joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40acf4
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004077c0
xor eax, eax
push ebp
push 0x40adb6
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407d6c
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407ea0
mov eax, dword [ebx]
call fcn.0040aba0
test al, al
jne 0x40ad91
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407d6c
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407ea0
mov eax, dword [ebx]
call fcn.0040aba0
test al, al
jne 0x40ad91
mov eax, ebx
call fcn.004076cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40adbd
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040772c
lea eax, [ebp - 4]
call fcn.004076cc
pop eax
jmp eax

Function at 0x40c808
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x416a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x416aa9
test eax, edx
je 0x416aac
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x416a67
movzx eax, word [eax]
sub eax, ecx
jmp 0x416a8e
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [eax + ecx]
xor ebx, dword [edx + ecx]
jne 0x416a8f
add ecx, 4
js 0x416a7f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x416a8c
movzx eax, word [eax + ecx]
movzx edx, word [edx + ecx]
sub eax, edx
pop ebx
pop ebx
jmp 0x416a8e
xor eax, eax
ret
test eax, eax
je 0x416ab8
test edx, edx
jne 0x416a58
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x418ca8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x418ce1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00407818
jmp 0x418cea
mov eax, ebx
mov edx, esi
call fcn.00407994
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x418cf4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push 3
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x418d18
movzx eax, word [esp]
jmp 0x418d1a
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41aa10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41ab37
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041a818
mov esi, eax
mov eax, dword [0x4236ac]
cmp byte [eax], 0
je 0x41aadd
mov eax, dword [0x4235b4]
call fcn.00404e64
call fcn.00404490
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41a9e0]
call fcn.004098ec
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41ab50
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x41ab19
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x42358c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x427634]
call fcn.00409c7c
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ab3e
lea eax, [ebp - 4]
mov edx, dword [0x41a9e0]
call fcn.00409a10
pop eax
jmp eax

Function at 0x41c97c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00407a8c
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040c7e8
mov edi, eax
cmp edi, 0x104
jbe 0x41c927
mov eax, edi
add eax, eax
call fcn.00404338
mov esi, eax
jmp 0x41c929
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040c7e8
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x41c962
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41c94c
mov eax, esp
cmp esi, eax
je 0x41c96f
mov eax, esi
call fcn.00404354
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41c9a8
cmp bl, 0
je 0x41c9a4
cmp bl, 0x41
jl 0x41c99f
cmp bl, 0x5a
jg 0x41c99f
or bl, 0x20
xor al, bl
inc esi
jmp 0x41c983
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41c8e8

Function at 0x41cd20
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00407d6c
add esp, 0x800
pop ebx
ret
Function at 0x41d530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x41d54e
mov eax, dword [eax - 4]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x41d566
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x41d561
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
jmp 0x41d56b
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x41d5d9
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x41d622
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x41d597
inc dword [ebp - 0xc]
jmp 0x41d5af
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x41d5af
cmp dword [ebp - 0xc], 0
jle 0x41d5af
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x41d5d1
xor eax, eax
jmp 0x41d5cd
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x41d5cc
mov eax, esi
jmp 0x41d625
inc eax
cmp eax, ecx
jle 0x41d5b9
inc esi
cmp esi, dword [ebp - 8]
jl 0x41d583
jmp 0x41d622
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x41d622
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x41d5fa
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x41d61c
xor eax, eax
jmp 0x41d618
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x41d617
mov eax, esi
jmp 0x41d625
inc eax
cmp eax, ecx
jle 0x41d604
inc esi
cmp esi, dword [ebp - 8]
jl 0x41d5e2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41d808
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x41d825
mov eax, dword [eax - 4]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x41d833
mov eax, dword [eax - 4]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x41d955
test ebx, ebx
jl 0x41d955
test esi, esi
jle 0x41d955
mov eax, dword [ebp - 8]
call fcn.00407ce0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407ce0
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x41d8f2
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x41d955
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x41d8d7
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x41d8a6
inc dword [ebp - 0x14]
jmp 0x41d8b6
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x41d8b6
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x41d8c1
or eax, 0xffffffff
jmp 0x41d8d7
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x41d8d4
inc eax
jmp 0x41d8d7
or eax, 0xffffffff
test eax, eax
jl 0x41d8df
cmp esi, eax
jg 0x41d894
cmp esi, eax
jg 0x41d8ea
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x41d958
inc edx
dec dword [ebp - 0x1c]
jne 0x41d890
jmp 0x41d955
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x41d955
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x41d93c
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x41d91b
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x41d926
or eax, 0xffffffff
jmp 0x41d93c
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x41d939
inc eax
jmp 0x41d93c
or eax, 0xffffffff
test eax, eax
jl 0x41d944
cmp esi, eax
jg 0x41d904
cmp esi, eax
jg 0x41d94f
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x41d958
inc edx
dec dword [ebp - 0x1c]
jne 0x41d900
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41e4dc
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41e629
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41e511
call fcn.0041cb14
xor eax, eax
push ebp
push 0x41e60a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x34
mov eax, ebx
call fcn.00407ce0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41e540
call fcn.0041cb14
xor eax, eax
push ebp
push 0x41e5ea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
je 0x41e58e
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x41e57d
cmp dword [ebp - 0x24], 3
jne 0x41e58e
push 0x3e8
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x41e56d
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x41e5ab
call fcn.0041cb14
lea eax, [ebp - 0x2c]
mov ecx, 0x41e644
mov edx, ebx
call fcn.00407ea0
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x4235b4]
call fcn.00405480
call fcn.00405584
call fcn.00404490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e5f1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
Function at 0x409cb4
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x4262cc
call fcn.0041bdc0
sub esp, 0x30
push ebx
push esi
push edi
lea ecx, [ebp - 0x3c]
call fcn.00402ccc
xor ebx, ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.00402ccc
push 0x100
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00402d7a
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
mov edi, 0xf003f
push eax
push edi
push ebx
mov dword [ebp - 0x14], ebx
call fcn.00409563
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x409d62
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0x100
call fcn.00402cd9
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
push ebx
mov dword [ebp - 0x1c], eax
push ebx
push ebx
lea eax, [ebp - 0x18]
push ebx
push eax
lea ecx, [ebp - 0x30]
call fcn.00409563
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
jne 0x409d62
lea ecx, [ebp - 0x30]
call fcn.00409563
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
dec dword [ebp - 0x14]
cmp eax, ebx
je 0x409d10
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
call fcn.00409563
push eax
push dword [ebp + 0xc]
call esi
mov esi, eax
xor edi, edi
cmp esi, ebx
jne 0x409e68
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0x100
call fcn.00402cd9
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x30]
shl eax, 2
push eax
call fcn.00402d7a
lea eax, [ebp - 0x24]
mov esi, edi
push eax
push ebx
push ebx
lea eax, [ebp - 0x18]
push ebx
push eax
lea ecx, [ebp - 0x30]
inc edi
call fcn.00409563
push eax
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x409e68
push dword [ebp + 0x10]
lea ecx, [ebp - 0x3c]
call fcn.00402d1f
push 0x42a210
lea ecx, [ebp - 0x3c]
call fcn.00402e0f
lea ecx, [ebp - 0x30]
call fcn.00409563
push eax
lea ecx, [ebp - 0x3c]
call fcn.00402e0f
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409cb4
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x409e68
lea ecx, [ebp - 0x30]
call fcn.00409563
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, ebx
jne 0x409e31
dec edi
jmp 0x409d8b
mov eax, dword [ebp + 8]
cmp word [eax + 0x35e], bx
jne 0x409e63
push str.Error_in_deleting_profile
call fcn.0041b83f
pop ecx
mov ecx, dword [ebp + 0x10]
call fcn.00409563
push eax
call fcn.0041b83f
mov dword [esp], str._in_the_registry_n
call fcn.0041b83f
pop ecx
push 0xb
pop esi
jmp 0x409e83
cmp esi, 0x103
jne 0x409e72
xor esi, esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x30]
call fcn.00402d02
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.00402cbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00402cbe
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40a860
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x426324
call fcn.0041bdc0
sub esp, 0x20
push ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00402ccc
xor ebx, ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
call fcn.00402cd9
mov eax, dword [ebp + 0x14]
mov esi, str.SOFTWARE_
sub eax, ebx
je 0x40a8a2
dec eax
jne 0x40a8af
push esi
lea ecx, [ebp - 0x2c]
call fcn.00402e0f
push str.ClassesVirtualStoreMACHINE_
lea ecx, [ebp - 0x2c]
call fcn.00402e0f
push esi
lea ecx, [ebp - 0x2c]
call fcn.00402e0f
push str.Public_DomainBlat
lea ecx, [ebp - 0x2c]
call fcn.00402e0f
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x2c]
push eax
push 0x20019
push ebx
call fcn.00409563
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40a9e3
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], 1
lea esi, [edi + 4]
mov word [edi + 0x35e], bx
mov ecx, esi
call fcn.00402cd9
push 0x400
mov ecx, esi
call fcn.00402d7a
push str._default_
push dword [ebp + 0x10]
call fcn.0041b0d0
pop ecx
test eax, eax
pop ecx
je 0x40a937
push str._all_
push dword [ebp + 0x10]
call fcn.0041b0d0
pop ecx
test eax, eax
pop ecx
jne 0x40a951
push 0x427e78
lea ecx, [ebp - 0x2c]
call fcn.00409563
push eax
push dword [ebp + 0xc]
push edi
call fcn.0040aa08
add esp, 0x10
mov dword [ebp + 0x14], ebx
mov eax, dword [ebp + 0x14]
inc dword [ebp + 0x14]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
lea eax, [ebp - 0x18]
push ebx
push eax
mov ecx, esi
mov dword [ebp - 0x18], 0x100
call fcn.00409563
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
jne 0x40a9d9
mov ecx, esi
call fcn.00402ebf
mov ecx, esi
call fcn.00409563
push eax
push dword [ebp + 0x10]
call fcn.0041b0d0
pop ecx
test eax, eax
pop ecx
je 0x40a9b7
push str._all_
push dword [ebp + 0x10]
call fcn.0041b0d0
pop ecx
test eax, eax
pop ecx
jne 0x40a954
mov ecx, esi
call fcn.00409563
push eax
lea ecx, [ebp - 0x2c]
call fcn.00409563
push eax
push dword [ebp + 0xc]
push edi
call fcn.0040aa08
add esp, 0x10
jmp 0x40a954
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
lea ecx, [ebp - 0x2c]
call fcn.00402d02
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402cbe
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40eeda
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x426454
call fcn.0041bdc0
sub esp, 0x10
push ebx
push esi
push edi
lea ecx, [ebp - 0x1c]
call fcn.00402ccc
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push str.CONTENT_LENGTH
call fcn.0040ee89
pop ecx
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.00409563
push eax
call fcn.0041c832
mov edi, dword [ebp + 8]
mov ebx, eax
pop ecx
lea eax, [ebx + 1]
mov ecx, edi
push eax
call fcn.004096a1
mov ecx, edi
call fcn.00402cd9
mov ecx, edi
call fcn.00402eb2
mov ecx, ebx
mov esi, 0x1000
sub ecx, eax
cmp ecx, esi
jae 0x40ef4b
mov ecx, edi
call fcn.00402eb2
mov esi, ebx
sub esi, eax
xor eax, eax
mov dword [ebp - 0x10], esi
cmp esi, eax
jbe 0x40ef7b
lea ecx, [ebp - 0x10]
push eax
push ecx
push eax
mov ecx, edi
mov dword [ebp - 0x10], eax
call fcn.00402eb6
push eax
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40ef7b
and dword [ebp - 0x10], eax
mov ecx, edi
call fcn.00402eb2
add eax, dword [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00402ed4
cmp dword [ebp - 0x10], esi
jne 0x40ef9d
mov ecx, edi
call fcn.00402eb2
cmp eax, ebx
jb 0x40ef2c
mov ecx, edi
call fcn.00402eb6
and word [eax], 0
lea ecx, [ebp - 0x1c]
call fcn.00402d02
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00402cbe
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x414154
Capabilities:
Get hostname

Disassembly:
mov eax, 0x4266c0
call fcn.0041bdc0
sub esp, 0x414
push ebx
push esi
push edi
lea ecx, [ebp - 0x1c]
call fcn.00402ccc
xor ebx, ebx
push 0x402
lea eax, [ebp - 0x420]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0041b960
add esp, 0xc
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x10
push 0x20
call fcn.00402d7a
push 0x427e78
lea ecx, [ebp - 0x1c]
call fcn.00402f0a
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x1c]
push eax
call fcn.00409563
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00409563
mov ecx, dword [ebp - 0x10]
mov word [eax + ecx*2], bx
lea ecx, [ebp - 0x1c]
call fcn.00402ebf
cmp esi, ebx
mov esi, dword [ebp + 0xc]
je 0x4141e6
lea ecx, [ebp - 0x1c]
call fcn.00402eb2
test eax, eax
jne 0x414242
lea eax, [ebp - 0x420]
push esi
push eax
mov byte [ebp - 0x420], bl
call sub.WSOCK32.dll_gethostname
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.00402d02
cmp esi, ebx
mov dword [ebp - 0x10], ebx
jle 0x41422d
mov eax, dword [ebp - 0x10]
mov al, byte [ebp + eax - 0x420]
cmp al, bl
je 0x41422d
and ax, 0xff
lea ecx, [ebp - 0x1c]
push eax
call fcn.00402e39
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x41420a
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00402e39
cmp edi, ebx
je 0x414242
lea ebx, [edi - 0x1388]
jmp 0x4142bd
lea ecx, [ebp - 0x1c]
call fcn.00409563
push eax
call fcn.0041c877
pop ecx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00409563
push eax
call fcn.00413364
pop ecx
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.00402d02
mov ecx, dword [ebp + 8]
xor eax, eax
cmp esi, ebx
mov dword [ebp - 0x10], eax
jle 0x4142a7
cmp eax, 0x402
jae 0x4142a7
mov dl, byte [ebp + eax - 0x420]
cmp dl, 0x20
jl 0x4142a7
cmp dl, 0x7e
jg 0x4142a7
movsx dx, dl
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, esi
mov dword [ebp - 0x10], eax
jl 0x41427c
mov word [ecx + eax*2], bx
cmp word [ecx], bx
jne 0x4142bd
push str.localhost
push ecx
call fcn.0041b4fb
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00402cbe
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x414324
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x190]
push eax
push 0x101
and dword [esi + 0x204], 0
call sub.WSOCK32.dll_WSAStartup
cmp word [esi], 0
mov ebx, eax
je 0x414380
push edi
mov di, word [esi + 0x35e]
and word [esi + 0x35e], 0
push ebx
call fcn.004130d7
push eax
push ebx
push str.superDebug:_init_winsock____WSAStartup___returned__i___s__n
push esi
call fcn.00403e43
add esp, 0x14
mov word [esi + 0x35e], di
pop edi
sub ebx, 0x2726
je 0x4143c4
sub ebx, 0xe
je 0x4143bd
sub ebx, 0x1f
je 0x4143b6
sub ebx, 0x18
je 0x4143af
dec ebx
je 0x4143a8
mov dword [esi + 0x204], 1
xor eax, eax
jmp 0x4143c9
mov eax, 0xfa4
jmp 0x4143c9
mov eax, 0xfa6
jmp 0x4143c9
mov eax, 0xfa8
jmp 0x4143c9
mov eax, 0xfab
jmp 0x4143c9
mov eax, 0xfa5
pop esi
pop ebx
leave
ret