joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ee95
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x388
push ebp
push esi
push edi
mov edi, ecx
call fcn.004020bf
call fcn.0041b18a
push 0
push 2
mov byte [0x473aec], al
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x40f0a3
lea eax, [esp + 0x160]
mov dword [esp + 0x160], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
lea eax, [esp + 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x40f09c
mov ebp, 0x466490
lea eax, [esp + 0x184]
push eax
lea ecx, [esp + 0x14]
call fcn.0040415e
mov ecx, dword [esp + 0x168]
push 0x46648c
call fcn.0041b1b8
movzx edx, al
lea ecx, [esp + 0x14c]
call fcn.0041ad61
mov edx, dword [esp + 0x16c]
lea ecx, [esp + 0x134]
push eax
push ebp
call fcn.0041ad61
mov edx, dword [esp + 0x174]
lea ecx, [esp + 0x124]
push eax
push ebp
call fcn.0041b1ee
mov edx, eax
lea ecx, [esp + 0x114]
call fcn.0041aef1
push eax
push ebp
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x104]
call fcn.0041aef1
push eax
mov edx, edi
lea ecx, [esp + 0xf0]
call fcn.004087cf
pop ecx
mov edx, eax
lea ecx, [esp + 0xd4]
call fcn.00408832
pop ecx
mov edx, eax
lea ecx, [esp + 0xb8]
call fcn.00402e81
pop ecx
mov edx, eax
lea ecx, [esp + 0x9c]
call fcn.00408832
pop ecx
mov edx, eax
lea ecx, [esp + 0x80]
call fcn.00402e81
pop ecx
mov edx, eax
lea ecx, [esp + 0x64]
call fcn.00408832
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00402e81
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00408832
pop ecx
push eax
mov ecx, edi
call fcn.00401fc2
lea ecx, [esp + 0x28]
call fcn.00401fb8
lea ecx, [esp + 0x40]
call fcn.00401fb8
lea ecx, [esp + 0x58]
call fcn.00401fb8
lea ecx, [esp + 0x70]
call fcn.00401fb8
lea ecx, [esp + 0x88]
call fcn.00401fb8
lea ecx, [esp + 0xa0]
call fcn.00401fb8
lea ecx, [esp + 0xb8]
call fcn.00401fb8
lea ecx, [esp + 0xd0]
call fcn.00401fb8
lea ecx, [esp + 0xe8]
call fcn.00401fb8
lea ecx, [esp + 0x100]
call fcn.00401fb8
lea ecx, [esp + 0x118]
call fcn.00401ee9
lea ecx, [esp + 0x130]
call fcn.00401fb8
lea ecx, [esp + 0x148]
call fcn.00401fb8
lea ecx, [esp + 0x10]
call fcn.00401ee9
lea eax, [esp + 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40eef9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x388
ret
Function at 0x40fe4d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x40ff84
cmp byte [edi + 0x3d], bl
je 0x40ff84
call fcn.00402e7d
mov esi, eax
mov ecx, edi
mov eax, dword [edi]
push esi
call dword [eax + 0xc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
call fcn.0040d495
pop ecx
pop ecx
test al, al
je 0x40fea3
xor al, al
jmp 0x40ff86
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.004051ec
lea ebp, [edi + 0x40]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
call fcn.0040249c
mov ecx, eax
call fcn.0040337b
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.0040245c
add esi, eax
lea ecx, [esp + 0x2c]
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.0040249c
mov ecx, eax
call fcn.0040337b
mov ecx, dword [edi + 0x38]
push eax
push ebp
call fcn.0040d819
sub eax, ebx
je 0x40ff0b
sub eax, 1
je 0x40ff0e
dec eax
sub eax, 1
jne 0x40ff77
inc eax
jmp 0x40ff75
mov byte [edi + 0x3d], bl
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
call fcn.0040249c
mov ecx, eax
call fcn.0040337b
mov esi, dword [esp + 0x1c]
sub esi, eax
je 0x40ff53
push dword [edi + 0x4c]
lea eax, [esp + 0x28]
push esi
push 1
push eax
lea ecx, [esp + 0x38]
call fcn.0040249c
mov ecx, eax
call fcn.0040337b
push eax
call fcn.0043f49c
add esp, 0x10
cmp esi, eax
jne 0x40ff73
cmp byte [edi + 0x3d], bl
je 0x40ff71
test esi, esi
jne 0x40feb2
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.00402a31
jmp 0x40feb2
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x28]
call fcn.00401fb8
mov al, bl
jmp 0x40ff86
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410ee7
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov esi, dword [ebx]
mov edx, dword [ebx + 0x3c]
movzx ebp, word [esi + 0x14]
add ebp, esi
mov eax, dword [ebp + 0x20]
mov ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
call fcn.00410d1e
lea edx, [ebp + 0x18]
mov dword [esp + 0x28], eax
mov ecx, ebx
call fcn.00410e2b
mov ebx, dword [ebp + 0x3c]
mov edi, eax
and dword [esp + 0x34], 0
xor eax, eax
inc eax
mov dword [esp + 0x2c], edi
add ebp, 0x40
mov dword [esp + 0x30], ebx
cmp ax, word [esi + 6]
mov esi, ecx
mov dword [esp + 0x20], eax
jae 0x410ff9
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.00410d1e
mov edx, ebp
mov dword [esp + 0x14], eax
mov ecx, esi
call fcn.00410e2b
mov edx, dword [esp + 0x10]
mov ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x28], eax
je 0x410fb0
lea ecx, [edi + edx]
cmp ecx, eax
ja 0x410fac
lea edx, [esp + 0x24]
mov ecx, esi
call fcn.00410e4a
test eax, eax
je 0x411016
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebx, dword [ebp + 0x24]
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
jmp 0x410fd4
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x24]
mov edi, 0x2000000
test edi, eax
je 0x410fc4
test edi, ebx
je 0x410fc4
or ebx, eax
jmp 0x410fcc
or ebx, eax
and ebx, 0xfdffffff
mov edi, ecx
sub edi, edx
add edi, dword [esp + 0x1c]
mov eax, dword [esi]
add ebp, 0x28
mov ecx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
movzx eax, word [eax + 6]
mov dword [esp + 0x20], ecx
cmp ecx, eax
jl 0x410f43
xor eax, eax
inc eax
lea edx, [esp + 0x24]
mov dword [esp + 0x34], eax
mov ecx, esi
call fcn.00410e4a
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor eax, eax
jmp 0x41100e
Function at 0x411de8
Capabilities:
Terminate process

Disassembly:
push ebx
push 0
push dword [0x471d64]
mov byte [0x471d4b], 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
push dword [0x471d64]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, bl
pop ebx
ret
Function at 0x41283c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41287f
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
jmp 0x412881
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x412886
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4128dd
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x4128df
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4128e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20019
xor esi, esi
mov edi, ecx
push esi
push dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412944
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x408]
push eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
test esi, esi
jne 0x412946
lea eax, [ebp - 0x408]
push eax
jmp 0x41294b
mov ecx, edi
push 0x465074
call fcn.00402073
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x412958
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20019
push 0
push dword [ebp + 8]
mov esi, ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4129b1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x808]
push eax
jmp 0x4129b6
push 0x465438
mov ecx, esi
call fcn.0040415e
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4129c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov edi, ecx
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
push ebx
mov esi, 0x465074
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412a24
cmp dword [ebp - 4], eax
jbe 0x412a24
push dword [ebp - 4]
call fcn.0043ace0
push dword [ebp - 4]
mov esi, eax
push 0
push esi
call fcn.00435e50
add esp, 0x10
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov ecx, edi
call fcn.0040415e
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412a35
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 8]
push esi
push eax
push 0x20019
xor esi, esi
push esi
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412aa5
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x412aa5
push dword [ebp + 0x18]
lea ecx, [ebp - 0x40c]
push dword [ebp + 0x14]
call fcn.0040632b
push dword [ebp + 0x10]
lea ecx, [ebp - 0x40c]
push dword [ebp + 0xc]
call fcn.004063b0
mov al, 1
jmp 0x412aa7
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x412aac
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x412afc
push esi
lea ecx, [ebp + 0xc]
call fcn.0040245c
push eax
lea ecx, [ebp + 0xc]
call fcn.00401f8b
push eax
push dword [ebp + 0x24]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete bl
jmp 0x412afe
xor bl, bl
lea ecx, [ebp + 0xc]
call fcn.00401fb8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412b0d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x412b4b
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x412b4d
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x412b51
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x412ba3
push esi
lea ecx, [ebp + 0xc]
call fcn.0040245c
lea ecx, [ebp + 0xc]
lea eax, [eax*2 + 2]
push eax
call fcn.00401ee4
push eax
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete bl
jmp 0x412ba5
xor bl, bl
lea ecx, [ebp + 0xc]
call fcn.00401ee9
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412bb4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x412bf6
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x412bf8
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x412bfc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x412c3a
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x412c3c
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x412c40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x412c7e
push esi
push 8
lea eax, [ebp + 0xc]
push eax
push 0xb
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x412c80
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x412d60
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x412d7c
xor al, al
jmp 0x412d8e
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
sbb al, al
inc al
mov esp, ebp
pop ebp
ret
Function at 0x412d92
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xabb4
call fcn.00456630
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x4a0]
push esi
push eax
mov ebx, ecx
call fcn.00435e50
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x50]
mov dword [ebp - 4], esi
mov dword [ebp - 8], 0x3fff
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x4a0]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x412e70
test eax, eax
je 0x412e70
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], 0xff
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x298]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x412e6a
push 0x466100
lea ecx, [ebp - 0x34]
call fcn.0040415e
push eax
lea edx, [ebp - 0x298]
lea ecx, [ebp - 0x68]
call fcn.004042dc
pop ecx
push eax
mov ecx, 0x474418
call fcn.0040323d
lea ecx, [ebp - 0x68]
call fcn.00401ee9
lea ecx, [ebp - 0x34]
call fcn.00401ee9
inc esi
cmp esi, dword [ebp - 4]
jb 0x412e0a
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x412fb2
xor esi, esi
test eax, eax
je 0x412fb2
xor eax, eax
mov byte [ebp - 0x5c], 0
lea edi, [ebp - 0x5b]
mov dword [ebp - 0xc], 0x2710
stosd dword es:[edi], eax
mov dword [ebp - 8], 0x3fff
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov word [ebp - 0xabb0], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2bb0]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xabb0]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x412fa8
push 0xa
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x1c]
call fcn.00440e11
add esp, 0xc
lea ecx, [ebp - 0x80]
push 0x466100
call fcn.0040415e
push eax
lea edx, [ebp - 0xabb0]
lea ecx, [ebp - 0x34]
call fcn.004042dc
pop ecx
push eax
mov ecx, 0x474430
call fcn.0040323d
lea ecx, [ebp - 0x34]
call fcn.00401ee9
lea ecx, [ebp - 0x80]
call fcn.00401ee9
push 0x465090
lea ecx, [ebp - 0x34]
call fcn.00402073
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x80]
call fcn.004052dd
pop ecx
push eax
mov ecx, 0x474448
call fcn.00403356
lea ecx, [ebp - 0x80]
call fcn.00401fb8
lea ecx, [ebp - 0x34]
call fcn.00401fb8
push str._regsplt_
lea ecx, [ebp - 0x98]
call fcn.00402073
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x2bb0]
push eax
lea ecx, [ebp - 0x34]
call fcn.00402097
mov edx, eax
lea ecx, [ebp - 0x80]
call fcn.00402e81
pop ecx
push eax
mov ecx, 0x4744e0
call fcn.00403356
lea ecx, [ebp - 0x80]
call fcn.00401fb8
lea ecx, [ebp - 0x34]
call fcn.00401fb8
lea ecx, [ebp - 0x98]
call fcn.00401fb8
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x412e85
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413a70
Capabilities:
Resolve dns

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push ecx
and dword [ebp], 0
mov dword [esp + 0x14], edx
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x413aee
cmp word [esi + 8], 2
jne 0x413ad0
push 4
pop eax
cmp word [esi + 0xa], ax
jne 0x413ad0
mov edi, dword [esi + 0xc]
jmp 0x413aca
push dword [eax]
mov edx, dword [esp + 0x1c]
push dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
call fcn.00413a09
mov dword [ebp], eax
test eax, eax
je 0x413ae9
lea ebp, [eax + 0x1c]
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x413aaa
push 0x400
push dword [esi]
push 0x401
push ebx
call fcn.004409c3
add esp, 0x10
xor eax, eax
jmp 0x413b0c
push 8
pop eax
jmp 0x413b0c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x413b0a
sub eax, 1
je 0x413b1b
sub eax, 1
je 0x413b14
sub eax, 1
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, 0x2afb
jmp 0x413b0c
mov eax, 0x2afa
jmp 0x413b0c

Function at 0x414122
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
cmp dword [0x475a98], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x413ca6
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x413f4c
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.00413c6b
jne 0x414279
push 0x104
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x41426f
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
mov ebx, 0x10c
push eax
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.004409ce
push str.ws2_32
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.00440a28
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
test esi, esi
je 0x4141e2
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4141de
push esi
call ebp
mov esi, edi
test esi, esi
jne 0x414233
lea eax, [esp + 0x134]
mov esi, 0x10c
push eax
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.004409ce
push str.wship6
lea eax, [esp + 0x38]
push esi
push eax
call fcn.00440a28
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x41426b
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x41422f
push esi
call ebp
mov esi, edi
test esi, esi
je 0x41426b
mov ebx, edi
push dword [esp + ebx*8 + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + ebx*8 + 0x14], eax
test eax, eax
je 0x414250
inc ebx
cmp ebx, 3
jl 0x414235
jmp 0x414255
push esi
call ebp
mov esi, edi
test esi, esi
je 0x41426b
mov eax, dword [esp + edi + 0x14]
mov dword [edi + 0x4709f8], eax
add edi, 8
cmp edi, 0x18
jl 0x414259
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x475a98], 1
mov eax, dword [0x4709f8]
add esp, 0x22c
ret
Function at 0x416668
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
push esi
push str._sysinfo.txt
push str.temp
call fcn.0043b05f
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040415e
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00402ff4
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401ee9
xor ebx, ebx
lea eax, [ebp - 0x48]
push ebx
push ebx
push eax
mov edx, 0x46b778
lea ecx, [ebp - 0x30]
call fcn.0040af80
pop ecx
mov ecx, eax
call fcn.00401ee4
push eax
push str.dxdiag
push 0x4650d8
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x30]
call fcn.00401ee9
lea ecx, [ebp - 0x18]
call fcn.004020bf
mov esi, ebx
lea ecx, [ebp - 0x48]
call fcn.00401ee4
lea edx, [ebp - 0x18]
mov ecx, eax
call fcn.0041b476
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x18]
inc esi
call fcn.0040619c
test al, al
je 0x41670f
cmp esi, 0x4b0
jl 0x4166e0
lea ecx, [ebp - 0x18]
call fcn.0040619c
test al, al
jne 0x41679f
lea ecx, [ebp - 0x48]
call fcn.00401ee4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
lea ecx, [ebp - 0xc8]
call fcn.004046d7
push ecx
lea ecx, [ebp - 0xc8]
call fcn.004048a8
test al, al
je 0x416794
sub esp, 0x18
lea eax, [ebp - 0x18]
mov esi, esp
lea edx, [ebp + 8]
lea ecx, [ebp - 0x30]
push eax
push 0x473ed0
call fcn.00402f11
pop ecx
mov edx, eax
mov ecx, esi
call fcn.00402ef0
pop ecx
push 0x97
lea ecx, [ebp - 0xc8]
call fcn.00404a81
lea ecx, [ebp - 0x30]
call fcn.00401fb8
lea ecx, [ebp - 0xc8]
call fcn.00404e06
mov bl, 1
lea ecx, [ebp - 0xc8]
call fcn.00404ec2
lea ecx, [ebp - 0x18]
call fcn.00401fb8
lea ecx, [ebp - 0x48]
call fcn.00401ee9
lea ecx, [ebp + 8]
call fcn.00401fb8
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret