joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d160
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfc48
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push edi
push 2
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x344], ebx
cmp ebx, 0xffffffff
je 0x42d2c2
lea eax, [ebp - 0x340]
push eax
push ebx
mov dword [ebp - 0x340], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x42d2bb
lea esp, [esp]
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp + 8]
jae 0x42d1dc
lea eax, [ebp + 8]
push 3
push eax
lea edx, [ebp - 0x114]
lea ecx, [ebp - 0x110]
push edx
mov dword [ebp - 0x114], ecx
call fcn.00435190
mov eax, dword [ebp - 0x114]
push eax
lea ecx, [ebp - 0x31c]
push ecx
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
sete bl
cmp eax, edx
je 0x42d22d
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
test bl, bl
je 0x42d299
mov eax, dword [esi + 4]
inc edi
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x348], edi
cmp ecx, eax
jae 0x42d27a
mov ecx, dword [esi]
lea edx, [ebp - 0x338]
cmp ecx, edx
ja 0x42d27a
mov edi, edx
sub edi, ecx
sar edi, 2
cmp eax, dword [esi + 8]
jne 0x42d264
mov eax, esi
call fcn.00429a00
mov eax, dword [esi + 4]
test eax, eax
je 0x42d272
mov ecx, dword [esi]
mov edx, dword [ecx + edi*4]
mov dword [eax], edx
mov edi, dword [ebp - 0x348]
jmp 0x42d295
cmp eax, dword [esi + 8]
jne 0x42d286
mov eax, esi
call fcn.00429a00
mov eax, dword [esi + 4]
test eax, eax
je 0x42d295
mov ecx, dword [ebp - 0x338]
mov dword [eax], ecx
add dword [esi + 4], 4
mov eax, dword [ebp - 0x344]
lea edx, [ebp - 0x340]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x42d1d0
mov ebx, dword [ebp - 0x344]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x1c], 0x10
jb 0x42d2d5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x42d620
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x60]
push esi
push eax
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
jae 0x42d658
lea eax, [ebp + 8]
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x60]
push edx
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0xc]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x42d6a4
mov edx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x1c]
push eax
call esi
cmp dword [ebp + 0x1c], 0x10
jb 0x42d69a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x1c], 0x10
jb 0x42d6b7
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42df80
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
push eax
xor ebx, ebx
push ebx
push 0x410
mov dword [ebp - 0x10c], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x42e036
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
push 4
lea edx, [ebp - 0x10c]
push edx
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x42e007
mov ecx, dword [ebp - 0x10c]
push 0x104
lea eax, [ebp - 0x108]
push eax
push ecx
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x42e023
sub eax, edx
push eax
lea edx, [ebp - 0x108]
push edx
jmp 0x42e048
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
push 0x4eb6d4
mov ecx, esi
call fcn.00405360
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, esi
pop ebx
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x435460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4daeb8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x44], 0
je 0x435586
cmp byte [edi + 0x49], 0
je 0x435586
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x43557a
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x4354d5
lea eax, [ebp - 0x2c]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea ebx, [edi + 0x4c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x4354f5
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x43551a
dec eax
je 0x43551e
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x435575
jmp 0x435581
mov byte [edi + 0x49], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x43552e
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x435558
cmp edx, 0x10
jae 0x43553d
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x435572
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x43557e
test esi, esi
jne 0x4354e9
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00434ed0
jmp 0x4354e3
lea ecx, [ebp - 0x2c]
call fcn.004054e0
xor al, al
jmp 0x435588
lea ecx, [ebp - 0x2c]
call fcn.004054e0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x437f20
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0980
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x50e018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
sub esp, 0x18
mov dword [ebp - 4], 0
mov esi, esp
lea edi, [ebp + 0x10]
mov dword [ebp - 0x10], esp
call fcn.004364a0
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x14], eax
call fcn.00439110
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], ecx
mov byte [ebx + 0x30], 0
cmp eax, ecx
je 0x437fc8
cmp dword [ebx], 0
je 0x437fa6
push ecx
push eax
lea esi, [ebp - 0x14]
mov ecx, ebx
call fcn.00438f90
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
jmp 0x437fa8
mov edx, ecx
mov eax, dword [ebx + 0x2c]
cmp edx, eax
jne 0x437fbc
cmp ecx, eax
jne 0x437fbc
cmp dword [ebx + 0x24], eax
jne 0x437fbc
mov byte [ebx + 0x30], 1
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x28], ecx
cmp dword [ebp + 0x20], 8
jbe 0x437fdf
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x437fdf
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x43ccb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x103
mov dword [ebp - 0x110], ebx
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x114], 0x104
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ecx
push 1
push ebx
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43cd43
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push 0x4eb6d4
mov ecx, esi
mov byte [esi], bl
call fcn.00405360
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x114]
push edx
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x110]
push ecx
push ebx
push str.svcVersion
push edx
call edi
test eax, eax
je 0x43cdbb
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x110]
push edx
push ebx
push str.Version
push eax
call edi
test eax, eax
je 0x43cdbb
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
push 0x4eb6d4
jmp 0x43cdf1
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x108]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x43cde0
sub eax, edx
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.00405360
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, esi
pop ebx
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x43d7e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x43d7f8
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x43d82a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x43d826
cmp esi, eax
jae 0x43d82a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x43d818
cmp esi, eax
jb 0x43d830
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x441720
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d18db
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ebp - 0x250]
call fcn.0045bac0
mov eax, esi
xor edi, edi
push eax
lea ecx, [edi + 3]
xor edx, edx
lea esi, [ebp - 0x234]
mov dword [ebp - 4], edi
call fcn.00434160
push 0x206
lea edx, [ebp - 0x216]
xor ecx, ecx
push edi
push edx
mov dword [ebp - 0x254], edi
mov word [ebp - 0x218], cx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea esi, [ebp - 0x218]
cmp word [ebp - 0x218], di
je 0x441876
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push esi
call ebx
cmp eax, 3
jne 0x44180f
cmp dword [ebp - 0x220], 8
mov ecx, dword [ebp - 0x234]
jae 0x4417dd
lea ecx, [ebp - 0x234]
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x441806
cmp dx, di
je 0x441802
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x441806
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4417e0
xor eax, eax
jmp 0x44180b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x441823
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 + 2], di
lea esi, [esi + eax*2 + 2]
jne 0x4417c0
jmp 0x441876
lea ecx, [ebp - 0x268]
push ecx
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x260]
push eax
push esi
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x44185d
push str.cannot_get_disk_free_space__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x25c]
shrd eax, ecx, 0x14
mov dword [ebp - 0x254], eax
shr ecx, 0x14
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov ebx, 8
cmp dword [ebp - 0x220], ebx
jb 0x441895
mov edx, dword [ebp - 0x234]
push edx
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], ax
cmp dword [ebp - 0x23c], ebx
jb 0x4418c2
mov ecx, dword [ebp - 0x250]
push ecx
call esi
add esp, 4
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x442d90
Capabilities:
Get common file path
Get file version info
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor ebx, ebx
push 0x103
lea ecx, [ebp - 0x107]
push ebx
push ecx
mov dword [ebp - 0x218], eax
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push str.Windows_Media_Playerwmplayer.exe
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
cmp edi, ebx
jg 0x442e16
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.004a64f8
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x442ed7
push esi
push edi
push ebx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x442ecd
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueA]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x214]
push ecx
push str.VarFileInfoTranslation
push esi
mov dword [ebp - 0x21c], ebx
call edi
push 0xff
lea edx, [ebp - 0x207]
push ebx
push edx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], ebx
mov byte [ebp - 0x208], bl
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0x214]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04xFileVersion
lea eax, [ebp - 0x208]
push 0x100
push eax
call dword [sym.imp.MSVCR100.dll__snprintf]
add esp, 0x20
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x208]
push eax
push esi
call edi
test eax, eax
jne 0x442eeb
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x20c]
mov edx, dword [ebp - 0x218]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
mov ecx, dword [ebp - 4]
add esp, 4
pop esi
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x442f20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftSilverlight
push reloc.OLEAUT32.dll_SysReAllocString
or esi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x442fcf
push 0xff
push eax
lea ecx, [ebp - 0x103]
push ecx
mov dword [ebp - 0x110], 1
mov byte [ebp - 0x104], al
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x10c]
push edx
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0
push str.Version
push edx
mov dword [ebp - 0x10c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x442fc2
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004a665a
mov esp, ebp
pop ebp
ret

Function at 0x443b60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x18e
push eax
lea ecx, [ebp - 0x1a2]
push ecx
mov word [ebp - 0x1a4], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x1a4]
push edx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x443bb7
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push str.127.0.0.1
mov esi, eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
mov eax, 2
push 0x50
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push esi
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x443c0b
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x444300
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5130d8]
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x444353
push 0x40
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
cmp eax, ebx
je 0x44434c
mov dword [eax + 0x18], ebx
mov ecx, 0xf
mov dword [eax + 0x1c], ecx
mov byte [eax + 8], bl
mov dword [eax + 0x38], ecx
mov dword [eax + 0x34], ebx
mov byte [eax + 0x24], bl
mov dword [eax], ebx
mov dword [eax + 4], ebx
jmp 0x44434e
xor eax, eax
mov dword [0x5130d8], eax
cmp dword [eax], ebx
jne 0x44451d
push edi
lea edi, [ebp - 0x330]
mov dword [eax], 1
mov dword [ebp - 0x330], ebx
call fcn.00446380
pop edi
test eax, eax
je 0x444398
mov eax, dword [ebp - 0x330]
mov ecx, dword [0x5130d8]
mov dword [ecx + 4], eax
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
push esi
push 0x103
lea edx, [ebp - 0x107]
push ebx
push edx
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
lea esi, [ebp - 0x32c]
call fcn.0042e220
mov esi, 0x10
cmp dword [eax + 0x14], esi
jb 0x4443cb
mov eax, dword [eax]
push eax
push str._sproxy.ini
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x10
cmp dword [ebp - 0x318], esi
jb 0x4443fe
mov ecx, dword [ebp - 0x32c]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea edx, [ebp - 0x108]
push ebx
push edx
call dword [sym.imp.MSVCR100.dll__access]
add esp, 8
cmp eax, 0xffffffff
jne 0x444421
mov eax, dword [0x5130d8]
mov dword [eax + 4], ebx
jmp 0x444517
push 0x103
lea ecx, [ebp - 0x20b]
push ebx
push ecx
mov byte [ebp - 0x20c], bl
call sub.MSVCR100.dll_memset
push 0x103
lea edx, [ebp - 0x30f]
push ebx
push edx
mov byte [ebp - 0x310], bl
call sub.MSVCR100.dll_memset
add esp, 0x18
lea eax, [ebp - 0x108]
push eax
push ebx
push str.enable
push str.proxy
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [0x5130d8]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x108]
push edx
push 0x104
mov dword [ecx + 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0x4eb6d4
push str.user
push str.proxy
call esi
lea ecx, [ebp - 0x108]
push ecx
push 0x104
lea edx, [ebp - 0x310]
push edx
push 0x4eb6d4
push 0x4ec68c
push str.proxy
call esi
lea eax, [ebp - 0x20c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4444d0
mov ecx, dword [0x5130d8]
sub eax, edx
push eax
lea eax, [ebp - 0x20c]
push eax
add ecx, 8
call fcn.00405360
lea eax, [ebp - 0x310]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4444f8
sub eax, edx
push eax
lea ecx, [ebp - 0x310]
push ecx
mov ecx, dword [0x5130d8]
add ecx, 0x24
call fcn.00405360
mov eax, dword [0x5130d8]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x4466a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xff
lea eax, [ebp - 0x103]
push 0
mov dword [ebp - 0x10c], 0
push eax
mov byte [ebp - 0x104], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemBIOS
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x110], 0x100
mov dword [ebp - 0x10c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x446746
lea edx, [ebp - 0x110]
push edx
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
push str.SystemProductName
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x104]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x446760
sub eax, edx
push eax
lea ecx, [ebp - 0x104]
push ecx
mov ecx, esi
call fcn.00405360
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.004a665a
mov esp, ebp
pop ebp
ret