joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e19f5
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6780cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.005d6459
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.005d6459
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x5e1a6c
cmp word [ecx], dx
je 0x5e1a6c
mov eax, dword [0x63b9a4]
push edi
dec eax
push eax
push 0x63b890
call fcn.005e1994
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x5e1adf
cmp word [eax], dx
je 0x5e1adf
mov eax, dword [edi]
test eax, eax
je 0x5e1a90
cmp word [eax], dx
je 0x5e1a90
lea eax, [ebp - 0x10]
push eax
call fcn.005e1362
jmp 0x5e1a99
lea eax, [ebp - 0x10]
push eax
call fcn.005e13fd
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x5e1b09
mov eax, dword [0x63b88c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x63b580
call fcn.005e1994
add esp, 0xc
test al, al
je 0x5e1b09
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x5e1ad4
cmp word [eax], di
je 0x5e1ad4
lea eax, [ebp - 0x10]
push eax
call fcn.005e1362
pop ecx
jmp 0x5e1b0b
lea eax, [ebp - 0x10]
push eax
call fcn.005e13fd
jmp 0x5e1ad1
mov eax, dword [edi]
test eax, eax
je 0x5e1af6
cmp word [eax], dx
je 0x5e1af6
lea eax, [ebp - 0x10]
push eax
call fcn.005e1317
pop ecx
jmp 0x5e1b09
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x5e1bd4
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.005e1819
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x5e1bd4
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x5e1bd4
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x5e1bd4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x5e1b61
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.005d95c5
test ebx, ebx
je 0x5e1bcf
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.005d95c5
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5e1bd4
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5e1bd4
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.005cc6b2
add esp, 0x10
xor eax, eax
inc eax
jmp 0x5e1bd6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005a5aba
leave
ret
Function at 0x40a4b7
Capabilities:
Check mutex on windows

Disassembly:
push 0x164
mov eax, 0x534b42
call fcn.005113b6
push 0xa
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jne 0x40a4dc
mov eax, 0x7535
jmp 0x40a69d
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 7
pop eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], eax
xor eax, eax
push 0xf
xor ecx, ecx
mov word [ebp - 0x74], ax
pop eax
mov dword [ebp - 0x9c], ebx
mov word [ebp - 0xac], cx
mov dword [ebp - 0x80], ebx
mov word [ebp - 0x90], cx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x58], bl
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x3c], bl
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov byte [ebp - 4], 1
call fcn.004019c8
lea ecx, [ebp - 0xac]
call fcn.0040250d
cmp byte [ebp - 0x1c], bl
jne 0x40a585
push str.MUTEX_KOMETA_INSTALLea8b3597_8ced_45c3_bafc_f7cac88600fe
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push ebx
push eax
mov dword [ebp - 0xb0], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebp - 0x1c], bl
jne 0x40a585
cmp eax, ebx
je 0x40a585
cmp eax, 0x80
jne 0x40a596
lea ecx, [ebp - 0xac]
call fcn.00409e37
mov dword [ebp - 0xb4], eax
mov dword [ebp - 4], ebx
jmp 0x40a620
cmp dword [ebp - 0xb0], ebx
je 0x40a640
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x64], ebx
je 0x40a656
cmp dword [ebp - 0x60], 8
mov ecx, dword [ebp - 0x74]
jae 0x40a651
lea ecx, [ebp - 0x74]
call fcn.004254d0
call dword [sym.imp.ole32.dll_CoUninitialize]
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x3c]
call fcn.004043d7
push ebx
push esi
lea ecx, [ebp - 0x58]
call fcn.004043d7
push ebx
push esi
lea ecx, [ebp - 0x74]
call fcn.004045af
push ebx
push esi
lea ecx, [ebp - 0x90]
call fcn.004045af
push ebx
push esi
lea ecx, [ebp - 0xac]
call fcn.004045af
mov eax, dword [ebp - 0xb4]
call fcn.00511412
ret 0x10
Function at 0x40be90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push str.pcnt
mov dword [ebp - 4], 0
call fcn.004201f0
add esp, 8
test eax, eax
je 0x40beb9
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
inc ecx
mov dword [ebp - 0xc], ecx
push 0x2001f
push 1
mov ecx, str.SoftwareNetBox_
mov eax, reloc.WS2_32.dll_accept
mov dword [ebp - 8], 0
call fcn.0041fe00
add esp, 0xc
test eax, eax
jne 0x40bf0f
mov eax, dword [ebp - 8]
test eax, eax
je 0x40bf0f
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push str.pcnt
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x40dfe0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52fa7b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x56adc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.005168e2
push 4
mov dword [ebp - 4], 0
call fcn.004f7806
mov edi, eax
add esp, 4
test edi, edi
je 0x40e05c
call fcn.00516100
mov dword [edi], eax
call fcn.00515ebf
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.005162a4
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40e052
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.005162cc
jmp 0x40e05e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40ed40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push str.scnt
mov dword [ebp - 4], 0
call fcn.004201f0
add esp, 8
test eax, eax
je 0x40ed69
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
inc ecx
mov dword [ebp - 0xc], ecx
push 0x2001f
push 1
mov ecx, str.SoftwareNetBox_
mov eax, reloc.WS2_32.dll_accept
mov dword [ebp - 8], 0
call fcn.0041fe00
add esp, 0xc
test eax, eax
jne 0x40edbf
mov eax, dword [ebp - 8]
test eax, eax
je 0x40edbf
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push str.scnt
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x4178f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f93b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x56adc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.005168e2
push 4
mov dword [ebp - 4], 0
call fcn.004f7806
mov edi, eax
add esp, 4
test edi, edi
je 0x417970
call fcn.00516100
mov dword [edi], eax
call fcn.00515ebf
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.005162a4
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x417966
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.005162cc
jmp 0x417972
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a760
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5327d3
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x56adc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x68], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x41a8fd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [esi]
jne 0x41a8fd
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41a816
lea ebx, [ebp - 0x2c]
call fcn.0041a3e0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41a7fa
lea eax, [esi + 0x10]
test eax, eax
je 0x41a7d2
lea eax, [esi + 0x20]
jmp 0x41a7d4
xor eax, eax
push 0x549be4
push ecx
push 0x549be8
push eax
call fcn.00407c44
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407e0a
add esp, 0x10
push eax
call fcn.00407c44
add esp, 8
mov edi, 8
mov byte [ebp - 4], 0
cmp dword [ebp - 0x18], edi
jb 0x41a81b
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004f77ab
add esp, 4
jmp 0x41a81b
mov edi, 8
lea ecx, [ebp - 0x64]
lea eax, [esi + 0x10]
call fcn.0040d540
lea edx, [ebp - 0x48]
push 0x549c08
push edx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00405ce0
add esp, 8
cmp dword [eax + 0x14], edi
jb 0x41a844
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x34], edi
jb 0x41a85c
mov eax, dword [ebp - 0x48]
push eax
call fcn.004f77ab
add esp, 4
xor ecx, ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], cx
cmp dword [ebp - 0x50], edi
jb 0x41a884
mov edx, dword [ebp - 0x64]
push edx
call fcn.004f77ab
add esp, 4
mov edi, dword [0x570194]
xor eax, eax
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x54], 0
mov word [ebp - 0x64], ax
cmp byte [0x56f9ca], al
jne 0x41a8ac
mov edi, dword [0x570134]
lea ecx, [ebp - 0x2c]
lea eax, [esi + 0x10]
call fcn.0040d540
mov ebx, 8
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], ebx
jb 0x41a8c7
mov eax, dword [eax]
mov ecx, dword [esi]
mov edx, dword [esi + 8]
push ecx
push eax
mov eax, dword [esi + 4]
push edx
push eax
call edi
add esp, 0x10
cmp dword [ebp - 0x18], ebx
jb 0x41a8e9
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004f77ab
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
add esi, 0x70
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0040d4b0
push esi
mov dword [esi], vtable.std::ios_base.0
call fcn.005168a4
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f6bad
mov esp, ebp
pop ebp
ret
Function at 0x420020
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533b6b
mov eax, dword fs:[0]
push eax
mov eax, 0x1028
call fcn.005101d0
mov eax, dword [0x56adc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea ebx, [ebp - 0x1030]
push ebx
or edx, 0x20019
push edx
push 0
mov dword [ebp - 0x1030], 0
call fcn.0041fe00
add esp, 0xc
test eax, eax
jne 0x4201d3
mov ebx, dword [ebp - 0x1030]
test ebx, ebx
je 0x4200dc
push 0xffe
push eax
lea ecx, [ebp - 0x100e]
push ecx
mov word [ebp - 0x1010], ax
call fcn.004fbb00
add esp, 0xc
lea edx, [ebp - 0x1034]
push edx
lea eax, [ebp - 0x1010]
push eax
push 0
push 0
push edi
push ebx
mov dword [ebp - 0x1034], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4200e6
mov ecx, dword [ebp - 0x1030]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004005
jmp 0x4201d3
xor edi, edi
xor edx, edx
mov ebx, 7
lea eax, [ebp - 0x1010]
mov word [ebp - 0x102c], dx
mov dword [ebp - 0x1018], ebx
mov dword [ebp - 0x101c], edi
lea edx, [eax + 2]
jmp 0x420110
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x420110
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x102c]
call fcn.00404bd5
lea ecx, [ebp - 0x102c]
cmp esi, ecx
je 0x4201ac
cmp dword [esi + 0x14], 8
jb 0x42014d
mov edx, dword [esi]
push edx
call fcn.004f77ab
add esp, 4
xor eax, eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edi
mov word [esi], ax
cmp dword [ebp - 0x1018], 8
jae 0x420190
mov ecx, dword [ebp - 0x101c]
lea edx, [ecx + ecx + 2]
push edx
lea eax, [ebp - 0x102c]
push eax
push esi
call fcn.004f6f30
mov edx, dword [ebp - 0x101c]
mov eax, dword [ebp - 0x1018]
add esp, 0xc
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], eax
jmp 0x4201c4
mov ecx, dword [ebp - 0x102c]
mov edx, dword [ebp - 0x101c]
mov eax, dword [ebp - 0x1018]
mov dword [esi], ecx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], eax
jmp 0x4201c4
cmp dword [ebp - 0x1018], 8
jb 0x4201c4
mov ecx, dword [ebp - 0x102c]
push ecx
call fcn.004f77ab
add esp, 4
mov edx, dword [ebp - 0x1030]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f6bad
mov esp, ebp
pop ebp
ret
Function at 0x4201f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, str.SoftwareNetBox_
mov eax, reloc.WS2_32.dll_accept
mov dword [ebp - 4], 0
call fcn.0041fe00
add esp, 0xc
test eax, eax
jne 0x420265
mov eax, dword [ebp - 4]
test eax, eax
jne 0x420230
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
push edx
push 0
push 0
push ecx
push eax
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push 0x20019
push edi
mov eax, reloc.WS2_32.dll_accept
mov dword [ebp - 8], edi
call fcn.0041fe00
add esp, 0xc
cmp eax, edi
jne 0x42033e
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x4202ca
lea ecx, [ebp - 0xc]
push ecx
push edi
push edi
push edi
push 0x549544
push eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4202d6
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ebx, dword [esi]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
mov byte [ebp - 1], 0
cmp ebx, eax
je 0x4202fd
mov edi, eax
sub edi, eax
push edi
push eax
push ebx
call fcn.004f6f30
add esp, 0xc
add edi, ebx
mov dword [esi + 4], edi
mov eax, dword [esi]
lea ecx, [ebp - 1]
push ecx
push eax
mov eax, dword [ebp - 0x10]
push esi
call fcn.00420df0
mov esi, dword [esi]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
push esi
push 0
push 0
push 0x549544
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0x80004005
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420350
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 1
mov eax, reloc.WS2_32.dll_accept
mov dword [ebp - 4], 0
call fcn.0041fe00
add esp, 0xc
test eax, eax
jne 0x4203c3
mov edi, dword [ebp - 4]
test edi, edi
jne 0x42038d
mov eax, 0x80004005
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420392
sub eax, edx
mov edx, dword [ebp + 8]
sar eax, 1
lea ecx, [eax + eax]
push ecx
push esi
push 1
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4203d0
Capabilities:
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, eax
push edi
lea eax, [ebp - 4]
push eax
push 0x2011f
push 1
mov ecx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
call fcn.0041fe00
add esp, 0xc
test eax, eax
jne 0x420452
mov edi, dword [ebp - 4]
test edi, edi
jne 0x420414
mov eax, 0x80004005
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420420
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
push ecx
push esi
push 1
push 0
push str.Userinit
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420460
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 1
mov eax, reloc.WS2_32.dll_accept
mov dword [ebp - 4], 0
call fcn.0041fe00
add esp, 0xc
test eax, eax
jne 0x4204bc
mov eax, dword [ebp - 4]
test eax, eax
jne 0x420499
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4204d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533b38
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x56adc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
push 0x2001f
mov dword [ebp - 4], 0
push 1
mov eax, reloc.WS2_32.dll_accept
mov dword [ebp - 0x10], 0
call fcn.0041fe00
mov esi, eax
add esp, 0xc
test esi, esi
je 0x420544
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x420532
push eax
call fcn.004f77ab
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10]
test edx, edx
jne 0x420570
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42055b
push eax
call fcn.004f77ab
add esp, 4
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
sub eax, ecx
jne 0x420584
push str.invalid_vector_T__subscript
call fcn.005161dc
push eax
push ecx
push 3
push 0
push 0x549544
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp byte [ebp + 8], 0
mov esi, eax
je 0x4205ac
test esi, esi
jne 0x4205ac
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
test esi, esi
jne 0x420525
test eax, eax
je 0x4205ce
push eax
call fcn.004f77ab
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4222c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x532dab
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push esi
mov eax, dword [0x56adc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, 8
cmp dword [edi + 0x14], esi
jb 0x4222f8
mov eax, dword [edi]
jmp 0x4222fa
mov eax, edi
test eax, eax
je 0x4223e8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4223e8
test al, 0x10
jne 0x4223e8
cmp dword [edi + 0x14], esi
jb 0x422323
mov eax, dword [edi]
jmp 0x422325
mov eax, edi
push 0
push 0x80
push 3
push 0
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4223e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xc9
lea eax, [ebp - 0xc8]
push eax
mov ebx, str.netboxinfo.cpp
call fcn.0041a6b0
mov ebx, eax
mov dword [ebp - 4], 0
test ebx, ebx
je 0x4223bc
lea esi, [ebx + 0x10]
test esi, esi
je 0x42237d
lea eax, [ebx + 0x20]
jmp 0x42237f
xor eax, eax
push str.ERROR:
push eax
call fcn.00407c44
add esp, 8
test esi, esi
je 0x422396
lea eax, [ebx + 0x20]
jmp 0x422398
xor eax, eax
push str.failed_to_check
push eax
call fcn.00407c44
add esp, 8
test esi, esi
je 0x4223af
lea eax, [ebx + 0x20]
jmp 0x4223b1
xor eax, eax
push eax
mov ecx, edi
call fcn.00407e0a
add esp, 4
lea ecx, [ebp - 0xc8]
mov dword [ebp - 4], 0xffffffff
call fcn.0041a760
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret