joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x461461
cmp dword [ebp + 0xc], 0
je 0x461461
cmp dword [ebp + 0x10], 0
je 0x461461
cmp dword [ebp + 0x14], 0
jne 0x461466
jmp 0x461539
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00460950
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x461539
cmp dword [ebp - 0x14], 0
je 0x461539
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x461539
mov edx, dword [ebp - 0x14]
add edx, 1
push edx
call fcn.00405e7b
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x461539
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x461539
mov edx, dword [ebp + 0x10]
cmp dword [edx], 1
je 0x46150f
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x461524
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00460a00
add esp, 8
mov dword [ebp - 4], eax
jmp 0x461539
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
cmp dword [ebp - 8], 0
je 0x461552
mov eax, dword [ebp - 8]
push eax
call fcn.00462990
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x46156b
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00462990
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4615e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x46161a
cmp dword [ebp + 0xc], 0
je 0x46161a
cmp dword [ebp + 0x14], 0
je 0x46161a
cmp dword [ebp + 0x18], 0
jne 0x46161f
jmp 0x4616a1
cmp dword [ebp + 0x10], 1
je 0x46162b
cmp dword [ebp + 0x10], 2
jne 0x461682
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00460660
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x461646
jmp 0x4616a1
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.00460660
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x461661
jmp 0x4616a1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
jmp 0x4616a1
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x4616ba
mov edx, dword [ebp - 4]
push edx
call fcn.00462990
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x4616d3
mov eax, dword [ebp - 8]
push eax
call fcn.00462990
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4616e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x46171a
cmp dword [ebp + 0xc], 0
je 0x46171a
cmp dword [ebp + 0x14], 0
je 0x46171a
cmp dword [ebp + 0x18], 0
jne 0x46171f
jmp 0x4617a9
cmp dword [ebp + 0x10], 1
je 0x46172b
cmp dword [ebp + 0x10], 2
jne 0x46178a
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00460950
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x461746
jmp 0x4617a9
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.00460950
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x461761
jmp 0x4617a9
mov ecx, dword [ebp - 0x10]
shl ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
jmp 0x4617a9
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x4617c2
mov eax, dword [ebp - 8]
push eax
call fcn.00462990
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x4617db
mov ecx, dword [ebp - 4]
push ecx
call fcn.00462990
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x461840
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x46187a
cmp dword [ebp + 8], 0
jne 0x46187a
jmp 0x46191a
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp dword [ebp - 8], 0
je 0x46191a
mov edx, dword [ebp - 8]
push edx
call fcn.00405e7b
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46191a
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x46191a
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00460b60
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46191a
cmp dword [ebp + 0xc], 0
je 0x461914
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jle 0x4618ee
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004057a0
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404340
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0xc], 0
je 0x461933
mov eax, dword [ebp - 0xc]
push eax
call fcn.00462990
add esp, 4
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x46194c
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00462990
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x461960
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x46199a
cmp dword [ebp + 8], 0
jne 0x46199a
jmp 0x461a3c
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [ebp - 8], 0
je 0x461a3c
mov edx, dword [ebp - 8]
shl edx, 1
push edx
call fcn.00405e7b
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x461a3c
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x461a3c
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00460a00
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x461a3c
cmp dword [ebp + 0xc], 0
je 0x461a36
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jle 0x461a10
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004057a0
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404340
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 4], 0
je 0x461a55
mov eax, dword [ebp - 4]
push eax
call fcn.00462990
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x461a6e
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00462990
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x461b90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00460660
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x461c86
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x461c86
cmp dword [ebp + 0x10], 0
je 0x461c86
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405e7b
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x461c86
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x461c86
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00460b60
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x461c6d
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jle 0x461c4e
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004436c0
add esp, 0xc
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
mov byte [edx], 0
jmp 0x461c86
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004057a0
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x461c9f
mov edx, dword [ebp - 8]
push edx
call fcn.00462990
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x461cb8
mov eax, dword [ebp - 4]
push eax
call fcn.00462990
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x461cd1
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00462990
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x461ce0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00460950
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x461dd8
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x461dd8
cmp dword [ebp + 0x10], 0
je 0x461dd8
mov eax, dword [ebp - 8]
shl eax, 1
push eax
call fcn.00405e7b
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x461dd8
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x461dd8
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00460a00
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x461dbf
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jle 0x461da0
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004436c0
add esp, 0xc
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
mov byte [edx], 0
jmp 0x461dd8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004057a0
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x461df1
mov edx, dword [ebp - 0x10]
push edx
call fcn.00462990
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 4], 0
je 0x461e0a
mov eax, dword [ebp - 4]
push eax
call fcn.00462990
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x461e23
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00462990
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x46d900
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x539a68]
xor eax, ebp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], str.getaddrinfo
mov dword [ebp - 0x18], 0x46dbb0
mov dword [ebp - 0x14], str.getnameinfo
mov dword [ebp - 0x10], 0x46e410
mov dword [ebp - 0xc], str.freeaddrinfo
mov dword [ebp - 8], fcn.0046db40
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
cmp dword [0x55a9c8], 0
je 0x46d96b
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x545364]
jmp 0x46db25
push 0x104
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x46d986
jmp 0x46da7b
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.0040393b
add esp, 0xc
push str.ws2_32
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.00403789
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x46d9f9
push str.getaddrinfo
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x46d9f9
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0
je 0x46da01
jmp 0x46da7b
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.0040393b
add esp, 0xc
push str.wship6
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.00403789
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x46da74
push str.getaddrinfo
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x46da74
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
jmp 0x46da7b
cmp dword [ebp - 0x20], 0
je 0x46db10
mov dword [ebp - 4], 0
jmp 0x46da97
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [0x52f04c]
jge 0x46dada
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*8 - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*8 - 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [ebp + edx*8 - 0x18], 0
jne 0x46dad8
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
jmp 0x46dada
jmp 0x46da8e
cmp dword [ebp - 0x20], 0
je 0x46db10
mov dword [ebp - 4], 0
jmp 0x46daf2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [0x52f04c]
jge 0x46db10
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*8 - 0x18]
mov dword [eax*8 + 0x545364], edx
jmp 0x46dae9
mov dword [0x55a9c8], 1
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x545364]
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0040553d
mov esp, ebp
pop ebp
ret 4
Function at 0x46df90
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x46dfbc
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x46dfdc
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x2e
jne 0x46dfda
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x46dfb3
cmp dword [ebp - 0xc], 3
je 0x46dfe6
xor eax, eax
jmp 0x46e00a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x46dffd
xor eax, eax
jmp 0x46e00a
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x46e260
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x46e328
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x46e308
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x46e308
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x46e2c5
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x46e308
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
mov ax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0046e010
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jne 0x46e2fb
mov eax, 8
jmp 0x46e36e
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 0xc], ecx
jmp 0x46e2bc
push 0x400
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
push 0x401
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.004037fa
add esp, 0x10
xor eax, eax
jmp 0x46e36e
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
sub edx, 0x2af9
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 3
ja case.default.0x46e346
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x46e374]
mov eax, 0x2af9
jmp 0x46e36e
mov eax, 0x2afa
jmp 0x46e36e
mov eax, 0x2afb
jmp 0x46e36e
mov eax, 0x2af9
jmp 0x46e36e
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x476b90
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x18]
push eax
call fcn.00478230
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004780a0
add esp, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x476c90
push 0
call fcn.00476d20
add esp, 4
push 1
call fcn.00476d20
add esp, 4
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x476c90
mov eax, dword [ebp - 0x10]
push eax
call fcn.00462990
add esp, 4
cmp dword [ebp + 8], 0
je 0x476c86
cmp dword [ebp + 8], 0
je 0x476c86
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x80], 0
je 0x476c55
xor edx, edx
je 0x476c55
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
mov dword [ebp - 0x14], ecx
jmp 0x476c5c
mov dword [ebp - 0x14], 0xffffffc1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x80], eax
push 0
push 0xff
push 0
push 0
push 0x1de
push 0xffffffffffffffc1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00463eb0
add esp, 0x1c
mov eax, 1
jmp 0x476d1a
mov edx, dword [ebp - 0x10]
push edx
call fcn.00462990
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x476cb8
cmp dword [ebp + 0x14], 0
jne 0x476cc8
mov eax, dword [ebp + 0x10]
push eax
call fcn.004038b0
add esp, 4
test eax, eax
jne 0x476cc8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x476d0e
cmp dword [ebp + 0x14], 0
je 0x476cd6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
jmp 0x476ce8
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004038b0
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
xor ecx, ecx
cmp dword [ebp + 0x14], 0
setne cl
lea ecx, [ecx + ecx + 1]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00461580
add esp, 0x14
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x478230
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x539a68]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x478250
mov eax, reloc.WSOCK32.dll_accept
jmp 0x47829c
push 0x94
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.004057a0
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x478297
cmp dword [ebp + 8], 0
jne 0x478297
cmp dword [ebp - 0x9c], 6
jb 0x478297
mov eax, reloc.WSOCK32.dll_accept
jmp 0x47829c
mov eax, reloc.WSOCK32.dll_bind
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040553d
mov esp, ebp
pop ebp
ret

Function at 0x47a2f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
je 0x47a304
mov eax, dword [ebp + 0x10]
mov dword [0x5624f0], eax
jmp 0x47a30e
mov dword [0x5624f0], 0xffffffff
mov ecx, dword [ebp + 0x14]
mov dword [0x5624e8], ecx
cmp dword [0x55b014], 0
je 0x47a32f
mov edx, dword [0x5624e4]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x47a3a0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x5624e4], eax
cmp dword [0x5624e4], 0
jne 0x47a34f
xor eax, eax
jmp 0x47a3a5
push 4
push 1
call fcn.0040605e
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47a368
xor eax, eax
jmp 0x47a3a5
mov eax, dword [ebp - 4]
mov ecx, dword [0x5624e4]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 0x47a260
call fcn.004468c9
add esp, 0xc
mov dword [0x55b014], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x55b014], 0
jne 0x47a3a0
xor eax, eax
jmp 0x47a3a5
mov eax, dword [0x55b014]
mov esp, ebp
pop ebp
ret

Function at 0x47a3e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.0040a5dc
add esp, 4
mov dword [0x55ac08], eax
cmp dword [0x55ac08], 0
je 0x47a407
mov eax, dword [0x55ac08]
jmp 0x47a482
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push str.SOFTWAREFLEXlm_License_Manager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47a480
mov dword [ebp - 0xc], 0x400
lea edx, [ebp - 0xc]
push edx
push 0x55ac10
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47a472
mov dword [0x55ac08], 0x55ac10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x55ac08]
jmp 0x47a482
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x47a482
xor eax, eax
mov esp, ebp
pop ebp
ret