joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437050
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x437074
mov eax, 3
jmp 0x43718c
mov ecx, dword [ebp - 0x14]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x437090
mov eax, 2
jmp 0x43718c
mov dword [ebp - 4], 0x82
mov edx, dword [ebp - 4]
shl edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp - 4], eax
ja 0x43716b
mov ecx, dword [ebp - 4]
shl ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x821
jb 0x4370c9
mov eax, 0xd
jmp 0x43718c
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00408423
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
shl edx, 1
push edx
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call fcn.00414820
add esp, 0xc
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0x446ca4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43713c
mov ecx, dword [ebp - 4]
sub ecx, 1
cmp dword [ebp - 8], ecx
jne 0x437166
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0040842e
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [ebp - 8], 0
jne 0x437166
mov eax, pe_nt_image_headers32
jmp 0x43718c
jmp 0x43709f
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x437183
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x43718a
mov eax, 0xd
jmp 0x43718c
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x4371a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, 0xfeff
mov word [ebp - 8], ax
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4371e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x437243
push 0
lea edx, [ebp - 4]
push edx
push 2
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x437204
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x437243
push 0
lea edx, [ebp - 4]
push edx
push 0x446c14
call fcn.0041489a
add esp, 4
lea eax, [eax + eax + 2]
push eax
push str._SESSION_
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x437237
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x437243
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x437530
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], vtable.CArmReport.0
push 0x104
push 0
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
call fcn.00414820
add esp, 0xc
mov edx, dword [ebp - 8]
add edx, 4
push edx
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x43757b
jmp 0x4375a7
push str.AdobeARM_
push 0x104
mov eax, dword [ebp - 8]
add eax, 4
push eax
call fcn.00401080
push str.ArmReport.ini
push 0x104
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
call fcn.00401080
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4376e0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x43770c
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x437713
mov eax, 2
jmp 0x437783
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x437781
mov byte [ebp - 9], 0
lea eax, [ebp - 9]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Delete_Report
mov ecx, dword [ebp - 0x10]
call fcn.004375b0
push 4
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x437781
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov byte [ebp - 0xa], 0
lea edx, [ebp - 0xa]
push edx
mov eax, dword [ebp - 8]
push eax
push str.MoveEx_Report
mov ecx, dword [ebp - 0x10]
call fcn.004375b0
mov eax, dword [ebp - 8]
jmp 0x437783
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x437790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov byte [0x452cc5], 1
mov dword [0x452cbc], 1
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov ecx, 0x452d20
call fcn.004031f0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x437816
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, 0x452d2c
call fcn.004031f0
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x43782c
cmp dword [ebp - 0xc], 1
jne 0x43782c
mov dword [0x452cbc], 2
mov esp, ebp
pop ebp
ret
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x35057a2b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1fbd56ba
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Get common file path
Get file version info
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x434440]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0x63
push 0x42c378
mov ecx, dword [ebp + 8]
call fcn.00402710
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x218]
test ecx, ecx
je 0x401059
lea edx, [ebp - 0x218]
push edx
call fcn.0041c0c5
add esp, 4
test eax, eax
ja 0x401060
xor eax, eax
jmp 0x4011e7
lea ecx, [ebp - 0x2e8]
call fcn.00408930
lea eax, [ebp - 0x218]
push eax
push str._sinternet_exploreriexplore.exe
lea ecx, [ebp - 0x2e8]
push ecx
call fcn.00403310
add esp, 0xc
push 0
lea ecx, [ebp - 0x2e8]
call fcn.00407570
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
add edx, 1
push edx
call fcn.0041c0ba
add esp, 4
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0
je 0x4011cc
mov ecx, dword [ebp - 8]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x2e4]
push edx
call fcn.0041c040
add esp, 0xc
mov eax, dword [ebp - 0x2e4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
lea ecx, [ebp - 0x2e8]
call fcn.00407570
push eax
call sub.VERSION.dll_GetFileVersionInfoW
lea edx, [ebp - 0x2fc]
push edx
lea eax, [ebp - 0x2f4]
push eax
push 0x42c3c4
mov ecx, dword [ebp - 0x2e4]
push ecx
call sub.VERSION.dll_VerQueryValueW
mov edx, dword [ebp - 0x2f4]
mov eax, dword [edx + 8]
shr eax, 0x10
and eax, 0xffff
mov word [ebp - 0x300], ax
mov ecx, dword [ebp - 0x2f4]
mov edx, dword [ecx + 8]
and edx, 0xffff
mov word [ebp - 0x2f0], dx
mov eax, dword [ebp - 0x2f4]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
mov word [ebp - 0x2f8], cx
mov edx, dword [ebp - 0x2f4]
mov eax, dword [edx + 0xc]
and eax, 0xffff
mov word [ebp - 0x2ec], ax
movzx ecx, word [ebp - 0x300]
push ecx
push 0x42c3c8
mov edx, dword [ebp + 8]
push edx
call fcn.00403310
add esp, 0xc
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x308], eax
mov ecx, dword [ebp - 0x308]
push ecx
call fcn.0041c027
add esp, 4
mov dword [ebp - 0x30c], 1
lea ecx, [ebp - 0x2e8]
call fcn.00408990
mov eax, dword [ebp - 0x30c]
jmp 0x4011e7
mov dword [ebp - 0x310], 0
lea ecx, [ebp - 0x2e8]
call fcn.00408990
mov eax, dword [ebp - 0x310]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041c0df
mov esp, ebp
pop ebp
ret
Function at 0x401bf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x401bf9
xor ecx, ecx
jne 0x401bf9
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401c40
mov eax, dword [ebp - 0xc]
jmp 0x401c9d
cmp dword [ebp - 4], 1
je 0x401c53
cmp dword [ebp - 4], 2
je 0x401c53
mov eax, 0xd
jmp 0x401c9d
cmp dword [ebp + 0xc], 0
je 0x401c91
cmp dword [ebp - 8], 0
je 0x401c89
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x401c80
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x401c87
mov eax, 0xd
jmp 0x401c9d
jmp 0x401c91
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4044e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x434440]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x454], ecx
call fcn.00403e50
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2c]
call fcn.004071d0
mov eax, dword [ebp - 0x454]
push eax
lea ecx, [ebp - 0x18]
call fcn.004047d0
lea ecx, [ebp - 0x438]
call fcn.004071d0
push 0x400
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404280
add esp, 8
mov dword [ebp - 8], eax
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40455e
call fcn.00403eb0
mov dword [ebp - 0x444], eax
jmp 0x4046b3
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jne 0x40458f
call fcn.00403eb0
mov dword [ebp - 0x444], eax
jmp 0x4046b3
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x4045bf
call fcn.00403eb0
mov dword [ebp - 0x444], eax
jmp 0x4046b3
mov edx, dword [ebp - 0x440]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
cmp edx, dword [ebp - 0x1c]
jae 0x40460f
mov dword [ebp - 0x44c], 0x8007000e
lea ecx, [ebp - 0x438]
call fcn.004071f0
lea ecx, [ebp - 0x2c]
call fcn.00406e00
mov eax, dword [ebp - 0x44c]
jmp 0x4046e8
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
lea ecx, [ebp - 0x438]
call fcn.00407210
lea ecx, [ebp - 0x438]
call fcn.00407570
test eax, eax
jne 0x40463c
mov dword [ebp - 0x444], 0x8007000e
jmp 0x4046b3
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x438]
call fcn.00407570
push eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
call fcn.00403e50
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x40467e
call fcn.00403eb0
mov dword [ebp - 0x444], eax
jmp 0x4046b3
lea ecx, [ebp - 0x438]
call fcn.00407570
xor ecx, ecx
mov edx, dword [ebp - 0x43c]
mov word [eax + edx*2], cx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x438]
call fcn.00407570
push eax
lea ecx, [ebp - 0x18]
call fcn.00404800
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x10], 0
je 0x4046c3
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x450], edx
lea ecx, [ebp - 0x438]
call fcn.004071f0
lea ecx, [ebp - 0x2c]
call fcn.00406e00
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.0041c0df
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405ec0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x434440]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00401af0
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00401b90
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x405f2b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00401b20
mov eax, dword [ebp - 0x224]
jmp 0x405fbc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x405f91
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00405ec0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x405f88
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00401b20
mov eax, dword [ebp - 0x228]
jmp 0x405fbc
mov dword [ebp - 4], 0x100
jmp 0x405f32
lea ecx, [ebp - 0x14]
call fcn.00401b40
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00405df0
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00401b20
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041c0df
mov esp, ebp
pop ebp
ret 4
Function at 0x406520
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x406529
xor ecx, ecx
jne 0x406529
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x40654a
mov eax, 0xd
jmp 0x4065a5
xor eax, eax
jne 0x406531
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x40655b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x408510
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x434440]
xor eax, ebp
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
call fcn.00408930
lea ecx, [ebp - 0xc]
call fcn.00408930
push 0x208
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.0041c040
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x220]
push ecx
call fcn.0041c040
add esp, 0xc
push 0x104
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 8], eax
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 4], eax
lea ecx, [ebp + 8]
call fcn.00402730
test eax, eax
jle 0x4085a4
lea ecx, [ebp - 0x428]
push ecx
call fcn.0041c0c5
add esp, 4
lea ecx, [ebp + 0xc]
call fcn.00402730
test eax, eax
jle 0x4086f2
lea ecx, [ebp - 0x468]
call fcn.00408930
push str.regsvr32.exe
lea edx, [ebp - 0x428]
push edx
push 0x42cb34
lea eax, [ebp - 0x10]
push eax
call fcn.00403310
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str.__s_s_
lea eax, [ebp - 0xc]
push eax
call fcn.00403310
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
push str.__s__s
lea edx, [ebp - 0x468]
push edx
call fcn.00403310
add esp, 0xc
mov dword [ebp - 0x464], 0
push 0x38
push 0
lea eax, [ebp - 0x460]
push eax
call fcn.0041c040
add esp, 0xc
mov dword [ebp - 0x464], 0x3c
mov dword [ebp - 0x460], 0x4000
mov dword [ebp - 0x458], str.open
mov dword [ebp - 0x454], str.regsvr32
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x44c], ecx
lea ecx, [ebp - 0x468]
call fcn.00407570
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x448], 0
lea edx, [ebp - 0x464]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4086e7
cmp dword [ebp + 0x10], 0
je 0x4086aa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x46c], 1
lea ecx, [ebp - 0x468]
call fcn.00408990
lea ecx, [ebp - 0xc]
call fcn.00408990
lea ecx, [ebp - 0x10]
call fcn.00408990
lea ecx, [ebp + 8]
call fcn.00408990
lea ecx, [ebp + 0xc]
call fcn.00408990
mov eax, dword [ebp - 0x46c]
jmp 0x408722
lea ecx, [ebp - 0x468]
call fcn.00408990
mov dword [ebp - 0x470], 0
lea ecx, [ebp - 0xc]
call fcn.00408990
lea ecx, [ebp - 0x10]
call fcn.00408990
lea ecx, [ebp + 8]
call fcn.00408990
lea ecx, [ebp + 0xc]
call fcn.00408990
mov eax, dword [ebp - 0x470]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041c0df
mov esp, ebp
pop ebp
ret
Function at 0x40bb50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea ecx, [ebp + 8]
call fcn.00402730
test eax, eax
jne 0x40bb76
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00408990
mov eax, dword [ebp - 4]
jmp 0x40bbc9
push ecx
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.0040ad30
call fcn.0040ba40
add esp, 4
test eax, eax
jne 0x40bbb7
push 0
lea ecx, [ebp + 8]
call fcn.00407570
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bbb7
mov dword [ebp - 0xc], 1
lea ecx, [ebp + 8]
call fcn.00408990
mov eax, dword [ebp - 0xc]
jmp 0x40bbc9
mov dword [ebp - 0x10], 1
lea ecx, [ebp + 8]
call fcn.00408990
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x40f9f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
mov eax, dword [0x434440]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1b8], 4
mov dword [ebp - 0x1bc], 0xe
mov dword [ebp - 0x1b4], 0
lea eax, [ebp - 0x198]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x40fb8d
push 0x3e8
push 2
push 6
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xffffffff
je 0x40fb87
push 0xe
push 0
lea ecx, [ebp - 0x1a8]
push ecx
call fcn.0041c040
add esp, 0xc
mov edx, 6
mov word [ebp - 0x1a8], dx
mov eax, dword [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x40fb7a
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x1ac]
push ecx
push 0x400d
push 0x3e8
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x40fb7a
cmp dword [ebp - 0x1ac], 0
je 0x40fb7a
push 0x18
push 0
lea eax, [ebp - 0x1d4]
push eax
call fcn.0041c040
add esp, 0xc
mov ecx, dword [ebp - 0x1ac]
sub ecx, 1
mov dword [ebp - 0x1ac], ecx
mov edx, dword [ebp - 0x1ac]
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1b8], 0x18
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x1d4]
push ecx
push 0x4007
push 0x3e8
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x40fb75
movzx eax, byte [ebp - 0x1c5]
cmp eax, 1
jne 0x40fb75
movzx ecx, byte [ebp - 0x1c6]
test ecx, ecx
jne 0x40fb75
push 6
lea edx, [ebp - 0x1cc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041dab0
add esp, 0xc
mov dword [ebp - 0x1b4], 1
jmp 0x40fb7a
jmp 0x40face
mov ecx, dword [ebp - 0x1b0]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c0df
mov esp, ebp
pop ebp
ret