joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5489c5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.005322aa
push 0xf1
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x548aae
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x548aae
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x548aae
movzx eax, word [edi + 6]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00525ad5
pop ecx
movzx ecx, word [edi + 6]
xor esi, esi
xor edx, edx
mov dword [ebp - 4], eax
mov eax, ecx
cmp si, cx
jae 0x548a5e
mov ebx, dword [ebp - 4]
lea ecx, [edi + 8]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov dword [ebx + edx*4], eax
inc edx
movzx esi, word [edi + 6]
cmp edx, esi
jl 0x548a47
mov ebx, dword [ebp - 0xc]
mov eax, esi
mov ecx, dword [ebp - 8]
movzx eax, ax
push eax
push dword [ebp - 4]
call fcn.00548ab7
push dword [ebp - 4]
mov esi, eax
call fcn.00525ad0
pop ecx
test esi, esi
je 0x548aa3
movzx ecx, word [edi + 4]
movzx esi, word [edi + 2]
push ecx
push esi
lea eax, [ecx + 7]
mov ecx, dword [ebp - 8]
lea edx, [esi + 7]
push eax
push edx
call fcn.00548c3e
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.00548974
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x548ab0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x5823e0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005820a3

Function at 0x5823eb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00582224

Function at 0x586f8d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00586c4d

Function at 0x58b730
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6160ec]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x616f84]
cmp eax, dword [ecx + 4]
jg 0x58b752
mov eax, 0x616f70
ret
push 0x616f84
call fcn.0055abd9
add esp, 4
cmp dword [0x616f84], 0xffffffff
jne 0x58b74c
push esi
push 0x5e38c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x58b7d5
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5e38d8
push esi
call edi
mov dword [0x616f70], eax
test eax, eax
je 0x58b7d4
push 0x5e38f0
push esi
call edi
mov dword [0x616f74], eax
test eax, eax
je 0x58b7d4
push 0x5e3904
push esi
call edi
mov dword [0x616f78], eax
test eax, eax
je 0x58b7d4
push 0x5e3924
push esi
call edi
mov dword [0x616f7c], eax
test eax, eax
je 0x58b7d4
push 0x5e3938
push esi
call edi
mov dword [0x616f80], eax
jmp 0x58b7d4
pop edi
push 0x59f8e0
call fcn.0055aa24
push 0x616f84
call fcn.0055ab8f
add esp, 8
pop esi
jmp 0x58b74c
Function at 0x10aaee50
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10aaee5a
pushal
call 0x10aaee60
pop ebp
sub ebp, 0x10
sub ebp, 0xaaee50
mov al, byte [esp + 0x28]
cmp al, 1
je 0x10aaee84
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10aaee8d
mov eax, 0xaaee50
add eax, ebp
add eax, 0x63
mov ecx, 0x5d3
mov edx, 0x73da1512
xor byte [eax], dl
inc eax
dec ecx
jne 0x10aaeea4
jmp 0x10aaeeb7
cdq
fistp word [ecx + 0x12122e9b]
adc dl, byte [ebx + 0x1212ead3]
adc dl, byte [ecx]
fild qword [edx + 0x12121214]
test al, 0x3a
adc dl, byte [edx]
adc ah, ch
invalid
Function at 0x409de0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4c9230]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], ecx
mov byte [ebp - 0x88], 0
push 0x7f
push 0
lea eax, [ebp - 0x87]
push eax
call fcn.00469c10
add esp, 0xc
mov byte [ebp - 0x110], 0
push 0x7f
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.00469c10
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x8c], edx
mov eax, dword [ebp + 0x10]
shl eax, 4
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x8c]
mov dword [ecx + eax + 0x3fec56], edx
mov eax, dword [ebp + 8]
push eax
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x409ed8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileMapping_:_errcode__d__n
lea ecx, [ebp - 0x88]
push ecx
call fcn.0046f198
add esp, 0xc
push str.BASIC_P:CreateMutex_ERR___SharedMemOpen__
lea edx, [ebp - 0x110]
push edx
call fcn.0046fd70
add esp, 8
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.00469b80
add esp, 4
push eax
lea ecx, [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0x118]
call fcn.00409a40
push 0
push 0
lea edx, [ebp - 0x88]
push edx
call fcn.0042758e
call fcn.00421033
xor eax, eax
jmp 0x409f56
mov eax, dword [ebp + 0x10]
shl eax, 4
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x114]
mov dword [ecx + eax + 0x3fec4e], edx
mov eax, dword [ebp - 0x8c]
push eax
push 0
push 0
push 0xf001f
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x118]
mov dword [edx + 0x3fec4a], eax
mov eax, dword [ebp - 0x118]
cmp dword [eax + 0x3fec4a], 0
jne 0x409f32
call fcn.00421033
xor eax, eax
jmp 0x409f56
mov ecx, dword [ebp + 0x10]
shl ecx, 4
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 0x3fec4a]
mov dword [edx + ecx + 0x3fec5a], eax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046a109
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41a050
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
mov eax, dword [0x4c9230]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x488], ecx
mov dword [ebp - 0x40c], 0
mov byte [ebp - 0x408], 0
push 0x3ff
push 0
lea eax, [ebp - 0x407]
push eax
call fcn.00469c10
add esp, 0xc
mov ecx, dword [ebp - 0x488]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x410], edx
mov eax, dword [ebp - 0x488]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x414], ecx
mov edx, dword [ebp - 0x410]
push edx
push 0x400
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x408]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004019c0
mov edx, dword [ebp - 0x40c]
or edx, 1
mov dword [ebp - 0x40c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046a109
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41ab70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x58], 0
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 0
push 0x40
push 0
lea ecx, [ebp - 0x44]
push ecx
call fcn.00469c10
add esp, 0xc
mov dword [ebp - 0x5c], 0
push 0x10
push 0
lea edx, [ebp - 0x58]
push edx
call fcn.00469c10
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.00469c10
add esp, 0xc
mov dword [ebp - 0x48], 0x44
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x48]
push edx
push 0
push 0
push 0x30
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov esp, ebp
pop ebp
ret
Function at 0x41ae90
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x4c9230]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x88], ecx
mov byte [ebp - 0x80], 0
push 0x63
push 0
lea eax, [ebp - 0x7f]
push eax
call fcn.00469c10
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x14], cx
xor edx, edx
mov dword [ebp - 0x12], edx
mov dword [ebp - 0xe], edx
mov dword [ebp - 0xa], edx
mov word [ebp - 6], dx
mov dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x192], 0
je 0x41aef3
or eax, 0xffffffff
jmp 0x41b038
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov ecx, dword [ebp - 0x88]
mov dword [ecx + 0x192], eax
mov edx, dword [ebp - 0x88]
cmp dword [edx + 0x192], 0xffffffff
jne 0x41af58
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.socket___falut___d
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x10
lea ecx, [ebp - 0x80]
push ecx
call fcn.0042758e
mov edx, dword [ebp - 0x88]
mov dword [edx + 0x192], 0
or eax, 0xffffffff
jmp 0x41b038
mov eax, 2
mov word [ebp - 0x14], ax
movzx ecx, word [ebp + 0x10]
push ecx
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0x12], ax
mov dword [ebp - 0x10], 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + 0x192]
push ecx
call dword [sym.imp.WSOCK32.dll_bind]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x41afed
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.bind___falut___d
lea edx, [ebp - 0x80]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + 0x192]
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
push 0
push 0x10
lea edx, [ebp - 0x80]
push edx
call fcn.0042758e
mov eax, dword [ebp - 0x88]
mov dword [eax + 0x192], 0
or eax, 0xffffffff
jmp 0x41b038
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + 0x192]
push ecx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
test eax, eax
jle 0x41b036
mov edx, dword [ebp - 0x88]
mov eax, dword [edx + 0x192]
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov ecx, dword [ebp - 0x88]
mov dword [ecx + 0x192], 0
or eax, 0xffffffff
jmp 0x41b038
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046a109
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41b050
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4c9230]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0
xor eax, eax
mov word [ebp - 0x14], ax
xor ecx, ecx
mov dword [ebp - 0x12], ecx
mov dword [ebp - 0xe], ecx
mov dword [ebp - 0xa], ecx
mov word [ebp - 6], cx
mov dword [ebp - 0x18], 0x10
mov edx, dword [ebp + 0x14]
and edx, 0xffff
movzx eax, dx
cmp eax, 1
jne 0x41b0b9
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.WSOCK32.dll_recvfrom]
mov dword [ebp - 0x1c], eax
jmp 0x41b0c0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046a109
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41b0e0
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4c9230]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0
xor eax, eax
mov word [ebp - 0x14], ax
xor ecx, ecx
mov dword [ebp - 0x12], ecx
mov dword [ebp - 0xe], ecx
mov dword [ebp - 0xa], ecx
mov word [ebp - 6], cx
mov edx, 2
mov word [ebp - 0x14], dx
movzx eax, word [ebp + 0x10]
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0x12], ax
push str.127.0.0.1
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0x10], eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push 0
movzx edx, word [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x192]
push edx
call dword [sym.imp.WSOCK32.dll_sendto]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046a109
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41b740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], 0
jne 0x41b75d
xor eax, eax
jmp 0x41b7a3
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
cmp eax, 1
jne 0x41b79f
cmp dword [ebp - 0xc], 0
je 0x41b798
push 0
lea edx, [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x41b79f
mov dword [ebp - 4], 0
mov ax, word [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x41b850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
xor ecx, ecx
mov word [ebp - 0xc], cx
jmp 0x41b873
mov dx, word [ebp - 0xc]
add dx, 1
mov word [ebp - 0xc], dx
movzx eax, word [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jae 0x41b89b
push 0
lea ecx, [ebp - 8]
push ecx
push 1
movzx edx, word [ebp - 0xc]
add edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x41b867
cmp dword [ebp + 0x10], 0
je 0x41b8bc
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0x469
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4247de
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0043e1fe
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x424817
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0042442f
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x424875
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x424899
cmp dword [edi + 0x54], 0
jne 0x424899
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0043e1fe
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00424836
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4281c5
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x49ef75
call fcn.00473307
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4281ea
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x428230
lea ecx, [ebp - 0x10]
call fcn.00404e00
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004210be
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004198c0
mov eax, esi
call fcn.004733df
ret 8
Function at 0x4296be
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x429706
call fcn.0043e1fe
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x429706
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x429749
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x429732
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x429732
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x429746
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42a25a
Capabilities:
Connect socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.WSOCK32.dll_connect]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret 8

Function at 0x431f88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x431fcf
call fcn.0043e1fe
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x431fcf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x431feb
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00431b02
mov esi, eax
test edi, edi
je 0x431fe9
test ebx, ebx
je 0x431fe9
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x43326b
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 1
mov ecx, esi
test al, 1
je 0x43328f
mov eax, dword [esi]
push 0
call dword [eax + 0x98]
test eax, eax
jne 0x43329d
pop esi
ret
mov eax, dword [esi + 0x24]
mov edx, dword [esi]
push eax
call dword [edx + 0x98]
jmp 0x433289
xor eax, eax
inc eax
pop esi
ret
Function at 0x43fbbb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x4a08fd
call fcn.00473307
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004019c0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x43fc1d
call fcn.0043d649
cmp eax, 1
jne 0x43fc1d
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00426c7a
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00401da0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004198c0
mov dword [ebp + 8], reloc.WSOCK32.dll_accept
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004198c0
mov eax, esi
call fcn.004733df
ret 0x10

Function at 0x43fc46
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x4a0928
call fcn.00473307
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004019c0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x43fca8
call fcn.0043d649
cmp eax, 1
jne 0x43fca8
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00426c7a
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00401da0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004198c0
mov dword [ebp + 8], reloc.WSOCK32.dll_accept
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004198c0
mov eax, esi
call fcn.004733df
ret 0x14

Function at 0x43fcd4
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x4a0953
call fcn.00473307
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004019c0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x43fd36
call fcn.0043d649
cmp eax, 1
jne 0x43fd36
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00426c7a
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00401da0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004198c0
mov dword [ebp + 8], reloc.WSOCK32.dll_accept
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004198c0
mov eax, esi
call fcn.004733df
ret 8

Function at 0x46a109
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c9230]
jne 0x46a113
repz ret
jmp fcn.004780ac
Function at 0x488480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4884b1
call fcn.00470e30
mov dword [eax], esi
call fcn.00470e1d
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004701d2
add esp, 0x14
push 0x16
pop eax
jmp 0x488506
test dword [ebp + 0xc], 0xfffffff9
jne 0x48848d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4884de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00470e43
pop ecx
call fcn.00470e1d
mov eax, dword [eax]
jmp 0x488506
test al, 0x10
jne 0x488504
test al, 1
je 0x488504
test byte [ebp + 0xc], 2
je 0x488504
call fcn.00470e30
mov dword [eax], 5
call fcn.00470e1d
mov dword [eax], 0xd
jmp 0x4884d5
xor eax, eax
pop esi
pop ebp
ret

Function at 0x495f20
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004779dd
and dword [ebp - 4], 0
cmp dword [0x4cd22c], 0
mov ebx, eax
jne 0x495fd1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x496082
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b213c
push edi
call esi
test eax, eax
je 0x496082
push eax
call fcn.0047796b
mov dword [esp], 0x4b212c
push edi
mov dword [0x4cd22c], eax
call esi
push eax
call fcn.0047796b
mov dword [esp], 0x4b2118
push edi
mov dword [0x4cd230], eax
call esi
push eax
call fcn.0047796b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4cd234], eax
call esi
push eax
call fcn.0047796b
pop ecx
mov dword [0x4cd23c], eax
test eax, eax
je 0x495fd1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047796b
pop ecx
mov dword [0x4cd238], eax
mov eax, dword [0x4cd238]
cmp eax, ebx
je 0x496029
cmp dword [0x4cd23c], ebx
je 0x496029
push eax
call fcn.004779e6
push dword [0x4cd23c]
mov esi, eax
call fcn.004779e6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x496029
test edi, edi
je 0x496029
call esi
test eax, eax
je 0x496020
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x496020
test byte [ebp - 0xc], 1
jne 0x496029
or dword [ebp + 0x10], 0x200000
jmp 0x496062
mov eax, dword [0x4cd230]
cmp eax, ebx
je 0x496062
push eax
call fcn.004779e6
pop ecx
test eax, eax
je 0x496062
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x496062
mov eax, dword [0x4cd234]
cmp eax, ebx
je 0x496062
push eax
call fcn.004779e6
pop ecx
test eax, eax
je 0x496062
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4cd22c]
call fcn.004779e6
pop ecx
test eax, eax
je 0x496082
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x496084
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret