fcn.00409397
pop ecx
push 8
push 0x401
push edi
push dword [0x450470]
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x409634
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x5c]
push eax
call edi
test eax, eax
jne 0x409620
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040ee3b
leave
ret
Function at 0x409952
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
fild dword [ebp + 0xc]
push esi
push edi
test eax, eax
jns 0x409969
fadd qword [0x42d320]
fdiv qword [0x42d318]
push ecx
push ecx
fstp qword [esp]
call fcn.004131f0
fmul qword [0x42d310]
fstp qword [ebp - 8]
fld qword [ebp - 8]
call fcn.004133c6
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
inc eax
push 1
push eax
call fcn.0040ee4a
mov edi, eax
xor esi, esi
add esp, 0x10
mov dword [ebp + 0x10], edi
cmp edi, esi
jne 0x4099ad
xor eax, eax
jmp 0x409a59
cmp esi, dword [ebp + 0xc]
jae 0x409a2f
mov ecx, dword [ebp + 8]
movzx ecx, byte [esi + ecx]
inc esi
cmp esi, dword [ebp + 0xc]
jae 0x4099c9
mov edx, dword [ebp + 8]
movzx edi, byte [esi + edx]
inc esi
jmp 0x4099cb
xor edi, edi
cmp esi, dword [ebp + 0xc]
jae 0x4099da
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
inc esi
jmp 0x4099dc
xor edx, edx
shl ecx, 8
add ecx, edi
shl ecx, 8
add ecx, edx
mov edx, ecx
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], dl
mov edx, ecx
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 6
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], dl
mov byte [eax + 3], cl
add eax, 4
cmp esi, dword [ebp + 0xc]
jb 0x4099b2
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 3
xor edx, edx
pop ecx
div ecx
mov esi, dword [edx*4 + 0x439f50]
test esi, esi
je 0x409a57
fld qword [ebp - 8]
call fcn.00413390
lea eax, [eax + edi - 1]
mov byte [eax], 0x3d
dec eax
dec esi
jne 0x409a50
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x409d5b
Capabilities:
Write file on windows

Disassembly:
push edi
push 0x439f64
push dword [esp + 0xc]
call fcn.004111c2
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x409d74
pop edi
ret
push ebx
push esi
push dword [esp + 0x14]
call fcn.00409ce1
push edi
push dword [esp + 0x20]
mov esi, eax
push 1
push esi
call fcn.00413592
push edi
mov ebx, eax
call fcn.00410fd7
add esp, 0x18
test esi, esi
je 0x409da4
push esi
call fcn.0040f26b
pop ecx
xor eax, eax
cmp ebx, dword [esp + 0x18]
pop esi
pop ebx
sete al
pop edi
ret