joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4184b6
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x418500
test byte [eax + 0x1c], 1
je 0x418500
cmp byte [eax + 0x19], 5
jb 0x418500
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
push ebx
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0041784c
mov eax, dword [0x4b70c8]
xor esi, esi
mov edi, 0x405830
cmp eax, 0x4b70c8
je 0x418557
test byte [eax + 0x1c], 2
je 0x41852f
cmp byte [eax + 0x19], 5
jb 0x41852f
push dword [eax + 0x14]
mov edx, edi
push dword [eax + 0x10]
push 0x2b
pop ecx
call fcn.00416054
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x418557
test byte [eax + 0x1c], 2
je 0x418557
cmp byte [eax + 0x19], 5
jb 0x418557
push 0x1f4
push dword [eax + 0x14]
mov edx, edi
push dword [eax + 0x10]
push 0x2c
pop ecx
call fcn.0041610f
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x41858a
test byte [eax + 0x1c], 2
je 0x41858a
cmp byte [eax + 0x19], 5
jb 0x41858a
push dword [eax + 0x14]
mov edx, edi
push dword [eax + 0x10]
push 0x2d
pop ecx
call fcn.00416054
push 1
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x4185d3
xor ebx, ebx
inc ebx
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x4185ca
test byte [eax + 0x1c], 2
je 0x4185ca
cmp byte [eax + 0x19], 5
jb 0x4185ca
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x2e
pop ecx
call fcn.00416054
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x418600
mov ebx, esi
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x418600
test byte [eax + 0x1c], 2
je 0x418600
cmp byte [eax + 0x19], 5
jb 0x418600
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x2f
pop ecx
call fcn.00416054
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esp + 0x10]
sub eax, edi
cmp eax, dword [ebp + 0xc]
ja 0x418623
test ebx, ebx
je 0x418665
mov ebx, dword [esp + 0x14]
mov edi, 0x405830
jmp 0x41852a
mov esi, 0x5b4
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x4186a1
test byte [edx + 0x1c], 2
je 0x41866b
cmp byte [edx + 0x19], 2
jb 0x41866b
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov eax, dword [0x4b70c8]
mov edx, 0x405830
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x30
pop ecx
call fcn.00417592
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x4186a1
test byte [edx + 0x1c], 1
je 0x4186a1
movzx ecx, byte [edx + 0x19]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x4186a1
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x405830
push 0x31
pop ecx
call fcn.0041610f
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004174b0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4186b7
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, edx
mov eax, ecx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
mov esi, dword [0x4b70c8]
cmp esi, 0x4b70c8
je 0x4186fd
test byte [esi + 0x1c], 1
je 0x4186fd
cmp byte [esi + 0x19], 5
jb 0x4186fd
push ecx
push dword [ebp + 8]
push ebx
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.0041791b
mov esi, dword [0x4b70c8]
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, 0x4b70c8
je 0x41872f
test byte [esi + 0x1c], 2
je 0x41872f
cmp byte [esi + 0x19], 5
jb 0x41872f
push dword [esi + 0x14]
mov edx, 0x405830
push dword [esi + 0x10]
push 0x33
pop ecx
call fcn.00416054
mov esi, dword [0x4b70c8]
cmp dword [ebx + 4], 1
je 0x418894
mov ecx, 0x7530
mov ebx, dword [ebx + 0x18]
mov eax, ebx
cmp ebx, ecx
jb 0x418749
mov eax, ecx
cmp eax, 0x1f4
jae 0x418757
mov ebx, 0x1f4
jmp 0x41875d
cmp ebx, ecx
jb 0x41875d
mov ebx, ecx
cmp esi, 0x4b70c8
je 0x418785
test byte [esi + 0x1c], 2
je 0x418785
cmp byte [esi + 0x19], 5
jb 0x418785
push ebx
push dword [esi + 0x14]
mov edx, 0x405830
push dword [esi + 0x10]
push 0x34
pop ecx
call fcn.0041610f
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x24
push ebx
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x418858
cmp dword [ebx + 4], 1
je 0x418825
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 8]
mov ecx, 0x7530
cmp eax, ecx
ja 0x4187d5
cmp dword [ebx + 4], 1
mov esi, dword [0x4b70c8]
jne 0x41873e
jmp 0x418894
mov edi, 0x5b4
mov esi, dword [0x4b70c8]
cmp esi, 0x4b70c8
je 0x4188ca
test byte [esi + 0x1c], 2
je 0x418894
cmp byte [esi + 0x19], 2
jb 0x418894
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push dword [ebp + 8]
mov eax, dword [0x4b70c8]
mov edx, 0x405830
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x37
pop ecx
call fcn.00417592
jmp 0x41888e
mov esi, dword [0x4b70c8]
cmp esi, 0x4b70c8
je 0x4188ca
test byte [esi + 0x1c], 2
je 0x418894
cmp byte [esi + 0x19], 5
jb 0x418894
push dword [esi + 0x14]
mov edx, 0x405830
push dword [esi + 0x10]
push 0x36
pop ecx
call fcn.00416054
jmp 0x41888e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov esi, dword [0x4b70c8]
cmp esi, 0x4b70c8
je 0x4188ca
test byte [esi + 0x1c], 2
je 0x418894
cmp byte [esi + 0x19], 2
jb 0x418894
push edi
push dword [esi + 0x14]
mov edx, 0x405830
push dword [esi + 0x10]
push 0x35
pop ecx
call fcn.0041610f
mov esi, dword [0x4b70c8]
cmp esi, 0x4b70c8
je 0x4188ca
test byte [esi + 0x1c], 1
je 0x4188ca
movzx ecx, byte [esi + 0x19]
mov eax, edi
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x4188ca
push edi
push dword [esi + 0x14]
mov edx, 0x405830
push dword [esi + 0x10]
push 0x38
pop ecx
call fcn.0041610f
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4188d3
Capabilities:
Query service status
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x4b8bd4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov ebx, edx
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x418914
test byte [eax + 0x1c], 1
je 0x418914
cmp byte [eax + 0x19], 5
jb 0x418914
push ecx
push ebx
push ecx
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004178de
push 9
pop ecx
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor esi, esi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], esi
push eax
push 0x24
lea eax, [esp + 0x18]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov ecx, 0x405830
test eax, eax
jne 0x41898e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x418a43
test byte [edx + 0x1c], 2
je 0x418a0d
cmp byte [edx + 0x19], 2
jb 0x418a0d
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x405830
push 0x3a
pop ecx
call fcn.0041610f
jmp 0x418a07
cmp dword [esp + 0x14], 1
jne 0x4189c5
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x418a43
test byte [edx + 0x1c], 2
je 0x418a0d
cmp byte [edx + 0x19], 5
jb 0x418a0d
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, ecx
push 0x3b
pop ecx
call fcn.00416054
jmp 0x418a07
cmp dword [esp + 0x14], 3
jne 0x418a59
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x4189f8
test byte [eax + 0x1c], 2
je 0x4189f8
cmp byte [eax + 0x19], 5
jb 0x4189f8
push dword [eax + 0x14]
mov edx, ecx
push dword [eax + 0x10]
push 0x3c
pop ecx
call fcn.00416054
push ecx
push edi
lea edx, [esp + 0x18]
mov ecx, ebx
call fcn.004186b7
mov esi, eax
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x418a43
test byte [edx + 0x1c], 1
je 0x418a43
movzx ecx, byte [edx + 0x19]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x418a43
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x405830
push 0x3e
pop ecx
call fcn.0041610f
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a8f70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x418a81
test byte [eax + 0x1c], 2
je 0x418a81
cmp byte [eax + 0x19], 5
jb 0x418a81
push dword [eax + 0x14]
mov edx, ecx
push dword [eax + 0x10]
push 0x3d
pop ecx
call fcn.00416054
lea eax, [esp + 0x10]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4189f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x418a05
Function at 0x41bcb9
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edx, dword [0x4b70c8]
mov edi, dword [ebp + 8]
cmp edx, 0x4b70c8
je 0x41bd03
test byte [edx + 0x1c], 1
je 0x41bd03
cmp byte [edx + 0x19], 5
jb 0x41bd03
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push dword [eax]
push dword [ebp + 0xc]
push edi
push ecx
push ecx
push dword [edx + 0x14]
push dword [edx + 0x10]
call fcn.0041b869
mov edx, dword [0x4b70c8]
xor esi, esi
mov dword [esp + 0x18], esi
mov ebx, esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], esi
test edi, edi
je 0x41bdfd
xor eax, eax
cmp ax, word [edi]
je 0x41bdfd
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x10], esi
mov dword [eax], ecx
lea eax, [esp + 0x10]
push eax
push 0x2011f
push esi
push 0x4043b8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
jne 0x41bd93
mov ebx, dword [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x14], ebx
test ecx, ecx
jne 0x41bd93
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.00424ad7
mov ecx, eax
test ecx, ecx
jne 0x41bd83
mov edx, dword [ebp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [edx], eax
cmp dword [ebp + 0x14], 1
jne 0x41bd93
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
cmp ecx, 0x490
je 0x41bda0
cmp ecx, 2
jne 0x41bda2
mov ecx, esi
test ecx, ecx
je 0x41be33
jg 0x41bdb0
mov esi, ecx
jmp 0x41bdb9
movzx esi, cx
or esi, 0x80070000
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x41be6e
test byte [edx + 0x1c], 2
je 0x41be39
movzx eax, byte [edx + 0x19]
mov ecx, esi
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x41be39
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push dword [eax]
push dword [ebp + 0xc]
push edi
push ecx
push ecx
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
push 0x1c
jmp 0x41be2d
mov esi, 0x80070057
cmp edx, 0x4b70c8
je 0x41be6e
test byte [edx + 0x1c], 2
je 0x41be39
cmp byte [edx + 0x19], 2
jb 0x41be39
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push dword [eax]
push dword [ebp + 0xc]
push edi
push ecx
push ecx
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
push 0x1b
pop ecx
call fcn.0041b7bb
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x41be6e
test byte [edx + 0x1c], 1
je 0x41be6e
movzx eax, byte [edx + 0x19]
mov ecx, esi
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x41be6e
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x4066d8
push 0x1d
pop ecx
call fcn.0041610f
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x41be84
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41ea85
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
call fcn.0049db56
mov ebx, eax
xor esi, esi
and dword [esp + 0x10], esi
lea eax, [esp + 0x10]
push eax
push 0x2011f
push esi
push 0x4043b8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x41eac5
mov esi, dword [esp + 0x10]
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x41eb09
test byte [edx + 0x1c], 2
je 0x41eb09
movzx ecx, byte [edx + 0x19]
mov eax, edi
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x41eb09
push edi
push dword [edx + 0x14]
mov ecx, 0x86
push dword [edx + 0x10]
mov edx, 0x4066d8
call fcn.0041610f
mov edx, dword [0x4b70c8]
test edi, edi
jne 0x41eb2d
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push 4
push edi
push 0x405c84
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x41eb57
test byte [edx + 0x1c], 1
je 0x41eb57
cmp byte [edx + 0x19], 5
jb 0x41eb57
push ebx
push dword [edx + 0x14]
mov ecx, 0x87
push dword [edx + 0x10]
mov edx, 0x4066d8
call fcn.0041610f
test esi, esi
je 0x41eb62
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4226e3
Capabilities:
Get session information
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x422718
test byte [eax + 0x1c], 1
je 0x422718
push dword [eax + 0x14]
mov edx, 0x4066d8
mov ecx, 0x108
push dword [eax + 0x10]
call fcn.00416054
and dword [esp + 0xc], 0
lea eax, [esp + 0x10]
and dword [esp + 0x10], 0
xor edi, edi
push eax
lea eax, [esp + 0x10]
inc edi
push eax
push edi
push 0
push 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
mov esi, eax
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x422777
test byte [eax + 0x1c], 2
je 0x422777
cmp byte [eax + 0x19], 5
jb 0x422777
push dword [esp + 0x10]
mov edx, 0x4066d8
mov ecx, 0x109
push dword [esp + 0x10]
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00417592
mov eax, dword [0x4b70c8]
test esi, esi
je 0x422868
cmp dword [esp + 0x10], 0
jne 0x42278d
xor edi, edi
jmp 0x422854
xor ecx, ecx
xor eax, eax
xor esi, esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
xor ebx, ebx
cmp eax, dword [esp + 0x10]
jae 0x42284a
mov ecx, dword [esp + 0xc]
mov eax, dword [ebx + ecx + 8]
test eax, eax
je 0x4227ba
add eax, 0xfffffffd
cmp eax, edi
ja 0x422832
lea eax, [esp + 0x20]
xor edx, edx
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
push eax
push 5
mov dword [esp + 0x2c], edx
push dword [ebx + ecx]
push edx
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov dword [esp + 0x24], eax
mov ecx, dword [0x4b70c8]
cmp ecx, 0x4b70c8
je 0x422817
test byte [ecx + 0x1c], 2
je 0x422817
cmp byte [ecx + 0x19], 5
jb 0x422817
push dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push dword [ebx + eax]
push dword [esp + 0x28]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0041b726
mov eax, dword [esp + 0x24]
test eax, eax
je 0x42289a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42289a
xor ecx, ecx
cmp cx, word [eax]
je 0x42282b
inc esi
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add ebx, 0xc
inc eax
mov dword [esp + 0x1c], eax
test esi, esi
je 0x42279d
test ecx, ecx
jne 0x422854
neg esi
sbb esi, esi
and edi, esi
push dword [esp + 0xc]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
and dword [esp + 0xc], 0
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x422891
test byte [eax + 0x1c], 1
je 0x422891
cmp byte [eax + 0x19], 5
jb 0x422891
push edi
push dword [eax + 0x14]
mov edx, 0x4066d8
mov ecx, 0x10b
push dword [eax + 0x10]
call fcn.0041610f
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
mov dword [esp + 0x18], ecx
jmp 0x422836
Function at 0x42494b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
test edx, edx
je 0x424990
mov ecx, edx
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x424963
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, 0x80004005
call fcn.00417459
int3

Function at 0x424a65
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x424ad0
cmp dword [ebp - 4], 1
je 0x424aa5
cmp dword [ebp - 4], 2
jne 0x424ac0
mov ecx, dword [ebp - 8]
test esi, esi
je 0x424aca
test ecx, ecx
je 0x424ac5
test cl, 1
jne 0x424ac0
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x424aca
push 0xd
pop eax
jmp 0x424ad0
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x436d15
Capabilities:
Monitor local ipv4 address changes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ebx
mov dword [esp + 0xc], ebx
call fcn.00437d27
test eax, eax
je 0x436e6c
call fcn.00437f66
test eax, eax
je 0x436e6c
push 0x4b93dc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov dword [0x4ba7e0], ebx
mov edi, 0x4b9c04
push ebx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4b9c14], eax
test eax, eax
jne 0x436d7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edi, esi
jmp 0x436dd4
push ebx
push 0xffffffffffffffff
push ebx
push 0x436a10
push eax
push 0x4ba7e4
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x436d73
push 0x4b9c04
xor esi, esi
push 0x4ba7e8
inc esi
call dword [sym.imp.IPHLPAPI.DLL_NotifyAddrChange]
mov ebx, eax
cmp ebx, 0x3e5
jne 0x436dd0
xor edi, edi
mov ecx, 0x4ba7ec
inc edi
call fcn.004369a7
mov ebx, eax
test ebx, ebx
jne 0x436ddc
mov dword [0x4ba7dc], edi
jmp 0x436dd4
mov edi, dword [esp + 0xc]
test ebx, ebx
je 0x436e5d
push 0x4b93dc
mov dword [0x4ba7e0], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
neg esi
sbb esi, esi
not esi
and dword [0x4ba7e4], esi
mov esi, 0x4b93dc
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
je 0x436e18
push 0x4b9c04
call dword [sym.imp.IPHLPAPI.DLL_CancelIPChangeNotify]
mov eax, dword [0x4b9c14]
test eax, eax
je 0x436e28
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, 0x4b9c04
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x4ba7ec]
test eax, eax
je 0x436e4c
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
and dword [0x4ba7ec], 0
pop ecx
and dword [0x4ba7e8], 0
and dword [0x4ba7dc], 0
push esi
jmp 0x436e62
push 0x4b93dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
jmp 0x436e9c
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x436e97
test byte [eax + 0x1c], 4
je 0x436e97
cmp byte [eax + 0x19], 2
jb 0x436e97
push dword [eax + 0x14]
mov edx, 0x4073f8
push dword [eax + 0x10]
push 0x12
pop ecx
call fcn.00416054
mov eax, 0x8000ffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43fb1a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 8], ebx
je 0x43fb32
mov eax, 0x8000ffff
jmp 0x43fc31
lea edi, [esi + 0x24]
mov ecx, edi
call fcn.00416afa
test eax, eax
js 0x43fc31
push ebx
push ebx
push ebx
push ebx
mov byte [edi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x40], eax
test eax, eax
jne 0x43fb70
cmp byte [edi + 0x18], bl
je 0x43fb68
push edi
mov byte [edi + 0x18], bl
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop esi
pop ebx
jmp fcn.00424c49
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
test edi, edi
jne 0x43fba4
call fcn.00424c49
push ecx
mov ecx, esi
mov edi, eax
call fcn.0043fd8b
test eax, eax
jns 0x43fc2f
test edi, edi
js 0x43fc2f
jmp 0x43fc2d
push ecx
push ebx
push edi
mov ecx, esi
call fcn.0043fa84
mov ebx, eax
test ebx, ebx
jns 0x43fbc7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esi
call fcn.0043fd8b
mov eax, ebx
jmp 0x43fc31
xor edi, edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
test ebx, ebx
je 0x43fb80
push ecx
push edi
push ebx
mov ecx, esi
call fcn.0043fa84
mov edi, eax
test edi, edi
jns 0x43fbfa
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esi
call fcn.0043fd8b
jmp 0x43fc2f
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push esi
push 0x43fd60
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x43fb80
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43fc2f
call fcn.00424c49
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
ret