joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430b5d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00430b5d
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov edx, 0x18609c8
call fcn.0045d0ba
mov ebx, dword [ebp + 0x14]
call fcn.0045c2a9
mov ebx, dword [ebp + 0x18]
mov dword [ebx], 0
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx]
call fcn.0045d0a3
mov eax, 1
mov ecx, 1
xchg ecx, eax
call fcn.00454232
mov edx, 0x18609d8
call fcn.0045d0ba
call fcn.0045c602
jne 0x430be3
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx]
call fcn.0045d0a3
mov ecx, 2
mov eax, 0x7fffffff
call fcn.00454232
mov ebx, dword [ebp + 0xc]
call fcn.0045c2a9
lea ebx, [ebp - 0xa4]
push ebx
fild dword [0x186d63c]
fild dword [0x186cde0]
call fcn.0045c11c
call fcn.0045c2a2
push eax
push 0
mov ebx, dword [ebp + 0xc]
call fcn.0045d1af
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x430d57
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
push 0
push 0
push 0
mov ebx, dword [ebp + 0x10]
call fcn.0045d1af
push ebx
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x430d48
mov eax, edi
mov ebx, eax
xor eax, eax
call fcn.00456eea
mov ebx, dword [ebp + 0x14]
call fcn.0045c2a9
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
mov ebx, dword [ebp + 0x14]
call fcn.0045d1af
push ebx
mov ebx, dword [ebp + 0x18]
push ebx
push 0
mov ebx, dword [ebp + 0x10]
call fcn.0045d1af
push ebx
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov esi, eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebx]
call fcn.0045c27b
fstp xword [ebp - 0x50]
fild dword [0x186cdcc]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
je 0x430ced
fild dword [0x186cdd0]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
je 0x430ced
fild dword [0x186cdd8]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
jne 0x430d13
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebx]
call fcn.0045d0a3
mov edx, 0x186080c
call fcn.0045d0ba
call fcn.0045a86f
mov ebx, dword [ebp + 0x14]
call fcn.0045c2a9
jmp 0x430d48
fild dword [0x186cdd4]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
jne 0x430d48
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebx]
call fcn.0045d0a3
mov eax, 1
call fcn.00450156
call fcn.0045ad27
mov ebx, dword [ebp + 0x14]
call fcn.0045c2a9
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x98], esi
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x430d7a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00430d7a
xor esi, esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyA]
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
call fcn.0045ce8d
call fcn.0045d088
push eax
mov ebx, dword [ebp + 0x14]
push ebx
push 1
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x430dfe
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00430dfe
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyA]
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
call fcn.0045ce8d
call fcn.0045d088
push eax
mov ebx, dword [ebp + 0x14]
push ebx
push 2
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x430e85
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00430e85
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0x9c]
mov dword [ebx], edi
push ebx
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186d63c]
fild dword [0x186cde4]
call fcn.0045c11c
call fcn.0045c2a2
push eax
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
mov esi, dword [ebp - 0x98]
mov edi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
call fcn.0045ce8d
call fcn.0045d088
push eax
mov ebx, dword [ebp + 0x14]
push ebx
push 1
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x430f3a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00430f3a
xor esi, esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyA]
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
push 4
mov ebx, dword [ebp + 0x14]
push ebx
push 4
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x43105b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0043105b
xor esi, esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
fild dword [0x186d63c]
fild dword [0x186cde8]
call fcn.0045c11c
call fcn.0045c2a2
push eax
push 0
mov ebx, dword [ebp + 0xc]
call fcn.0045d1af
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
push 4
lea ebx, [ebp + 0x14]
push ebx
push 4
push 0
mov ebx, dword [ebp + 0x10]
call fcn.0045d1af
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4310f6
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004310f6
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push 0
xor eax, eax
lea ebx, [esp]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186d63c]
fild dword [0x186cde8]
call fcn.0045c11c
call fcn.0045c2a2
push eax
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
add esp, 4
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
push 0
xor eax, eax
lea ebx, [esp]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
push 0
push 0xf003f
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
add esp, 4
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4311e9
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004311e9
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push 0
xor eax, eax
lea ebx, [esp]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186d63c]
fild dword [0x186cde8]
call fcn.0045c11c
call fcn.0045c2a2
push eax
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
add esp, 4
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x431284
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00431284
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
mov ebx, dword [ebp + 0xc]
call fcn.0045ce8d
mov eax, 1
call fcn.00454296
mov edx, 0x18609d8
call fcn.0045d0ba
call fcn.0045c602
je 0x4312e3
mov ebx, dword [ebp + 0xc]
call fcn.0045ce8d
mov edx, 0x18609d8
call fcn.0045d0ba
call fcn.0045c56d
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
call fcn.0045ced6
push 0
push 0
xor eax, eax
lea ebx, [esp]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186d63c]
fild dword [0x186cde8]
call fcn.0045c11c
call fcn.0045c2a2
push eax
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
add esp, 4
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x4313eb
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
push 0
push 0
push 0
xor eax, eax
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186d63c]
fild dword [0x186cde8]
call fcn.0045c11c
call fcn.0045c2a2
push eax
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
call fcn.0045ce8d
mov ebx, dword [ebp + 0x10]
call fcn.0045ce8d
call fcn.0045c56d
lea ebx, [esp + 0x1c]
call fcn.0045c36b
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 8
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x4313eb
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x431408
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00431408
xor esi, esi
xor edi, edi
mov ecx, 0x52
push esi
dec ecx
jne 0x431424
lea ebx, [ebp + 8]
call fcn.0045ce8d
xor eax, eax
call fcn.00452fc5
lea ebx, [ebp + 8]
mov ecx, 0x104
call fcn.0045ced6
push 0
mov eax, 2
mov ecx, 1
add eax, ecx
mov ecx, 4
add eax, ecx
mov ecx, 8
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x431476
jmp 0x43150a
mov eax, 0x128
mov dword [ebp - 0x1c0], eax
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
nop
nop
nop
nop
nop
nop
cmp dword [ebp - 0x1cc], 0
je 0x4314fe
lea ebx, [ebp - 0x19c]
call fcn.0045ce8d
xor eax, eax
call fcn.00452fc5
lea ebx, [ebp + 8]
call fcn.0045ce8d
call fcn.0045c602
jne 0x4314e3
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x98], eax
jmp 0x4314fe
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
jmp 0x4314a0
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104

Function at 0x43181e
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0043181e
xor esi, esi
xor edi, edi
mov ecx, 0x16
push esi
dec ecx
jne 0x43183a
push 0
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov edx, 0x1865548
call fcn.0045d0ba
lea ebx, [esp + 4]
call fcn.0045c36b
fild qword [0x186d0c4]
call fcn.0045c2a2
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov eax, esi
test eax, eax
je 0x431904
mov edi, 0x40
push 0
push 0
push 0
xor eax, eax
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
push 0
xor eax, eax
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], edi
push ebx
lea ebx, [ebp - 0xdc]
push ebx
push 0
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegEnumValueA]
add esp, 8
mov edi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x4318fd
lea ebx, [ebp - 0xdc]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueA]
fldcw word [ebp - 0x10]
jmp 0x431902
jmp 0x431904
jmp 0x431890
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x431925
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00431925
xor esi, esi
xor edi, edi
mov ecx, 0xe
push esi
dec ecx
jne 0x431941
push 0
push 0
push 0xf003f
mov edx, 0x18609c8
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x18609c8
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
call dword [sym.imp.ADVAPI32.DLL_OpenSCManagerA]
push eax
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 8
fldcw word [ebp - 0x10]
mov esi, eax
fild dword [0x186d6a4]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
jne 0x4319b5
jmp 0x431a31
push 0xf01ff
mov ebx, dword [ebp + 8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_OpenServiceA]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x4319e6
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
jmp 0x431a31
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0xffffffffffffffff
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_ChangeServiceConfigA]
fldcw word [ebp - 0x10]
test eax, eax
je 0x431a19
mov dword [ebp - 0x98], 1
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x431c10
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00431c10
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0
push 0
push 0
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
push 0
push 2
mov edx, dword [ebp + 8]
call fcn.0045d0a3
mov edx, 0x18609c8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp + 0x14]
call fcn.0045c36b
mov edx, 0x18609c8
call fcn.0045d0ba
lea ebx, [esp + 0x14]
call fcn.0045c36b
mov edx, 0x1865580
call fcn.0045d0ba
lea ebx, [esp + 0x14]
call fcn.0045c36b
call dword [sym.imp.ADVAPI32.DLL_LogonUserA]
push eax
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 0xc
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
test eax, eax
je 0x431cce
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
jmp 0x431cd8
mov dword [ebp - 0x98], 1
jmp 0x431cdd
call fcn.0045cf2c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4320f6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004320f6
xor esi, esi
mov ecx, 0x22
push esi
dec ecx
jne 0x432110
mov eax, dword [0x460140]
test eax, eax
je 0x432123
jmp 0x432244
push 0
push 0x90
call dword [sym.imp.USER32.DLL_GetKeyState]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cwde
cmp eax, dword [ebp - 0x30]
jne 0x43223a
push 0
push 1
push 0x1c
push 0x1280008
push 0
lea ebx, [ebp - 0x10c]
call fcn.004501f1
xor eax, eax
sub eax, dword [ebp - 0xf4]
imul eax, eax, 0x1c
add eax, dword [ebp - 0x10c]
mov dword [eax], 1
xor eax, eax
sub eax, dword [ebp - 0xf4]
imul eax, eax, 0x1c
add eax, dword [ebp - 0x10c]
mov word [eax + 4], 0x90
xor eax, eax
sub eax, dword [ebp - 0xf4]
imul eax, eax, 0x1c
add eax, dword [ebp - 0x10c]
mov dword [eax + 8], 0
mov eax, 1
sub eax, dword [ebp - 0xf4]
imul eax, eax, 0x1c
add eax, dword [ebp - 0x10c]
mov dword [eax], 1
mov eax, 1
sub eax, dword [ebp - 0xf4]
imul eax, eax, 0x1c
add eax, dword [ebp - 0x10c]
mov word [eax + 4], 0x90
mov eax, 1
sub eax, dword [ebp - 0xf4]
imul eax, eax, 0x1c
add eax, dword [ebp - 0x10c]
mov dword [eax + 8], 2
fild dword [0x186d70c]
mov edx, 1
call fcn.0045c92e
push 0x1c
xor eax, eax
sub eax, dword [ebp - 0xf4]
imul eax, eax, 0x1c
add eax, dword [ebp - 0x10c]
mov ebx, eax
push ebx
push 2
call dword [sym.imp.USER32.DLL_SendInput]
mov ebx, 0x4001
call fcn.0045c8f6
call fcn.0045c27b
fcompp
fnstsw ax
sahf
jne 0x432235
jmp 0x432244
mov dword [0x460140], 1
call fcn.0045cf2c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x433316
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00433316
xor esi, esi
mov ecx, 0x4d
push esi
dec ecx
jne 0x433330
push 0
push 0x400
lea ebx, [ebp - 0x19c]
push ebx
mov edx, 0x1865d58
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x19c]
call fcn.0045ce8d
call fcn.0045d088
test eax, eax
je 0x433498
fild dword [0x186d87c]
fimul dword [0x186d87c]
fimul dword [0x186d87c]
fimul dword [ebp + 8]
fistp qword [ebp - 0x1b0]
fild dword [0x186d87c]
fimul dword [0x186d87c]
fimul dword [0x186d87c]
fimul dword [ebp + 8]
fistp qword [ebp - 0x1b8]
lea ebx, [ebp - 0x19c]
call fcn.0045ce8d
mov edx, 0x1865d60
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp - 0x1a8]
call fcn.0045c2a9
mov edx, dword [ebp - 0x1a8]
call fcn.0045d0a3
xor eax, eax
call fcn.004571ea
lea ebx, [ebp - 0x1a8]
call fcn.0045c2a9
mov edx, dword [ebp - 0x1a8]
call fcn.0045d0a3
call fcn.0045d088
mov word [ebp - 0x1a4], ax
mov eax, 2
movzx ecx, word [ebp - 0x1a4]
add eax, ecx
mov word [ebp - 0x1a2], ax
lea ebx, [ebp - 0x1a8]
call fcn.0045d1af
mov eax, ebx
mov dword [ebp - 0x1a0], eax
push 1
call fcn.004334ba
test eax, eax
je 0x433498
fild dword [0x186d6a4]
mov edx, 1
call fcn.0045c92e
push 0
lea ebx, [ebp - 0x1b8]
push ebx
lea ebx, [ebp - 0x1b0]
push ebx
lea ebx, [ebp - 0x1a4]
push ebx
call dword [sym.imp.NTDLL.DLL_NtCreatePagingFile]
mov ebx, 0x4001
call fcn.0045c8f6
call fcn.0045c27b
fcompp
fnstsw ax
sahf
jne 0x433498
mov dword [ebp - 0x98], 1
call fcn.0045cf2c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x433e58
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00433e58
xor esi, esi
xor edi, edi
mov ecx, 0x207
push esi
dec ecx
jne 0x433e74
push 0
push 0
push 0
xor eax, eax
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186d63c]
fild dword [0x186cde8]
call fcn.0045c11c
call fcn.0045c2a2
push eax
push 0
push 0
push 0
mov edx, 0x18655a8
call fcn.0045d0ba
lea ebx, [esp + 0x1c]
call fcn.0045c36b
fild qword [0x186d0cc]
call fcn.0045c2a2
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 8
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x43409f
mov edi, 0x400
push 0
push 0
push 0
lea ebx, [ebp - 0x8a0]
mov dword [ebx], edi
push ebx
lea ebx, [ebp - 0x49c]
push ebx
mov eax, 1
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
push 0
mov edx, 0x1865f74
call fcn.0045d0ba
lea ebx, [esp + 0x10]
call fcn.0045c36b
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 8
mov edi, dword [ebp - 0x8a0]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x43409f
lea ebx, [ebp - 0x49c]
call fcn.0045ce8d
mov eax, 1
call fcn.00454296
mov edx, 0x1861cd8
call fcn.0045d0ba
call fcn.0045c602
je 0x433fb2
lea ebx, [ebp - 0x49c]
call fcn.0045ce8d
mov edx, 0x1861cd8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp - 0x49c]
mov ecx, 0x400
call fcn.0045ced6
xor eax, eax
lea ebx, [ebp - 0x49c]
call fcn.0045ce8d
xor ecx, ecx
xchg ecx, eax
call fcn.00452fc5
mov eax, 1
mov ebx, dword [ebp + 8]
call fcn.0045ce8d
call fcn.004512ed
cmp eax, ecx
jne 0x43407d
lea ebx, [ebp - 0x49c]
call fcn.0045ce8d
mov ebx, dword [ebp + 8]
call fcn.0045ce8d
call fcn.0045c56d
mov edx, 0x1861cd8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp - 0x49c]
mov ecx, 0x400
call fcn.0045ced6
push 0
push 0
lea ebx, [ebp - 0x49c]
call fcn.0045ce8d
call fcn.0045d088
push eax
lea ebx, [ebp - 0x49c]
push ebx
push 1
push 0
mov edx, 0x1865f74
call fcn.0045d0ba
lea ebx, [esp + 0x10]
call fcn.0045c36b
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x434078
mov dword [ebp - 0x98], 1
jmp 0x434087
mov dword [ebp - 0x98], 1
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegFlushKey]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4