joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465117
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x465140
xor eax, eax
jmp 0x46526f
push str.LoadLibraryExA
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push 0x4c33e8
push dword [ebp + 8]
call fcn.00427790
pop ecx
pop ecx
test eax, eax
je 0x465190
cmp dword [ebp - 8], 0
je 0x465179
push 8
push 0
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 0x18], eax
jmp 0x465185
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
jmp 0x46526c
cmp dword [ebp - 8], 0
je 0x4651bd
push str.AddDllDirectory
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4651bd
push 0x800
push 0
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x46526c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x46526c
push dword [ebp + 8]
call fcn.00421050
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax + 1]
push eax
call dword [0x4bfa34]
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x465262
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x465262
push 0x4c33fc
push dword [ebp - 4]
call fcn.00421050
pop ecx
add eax, dword [ebp - 4]
push eax
call fcn.00421490
pop ecx
pop ecx
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00421050
pop ecx
add eax, dword [ebp - 4]
push eax
call fcn.00421490
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x465250
push 8
push 0
push dword [ebp - 4]
call dword [ebp - 8]
mov dword [ebp - 0x1c], eax
jmp 0x46525c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [0x4bfa3c]
pop ecx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x469b1d
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp + 0x90], eax
push dword [ebp + 0x9c]
call fcn.00428076
pop ecx
mov dword [ebp - 0x7c], eax
xor eax, eax
inc eax
imul eax, eax, 0
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x104
jae 0x469b5b
jmp 0x469b60
call fcn.00415672
mov eax, dword [ebp - 0x78]
mov byte [ebp + eax - 0x74], 0
cmp dword [ebp - 0x7c], 0
je 0x469b80
push 0x104
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor eax, eax
inc eax
imul eax, eax, 0
movsx eax, byte [ebp + eax - 0x74]
test eax, eax
je 0x469b9f
lea eax, [ebp - 0x74]
push eax
call dword [0x4bfa40]
pop ecx
mov dword [ebp - 0x80], eax
jmp 0x469ba3
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
call fcn.0041553e
add ebp, 0x94
mov esp, ebp
pop ebp
ret
Function at 0x476f5c
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cdq
push 0x64
pop ecx
idiv ecx
cmp eax, 2
je 0x476f8f
push str.Couldnt_set_desired_mode
push dword [ebp - 8]
call fcn.004465bf
pop ecx
pop ecx
push 0x11
pop eax
jmp 0x476ffc
cmp dword [ebp + 0xc], 0xc8
je 0x476fab
push dword [ebp + 0xc]
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push dword [ebp - 8]
call fcn.004460bd
add esp, 0xc
cmp dword [ebp + 0x10], 0x13
jne 0x476fbf
push dword [ebp + 8]
call fcn.00478405
pop ecx
mov dword [ebp - 4], eax
jmp 0x476ff9
cmp dword [ebp + 0x10], 0x14
jne 0x476fd3
push dword [ebp + 8]
call fcn.0047825c
pop ecx
mov dword [ebp - 4], eax
jmp 0x476ff9
cmp dword [ebp + 0x10], 0x15
jne 0x476fe7
push dword [ebp + 8]
call fcn.0047823b
pop ecx
mov dword [ebp - 4], eax
jmp 0x476ff9
cmp dword [ebp + 0x10], 0x16
jne 0x476ff9
push dword [ebp + 8]
call fcn.0047821a
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x479bbc
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp + 0x7c]
mov eax, dword [ecx + eax + 0x1a8]
mov dword [ebp - 0x20], eax
or dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x1c], 0x80
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x479c27
mov dword [ebp - 0x1c], 0x80
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x20]
push dword [ebp + 0x7c]
call fcn.00446a9c
pop ecx
pop ecx
cmp dword [ebp - 0x14], 0xffffffff
jne 0x479c51
push str.Error_accept__ing_server_connect
push dword [ebp - 0x18]
call fcn.004465bf
pop ecx
pop ecx
push 0x1e
pop eax
jmp 0x479cdd
push str.Connection_accepted_from_server_n
push dword [ebp - 0x18]
call fcn.004460bd
pop ecx
pop ecx
mov eax, dword [ebp + 0x7c]
mov byte [eax + 0x280], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp + 0x7c]
mov edx, dword [ebp - 0x14]
mov dword [ecx + eax + 0x1a8], edx
push 1
push dword [ebp - 0x14]
call fcn.00468ade
pop ecx
pop ecx
xor eax, eax
inc eax
shl eax, 0
mov ecx, dword [ebp + 0x7c]
mov byte [ecx + eax + 0x1b8], 1
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x1d8], 0
je 0x479cdb
and dword [ebp - 0x24], 0
push 1
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push dword [eax + 0x1dc]
mov eax, dword [ebp - 0x18]
call dword [eax + 0x1d8]
add esp, 0xc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x479cdb
push dword [ebp + 0x7c]
call fcn.00479dd6
pop ecx
push 0x2a
pop eax
jmp 0x479cdd
xor eax, eax
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.0041553e
add ebp, 0x74
mov esp, ebp
pop ebp
ret
Function at 0x47c31a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 4], 0xff
xor eax, eax
inc eax
shl eax, 0
mov cl, byte [ebp + 0xc]
mov byte [ebp + eax - 4], cl
xor eax, eax
inc eax
shl eax, 1
mov cl, byte [ebp + 0x10]
mov byte [ebp + eax - 4], cl
push 0
push 3
lea eax, [ebp - 4]
push eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 8]
push dword [ecx + eax + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x47c38f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0x4c7ca8
push dword [ebp - 0x10]
call fcn.004465bf
add esp, 0xc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x4c7cc4
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.0047c3ab
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x47c645
Capabilities:
Initialize winsock library

Disassembly:
push ebp
lea ebp, [esp - 0x11c]
sub esp, 0x19c
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp + 0x118], eax
xor eax, eax
jne 0x47c660
push 2
pop eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x47c69c
push dword [ebp - 0x80]
push str.WSAStartup_failed___d_
push dword [ebp + 0x124]
call fcn.004465bf
add esp, 0xc
push 2
pop eax
jmp 0x47c6fb
call dword [sym.imp.WS2_32.dll_WSACleanup]
movzx eax, word [ebp - 0x78]
and eax, 0xff
movzx eax, al
movzx ecx, word [ebp - 0x7c]
and ecx, 0xff
movzx ecx, cl
cmp eax, ecx
jne 0x47c6e2
movzx eax, word [ebp - 0x78]
shr eax, 8
and eax, 0xff
movzx eax, al
movzx ecx, word [ebp - 0x7c]
shr ecx, 8
and ecx, 0xff
movzx ecx, cl
cmp eax, ecx
je 0x47c6f9
push str.insufficient_winsock_version_to_support_telnet
push dword [ebp + 0x124]
call fcn.004465bf
pop ecx
pop ecx
push 2
pop eax
jmp 0x47c6fb
xor eax, eax
mov ecx, dword [ebp + 0x118]
xor ecx, ebp
call fcn.0041553e
add ebp, 0x11c
mov esp, ebp
pop ebp
ret
Function at 0x481882
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.00420921
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4818ab
cmp dword [ebp - 4], 0xffffffff
jne 0x4818af
xor eax, eax
jmp 0x4818b2
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x48897d
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
inc eax
imul eax, eax, 0
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostname]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
mov byte [eax - 1], 0
cmp dword [ebp - 4], 0
je 0x4889b3
mov eax, dword [ebp - 4]
jmp 0x4889d0
push 0x2e
push dword [ebp + 8]
call fcn.004180b0
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4889ce
mov eax, dword [ebp - 8]
mov byte [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x489ab5
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 8
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x489aec
xor al, al
jmp 0x489b96
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004179d0
add esp, 0xc
mov byte [ebp - 0x18], 8
mov byte [ebp - 0x17], 2
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
call fcn.00489ba4
pop ecx
pop ecx
push 8
lea eax, [ebp - 0xc]
push eax
call fcn.0048e3e6
pop ecx
pop ecx
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x489b57
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x489b96
push 8
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00417b30
add esp, 0xc
push dword [ebp - 0x20]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push 0
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
Function at 0x489d11
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push dword [ebp + 0xc]
call fcn.00421050
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x489d3b
mov eax, dword [ebp - 4]
shl eax, 1
push eax
call dword [0x4bfa34]
pop ecx
mov dword [ebp - 0x10], eax
jmp 0x489d4a
push 0x4cc86c
call dword [0x4bfa40]
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x489d5e
push 0x1b
pop eax
jmp 0x489e12
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.00489a7a
add esp, 0xc
and dword [ebp - 0x14], 0
je 0x489d7d
mov eax, dword [ebp - 0x14]
jmp 0x489e12
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x489df3
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x489de8
mov dword [ebp - 0x1c], 0x10
push 0
mov eax, dword [ebp - 4]
shl eax, 1
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 5
push 0
mov eax, dword [ebp + 0x10]
add eax, 0x10
push eax
call fcn.004179d0
add esp, 0xc
push dword [ebp - 8]
call dword [0x4bfa3c]
pop ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x494000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4979d2
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x250]
mov dword [0x4cc76c], 0x706863
push 0
push eax
mov dword [0x4cc768], 0x706569
mov word [0x4cc779], 0x666f
mov dword [0x4cc781], 0x4f5353
mov dword [0x4cc77c], 0x65726177
mov byte [0x4cc778], 0x53
mov byte [0x4cc77b], 0x74
mov byte [0x4cc780], 0x5c
mov word [0x4cc770], 0x2d53
mov dword [0x4cc773], 0x302d312d
mov byte [0x4cc777], 0
mov byte [0x4cc772], 0x31
call fcn.004179d0
add esp, 0xc
lea eax, [ebp - 0x250]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x14c]
push 0
push eax
call fcn.004179d0
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea eax, [ebp - 0x14c]
push 0x104
push eax
call fcn.0041e719
add esp, 0xc
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0x254]
call fcn.0040bf20
push eax
mov ecx, 0x4cc890
mov dword [ebp - 4], 0
call fcn.004092a0
lea ecx, [ebp - 0x254]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c260
push 0x4cc890
mov ecx, 0x4cc894
call fcn.004092a0
push 0x4cc890
mov ecx, 0x4cc898
call fcn.004092a0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x19], 0x5c7365
mov word [ebp - 0x28], 0x746e
mov dword [ebp - 0x38], 0x54535953
mov word [ebp - 0x25], 0x6c6f
mov dword [ebp - 0x2d], 0x43746e65
mov word [ebp - 0x1b], 0x6369
mov dword [ebp - 0x32], 0x7275435c
mov dword [ebp - 0x22], 0x735c7465
mov byte [ebp - 0x26], 0x72
mov word [ebp - 0x1e], 0x7265
mov word [ebp - 0x34], 0x4d45
mov byte [ebp - 0x23], 0x53
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x29], 0x6f
mov byte [ebp - 0x2e], 0x72
mov dword [ebp - 0x48], 0x6365535c
mov word [ebp - 0x43], 0x6972
mov word [ebp - 0x40], 0x79
mov byte [ebp - 0x41], 0x74
mov byte [ebp - 0x44], 0x75
push eax
lea ecx, [ebp - 0x258]
call fcn.0040bf20
push 0x4cc890
mov edx, eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x254]
call fcn.00408bd0
add esp, 4
push eax
mov ecx, 0x4cc89c
mov byte [ebp - 4], 2
call fcn.004092a0
lea ecx, [ebp - 0x254]
call fcn.0040c260
lea ecx, [ebp - 0x258]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c260
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x264]
call fcn.0040bf20
push 0x4cc890
mov edx, eax
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x260]
call fcn.00408bd0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
push ecx
mov edx, eax
lea ecx, [ebp - 0x25c]
call fcn.00408ae0
add esp, 8
push eax
mov ecx, 0x4cc8a0
mov byte [ebp - 4], 5
call fcn.004092a0
lea ecx, [ebp - 0x25c]
call fcn.0040c260
lea ecx, [ebp - 0x260]
call fcn.0040c260
lea ecx, [ebp - 0x264]
call fcn.0040c260
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
Function at 0x4942b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], 0
push eax
lea eax, [ebp - 0x24]
mov word [ebp - 0x24], 0x656b
push eax
mov dword [ebp - 0x21], 0x336c656e
mov word [ebp - 0x1d], 0x32
mov byte [ebp - 0x22], 0x72
mov dword [ebp - 0x15], 0x3436776f
mov word [ebp - 0xd], 0x7365
mov word [ebp - 0x17], 0x5773
mov word [ebp - 0x10], 0x6f72
mov byte [ebp - 0x18], 0x49
mov word [ebp - 0xb], 0x73
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0x11], 0x50
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x494332
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
xor ecx, ebp
pop esi
call fcn.0041553e
mov esp, ebp
pop ebp
ret

Function at 0x494350
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
push dword [eax - 0xc]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov edx, dword [ebp + 8]
test eax, eax
sete bl
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x4943b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov edi, dword [eax + 4]
mov dword [ebp - 4], edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x494423
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call edi
mov ecx, dword [ebp + 0xc]
mov eax, esi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4943e7
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 4], edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x494428
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call edi
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x49441a
mov edx, dword [eax]
push eax
mov ecx, dword [edx]
mov esi, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x49442f
mov ecx, dword [edx + 4]
push 0
push dword [ecx + 4]
call edi
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call dword [ebp - 4]
jmp 0x4943b3
mov ecx, edx
call dword [ebp - 4]
jmp 0x4943e7
mov ecx, edx
call esi
jmp 0x49441a
Function at 0x494440
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497a10
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 4], 1
mov ecx, 1
mov eax, dword [esi]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x800
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x800
or eax, ecx
jge 0x4944a4
push 0x800
mov ecx, esi
call fcn.0040c200
lea eax, [ebp - 0x14]
push eax
push dword [esi]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ecx, dword [esi]
mov edi, eax
test ecx, ecx
je 0x4944dd
push dword [ecx - 8]
push ecx
call fcn.00420290
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x49458c
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x49458c
mov dword [eax - 0xc], ecx
test edi, edi
mov eax, dword [esi]
sete bl
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov byte [ebp - 0x19], bl
mov byte [ecx + eax], 0
mov eax, esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x494538
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x494533
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call edi
jmp 0x494535
call ebx
mov bl, byte [ebp - 0x19]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jg 0x49456e
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x49456a
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call edi
jmp 0x49456e
mov ecx, edx
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0040c2a0
int3
Function at 0x4945a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497a61
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 1
mov dword [esi], 0
call fcn.0040c560
mov ecx, eax
test ecx, ecx
jne 0x4945fb
push 0x80004005
call fcn.0040c2a0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x494610
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x494612
call edx
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x54], 1
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
push eax
mov dword [ebp - 0x4c], 0
movq qword [ebp - 0x48], xmm0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3a], 0x336c6c65
mov dword [ebp - 0x34], 0x6c6c64
mov word [ebp - 0x3c], 0x6873
mov word [ebp - 0x36], 0x2e32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4946ff
push 0x2bf
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4cc7a0], eax
test eax, eax
je 0x494687
lea ecx, [ebp - 0x4c]
push ecx
push dword [ebp + 8]
call eax
lea eax, [ebp - 0x2c]
mov word [ebp - 0x25], 0x776f
push eax
push edi
mov dword [ebp - 0x22], 0x646c6f46
mov dword [ebp - 0x2a], 0x4b746547
mov word [ebp - 0x1e], 0x7265
mov dword [ebp - 0x1b], 0x687461
mov word [ebp - 0x2c], 0x4853
mov byte [ebp - 0x26], 0x6e
mov byte [ebp - 0x23], 0x6e
mov byte [ebp - 0x1c], 0x50
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4cc79c], eax
test eax, eax
je 0x4946f8
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
lea ecx, [ebp - 0x4c]
push ecx
call eax
test eax, eax
jne 0x4946f8
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x4946f8
push eax
mov ecx, esi
call fcn.00409210
push dword [ebp - 0x50]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x494739
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x494735
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x494739
mov ecx, edx
call edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
Function at 0x494760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10c], 0
xor bl, bl
call fcn.00406360
push 0x104
mov esi, eax
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004179d0
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x494805
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x494805
lea ecx, [ebp - 0x108]
push ecx
push 0
push eax
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x108]
push eax
push 0x4b7e5c
push edi
call fcn.0040ae40
add esp, 0xc
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041553e
mov esp, ebp
pop ebp
ret