joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47119c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00470794
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00405360
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4711fa
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5cf674]
mov dl, 1
mov eax, dword [0x470568]
call fcn.0040df58
call fcn.0040486c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x471204
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00405360
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47125c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5cfb98]
mov dl, 1
mov eax, dword [0x470568]
call fcn.0040df58
call fcn.0040486c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004707c4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x482898
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482970
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5d0cb8], 0
jne 0x482954
lea eax, [ebp - 4]
mov edx, 0x482988
call fcn.00404f48
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405360
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x482954
mov eax, ebx
call fcn.00402828
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48294d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x482937
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x482998
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x482937
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x5d0cb8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482954
mov eax, dword [ebp - 0xc]
call fcn.00402848
ret
mov ebx, dword [0x5d0cb8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482977
lea eax, [ebp - 4]
call fcn.00404eb0
ret
Function at 0x49c830
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49ca90
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x49c893
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0049c2f8
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e72c
cmp al, 1
jne 0x49c893
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0049c610
test al, al
je 0x49ca1f
cmp dword [ebp - 8], 0
jge 0x49c8b1
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0049c2f8
mov eax, dword [ebp - 0x210]
call fcn.00405168
cmp ebx, eax
jge 0x49c8fb
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0049c2f8
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5cfb38]
and eax, 0xff
bt dword [edx], eax
jae 0x49c8fb
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x49c90f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049c80c
cmp ebx, dword [ebp - 8]
je 0x49ca11
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x49c93b
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040429c
and eax, 0x7f
movzx eax, word [eax*2 + 0x5cd210]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x49c9fe
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040429c
and eax, 0x7f
movzx eax, word [eax*2 + 0x5cd210]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004541d8
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040429c
and eax, 0x7f
movzx eax, word [eax*2 + 0x5cd210]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004541d8
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ca05
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x49ca72
cmp dword [ebp - 8], 0
jge 0x49ca2a
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0049c2f8
mov eax, dword [ebp - 0x218]
call fcn.00405168
cmp eax, dword [ebp - 8]
jg 0x49ca64
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0049c2f8
mov eax, dword [ebp - 0x21c]
call fcn.00405168
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049c80c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ca97
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404ed4
ret
Function at 0x4b0624
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416bf8]
call fcn.004058e0
xor eax, eax
push ebp
push 0x4b0768
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5cd23c], 0
jne 0x4b0677
mov ecx, dword [0x5cf08c]
mov dl, 1
mov eax, dword [0x408a68]
call fcn.0040df1c
call fcn.0040486c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403304
mov eax, ebx
call fcn.00405730
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4b0778
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406ed0
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405740
test eax, eax
jle 0x4b070f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4b0708
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00405130
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00405118
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409914
test eax, eax
jne 0x4b0708
mov ebx, 0x15
jmp 0x4b0714
mov ebx, 0x10
jmp 0x4b0714
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5cd23c]
call fcn.004b0520
mov eax, dword [ebp - 8]
call fcn.004b0520
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406ee8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b076f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404ed4
lea eax, [ebp - 0x10]
mov edx, dword [0x416bf8]
call fcn.004059b0
ret

Function at 0x4b32fc
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4b330e
add esp, 0xfffffff0
call fcn.00404404
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406f40
xor eax, eax
push ebp
push 0x4b3391
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00404070
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004b3488
mov dl, 1
mov eax, dword [0x417ca4]
call fcn.00404070
mov dword [esi + 0x28], eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4b337b
push 0x4b33b4
call sub.user32.dll_RegisterClipboardFormatA
mov dword [0x5d0d7c], eax
push 0x4b33c8
call sub.user32.dll_RegisterClipboardFormatA
mov dword [0x5d0d80], eax
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3398
lea eax, [ebp - 4]
call fcn.00406ed0
ret

Function at 0x4ba450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405360
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4ba469
test al, 0x10
jne 0x4ba46d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4ba474
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.00405350
xor eax, eax
push ebp
push 0x4ba64f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.004036d0
mov edi, eax
cmp dword [ebp + 0x20], 0
je 0x4ba51d
cmp dword [ebp - 0x10], 0
je 0x4ba51d
mov eax, dword [ebp + 0x20]
call fcn.0040a0f0
test al, al
jne 0x4ba4d3
mov eax, dword [ebp + 0x20]
call fcn.004ba450
test al, al
je 0x4ba4f6
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00405360
push eax
call sub.shell32.dll_SHGetFileInfoA
jmp 0x4ba517
push 0x4010
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00405360
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, dword [ebp - 0x174]
cmp byte [ebp + 0x1c], 0
je 0x4ba544
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x4ba660
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
jmp 0x4ba563
push 0x4001
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x4ba660
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.004188f0
test bl, bl
je 0x4ba5a3
cmp byte [ebp + 0x14], 0
jne 0x4ba5a3
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0042725c
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x4ba639
mov dl, 1
mov eax, dword [0x424e74]
call fcn.0042b924
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0
push 0
push 0
mov eax, ebx
call fcn.0042beec
call fcn.0042725c
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x184], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.00402c88
add eax, dword [ebp - 8]
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.00402c88
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x17c], eax
mov ecx, ebx
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 4]
call fcn.004ba374
mov eax, ebx
call fcn.004040a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba656
lea eax, [ebp + 0x20]
call fcn.00404eb0
ret
Function at 0x4be5f4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405350
xor eax, eax
push ebp
push 0x4be6a0
push dword fs:[eax]
mov dword fs:[eax], esp
or edi, 0xffffffff
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 4]
call fcn.0040a58c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jle 0x4be68a
mov eax, ebx
call fcn.00402828
mov esi, eax
push esi
push ebx
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4be6b0
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4be683
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xfeef04bd
jne 0x4be683
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 8]
mov eax, esi
call fcn.00402848
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be6a7
lea eax, [ebp - 4]
call fcn.00404eb0
ret

Function at 0x4d1764
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4d1835
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.004a7224
mov edx, dword [ebp - 4]
mov eax, 0x4d184c
call fcn.004054a4
test eax, eax
je 0x4d181f
mov eax, dword [ebp - 4]
call fcn.00405168
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x4d181f
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
jne 0x4d17ca
push ebx
call sub.kernel32.dll_GlobalFree
jmp 0x4d181f
mov edx, 0x4d1850
mov eax, esi
call fcn.0040a504
mov eax, dword [ebp - 4]
call fcn.00405360
mov edx, eax
mov eax, esi
call fcn.0040a5d0
push ebx
call sub.kernel32.dll_GlobalUnlock
mov eax, edi
call fcn.004541d8
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x4d1806
push ebx
call sub.kernel32.dll_GlobalFree
jmp 0x4d181f
push 0x4d1854
call sub.user32.dll_RegisterClipboardFormatA
push ebx
movzx eax, ax
push eax
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d183c
lea eax, [ebp - 4]
call fcn.00404eb0
ret
Function at 0x4d28c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d2ab0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x590]
cmp byte [eax + 0xc], 0
je 0x4d29fb
mov eax, dword [ebp - 4]
call fcn.004541d8
push eax
call sub.user32.dll_OpenClipboard
push 0x4d2ac0
call sub.user32.dll_RegisterClipboardFormatA
mov ebx, eax
call sub.user32.dll_CloseClipboard
call fcn.00446afc
mov edx, ebx
call fcn.00446ac4
test al, al
je 0x4d29fb
call fcn.00446afc
mov edx, dword [eax]
call dword [edx + 0x18]
push ebx
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4d2992
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x18], 0
je 0x4d2966
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
jmp 0x4d296b
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2999
cmp dword [ebp - 0x18], 0
je 0x4d2987
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GlobalUnlock
call fcn.00446afc
mov edx, dword [eax]
call dword [edx + 0x14]
ret
call fcn.00446afc
mov dx, 1
call fcn.00446ac4
test al, al
je 0x4d2a95
call fcn.00446afc
mov edx, dword [eax]
call dword [edx + 0x18]
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4d2a8e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x18], 0
je 0x4d2a47
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
jmp 0x4d2a4c
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4d2a67
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d2564
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2a95
cmp dword [ebp - 0x18], 0
je 0x4d2a83
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GlobalUnlock
call fcn.00446afc
mov edx, dword [eax]
call dword [edx + 0x14]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2ab7
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00404ed4
ret
Function at 0x5007ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x5ce13a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x500857
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x5ce15b
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x50084d
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x50085b
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x518284
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x51829e
add esp, 0xfffffff0
call fcn.00404404
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x51833b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00404070
mov dword [edi + 0x20], esi
mov dl, 1
mov eax, dword [0x424498]
call fcn.00425c0c
mov esi, eax
mov dword [edi + 0x10], esi
mov eax, edi
call fcn.005186c0
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [edi + 0x10]
mov dword [eax + 0xc], edi
mov dword [eax + 8], 0x518570
mov dl, 1
mov eax, dword [0x417ca4]
call fcn.00404070
mov dword [edi + 4], eax
lea eax, [ebp - 0x10]
call fcn.00414e98
lea edx, [ebp - 0x10]
lea eax, [edi + 0x30]
call fcn.00405f0c
mov byte [edi + 0x28], 1
mov dl, byte [0x518360]
mov ax, 0x2e
call fcn.0045d354
mov word [edi + 0x26], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518342
lea eax, [ebp - 0x10]
call fcn.00406014
ret

Function at 0x51c43c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
test dl, dl
je 0x51c454
push 5
mov eax, ebx
call fcn.004541d8
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
push 0
mov eax, ebx
call fcn.004541d8
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x54d170
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x54d19e
mov eax, ebx
call fcn.0054dc28
cmp dword [ebx + 0x3c], 0
je 0x54d197
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x54d20f
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x54d201
cmp dword [ebx + 8], 0
je 0x54d1c0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x54d1d2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x54d201
cmp dword [ebx + 8], 0
je 0x54d1b3
cmp eax, 3
je 0x54d1e5
dec eax
jne 0x54d1b3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x54d1b3
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x54d1b3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x54d22d
cmp dword [ebx + 0x10], 0xcc
je 0x54d22d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0054d238
pop ebx
ret
Function at 0x576620
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405350
xor eax, eax
push ebp
push 0x576833
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0xc
call fcn.00403304
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x1c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_CreatePipe
lea edx, [ebp - 0x17c]
mov eax, dword [0x5cf79c]
mov eax, dword [eax]
call fcn.0046e6c4
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x18]
call fcn.0040a344
lea eax, [ebp - 0x168]
xor ecx, ecx
mov edx, 0x44
call fcn.00403304
mov dword [ebp - 0x168], 0x44
mov dword [ebp - 0x13c], 0x101
mov word [ebp - 0x138], bx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x128], eax
push 0x576850
push dword [ebp - 4]
push 0x576870
mov eax, esi
mov edx, 3
call fcn.00405228
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x57687c
call fcn.004051b4
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x168]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00405360
push eax
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.00405360
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x57675c
mov dword [ebp - 8], 0xffffffff
jmp 0x576805
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, eax
mov eax, esi
call fcn.00404eb0
jmp 0x5767c2
lea eax, [ebp - 0x124]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403304
push 0
lea eax, [ebp - 0x14]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x124]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
mov ebx, eax
lea eax, [ebp - 0x180]
lea edx, [ebp - 0x124]
mov ecx, pe_nt_image_headers32
call fcn.00405118
mov edx, dword [ebp - 0x180]
mov eax, esi
call fcn.00405170
test ebx, ebx
jne 0x576770
push 0xffffffffffffffff
mov eax, dword [ebp - 0x178]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x178]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x178]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x174]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57683a
lea eax, [ebp - 0x180]
mov edx, 2
call fcn.00404ed4
lea eax, [ebp - 0x18]
call fcn.00404eb0
lea eax, [ebp - 4]
call fcn.00404eb0
ret
Function at 0x57d580
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1d8], eax
xor eax, eax
push ebp
push 0x57d63a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov dl, 1
mov eax, dword [0x417ca4]
call fcn.00404070
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x57d621
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x57d615
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1d8]
call fcn.004050a0
mov edx, dword [ebp - 0x1d8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
add ebx, 1
jno 0x57d615
call fcn.00403fe0
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x57d5e9
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57d641
lea eax, [ebp - 0x1d8]
call fcn.00404eb0
ret