joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4066a6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, 0x64
mov esi, dword [ebp + 8]
jmp 0x4066eb
mov dword [ebp - 0x10], 0x61736e
mov bl, byte [ebp - 0xe]
call sub.KERNEL32.dll_GetTickCount
mov edx, 0x1a
push esi
mov ecx, edx
xor edx, edx
div ecx
lea eax, [ebp - 0x10]
push 0
push eax
add ebx, edx
push dword [ebp + 0xc]
mov byte [ebp - 0xe], bl
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
jne 0x4066f6
dec edi
cmp edi, 0xffffffff
jne 0x4066b9
mov byte [esi], 0
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x406702
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
push dword [ebp + 8]
push 0x7a27c0
call fcn.00406334
push ecx
push 0x7a27c0
call fcn.00406191
add esp, 0xc
mov ebx, eax
test eax, eax
je 0x4067b7
sub esp, 0xc
push eax
call fcn.004061fa
add esp, 0xc
cmp byte [0x7a3510], 0
jns 0x40677a
mov al, byte [ebx]
test al, al
je 0x4067b7
cmp al, 0x5c
jne 0x40677a
jmp 0x4067b7
sub esp, 0xc
push 0x7a27c0
call fcn.00406132
add esp, 0xc
test eax, eax
je 0x406768
test byte [eax], 0x10
je 0x4067b7
sub esp, 0xc
push 0x7a27c0
call fcn.004062c2
add esp, 0xc
jmp 0x406780
sub ebx, 0x7a27c0
sub esp, 0xc
push 0x7a27c0
call fcn.004062b9
add esp, 0xc
cmp eax, ebx
jg 0x40674f
sub esp, 0xc
push 0x7a27c0
call fcn.004062f7
push 0x7a27c0
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
inc eax
setne al
movzx eax, al
jmp 0x4067b9
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4067c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
pop edx
xor edx, edx
cmp eax, 0xffffffff
pop ecx
setne dl
neg edx
and edx, eax
push 0
push edx
push dword [ebp + 0x10]
push 0
push 1
push dword [ebp + 0xc]
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x4067f8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x40681e
and eax, 0xfffffffe
push edx
push edx
push eax
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
pop ebx
pop eax
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x40688b
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 1
call fcn.004060e3
add esp, 0xc
test eax, eax
je 0x4068b8
push edx
push 5
push ebx
push esi
call eax
pop edi
test eax, eax
jne 0x406a7e
mov dword [0x7a1bc0], 0x4c554e
test ebx, ebx
je 0x406901
push ecx
push 1
push 0
push ebx
call fcn.004067c0
push edx
push edx
push eax
call sub.KERNEL32.dll_CloseHandle
push eax
push eax
push 0x400
push 0x7a1bc0
push ebx
call sub.KERNEL32.dll_GetShortPathNameA
add esp, 0x14
test eax, eax
je 0x406a84
cmp eax, 0x400
jg 0x406a84
push eax
push 0x400
push 0x7a1fc0
push esi
call sub.KERNEL32.dll_GetShortPathNameA
pop edi
test eax, eax
je 0x406a84
cmp eax, 0x400
jg 0x406a84
push 0x7a1fc0
push 0x7a1bc0
push str._s_s_r_n
push 0x7a23c0
call sub.USER32.dll_wsprintfA
pop ebx
mov dword [ebp - 0x24], eax
mov eax, dword [0x7a34b0]
pop esi
push dword [eax + 0x128]
push 0x7a1fc0
call fcn.004063eb
sub esp, 0xc
push 4
push 0xc0000000
push 0x7a1fc0
call fcn.004067c0
add esp, 0x14
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x406a7e
push ecx
push ecx
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
mov edx, dword [ebp - 0x24]
mov ebx, eax
lea eax, [eax + edx + 0xa]
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov esi, eax
pop eax
test esi, esi
pop edx
je 0x406a70
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
push ebx
push esi
push dword [ebp - 0x20]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x406a70
cmp ebx, dword [ebp - 0x10]
jne 0x406a70
push edi
push edi
push str._Rename__r_n
push esi
call fcn.00406825
pop edx
test eax, eax
pop ecx
jne 0x4069f6
push eax
push eax
lea eax, [esi + ebx]
push str._Rename__r_n
push eax
call fcn.00406334
add ebx, 0xa
pop ecx
mov eax, ebx
pop edi
jmp 0x406a2f
add eax, 0xa
push edx
push edx
push 0x40a3a3
push eax
call fcn.00406825
mov edx, eax
pop edi
test edx, edx
pop eax
mov eax, ebx
je 0x406a2f
lea ecx, [edx + 1]
lea edi, [esi + ebx]
mov edx, ecx
mov dword [ebp - 0x28], edi
jmp 0x406a26
mov edi, dword [ebp - 0x24]
mov al, byte [edx]
mov byte [edi + edx], al
inc edx
cmp edx, dword [ebp - 0x28]
jb 0x406a1d
mov eax, ecx
sub eax, esi
push dword [ebp - 0x24]
lea eax, [esi + eax]
push 0x7a23c0
push eax
call fcn.00405fdf
push 0
push 0
push 0
push dword [ebp - 0x20]
call sub.KERNEL32.dll_SetFilePointer
mov edx, dword [ebp - 0x24]
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
lea eax, [ebx + edx]
push eax
push esi
push dword [ebp - 0x20]
call sub.KERNEL32.dll_WriteFile
push esi
call sub.KERNEL32.dll_GlobalFree
add esp, 0xc
sub esp, 0xc
push dword [ebp - 0x20]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
inc dword [0x7a3460]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x406d8e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x7a2fc0], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x7a2fc0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.KERNEL32.dll_CreateProcessA
pop edx
xor edx, edx
pop ecx
test eax, eax
je 0x406dd6
sub esp, 0xc
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov eax, edx
leave
ret 4

Function at 0x406de0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x7a3014], 0
push ebx
mov esi, dword [ebp + 0x10]
jne 0x406e1d
xor ebx, ebx
mov edx, ebx
xor ecx, ecx
mov eax, edx
inc ecx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
cmp ecx, 8
jne 0x406df7
mov dword [ebx*4 + 0x7a3010], edx
inc ebx
cmp ebx, 0x100
jne 0x406df3
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
not edx
jmp 0x406e39
mov al, byte [ecx - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x7a3010]
dec esi
inc ecx
cmp esi, 0xffffffff
jne 0x406e27
not edx
mov eax, edx
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4019e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x401a30
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x401a30
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x401a35
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x401a1b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x401a42
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret

Function at 0x402290
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x402325
push ebx
push edi
mov edi, dword [esi + 0x20]
mov ebx, 4
test edi, edi
je 0x4022df
call fcn.00402b30
test eax, eax
je 0x4022df
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4022cc
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x4022cc
mov ebx, dword [ecx + 0x64]
lea eax, [edi - 0x2000]
cmp ebx, eax
jbe 0x4022d8
add edi, ebx
mov ebx, 0x10004
jmp 0x4022e1
xor edi, edi
lea ecx, [esi + 4]
push ecx
push ebx
push esi
push 0x402460
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [esi + 8], eax
test eax, eax
pop ebx
je 0x402325
mov ecx, dword [esi + 0x24]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x402314
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x402330
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x402344
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x402390
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push edx
call edi
mov eax, dword [esi + 0x14]
push eax
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x404510
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x404551
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x404553
mov esi, edi
test esi, esi
je 0x4045c8
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x4045bd
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x4045bd
cmp dword [esp + 0x1c], eax
jbe 0x40458e
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x4045bd
cmp esi, edi
je 0x4045af
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x4045c8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x4045e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x42d14f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x42e314]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x40464b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x40464d
mov esi, edi
test esi, esi
je 0x404717
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40470c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x40468f
cmp eax, 2
je 0x40468f
cmp eax, 6
je 0x40468f
cmp eax, 7
jne 0x40470c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.0041493d
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x4046f2
lea ecx, [esp + 0x14]
call fcn.00401680
cmp esi, dword [esp + 0x14]
je 0x4046e7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.00414bad
add esp, 4
jmp 0x404729
call fcn.00414bad
add esp, 4
lea ecx, [esp + 0x10]
push 0x447350
call fcn.00401680
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x404717
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x404729
push eax
lea ecx, [esp + 0x14]
call fcn.00401680
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00401000
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00401490
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x4049f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x444034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push esi
mov esi, dword [ebp + 8]
push 0x200
push 0
push eax
call fcn.00417cd0
push esi
push 0x44646c
lea eax, [ebp - 0x204]
push str._s_s
push eax
call fcn.00404980
add esp, 0x1c
lea eax, [ebp - 0x210]
xor esi, esi
mov dword [ebp - 0x210], esi
push eax
lea eax, [ebp - 0x204]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x404ae9
lea eax, [ebp - 0x208]
mov dword [ebp - 0x20c], esi
push eax
push esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x208], esi
push eax
push esi
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x208]
cmp eax, 2
jb 0x404add
add eax, 2
xor ecx, ecx
mov dword [ebp - 0x208], eax
mov edx, 2
shr eax, 1
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00414712
mov esi, eax
add esp, 4
test esi, esi
je 0x404add
lea eax, [ebp - 0x208]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push 0
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041446e
mov esp, ebp
pop ebp
ret 8

Function at 0x404b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x444034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x204]
push edi
mov edi, dword [ebp + 0xc]
push 0x200
push 0
push eax
call fcn.00417cd0
push esi
push 0x44646c
lea eax, [ebp - 0x204]
push str._s_s
push eax
call fcn.00404980
add esp, 0x1c
mov dword [ebp - 0x208], 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0
push eax
lea eax, [ebp - 0x204]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x404bb9
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x208]
mov dword [ebp - 0x20c], 4
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x208]
xor ecx, ebp
pop edi
pop esi
call fcn.0041446e
mov esp, ebp
pop ebp
ret 8
Function at 0x404cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x444034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x44646c
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea ebx, [esi + 2]
test eax, eax
jne 0x404d4a
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
push esi
push 0x433c00
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 8]
cmp eax, ebx
jb 0x404d41
add eax, ebx
xor ecx, ecx
mov dword [ebp - 8], eax
shr eax, 1
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00414712
mov esi, eax
add esp, 4
test esi, esi
je 0x404d41
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x433c00
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x404d6e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
test ax, ax
jne 0x404d53
sub ecx, edx
sar ecx, 1
jne 0x404db6
push 2
push esi
call fcn.00414704
add esp, 8
xor ecx, ecx
mov eax, 3
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00414712
add esp, 4
test eax, eax
je 0x404da6
xor ecx, ecx
mov dword [eax], ecx
mov word [eax + 4], cx
mov ecx, dword [0x433c0c]
mov dword [eax], ecx
mov cx, word [0x433c10]
mov word [eax + 4], cx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041446e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041446e
mov esp, ebp
pop ebp
ret

Function at 0x4059c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x444034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push 1
lea eax, [esi + 4]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x14], xmm0
call fcn.00402060
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
jne 0x405a29
mov eax, dword [esi + 0x28]
cmp dword [eax - 8], 0
je 0x405a21
push 0
push 0x80
push 4
push 0
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
je 0x405a69
test edi, edi
je 0x405a69
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, edi
mov dword [ebp - 8], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405a46
sub ecx, edx
lea eax, [ebp - 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edi
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x14]
call fcn.00402090
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041446e
mov esp, ebp
pop ebp
ret 4
Function at 0x405c30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bf23
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x444034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CTLogSysW.0
call fcn.00401fc0
lea ecx, [edi + 0x30]
mov dword [ebp - 4], 0
call fcn.00401a70
mov eax, dword [0x42e314]
mov dword [edi + 0x40], eax
lea esi, [edi + 0x44]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 3
lea ecx, [esi + 4]
mov dword [esi], vtable.CTLogToFileW.0
call fcn.00401fc0
mov eax, dword [0x42e314]
lea ecx, [esi + 0x28]
mov dword [ecx], eax
mov byte [ebp - 4], 5
mov dword [esi + 0x24], 0xffffffff
call fcn.00401360
mov dword [edi + 0x70], vtable.CTLogToDbgViewW.0
mov dword [edi + 0x74], vtable.CTLogToConsoleW.0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0xffffffff
lea eax, [edi + 0x84]
mov dword [ebp - 0x14], eax
mov dword [eax], vtable.CTLogToMsgboxW.0
lea ecx, [eax + 4]
mov eax, dword [0x42e314]
mov dword [ecx], eax
mov byte [ebp - 4], 0xa
call fcn.00401360
mov dword [edi + 4], 0
mov eax, edi
mov dword [edi + 8], 2
mov dword [edi + 0xc], 0xffffffff
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406530
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x444034]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi + 0xc], 0xffffffff
jne 0x40655a
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041446e
mov esp, ebp
pop ebp
ret
push esi
push 0x1c
call fcn.0041493d
mov esi, eax
add esp, 4
lea eax, [ebp - 8]
mov dword [ebp - 0x20], esi
push eax
lea eax, [ebp - 0x1c]
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0xffffffff
mov dword [esi], vtable.CXINetSocket.0
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
push eax
push dword [edi + 0xc]
mov dword [ebp - 8], 0x10
call dword [sym.imp.WS2_32.dll_accept]
cmp eax, 0xffffffff
jne 0x4065d1
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041446e
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xc], eax
lea eax, [ebp - 0xc]
push 4
push eax
push 1
push 6
mov dword [ebp - 0xc], 1
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop edi
call fcn.0041446e
mov esp, ebp
pop ebp
ret