joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f938
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x388
push ebp
push esi
push edi
mov edi, ecx
call fcn.004020df
call fcn.0041c048
push 0
push 2
mov byte [0x474af4], al
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x40fb46
lea eax, [esp + 0x160]
mov dword [esp + 0x160], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
lea eax, [esp + 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x40fb3f
mov ebp, 0x4674d0
lea eax, [esp + 0x184]
push eax
lea ecx, [esp + 0x14]
call fcn.0040417e
mov ecx, dword [esp + 0x168]
push 0x4674cc
call fcn.0041c076
movzx edx, al
lea ecx, [esp + 0x14c]
call fcn.0041bc1f
mov edx, dword [esp + 0x16c]
lea ecx, [esp + 0x134]
push eax
push ebp
call fcn.0041bc1f
mov edx, dword [esp + 0x174]
lea ecx, [esp + 0x124]
push eax
push ebp
call fcn.0041c26e
mov edx, eax
lea ecx, [esp + 0x114]
call fcn.0041bdaf
push eax
push ebp
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x104]
call fcn.0041bdaf
push eax
mov edx, edi
lea ecx, [esp + 0xf0]
call fcn.00406362
pop ecx
mov edx, eax
lea ecx, [esp + 0xd4]
call fcn.00406383
pop ecx
mov edx, eax
lea ecx, [esp + 0xb8]
call fcn.00402ea1
pop ecx
mov edx, eax
lea ecx, [esp + 0x9c]
call fcn.00406383
pop ecx
mov edx, eax
lea ecx, [esp + 0x80]
call fcn.00402ea1
pop ecx
mov edx, eax
lea ecx, [esp + 0x64]
call fcn.00406383
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00402ea1
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00406383
pop ecx
push eax
mov ecx, edi
call fcn.00401fe2
lea ecx, [esp + 0x28]
call fcn.00401fd8
lea ecx, [esp + 0x40]
call fcn.00401fd8
lea ecx, [esp + 0x58]
call fcn.00401fd8
lea ecx, [esp + 0x70]
call fcn.00401fd8
lea ecx, [esp + 0x88]
call fcn.00401fd8
lea ecx, [esp + 0xa0]
call fcn.00401fd8
lea ecx, [esp + 0xb8]
call fcn.00401fd8
lea ecx, [esp + 0xd0]
call fcn.00401fd8
lea ecx, [esp + 0xe8]
call fcn.00401fd8
lea ecx, [esp + 0x100]
call fcn.00401fd8
lea ecx, [esp + 0x118]
call fcn.00401f09
lea ecx, [esp + 0x130]
call fcn.00401fd8
lea ecx, [esp + 0x148]
call fcn.00401fd8
lea ecx, [esp + 0x10]
call fcn.00401f09
lea eax, [esp + 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40f99c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x388
ret
Function at 0x4108f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x410a27
cmp byte [edi + 0x3d], bl
je 0x410a27
call fcn.00402e9d
mov esi, eax
mov ecx, edi
mov eax, dword [edi]
push esi
call dword [eax + 0xc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
call fcn.0040df38
pop ecx
pop ecx
test al, al
je 0x410946
xor al, al
jmp 0x410a29
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.0040520c
lea ebp, [edi + 0x40]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
call fcn.004024bc
mov ecx, eax
call fcn.0040339b
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.0040247c
add esi, eax
lea ecx, [esp + 0x2c]
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.004024bc
mov ecx, eax
call fcn.0040339b
mov ecx, dword [edi + 0x38]
push eax
push ebp
call fcn.0040e2bc
sub eax, ebx
je 0x4109ae
sub eax, 1
je 0x4109b1
dec eax
sub eax, 1
jne 0x410a1a
inc eax
jmp 0x410a18
mov byte [edi + 0x3d], bl
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
call fcn.004024bc
mov ecx, eax
call fcn.0040339b
mov esi, dword [esp + 0x1c]
sub esi, eax
je 0x4109f6
push dword [edi + 0x4c]
lea eax, [esp + 0x28]
push esi
push 1
push eax
lea ecx, [esp + 0x38]
call fcn.004024bc
mov ecx, eax
call fcn.0040339b
push eax
call fcn.0044055c
add esp, 0x10
cmp esi, eax
jne 0x410a16
cmp byte [edi + 0x3d], bl
je 0x410a14
test esi, esi
jne 0x410955
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.00402a51
jmp 0x410955
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x28]
call fcn.00401fd8
mov al, bl
jmp 0x410a29
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41198a
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov esi, dword [ebx]
mov edx, dword [ebx + 0x3c]
movzx ebp, word [esi + 0x14]
add ebp, esi
mov eax, dword [ebp + 0x20]
mov ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
call fcn.004117c1
lea edx, [ebp + 0x18]
mov dword [esp + 0x28], eax
mov ecx, ebx
call fcn.004118ce
mov ebx, dword [ebp + 0x3c]
mov edi, eax
and dword [esp + 0x34], 0
xor eax, eax
inc eax
mov dword [esp + 0x2c], edi
add ebp, 0x40
mov dword [esp + 0x30], ebx
cmp ax, word [esi + 6]
mov esi, ecx
mov dword [esp + 0x20], eax
jae 0x411a9c
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.004117c1
mov edx, ebp
mov dword [esp + 0x14], eax
mov ecx, esi
call fcn.004118ce
mov edx, dword [esp + 0x10]
mov ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x28], eax
je 0x411a53
lea ecx, [edi + edx]
cmp ecx, eax
ja 0x411a4f
lea edx, [esp + 0x24]
mov ecx, esi
call fcn.004118ed
test eax, eax
je 0x411ab9
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebx, dword [ebp + 0x24]
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
jmp 0x411a77
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x24]
mov edi, 0x2000000
test edi, eax
je 0x411a67
test edi, ebx
je 0x411a67
or ebx, eax
jmp 0x411a6f
or ebx, eax
and ebx, 0xfdffffff
mov edi, ecx
sub edi, edx
add edi, dword [esp + 0x1c]
mov eax, dword [esi]
add ebp, 0x28
mov ecx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
movzx eax, word [eax + 6]
mov dword [esp + 0x20], ecx
cmp ecx, eax
jl 0x4119e6
xor eax, eax
inc eax
lea edx, [esp + 0x24]
mov dword [esp + 0x34], eax
mov ecx, esi
call fcn.004118ed
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor eax, eax
jmp 0x411ab1
Function at 0x41288b
Capabilities:
Terminate process

Disassembly:
push ebx
push 0
push dword [0x472d64]
mov byte [0x472d4b], 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
push dword [0x472d64]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, bl
pop ebx
ret
Function at 0x41330d
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x218
cmp dword [0x474b28], 0
mov eax, ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
jne 0x41332e
push 0xfffffffffffffffc
pop eax
jmp 0x413434
call fcn.004134ad
test eax, eax
jne 0x41333f
or eax, 0xffffffff
jmp 0x413434
push esi
push eax
push 0
push 0x440
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x41335c
push 0xfffffffffffffffe
pop eax
jmp 0x413433
push ebp
push edi
mov edi, 0x400
push edi
mov dword [esp + 0x10], edi
call fcn.0043bda0
jmp 0x413391
push ebp
cmp eax, 0xc0000004
jne 0x41343b
call fcn.0043bd9b
mov eax, dword [esp + 0x10]
add eax, edi
push eax
mov dword [esp + 0x14], eax
call fcn.0043bda0
pop ecx
pop ecx
mov ebp, eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push ebp
push 0x33
push esi
call dword [0x474b24]
test eax, eax
js 0x41336f
xor edi, edi
push ebx
cmp dword [ebp], edi
jbe 0x413426
lea ebx, [ebp + 8]
push 2
push 0
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x41341d
push 0x208
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00436f10
add esp, 0xc
lea eax, [esp + 0x20]
push 0
push 0x104
push eax
push dword [esp + 0x20]
call dword [0x474b28]
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x1c]
call fcn.0043f9a4
pop ecx
pop ecx
test eax, eax
je 0x413446
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
add ebx, 0x1c
cmp edi, dword [ebp]
jb 0x4133b6
push ebp
call fcn.0043bd9b
pop ecx
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop ebp
pop esi
add esp, 0x218
ret
call fcn.0043bd9b
xor eax, eax
pop ecx
inc eax
jmp 0x413431
xor edi, edi
push edi
push edi
push edi
push 2
push edi
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push edi
push edi
push edi
mov ebx, eax
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.0043bda0
mov ecx, dword [esp + 0x20]
push edi
push esi
push eax
mov dword [ecx], eax
call fcn.00436990
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [esp + 0x14]
call ebx
push ebp
call fcn.0043bd9b
pop ecx
mov eax, edi
jmp 0x413430

Function at 0x41353a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41357d
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
jmp 0x41357f
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413584
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4135db
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x4135dd
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4135e1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20019
xor esi, esi
mov edi, ecx
push esi
push dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413642
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x408]
push eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
test esi, esi
jne 0x413644
lea eax, [ebp - 0x408]
push eax
jmp 0x413649
mov ecx, edi
push 0x4660b4
call fcn.00402093
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x413656
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20019
push 0
push dword [ebp + 8]
mov esi, ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4136af
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x808]
push eax
jmp 0x4136b4
push 0x466478
mov ecx, esi
call fcn.0040417e
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4136c2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov edi, ecx
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
push ebx
mov esi, 0x4660b4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413722
cmp dword [ebp - 4], eax
jbe 0x413722
push dword [ebp - 4]
call fcn.0043bda0
push dword [ebp - 4]
mov esi, eax
push 0
push esi
call fcn.00436f10
add esp, 0x10
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov ecx, edi
call fcn.0040417e
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413733
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 8]
push esi
push eax
push 0x20019
xor esi, esi
push esi
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4137a3
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4137a3
push dword [ebp + 0x18]
lea ecx, [ebp - 0x40c]
push dword [ebp + 0x14]
call fcn.00406cf2
push dword [ebp + 0x10]
lea ecx, [ebp - 0x40c]
push dword [ebp + 0xc]
call fcn.00406d77
mov al, 1
jmp 0x4137a5
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4137aa
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4137fa
push esi
lea ecx, [ebp + 0xc]
call fcn.0040247c
push eax
lea ecx, [ebp + 0xc]
call fcn.00401fab
push eax
push dword [ebp + 0x24]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete bl
jmp 0x4137fc
xor bl, bl
lea ecx, [ebp + 0xc]
call fcn.00401fd8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41380b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x413849
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x41384b
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x41384f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4138a1
push esi
lea ecx, [ebp + 0xc]
call fcn.0040247c
lea ecx, [ebp + 0xc]
lea eax, [eax*2 + 2]
push eax
call fcn.00401f04
push eax
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete bl
jmp 0x4138a3
xor bl, bl
lea ecx, [ebp + 0xc]
call fcn.00401f09
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4138b2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4138f4
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x4138f6
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4138fa
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x413938
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x41393a
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x41393e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41397c
push esi
push 8
lea eax, [ebp + 0xc]
push eax
push 0xb
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x41397e
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x413a5e
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x413a7a
xor al, al
jmp 0x413a8c
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
sbb al, al
inc al
mov esp, ebp
pop ebp
ret
Function at 0x413a90
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xabb4
call fcn.00457730
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x4a0]
push esi
push eax
mov ebx, ecx
call fcn.00436f10
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x50]
mov dword [ebp - 4], esi
mov dword [ebp - 8], 0x3fff
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x4a0]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x413b6e
test eax, eax
je 0x413b6e
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], 0xff
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x298]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x413b68
push 0x467140
lea ecx, [ebp - 0x34]
call fcn.0040417e
push eax
lea edx, [ebp - 0x298]
lea ecx, [ebp - 0x68]
call fcn.004042fc
pop ecx
push eax
mov ecx, 0x4754b0
call fcn.0040325d
lea ecx, [ebp - 0x68]
call fcn.00401f09
lea ecx, [ebp - 0x34]
call fcn.00401f09
inc esi
cmp esi, dword [ebp - 4]
jb 0x413b08
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x413cb0
xor esi, esi
test eax, eax
je 0x413cb0
xor eax, eax
mov byte [ebp - 0x5c], 0
lea edi, [ebp - 0x5b]
mov dword [ebp - 0xc], 0x2710
stosd dword es:[edi], eax
mov dword [ebp - 8], 0x3fff
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov word [ebp - 0xabb0], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2bb0]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xabb0]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x413ca6
push 0xa
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x1c]
call fcn.00441ed1
add esp, 0xc
lea ecx, [ebp - 0x80]
push 0x467140
call fcn.0040417e
push eax
lea edx, [ebp - 0xabb0]
lea ecx, [ebp - 0x34]
call fcn.004042fc
pop ecx
push eax
mov ecx, 0x4754c8
call fcn.0040325d
lea ecx, [ebp - 0x34]
call fcn.00401f09
lea ecx, [ebp - 0x80]
call fcn.00401f09
push 0x4660d0
lea ecx, [ebp - 0x34]
call fcn.00402093
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x80]
call fcn.004052fd
pop ecx
push eax
mov ecx, 0x4754e0
call fcn.00403376
lea ecx, [ebp - 0x80]
call fcn.00401fd8
lea ecx, [ebp - 0x34]
call fcn.00401fd8
push str._regsplt_
lea ecx, [ebp - 0x98]
call fcn.00402093
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x2bb0]
push eax
lea ecx, [ebp - 0x34]
call fcn.004020b7
mov edx, eax
lea ecx, [ebp - 0x80]
call fcn.00402ea1
pop ecx
push eax
mov ecx, 0x475578
call fcn.00403376
lea ecx, [ebp - 0x80]
call fcn.00401fd8
lea ecx, [ebp - 0x34]
call fcn.00401fd8
lea ecx, [ebp - 0x98]
call fcn.00401fd8
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x413b83
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41470f
Capabilities:
Resolve dns

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push ecx
and dword [ebp], 0
mov dword [esp + 0x14], edx
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x41478d
cmp word [esi + 8], 2
jne 0x41476f
push 4
pop eax
cmp word [esi + 0xa], ax
jne 0x41476f
mov edi, dword [esi + 0xc]
jmp 0x414769
push dword [eax]
mov edx, dword [esp + 0x1c]
push dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
call fcn.004146a8
mov dword [ebp], eax
test eax, eax
je 0x414788
lea ebp, [eax + 0x1c]
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x414749
push 0x400
push dword [esi]
push 0x401
push ebx
call fcn.00441a83
add esp, 0x10
xor eax, eax
jmp 0x4147ab
push 8
pop eax
jmp 0x4147ab
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x4147a9
sub eax, 1
je 0x4147ba
sub eax, 1
je 0x4147b3
sub eax, 1
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, 0x2afb
jmp 0x4147ab
mov eax, 0x2afa
jmp 0x4147ab

Function at 0x414dc1
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
cmp dword [0x476b4c], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x414945
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x414beb
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.0041490a
jne 0x414f18
push 0x104
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x414f0e
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
mov ebx, 0x10c
push eax
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.00441a8e
push str.ws2_32
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.00441ae8
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
test esi, esi
je 0x414e81
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x414e7d
push esi
call ebp
mov esi, edi
test esi, esi
jne 0x414ed2
lea eax, [esp + 0x134]
mov esi, 0x10c
push eax
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.00441a8e
push str.wship6
lea eax, [esp + 0x38]
push esi
push eax
call fcn.00441ae8
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x414f0a
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x414ece
push esi
call ebp
mov esi, edi
test esi, esi
je 0x414f0a
mov ebx, edi
push dword [esp + ebx*8 + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + ebx*8 + 0x14], eax
test eax, eax
je 0x414eef
inc ebx
cmp ebx, 3
jl 0x414ed4
jmp 0x414ef4
push esi
call ebp
mov esi, edi
test esi, esi
je 0x414f0a
mov eax, dword [esp + edi + 0x14]
mov dword [edi + 0x4719f8], eax
add edi, 8
cmp edi, 0x18
jl 0x414ef8
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x476b4c], 1
mov eax, dword [0x4719f8]
add esp, 0x22c
ret