joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cd8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x426bfb
call fcn.0041ba64
push ecx
push ebx
mov ebx, ecx
push esi
lea esi, [ebx + 4]
push edi
mov ecx, esi
mov dword [ebp - 0x10], ebx
call fcn.00405c3f
and dword [ebp - 4], 0
lea ecx, [ebx + 0xc]
mov dword [ebx], 0x4016e0
mov dword [esi], 0x4016d4
call fcn.00405b6e
mov byte [ebp - 4], 1
lea edi, [ebx + 0x20]
mov esi, 0x403df0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x30]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x405d50
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x426c24
call fcn.0041ba64
push ecx
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4016e0
mov dword [edi], 0x4016d4
mov dword [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.00405a82
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00405c85
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x405d5b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x426c24
call fcn.0041ba64
push ecx
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4016e0
mov dword [edi], 0x4016d4
mov dword [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.00405a82
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00405c85
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x406061
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4060b9
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x406086
xor eax, eax
jmp 0x4060b8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x4060aa
cmp esi, eax
jae 0x406082
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40609c
cmp esi, eax
jae 0x406082
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x4065b2
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x426ccb
call fcn.0041ba64
sub esp, 0x11c
mov eax, dword [0x42c300]
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x120], ebx
jne 0x4065e2
mov eax, 0x80070057
jmp 0x406788
push esi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 0x98]
call fcn.00405759
mov dword [ebp - 4], ebx
mov eax, dword [eax]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x120]
push ecx
push 1
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov edi, eax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x94]
cmp dword [ebp - 0x98], eax
je 0x40662f
push dword [ebp - 0x98]
call fcn.0041b1d4
pop ecx
cmp edi, ebx
jne 0x406776
lea eax, [ebp - 0x128]
push eax
push 1
push ebx
push dword [0x42c0c0]
mov dword [ebp - 0x128], ebx
push dword [ebp - 0x120]
call esi
cmp eax, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x4066b8
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x124]
push eax
push ebx
push dword [0x42c0c4]
mov dword [ebp - 0x11c], 0x104
push dword [ebp - 0x128]
call esi
mov edi, eax
cmp edi, ebx
jne 0x4066a8
cmp dword [ebp - 0x124], 1
jne 0x4066a5
cmp dword [ebp - 0x11c], 2
jae 0x4066a8
push 0xd
pop edi
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x406701
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x124]
push eax
push ebx
push dword [0x42c0bc]
mov dword [ebp - 0x11c], 0x104
push dword [ebp - 0x120]
call esi
mov edi, eax
cmp edi, ebx
jne 0x406701
cmp dword [ebp - 0x124], 1
jne 0x4066fe
cmp dword [ebp - 0x11c], 2
jae 0x406701
push 0xd
pop edi
push dword [ebp - 0x120]
mov byte [ebp - 0x14], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x406776
push 0x401770
push dword [ebp + 8]
call fcn.0041bc34
pop ecx
test eax, eax
mov eax, dword [0x42c0b4]
pop ecx
je 0x406731
mov eax, dword [0x42c0b8]
push eax
push 0x105
lea eax, [ebp - 0x118]
push eax
call fcn.0040637c
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x406772
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x406764
call esi
jmp 0x406786
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x406786
xor eax, eax
jmp 0x406786
jle 0x406784
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0041b4ee
leave
ret 4
Function at 0x406ce2
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x426d2b
call fcn.0041ba64
sub esp, 0x5c
push ebx
xor ebx, ebx
cmp dword [0x42cf14], ebx
push esi
push edi
jne 0x406e47
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004062bd
mov esi, eax
cmp esi, ebx
jl 0x406de9
push dword [ebp - 0x10]
lea ecx, [ebp + 8]
call fcn.00406c8e
mov byte [ebp - 4], 1
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x68]
rep stosd dword es:[edi], eax
push ebx
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], bx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x42cf14
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
push 0x40189c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x406dbc
push dword [0x42cf18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x4022dc
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x406dde
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.00418af5
mov esi, eax
cmp esi, ebx
jl 0x406dde
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [ebp - 0x20], eax
jne 0x406df8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x406dce
call esi
mov esi, eax
jmp 0x406dde
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.004069e8
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x406e4c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
mov dword [ebp - 0x1c], eax
jg 0x406e0c
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x412afc
push ebx
push ebx
call fcn.0041bd4e
add esp, 0x18
cmp eax, ebx
je 0x406dbc
push 0xffffffffffffffff
push dword [ebp - 0x20]
mov dword [0x42cf24], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x20]
call edi
lea ecx, [ebp + 8]
call fcn.00406928
jmp 0x406dde
mov esi, 0x8000ffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x408738
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x426e42
call fcn.0041ba64
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
lea ecx, [esi + 0x2c]
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
mov byte [esi + 0x14], bl
mov byte [esi + 0x15], bl
mov byte [esi + 0x16], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x20], bl
mov byte [esi + 0x21], bl
mov byte [esi + 0x22], bl
mov byte [esi + 0x23], bl
mov byte [esi + 0x24], bl
mov dword [esi + 0x28], ebx
call fcn.004069b2
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.004069b2
mov byte [ebp - 4], 2
lea ecx, [esi + 0x34]
call fcn.004069b2
mov byte [ebp - 4], 3
lea ecx, [esi + 0x38]
call fcn.004069b2
mov byte [ebp - 4], 4
mov eax, dword [ebp + 8]
lea edi, [esi + 0x3c]
mov dword [edi], eax
mov dword [edi + 4], ebx
mov byte [edi + 8], bl
mov byte [ebp - 4], 5
push ebx
push 0x3e7
push 0xb
push 0x401a44
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push eax
mov ecx, edi
call fcn.004144e5
mov dword [0x42cfcc], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x409a77
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x426fb9
call fcn.0041ba64
sub esp, 0x42c
mov eax, dword [0x42c300]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
call dword [0x42c090]
mov dword [ebp - 0x42c], eax
xor ebx, ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
cmp dword [ebp + 8], ebx
je 0x409b2e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
cmp edi, 0x400
jg 0x409afc
push edi
call fcn.00405430
test al, al
je 0x409afc
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.0041b480
mov dword [ebp - 0x10], esp
mov esi, esp
jmp 0x409b0a
push edi
lea ecx, [ebp - 0x41c]
call fcn.00405732
mov esi, eax
cmp esi, ebx
je 0x409b2e
mov byte [esi], bl
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x409b30
xor eax, eax
cmp eax, ebx
jne 0x409b5a
mov byte [ebp - 4], bl
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x409b50
lea ecx, [ebp - 0x418]
call fcn.00409c9e
mov esi, 0x8007000e
jmp 0x409c6e
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x428], edi
cmp edi, ebx
jne 0x409b7c
call fcn.00406f13
mov esi, eax
jmp 0x409c52
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x409ba1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x424], eax
cmp eax, ebx
jne 0x409bab
call fcn.00406f13
jmp 0x409c44
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x420], eax
mov byte [ebp - 4], 2
inc eax
mov dword [ebp - 0x438], eax
cmp eax, 0x400
jbe 0x409bd9
push eax
lea ecx, [ebp - 0x418]
call fcn.0040b036
jmp 0x409bef
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x409bef
mov dword [ebp - 4], 1
mov edi, dword [ebp - 0x418]
cmp edi, ebx
jne 0x409c07
mov esi, 0x8007000e
jmp 0x409c46
mov ecx, dword [ebp - 0x420]
mov esi, dword [ebp - 0x424]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 0x420]
mov byte [ecx + eax], bl
push dword [ebp + 0x14]
push dword [ebp - 0x418]
lea ecx, [ebp - 0x434]
call fcn.00409cb4
mov esi, eax
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], bl
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x409c6e
lea ecx, [ebp - 0x418]
call fcn.00409c9e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x41c]
call fcn.0040560f
mov eax, esi
lea esp, [ebp - 0x444]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0041b4ee
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40aa42
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x42701e
call fcn.0041ba64
sub esp, 0x114
mov eax, dword [0x42c300]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
mov dword [ebp - 0x114], esi
mov dword [ebp - 4], esi
push 0x2001f
push dword [ebp + 8]
lea ecx, [ebp - 0x114]
push dword [ebx]
call fcn.0040a973
cmp eax, esi
jne 0x40aae1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40aa9b
lea eax, [ebp - 0x110]
push eax
call fcn.0040aa42
cmp eax, esi
jne 0x40aae0
lea eax, [ebp - 0x120]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 0x114]
mov dword [ebp - 0x118], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x114]
je 0x40aa8b
call fcn.0040a95c
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.0040a95c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0041b4ee
leave
ret 4
Function at 0x40af21
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x40af2c
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x40b8a7
Capabilities:
Check os version

Disassembly:
mov eax, 0x42712d
call fcn.0041ba64
sub esp, 0x84
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebx
je 0x40b8dd
jl 0x40ba89
mov eax, 0x80004005
jmp 0x40ba89
call fcn.004136b1
cmp eax, 4
jne 0x40b8ee
xor eax, eax
jmp 0x40ba89
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x14]
push eax
call fcn.00416557
mov dword [ebp - 0x18], eax
cmp eax, ebx
jl 0x40ba89
mov dword [ebp - 4], ebx
cmp byte [ebp + 8], bl
jne 0x40b948
cmp edi, ebx
je 0x40ba4b
xor esi, esi
inc esi
cmp edi, esi
je 0x40ba48
jle 0x40ba4b
cmp edi, 3
jle 0x40b93f
cmp edi, 4
je 0x40b948
jle 0x40ba4b
cmp edi, 6
jg 0x40ba4b
call fcn.00416593
test eax, eax
jne 0x40b95a
push 0x42cf84
call fcn.00407155
mov dword [ebp - 0x18], eax
jmp 0x40ba4b
push ebx
mov eax, dword [ebp - 0x14]
push dword [eax]
lea ecx, [ebp - 0x54]
call fcn.0040b82a
mov byte [ebp - 4], 1
push dword [ebp - 0x14]
call fcn.00416248
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x90]
call fcn.00408d29
mov byte [ebp - 4], 2
push ebx
push esi
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x90]
call fcn.00408afe
lea eax, [ebp - 0x70]
push eax
call fcn.0040886c
mov byte [ebp - 4], 3
push ebx
push esi
push eax
lea ecx, [ebp - 0x90]
call fcn.00408afe
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70]
call fcn.004083ba
mov esi, 0x4018e8
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 4], 4
push ebx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x38]
call fcn.00407b7f
push ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x38]
call fcn.00407ac0
push ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x38]
call fcn.00407a01
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
push 6
pop ecx
mov dword [ebp - 0x2c], ecx
push ebx
push ebx
push ebx
push 2
push ecx
push ebx
push ebx
push 0xffffffffffffffff
push eax
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x38]
call fcn.00407801
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x90]
call fcn.0040910a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x54]
call fcn.004083ba
jmp 0x40ba4b
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x14], ebx
je 0x40ba5b
push dword [ebp - 0x14]
call fcn.00416248
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jl 0x40ba89
jmp 0x40b8e7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40c4ad
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c4fe
cmp dword [ebp + 0x10], 1
je 0x40c4e7
cmp dword [ebp + 0x10], 2
jne 0x40c4f5
test edi, edi
mov eax, dword [ebp - 4]
je 0x40c4fa
cmp byte [eax + edi - 1], 0
je 0x40c4fa
push 0xd
pop eax
jmp 0x40c4fe
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x40f7fc
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 0xc

Function at 0x40fce4
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4277c5
call fcn.0041ba64
sub esp, 0x318
mov eax, dword [0x42c300]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x318], ebx
mov byte [ebp - 4], 1
push 0x100
lea eax, [ebp - 0x310]
push eax
sub esp, 0x10
mov edi, esp
mov esi, 0x403df0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040fc29
push 0x20019
lea eax, [ebp - 0x310]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x31c]
call fcn.0040a973
test eax, eax
je 0x40fd67
mov byte [ebp + 0x1f], bl
jmp 0x40fe8b
mov dword [ebp + 0x14], ebx
lea eax, [ebp - 0x324]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0x14]
mov esi, 0x100
push dword [ebp - 0x31c]
mov dword [ebp - 0x314], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc dword [ebp + 0x14]
test eax, eax
jne 0x40fd5f
push 1
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x31c]
lea ecx, [ebp - 0x318]
mov byte [ebp - 0x111], bl
call fcn.0040a973
test eax, eax
jne 0x40fd6a
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x401ca4
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x314], esi
call fcn.0040c4ad
test eax, eax
jne 0x40fe4a
push 0xc
mov edi, 0x401ebc
lea esi, [ebp - 0x110]
pop ecx
xor eax, eax
mov byte [ebp - 0x11], bl
repe cmpsb byte [esi], byte es:[edi]
jne 0x40fe4a
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x401eb4
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x314], 0x100
call fcn.0040c4ad
test eax, eax
jne 0x40fe4a
push dword [ebp + 0x18]
lea eax, [ebp - 0x110]
push eax
mov byte [ebp - 0x11], bl
call fcn.0041c460
test eax, eax
pop ecx
pop ecx
je 0x40fe5a
lea ecx, [ebp - 0x318]
call fcn.0040a95c
jmp 0x40fd6a
cmp dword [ebp + 0x1c], ebx
je 0x40fe87
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x310]
push eax
push 0x401eac
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
call fcn.0040c83d
add esp, 0x14
test eax, eax
mov byte [ebp + 0x1f], bl
jl 0x40fe8b
mov byte [ebp + 0x1f], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x318]
call fcn.0040a95c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x31c]
call fcn.0040a95c
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0x1f]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0041b4ee
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x412478
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x427b98
call fcn.0041ba64
sub esp, 0x68
push ebx
push esi
push edi
push 0x402238
lea ecx, [ebp - 0x20]
call fcn.00411d0a
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1c]
call fcn.004069b2
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1c]
push eax
push 0x40181c
push dword [ebp - 0x20]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00415992
cmp eax, ebx
jge 0x4124d3
cmp eax, 0x80070002
jne 0x4124cc
mov eax, 0x80046900
mov esi, eax
jmp 0x4125d2
lea ecx, [ebp - 0x18]
call fcn.004069b2
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
push 0x401c44
push dword [ebp - 0x1c]
call fcn.00415e4f
cmp eax, ebx
jge 0x4124fb
mov esi, eax
jmp 0x4125c6
lea ecx, [ebp - 0x10]
call fcn.004069b2
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call fcn.004159f7
cmp eax, ebx
jge 0x41251e
mov esi, eax
jmp 0x4125ba
lea ecx, [ebp - 0x14]
call fcn.004069b2
mov byte [ebp - 4], 4
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [ebp - 0x10]
push 0x402224
push eax
call fcn.0040da3a
add esp, 0x10
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x70]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x74], 0x44
call fcn.00414e14
test al, al
jne 0x412562
mov esi, 0x80046901
jmp 0x4125ae
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
call fcn.0040f941
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push eax
call fcn.00410c3d
mov esi, eax
cmp esi, ebx
jl 0x4125ae
push 0xffffffffffffffff
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x4125ae
push dword [ebp - 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x2c]
call edi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.004069e8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.004069e8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004069e8
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.004069e8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004069e8
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x412683
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, dword [ebp + 0xc]
je 0x4126bc
test byte [esi + 8], 2
je 0x4126bc
mov al, byte [0x42d038]
mov byte [ebp + 0xf], al
push 0x4299f4
lea eax, [ebp + 0xf]
push eax
call fcn.0041b55e
xor ecx, ecx
cmp eax, dword [ebp + 0xc]
pop esi
sete cl
mov eax, ecx
pop ebp
ret 0xc