joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b4b9
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x42b4d3
mov dword [ebp + 8], 1
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x477c14
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b511
mov eax, dword [ebp - 4]
push eax
push 0x477c50
call fcn.00452380
add esp, 8
jmp 0x42b548
mov eax, dword [ebp + 8]
push eax
push str._nUpdating_Registry_parameter__AuditUseNDSName__with_value_of___d__n____1Use_NDS_Login_Name__0Use_Local_Login_Name_
call fcn.00452380
add esp, 8
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push str.AuditUseNDSName
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42b54d
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x42b567
mov dword [ebp + 8], 1
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x477d08
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b5a5
mov eax, dword [ebp - 4]
push eax
push 0x477d44
call fcn.00452380
add esp, 8
jmp 0x42b5dc
mov eax, dword [ebp + 8]
push eax
push str._nUpdating_Registry_parameter__AuditRemoteOpenCreateOnly__with_value_of___d__n____1Audit_Remote_File_Open_Create_Only__0Audit_All_File_Open_Create_
call fcn.00452380
add esp, 8
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push str.AuditRemoteOpenCreateOnly
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42b5e1
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
push 0x23
lea eax, [ebp - 0x68]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
push 4
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x70]
push eax
push 0xf003f
push 0
push 0x477e30
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b63e
mov eax, dword [ebp - 4]
push eax
push 0x477e6c
call fcn.00452380
add esp, 8
jmp 0x42b688
mov eax, dword [ebp + 8]
push eax
push str._nUpdating_Registry_with_Server___s_
call fcn.00452380
add esp, 8
lea eax, [ebp - 0x68]
push eax
call fcn.00453060
add esp, 4
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
add eax, eax
push eax
lea eax, [ebp - 0x68]
push eax
push 1
push 0
push 0x477eb0
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b68d
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
push 0x23
lea eax, [ebp - 0x68]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
push 4
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x70]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSOFTRACKQISVC
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b6ea
mov eax, dword [ebp - 4]
push eax
push 0x477ef8
call fcn.00452380
add esp, 8
jmp 0x42b734
mov eax, dword [ebp + 8]
push eax
push str._nUpdating_QISVC_Registry_with_Server___s_
call fcn.00452380
add esp, 8
lea eax, [ebp - 0x68]
push eax
call fcn.00453060
add esp, 4
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
add eax, eax
push eax
lea eax, [ebp - 0x68]
push eax
push 1
push 0
push str.ServerName
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b739
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x477f5c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b780
mov eax, dword [ebp - 4]
push eax
push 0x477f98
call fcn.00452380
add esp, 8
jmp 0x42b89e
cmp dword [ebp + 0x10], 3
jne 0x42b7a1
push 0x477fb8
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
jmp 0x42b894
cmp dword [ebp + 0x10], 1
jne 0x42b823
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
push 3
push 0
push 0x477fc8
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push str._n__d_Updating_Registry_with_OfflineBlock___d_
call fcn.00452380
add esp, 0xc
cmp dword [0x462354], 0
je 0x42b80f
push 4
mov eax, dword [ebp + 8]
push eax
push 3
push 0
push 0x478008
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x42b81e
push 0x47801c
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x42b894
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push str.OfflineV2
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42b85c
mov dword [0x462354], 1
jmp 0x42b866
mov dword [0x462354], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push str.Offline
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b894
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b8a3
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x478044
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b8ea
mov eax, dword [ebp - 4]
push eax
push 0x478080
call fcn.00452380
add esp, 8
jmp 0x42b985
cmp dword [ebp + 0xc], 3
jne 0x42b90b
push 0x4780a0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
jmp 0x42b97b
cmp dword [ebp + 0xc], 1
jne 0x42b94c
push str._nUpdating_Registry_with_AltIpAddr
call fcn.00452380
add esp, 4
mov dword [ebp - 8], 4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
push 4
push 0
push 0x4780d0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x42b97b
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push str.AltIP
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b97b
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42b98a
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x4780e4
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b9d1
mov eax, dword [ebp - 4]
push eax
push str._nError_Updating_Registry___x_
call fcn.00452380
add esp, 8
jmp 0x42ba6e
cmp dword [ebp + 0x10], 3
jne 0x42b9f2
push 0x478140
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
jmp 0x42ba64
cmp dword [ebp + 0x10], 1
jne 0x42ba36
mov eax, dword [ebp + 0xc]
push eax
push str._nUpdating_Registry_with_CMDL___d_
call fcn.00452380
add esp, 8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
push 3
push 0
push 0x478170
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x42ba64
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push str.CMDL
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42ba64
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42cc1d
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x48]
push eax
push 0xf003f
push 0
push 0x4786fc
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42cc78
cmp dword [0x45e03c], 0
je 0x42cc73
mov eax, dword [ebp - 4]
push eax
push str._nERR__d_ON_BXU_SET
call fcn.00452380
add esp, 8
jmp 0x42ce2c
cmp dword [0x46208c], 0
jne 0x42cc8a
call fcn.0041414e
cmp dword [0x46208c], 0
je 0x42ccd3
push 0
push 0x200
push 0x47874c
mov eax, dword [ebp - 0x48]
push eax
call dword [0x46208c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42ccd3
push 0
push 0x100
push 0x478750
mov eax, dword [ebp - 0x48]
push eax
call dword [0x46208c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push str.BXUTable
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [0x45e03c], 0
je 0x42cd07
mov eax, dword [ebp - 4]
push eax
push str._r_nSAVE_BXU_TABLE_ENTRIES__d__r_n
call fcn.00452380
add esp, 8
cmp dword [ebp - 4], 0
jne 0x42ce10
mov eax, dword [0x462ed4]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42ce06
cmp dword [0x45e03c], 0
je 0x42cd9c
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
push 0x478780
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x94]
push eax
push 0x478794
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 8]
add eax, 0x98
push eax
push 0x4787a8
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cx, word [eax + 4]
push ecx
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cx, word [eax + 0xa]
push ecx
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cx, word [eax + 6]
push ecx
push 0x4787bc
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x10]
push eax
push str._04d
push 0x32
lea eax, [ebp - 0x44]
push eax
call fcn.00452660
add esp, 0x10
push 0xd4
mov eax, dword [ebp - 8]
add eax, 4
push eax
push 3
push 0
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [0x45e03c], 0
je 0x42cdf6
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x44]
push eax
push str._r_n__BXUTable_Set__s___d_
call fcn.00452380
add esp, 0xc
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x42cd19
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x45e03c], 0
je 0x42ce2c
call fcn.0042c9e9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42d99e
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x744
push ebx
push esi
push edi
mov dword [ebp - 0x210], 0
call fcn.0042ce31
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push 0
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42d9e6
jmp 0x42dbbb
mov dword [ebp - 8], 0
mov dword [ebp - 0x210], 0
cmp dword [ebp - 8], 0
jne 0x42db97
mov byte [ebp - 0x540], 0
mov dword [ebp - 4], 0x320
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x540]
push eax
mov eax, dword [ebp - 0x210]
push eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 8], eax
inc dword [ebp - 0x210]
cmp dword [ebp - 8], 0
jne 0x42db92
lea edi, [ebp - 0x540]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 0xf
jbe 0x42db92
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x540]
push eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42db92
lea eax, [ebp - 0x218]
push eax
push 0x20019
push 0
push str.Volatile_Environment
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42db85
mov dword [ebp - 0x220], 0x200
lea eax, [ebp - 0x20c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.USERNAME
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42db78
mov dword [ebp - 0x220], 0x200
lea eax, [ebp - 0x740]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x740]
push eax
push 0
push 0
push str.LOCALAPPDATA
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42db78
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042d372
add esp, 8
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42d9f7
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042cc1d
cmp dword [0x45e03c], 0
je 0x42dbbb
call fcn.0042c9e9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e65e
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x478c6c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x42e6e3
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x478ca8
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x42e6d4
xor eax, eax
jmp 0x42e793
mov eax, 1
jmp 0x42e793
cmp dword [ebp + 0xc], 0
je 0x42e73a
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push 0x478cb4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov eax, 0x478ccc
mov ecx, 0x478cd4
xor edx, edx
cmp dword [ebp - 4], 0
setne dl
dec edx
sub ecx, eax
and edx, ecx
add edx, eax
push edx
push str._nUpdating_Registry___s_._d:_Agent_will_use_Level0Start
call fcn.00452380
add esp, 0xc
jmp 0x42e789
push str.Level0Start
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jne 0x42e75d
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
push eax
mov eax, str.failed
mov ecx, str.success
xor edx, edx
cmp dword [ebp - 4], 0
setne dl
dec edx
sub ecx, eax
and edx, ecx
add edx, eax
push edx
push str._nUpdating_Registry___s_._d:_Agent_will_use_default_not_Level0Start
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42ecd6
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
push ebx
push esi
push edi
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42ef1b
mov dword [ebp - 8], 0
mov dword [ebp - 0x210], 0
cmp dword [ebp - 8], 0
jne 0x42ef0e
mov byte [ebp - 0x540], 0
mov dword [ebp - 4], 0x320
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x540]
push eax
mov eax, dword [ebp - 0x210]
push eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 8], eax
inc dword [ebp - 0x210]
cmp dword [ebp - 8], 0
jne 0x42ef09
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x540]
push eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42ef09
lea edi, [ebp - 0x20c]
xor eax, eax
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov dword [ebp - 0x220], 0x1ff
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.DhcpDefaultGateway
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42eefc
movsx eax, byte [ebp - 0x20c]
test eax, eax
je 0x42eefc
lea eax, [ebp - 0x20c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [ebp - 0x220], 0x1ff
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.DhcpIpAddress
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42eed4
lea eax, [ebp - 0x20c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [ebp - 0x220], 0x1ff
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.IpAddress
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42eea7
jmp 0x42eecf
lea edi, [ebp - 0x20c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp + 0xc]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x42eefc
lea edi, [ebp - 0x20c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp + 0xc]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42ed32
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x42ef22
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42f7f7
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2154
call fcn.00452960
push ebx
push esi
push edi
mov dword [ebp - 0x2154], 0
mov dword [ebp - 0x214c], 0
cmp dword [ebp - 0x2154], 0
jne 0x42f8de
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x204], 0
mov dword [ebp - 0x2148], 0x200
mov dword [ebp - 0x2150], 0x1f40
mov edx, dword [ebp - 0x2150]
lea edi, [ebp - 0x2144]
xor eax, eax
mov ecx, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x2150]
push eax
lea eax, [ebp - 0x2144]
push eax
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x2148]
push eax
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 0x214c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x2154], eax
inc dword [ebp - 0x214c]
cmp dword [ebp - 0x2154], 0
jne 0x42f8d9
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x2154], eax
mov dword [ebp - 0x214c], 0
jmp 0x42f8d9
jmp 0x42f81b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42f96e
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push edi
push str.SofTrackLocalAgentService
push str.SYSTEMCurrentControlSetServices_sBXSublaunch
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x190]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x188]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42f9e4
cmp dword [0x45e03c], 0
je 0x42f9df
mov eax, dword [ebp - 4]
push eax
push str._r_nSBXPID_fail_open__d_
call fcn.00452380
add esp, 8
jmp 0x42fa79
mov eax, dword [ebp + 0xc]
push eax
call fcn.004536a0
add esp, 4
mov dword [ebp - 0x88], eax
cmp dword [0x45e03c], 0
je 0x42fa1f
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x88]
push eax
mov eax, dword [ebp + 8]
push eax
push str._r_nSetBXPID_PP._d__d__s_
call fcn.00452380
add esp, 0x10
mov eax, dword [0x462ed8]
push eax
mov eax, dword [ebp + 8]
push eax
push str._d:_d
push 0x80
lea eax, [ebp - 0x84]
push eax
call fcn.00452660
add esp, 0x14
inc dword [0x462ed8]
push 4
lea eax, [ebp - 0x88]
push eax
push 4
push 0
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x190]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x190]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret