joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4271af
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x4272a8
cmp eax, dword [edi + 0xc]
jge 0x4272a8
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x427200
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x427291
cmp dword [ebp + 0xc], ebx
je 0x427291
jmp 0x42722a
push 0x10
call fcn.00426e9b
cmp eax, ebx
je 0x427216
mov ecx, eax
call fcn.00427101
mov esi, eax
jmp 0x427218
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x427241
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x427251
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x427263
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0041c02f
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00411360
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4272a3
cmp ecx, dword [esi + 8]
jge 0x4272a3
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x4272a9
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x427367
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x427395
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4273b3
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004272d1
jmp 0x4273b3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4273b3
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004272d1
test edi, edi
mov eax, edi
jne 0x42739d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x43ad60]
test ecx, ecx
je 0x427466
jmp 0x427366
ret 8
Function at 0x4010e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa8
mov eax, dword [0x44f318]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov dword [esp + 0xac], eax
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9c
call esi
test eax, eax
jne 0x401133
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x94
call esi
test eax, eax
je 0x40113d
mov eax, dword [esp + 0x18]
dec eax
je 0x4011b1
dec eax
je 0x401151
xor eax, eax
mov ecx, dword [esp + 0xac]
call fcn.0042005d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
cmp eax, 4
ja 0x401171
mov eax, 2
mov ecx, dword [esp + 0xac]
call fcn.0042005d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x40119a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40119a
cmp eax, 1
jne 0x40119a
mov eax, 4
mov ecx, dword [esp + 0xac]
call fcn.0042005d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 3
mov ecx, dword [esp + 0xac]
call fcn.0042005d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xac]
mov eax, 1
call fcn.0042005d
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401200
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push edi
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x44]
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x3c
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x14], str.open
mov dword [esp + 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
pop edi
je 0x401259
mov edx, dword [esp + 0x38]
push 0x1f4
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 0x3c
ret 4
Function at 0x401710
Capabilities:
Get user security identifier

Disassembly:
sub esp, 0x410
mov eax, dword [0x44f318]
push ebx
mov ebx, dword [esp + 0x418]
push ebp
mov ebp, dword [esp + 0x420]
mov dword [esp + 0x414], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
push 0
push ebx
push ebp
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x100
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4017ad
push eax
lea eax, [esp + 0x18]
push str.__d__Failed_to_call_LookupAccountName_for_size__
push eax
call fcn.0042006b
add esp, 0xc
push 0
push str.Error
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x40c]
call fcn.0042005d
add esp, 0x410
ret 8
mov edx, dword [esp + 8]
inc edx
push edi
push edx
call fcn.0042f5c0
mov edi, eax
add esp, 4
test edi, edi
jne 0x4017da
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40c]
call fcn.0042005d
add esp, 0x410
ret 8
mov eax, dword [esp + 0x10]
inc eax
push esi
push eax
call fcn.0042f5c0
mov esi, eax
add esp, 4
test esi, esi
je 0x401847
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x40184b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x20]
push str.__d__Failed_to_LookupAccountName__
push ecx
call fcn.0042006b
add esp, 0xc
push 0
push str.Error
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0042f5bb
add esp, 4
xor eax, eax
jmp 0x401856
push esi
call fcn.0042f5bb
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x41c]
pop esi
pop edi
pop ebp
pop ebx
call fcn.0042005d
add esp, 0x410
ret 8

Function at 0x401980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401999
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4019ad
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4019ce
cmp esi, eax
jae 0x4019a7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4019c0
cmp esi, eax
jae 0x4019a7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4019e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x408
mov eax, dword [0x44f318]
mov dword [esp + 0x404], eax
mov eax, dword [esp + 0x40c]
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
lea ecx, [esp + 0xc]
push str._s_s
push ecx
call fcn.0042006b
add esp, 0x10
lea edx, [esp]
push edx
lea eax, [esp + 8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x401a41
or eax, 0xffffffff
mov ecx, dword [esp + 0x404]
call fcn.0042005d
add esp, 0x408
ret 8
mov edx, dword [esp + 0x410]
mov eax, edx
push esi
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401a50
mov ecx, dword [esp + 4]
sub eax, esi
inc eax
push eax
push edx
push 2
push 0
push str.ProfileImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
je 0x401a9b
xor edx, edx
cmp eax, 5
setne dl
dec edx
and edx, 7
add edx, 0xfffffffe
mov eax, edx
mov ecx, dword [esp + 0x404]
call fcn.0042005d
add esp, 0x408
ret 8
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x404]
xor eax, eax
call fcn.0042005d
add esp, 0x408
ret 8

Function at 0x401b00
Capabilities:
Set registry value

Disassembly:
sub esp, 0x408
mov eax, dword [0x44f318]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov dword [esp + 0x408], eax
lea eax, [esp + 8]
push 0x43ea50
push eax
call fcn.0042006b
add esp, 0xc
lea ecx, [esp]
push ecx
lea edx, [esp + 8]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x401b58
xor eax, eax
mov ecx, dword [esp + 0x404]
call fcn.0042005d
add esp, 0x408
ret 8
push edi
mov edi, dword [esp + 0x410]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401b65
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0xc]
push edi
push 1
push 0
push str.DefaultUserName
push eax
call esi
test eax, eax
je 0x401ba5
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x404]
call fcn.0042005d
add esp, 0x408
ret 8
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401bb0
mov ecx, dword [esp + 8]
sub eax, edx
inc eax
push eax
push edi
push 1
push 0
push str.AltDefaultUserName
push ecx
call esi
test eax, eax
jne 0x401b8c
mov edi, dword [esp + 0x418]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401be0
sub eax, edx
mov edx, dword [esp + 8]
inc eax
push eax
push edi
push 1
push 0
push str.DefaultDomainName
push edx
call esi
test eax, eax
jne 0x401b8c
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401c05
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0xc]
push edi
push 1
push 0
push str.AltDefaultDomainName
push eax
call esi
test eax, eax
jne 0x401b8c
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x40c]
pop esi
mov eax, 1
pop edi
call fcn.0042005d
add esp, 0x408
ret 8
Function at 0x402920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43c598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00402400
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00401d20
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4029b2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4033a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x44f318]
mov dword [esp + 0x10c], eax
xor eax, eax
push esi
push edi
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], al
mov ecx, 0x3f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x14], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov esi, dword [ebp + 8]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00403290
mov ecx, dword [esp + 0x114]
mov eax, esi
call fcn.0042005d
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x403410
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x44f318]
mov dword [esp + 0x10c], eax
xor eax, eax
push esi
push edi
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], al
mov ecx, 0x3f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x14], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esi, dword [ebp + 8]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00403290
mov ecx, dword [esp + 0x114]
mov eax, esi
call fcn.0042005d
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x403480
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x110
mov eax, dword [0x44f318]
push esi
mov dword [esp + 0x110], eax
push 0x104
lea eax, [esp + 0xc]
push eax
push str._USERPROFILE_
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, dword [esp + 0x118]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
mov byte [esp + 0x110], 0
call fcn.00403290
mov ecx, dword [esp + 0x110]
mov eax, esi
pop esi
call fcn.0042005d
add esp, 0x110
ret 4
Function at 0x407890
Capabilities:
Inspect load icon resource

Disassembly:
push 0xffffffffffffffff
push 0x43cda1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
push eax
mov esi, ecx
push 0x66
mov dword [esp + 0x10], esi
call fcn.00430277
push 0x43ecf6
lea ecx, [esi + 0x78]
mov dword [esp + 0x18], 0
mov dword [esi], method.CDialog.virtual_0
call fcn.00403290
push 0x43ecf6
lea ecx, [esi + 0x7c]
mov byte [esp + 0x18], 1
call fcn.00403290
push 0x43ecf6
lea ecx, [esi + 0x80]
mov byte [esp + 0x18], 2
call fcn.00403290
push 0x43ecf6
lea ecx, [esi + 0x84]
mov byte [esp + 0x18], 3
call fcn.00403290
lea ecx, [esi + 0x88]
mov byte [esp + 0x14], 4
call fcn.004010b0
lea edi, [esi + 0x98]
mov ecx, edi
mov byte [esp + 0x14], 5
call fcn.0043168d
mov dword [edi], vtable.CButton.0
mov byte [esp + 0x14], 6
call fcn.00438769
call fcn.00438769
mov eax, dword [eax + 0xc]
push 0x84
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x1c
mov dword [esi + 0x74], eax
call fcn.0042f590
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 7
je 0x40797a
mov ecx, eax
call fcn.00404bc0
jmp 0x40797c
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x94], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x407c60
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43cdf6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov eax, dword [0x44f318]
push esi
mov dword [esp + 0x118], eax
lea eax, [esp + 8]
push edi
push eax
call fcn.00407bb0
mov ecx, dword [esp + 0x10]
push 0x43ecf6
push ecx
mov dword [esp + 0x138], 0
call fcn.0042062d
add esp, 0xc
test eax, eax
jne 0x407cc2
fld dword [0x43faac]
jmp 0x407ce6
mov eax, dword [esp + 0xc]
cmp dword [eax - 4], 1
jle 0x407cdd
mov edx, dword [eax - 0xc]
push edx
lea ecx, [esp + 0x10]
call fcn.00401ca0
mov eax, dword [esp + 0xc]
push eax
call fcn.00421bfd
add esp, 4
fsub dword [0x43f878]
fabs
fcomp dword [0x43faa8]
fnstsw ax
test ah, 0x41
jne 0x407d85
fld qword [0x43faa0]
sub esp, 8
fstp qword [esp]
lea eax, [esp + 0x14]
push 0x43fa98
push eax
call fcn.00402490
mov esi, dword [esp + 0x1c]
add esp, 0x10
call fcn.00438769
mov eax, dword [eax + 4]
push esi
push str.Version
push str.Settings
mov ecx, eax
call fcn.00437998
call fcn.00438769
mov eax, dword [eax + 4]
push 0x43ecf6
push str.NewComputerName
push str.Settings
mov ecx, eax
call fcn.00437998
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x12c], esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x407d7e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
jmp 0x407e6d
lea eax, [esp + 0x10]
push eax
call fcn.00407be0
add esp, 4
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 1
call fcn.00402350
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or esi, 0xffffffff
mov byte [esp + 0x12c], 0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407dcc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xc]
push 0x43ecf6
push eax
call fcn.0042062d
add esp, 8
test eax, eax
je 0x407d5c
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x3f
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x1c], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.00421969
add esp, 8
test eax, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x12c], esi
je 0x407e51
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407e4d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, esi
jmp 0x407e6d
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x407e68
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 1
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x11c]
call fcn.0042005d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407e90
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x43ce08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push esi
push eax
lea ecx, [esp + 8]
call fcn.00403290
mov ecx, 0x401eb0
test ecx, ecx
mov dword [esp + 0x14], 0
je 0x407f4f
mov ecx, dword [esp + 4]
mov eax, dword [ecx - 4]
mov edx, 1
sub edx, eax
mov eax, dword [ecx - 8]
mov esi, 0x105
sub eax, esi
or eax, edx
jge 0x407ef6
push esi
lea ecx, [esp + 8]
call fcn.00401f70
mov ecx, dword [esp + 4]
cmp dword [ecx - 8], esi
mov eax, ecx
jge 0x407f07
push 0x80070057
call fcn.004016f0
push 0x104
mov dword [ecx - 0xc], esi
mov edx, dword [esp + 8]
push eax
push 0
mov byte [edx + 0x105], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [esp + 4]
test edx, edx
jne 0x407f2f
xor eax, eax
jmp 0x407f3f
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407f34
sub eax, esi
js 0x407efd
cmp eax, dword [edx - 8]
jg 0x407efd
mov dword [edx - 0xc], eax
mov ecx, dword [esp + 4]
mov byte [eax + ecx], 0
lea edx, [esp + 8]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [esp + 4]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov eax, dword [esp + 0x10]
push 1
push 0
push str.JoinDomain
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407fba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x408630
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
mov dword [esi], 0
push eax
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x20], ecx
je 0x4086d6
cmp word [ecx + 8], 2
push ebp
push edi
jne 0x4086a9
cmp word [ecx + 0xa], 4
jne 0x4086a9
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x4086a9
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov ecx, dword [eax]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
push ebp
call fcn.004085c0
test eax, eax
mov dword [esi], eax
je 0x4086ca
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x408680
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov eax, dword [ecx]
push 0x400
push eax
push ebx
call fcn.00420110
add esp, 0xc
pop edi
pop ebp
pop esi
mov byte [ebx + 0x400], 0
xor eax, eax
pop ebx
ret 0x18
pop edi
pop ebp
pop esi
mov eax, 8
pop ebx
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4086e6.11001
jmp dword [eax*4 + 0x40870c]
pop esi
mov eax, 0x2af9
pop ebx
ret 0x18
pop esi
mov eax, 0x2afa
pop ebx
ret 0x18
pop esi
mov eax, 0x2afb
pop ebx
ret 0x18
Function at 0x408f10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x44f318]
mov dword [esp + 0x22c], eax
mov eax, dword [0x4504e8]
test eax, eax
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x408990
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x408c80
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.00408940
jne 0x409072
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x409068
xor eax, eax
jmp 0x408f80
mov cl, byte [esp + eax + 0x124]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x408f80
push edi
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x408f96
mov edx, dword [str.ws2_32]
mov eax, dword [0x440fc0]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x408fdd
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x40902f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
nop
mov cl, byte [esp + eax + 0x134]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x408fe0
lea edi, [esp + 0x28]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x408ff5
mov edx, dword [str.wship6]
mov eax, dword [0x440fb8]
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov esi, eax
test esi, esi
je 0x409064
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x40902f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x409064
xor edi, edi
mov edx, dword [esp + edi*8 + 0x10]
push edx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x409026
inc edi
cmp edi, 3
jl 0x409031
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov dword [0x44e0d8], eax
mov dword [0x44e0e0], ecx
mov dword [fcn.00408940], edx
pop esi
pop ebp
pop ebx
pop edi
mov dword [0x4504e8], 1
movzx eax, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [eax*8 + 0x44e0d8]
call fcn.0042005d
add esp, 0x230
ret 4