joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4199d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.005dfd60
push 0x103
lea ecx, [ebp - 0x20b]
push 0
push ecx
mov byte [ebp - 0x20c], 0
call fcn.005dfd60
add esp, 0x18
push 0x6af4b8
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push eax
call fcn.004e24e0
add esp, 4
push str.eServ.ini
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x108]
push edx
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x60c81c
push str.ClientLogDir
push str.General
call esi
cmp byte [ebp - 0x20c], 0
jne 0x419a92
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x108]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0x60c81c
push str.FTPDownloadDir
push str.General
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp byte [ebp - 0x20c], al
pop esi
setne al
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret

Function at 0x419ad0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.005dfd60
push 0x103
lea ecx, [ebp - 0x20b]
push 0
push ecx
mov byte [ebp - 0x20c], 0
call fcn.005dfd60
add esp, 0x18
call fcn.0052a220
push 0x6af4b8
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push eax
call fcn.004e24e0
add esp, 4
push str.eServ.ini
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x108]
push edx
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x60c81c
push str.ClientLogDir
push str.General
call esi
cmp byte [ebp - 0x20c], 0
jne 0x419bf0
lea ecx, [ebp - 0x108]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0x60c81c
push str.FTPDownloadDir
push str.General
call esi
cmp byte [ebp - 0x20c], 0
je 0x419bf0
push str.LOG
lea eax, [ebp - 0x20c]
push 0x614850
push eax
call fcn.004e9030
add esp, 0xc
test eax, eax
je 0x419bf0
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x20c]
push edx
push str.ClientLogDir
push str.General
call fcn.004e0cb0
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x41b540
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x558], eax
push ebx
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x564], ecx
mov dword [ebp - 0x560], edx
mov esi, 1
xor edi, edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x558], edi
je 0x41b5b6
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004e24e0
mov edx, dword [ebp - 0x558]
add esp, 4
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x41b5ce
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.004d83c0
add esp, 0xc
cmp dword [ebp + 0x18], edi
je 0x41b5e9
lea eax, [ebp - 0x20c]
push eax
push str._EUI__FindFiles___s_
push 0
call fcn.004f0f30
add esp, 0xc
lea ecx, [ebp - 0x554]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.004e0820
add esp, 8
mov dword [ebp - 0x55c], eax
cmp eax, 0xffffffff
je 0x41b756
mov edi, edi
test esi, esi
je 0x41b736
test byte [ebp - 0x554], 0x10
jne 0x41b719
cmp dword [ebp - 0x558], 0
je 0x41b65b
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004e24e0
add esp, 4
lea edx, [ebp - 0x528]
push edx
lea eax, [ebp - 0x20c]
push eax
jmp 0x41b68c
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x20c]
push eax
call fcn.004e24e0
add esp, 4
lea ecx, [ebp - 0x528]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x41b6bc
mov eax, dword [ebp - 0x554]
mov ecx, eax
and ecx, 0x20
push ecx
push eax
lea edx, [ebp - 0x20c]
push edx
push str._EUI__mstr:__s___Att:_0x_x___Arch:_d
push 0
call fcn.004f0f30
add esp, 0x14
test byte [ebp - 0x554], 0x20
je 0x41b719
mov eax, dword [ebp - 0x564]
test eax, eax
je 0x41b6e0
mov ecx, dword [ebp - 0x540]
mov edx, dword [ebp - 0x53c]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x560]
test eax, eax
je 0x41b6f2
mov ecx, dword [ebp - 0x534]
mov dword [eax], ecx
test esi, esi
je 0x41b705
push str._EUI__setting_rval_to_TRUE...
push 0
call fcn.004f0f30
add esp, 8
push 0
lea edx, [ebp - 0x20c]
push edx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp - 0x55c]
lea eax, [ebp - 0x554]
push eax
push ecx
call fcn.004d5ad0
add esp, 8
mov esi, eax
jmp 0x41b610
mov edx, dword [ebp - 0x55c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], edi
je 0x41b76a
push str._EUI__No_files_found
push 0
call fcn.004f0f30
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x421380
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x66fde8
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push 0x421100
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x1c], eax
cmp eax, esi
jne 0x42141a
call fcn.004d9930
test eax, eax
jne 0x4213ff
call fcn.004190e0
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x20]
push ecx
push 0xffffffffffffffff
push str.WAV_STAT_4a
call fcn.00411ca0
add esp, 0xc
cmp dword [ebp - 0x1c], esi
je 0x421455
lea edx, [ebp - 0x1c]
push edx
call fcn.004dca10
jmp 0x421455
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421480
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.005dfd60
add esp, 0xc
push esi
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0x60c81c
push str.DownloadFromAnotherServer
push 0x60da74
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x108], 0x31
je 0x4214ec
cmp dword [0x6b076c], 0
je 0x421579
push 0
push 0
push 0x4496a0
call fcn.005e07ac
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x421543
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x20c]
push str.Error:_beginthread_5x2ay__fails_with_error__d
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x20c]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x108], 0x31
push 0
push 1
jne 0x421557
push str._DISCOVER__Discover_Clients_Thread_Started__Download_From_Another_Server_...
jmp 0x42155c
push str._DISCOVER__Discover_Clients_Thread_Started__eScan_Primary_Server_...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0
push esi
push str.CBD_5e2ay
call fcn.00420720
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x42b740
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
cmp dword [esp + 0x30], 0
mov dword [esp], 0
jne 0x42b76a
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
add esp, 0x20
ret
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x34]
push ebx
push 5
push ebp
mov dword [esp + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov esi, eax
mov edi, 1
cmp esi, 0x102
jne 0x42b828
lea ecx, [ecx]
cmp edi, 0x14
jl 0x42b7b7
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x40]
cmp eax, dword [esp + 0x38]
ja 0x42b828
cmp dword [esp + 0x10], 0
jne 0x42b80f
mov edi, edi
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x42b80f
cmp dword [esp + 0x18], 0x12
je 0x42b807
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x42b7c0
mov dword [esp + 0x10], 1
push ebx
push 5
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov esi, eax
inc edi
cmp esi, 0x102
je 0x42b7a0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x42b840
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x66ff50
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x42b8d6
jle 0x42b897
cmp byte [esi + edi - 1], 0x2e
je 0x42b8d6
push 0x2e
push edi
call fcn.005e0940
add esp, 8
test eax, eax
je 0x42b8d6
add esi, 2
push esi
call fcn.005e20e4
add esp, 4
mov esi, eax
test esi, esi
je 0x42b8d6
mov ebx, 1
mov dword [ebp - 0x20], ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x66d664
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x42b8d8
mov esi, edi
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
test ebx, ebx
je 0x42b8f7
push esi
call fcn.005e0865
add esp, 4
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x42b918
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b940
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x66ff70
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x120
push ebx
push esi
push edi
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
xor edi, edi
lea ebx, [esi + 1]
mov ecx, dword [0x6b3344]
mov dword [ebp - 0x2c], edi
cmp edi, dword [ebp + 0xc]
jge 0x42ba45
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x130], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x1c], 4
cmp ecx, esi
je 0x42b9ef
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 5
lea ecx, [ebp - 0x28]
push ecx
push esi
push esi
lea edx, [ebp - 0x130]
push edx
push esi
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 6
mov ecx, dword [0x6b3344]
cmp ecx, esi
jne 0x42b9d0
mov dword [ebp - 0x1c], 7
cmp eax, esi
jne 0x42ba3e
add edi, ebx
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x1c], 0xa
jmp 0x42b994
mov dword [ebp - 0x1c], 9
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42db30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670010
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
test eax, eax
je 0x42dc1b
cmp byte [eax], 0
je 0x42dc1b
push eax
push str.netsh.exe__f__s
lea eax, [ebp - 0x120]
push eax
call fcn.005dfb23
add esp, 0xc
push 1
push str.NetshIPChanged
push 0x60d9ec
push connect
call fcn.004f48a0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 1
lea ecx, [ebp - 0x120]
push ecx
call fcn.0042db00
add esp, 0x1c
test eax, eax
je 0x42dbe4
push str.NetshIPChanged
push 0x60d9ec
push connect
call fcn.004e9430
jmp 0x42dc1b
push 0
push 0
push 0x42d730
call fcn.005e07ac
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x42dc24
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x42f200
Capabilities:
Create thread

Disassembly:
sub esp, 0x230
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
xor ebx, ebx
push 0x11c
lea eax, [esp + 0x14]
push ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.005dfd60
mov eax, dword [0x6b2fc0]
add esp, 0xc
cmp eax, ebx
jne 0x42f257
push str.GetSystemTimes
push 0x61bed4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6b2fc0], eax
cmp eax, ebx
je 0x42f260
push ebx
push ebx
push ebx
call eax
cmp eax, ebx
jne 0x42f28e
cmp dword [esp + 0x244], ebx
je 0x42f276
push str.GetSystemTimes___failed__n
call fcn.005e0e7f
add esp, 4
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x230
ret
push esi
mov esi, dword [esp + 0x23c]
cmp esi, ebx
jne 0x42f2a2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
push ebp
mov bp, word [esp + 0x250]
cmp bp, bx
push esi
push ebx
jg 0x42f2c5
push 0x410
call fcn.004e45c0
add esp, 0xc
mov dword [esp + 0xc], eax
jmp 0x42f330
push 0x1fffff
call fcn.004e45c0
add esp, 0xc
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x42f36e
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], ebx
call fcn.004efe60
add esp, 4
test eax, eax
je 0x42f302
mov edx, dword [esp + 0x10]
push 1
push edx
call fcn.004d8790
add esp, 8
push esi
push ebx
push 0x1fffff
call fcn.004e45c0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0xc], eax
cmp ecx, ebx
je 0x42f330
cmp ecx, 0xffffffff
je 0x42f330
push ebx
push ecx
call fcn.004d8790
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, ebx
jne 0x42f36e
cmp dword [esp + 0x24c], ebx
je 0x42f351
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcess___failed_with_Error__d__n
call fcn.005e0e7f
add esp, 8
pop ebp
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x230
ret
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x244]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x248]
push edi
mov edi, dword [esp + 0x250]
mov dword [esp + 0x1c], esi
mov word [esp + 0x28], bp
mov dword [esp + 0x20], edi
mov dword [esp + 0x130], ebx
mov dword [esp + 0x134], ebx
cmp eax, ebx
je 0x42f3c1
cmp byte [eax], bl
je 0x42f3c1
lea edx, [esp + 0x2a]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x42f3b5
jmp 0x42f3d4
lea ecx, [esp + 0x2a]
push ecx
lea edx, [esp + 0x13c]
push edx
push esi
call fcn.00515670
cmp edi, ebx
pop edi
je 0x42f3ec
push esi
lea eax, [esp + 0x2a]
push eax
push str.Process:__s__PID:__u__n
call fcn.005e0e7f
add esp, 0xc
cmp bp, bx
push ebx
push ebx
jg 0x42f3ff
lea ecx, [esp + 0x1c]
push ecx
push 0x42ecf0
jmp 0x42f409
lea edx, [esp + 0x1c]
push edx
push 0x42e8f0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esp + 0x130], ebx
jne 0x42f42d
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
cmp dword [esp + 0x130], ebx
je 0x42f420
lea eax, [esp + 0xc]
push eax
call fcn.004dca10
mov ecx, dword [esp + 0x238]
pop ebp
pop esi
pop ebx
xor ecx, esp
mov eax, 2
call fcn.005dfbbe
add esp, 0x230
ret
Function at 0x430180
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
push esi
push edi
push 1
lea eax, [esp + 0xc]
push eax
push str.SoftwareMicrosoftCommand_Processor
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call fcn.004faef0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0x10
test eax, eax
jne 0x430206
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.EnableExtensions
push eax
mov dword [esp + 0x28], 4
call edi
test eax, eax
je 0x4301fb
mov edx, dword [esp + 8]
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push str.EnableExtensions
push edx
mov dword [esp + 0x24], 1
call esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
lea ecx, [esp + 0xc]
push ecx
push str.SoftwareMicrosoftCommand_Processor
push connect
call fcn.004faef0
add esp, 0x10
test eax, eax
jne 0x430273
mov ecx, dword [esp + 8]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push 0
push str.EnableExtensions
push ecx
mov dword [esp + 0x28], 4
call edi
test eax, eax
je 0x430268
mov eax, dword [esp + 8]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push str.EnableExtensions
push eax
mov dword [esp + 0x24], 1
call esi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0xc
ret
Function at 0x430300
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x43041d
cmp byte [esi], bl
je 0x43041d
mov edi, dword [esp + 0x20]
cmp edi, ebx
jbe 0x43041d
lea eax, [esp + 0xc]
push eax
push 0x20019
push ebx
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43041d
mov eax, dword [esp + 0x24]
cmp eax, 1
jne 0x430392
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
push edx
push ebx
push ebx
push esi
push eax
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x430387
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp eax, ebx
jne 0x4303d4
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
push esi
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x4303c9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp eax, 2
jne 0x43041d
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
push esi
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x43040c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp + 0x10], 1
pop edi
pop esi
sete al
pop ebx
add esp, 8
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x430430
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0xfb30
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0xfb2c], eax
mov eax, dword [esp + 0xfb44]
mov ecx, dword [esp + 0xfb48]
push edi
mov edi, dword [esp + 0xfb38]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
test edi, edi
je 0x430681
cmp byte [edi], 0
je 0x430681
push ebx
push ebp
push esi
push 0x20
push 0x615764
push edi
call fcn.005dffe9
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4304e9
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x18], eax
call ebp
sub eax, dword [esp + 0x18]
cmp eax, 0x7d0
jae 0x4304cb
push 0xa
call ebx
push 0x20
push 0x615764
push edi
call fcn.005dffe9
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4304a2
jmp 0x4304e9
test esi, esi
jne 0x4304e9
push 0x20
push 0x60cf08
push edi
call fcn.005dffe9
mov esi, eax
add esp, 0xc
test esi, esi
je 0x43067e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, 1
mov ebx, eax
cmp dword [esp + 0xfb48], ebp
jne 0x4305c2
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x38]
push 0
push eax
call fcn.004f00d0
movzx ecx, word [esp + 0x32]
push ecx
lea edx, [esp + 0x38]
push 0x61c6bc
push edx
call fcn.005dfb23
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x14
push 0x66d664
lea eax, [esp + 0x3c]
push eax
call edi
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x3c]
push edx
call edi
cmp dword [esp + 0xfb50], 0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
lea edx, [esp + 0x140]
push ecx
je 0x43057c
push ebx
push str.__04d___s____s
push edx
call fcn.005dfb23
add esp, 0x14
jmp 0x43058a
push 0x61c6a0
push edx
call fcn.005dfb23
add esp, 0x10
mov eax, dword [esp + 0x14]
test eax, eax
je 0x430630
cmp byte [eax], 0
je 0x430630
lea ecx, [esp + 0x13c]
push ecx
push eax
lea edx, [esp + 0x7e44]
push str.__s___s
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x43064d
cmp dword [esp + 0xfb50], 0
je 0x4305e9
mov eax, dword [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x144]
push str.__04d_____s
push ecx
call fcn.005dfb23
add esp, 0x10
jmp 0x430603
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x140]
push 0x60c800
push eax
call fcn.005dfb23
add esp, 0xc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x430630
cmp byte [eax], 0
je 0x430630
lea ecx, [esp + 0x13c]
push ecx
push eax
lea edx, [esp + 0x7e44]
push str.__s___s
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x43064d
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x7e40]
push 0x60c800
push ecx
call fcn.005dfb23
add esp, 0xc
lea edx, [esp + 0x7e3c]
push esi
push edx
call fcn.005e2972
add esp, 8
cmp dword [esp + 0xfb4c], ebp
jne 0x430675
push esi
push 0x60cc70
call fcn.005e2972
add esp, 8
push esi
call fcn.005dff6d
add esp, 4
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xfb30]
pop edi
xor ecx, esp
call fcn.005dfbbe
add esp, 0xfb30
ret