joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1364250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1378808
push 0x1368288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1364329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1364329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.013671d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x1364329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x1364329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x136432c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.01364351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1364d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1364d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x1364d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1364d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1364d94
push eax
push esi
call fcn.0136720b
add esp, 8
pop esi
ret 0x10

Function at 0x1364da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1364e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x1364e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x137d320
push ecx
mov dword [esp + 0x1c], 4
call fcn.01366dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x1364dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x1364e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1364ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x1364eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x137d320
push ecx
mov dword [esp + 0x1c], 4
call fcn.01366dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x1364eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x1364e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x1365000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1365131
push esi
call fcn.01368145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.01357080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x1365131
push 0
push ebp
call fcn.013573a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.01357260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x136508b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.013572f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1365121
push 0x137d918
push edi
call fcn.013663f0
push eax
push ebx
push esi
call fcn.01364f60
push 0x137d8f8
push edi
call fcn.013663f0
push eax
push ebx
push esi
call fcn.01364f60
push 0x137d8d8
push edi
call fcn.013663f0
push eax
push ebx
push esi
call fcn.01364f60
push 0x137d8c0
push edi
call fcn.013663f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.01364f60
push 0x137d8a0
push edi
call fcn.013663f0
push eax
push ebx
push esi
call fcn.01364f60
push 0x137d888
push edi
call fcn.013663f0
push eax
push ebx
push esi
call fcn.01364f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x13661b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.01366140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.01366140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.01366140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.01366140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x1366bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1366c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x137887c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1366c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1366c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x710c7e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x7109ec
sub esi, 0xe509f123
dec esi
add esi, edx
call fcn.00710cb5
sub edx, edx
xor dword [ebx], eax
add esi, esi
mov esi, 0xc6273310
sub esi, esi
inc ebx
and esi, edx
cmp ebx, ecx
jne fcn.00710c7e
and edx, esi
ret
Function at 0x4049e0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x34]
xor edx, edx
xor ecx, ecx
push esi
mov esi, dword [esp + 0x20]
mov ax, word [esi + 8]
mov dx, word [esi + 6]
mov bx, word [esi + 4]
mov cx, word [esi + 0xa]
mov word [esp + 0x10], ax
push edi
lea edi, [esi + 4]
mov eax, edi
mov byte [eax], bh
mov byte [eax + 1], bl
inc eax
mov byte [eax + 1], dh
inc eax
mov byte [eax + 1], dl
inc eax
inc eax
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x14]
mov byte [eax], dh
inc eax
mov byte [eax], dl
inc eax
test ebp, ebp
mov byte [eax], ch
mov dword [esp + 0x10], ecx
mov byte [eax + 1], cl
je 0x404a60
push ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
call fcn.00405d60
add esp, 0x10
test eax, eax
mov dword [esp + 0x28], eax
jne 0x404a64
pop edi
pop esi
pop ebp
mov eax, 0xfffeffff
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
test ecx, ecx
jl 0x404ad0
sub eax, esi
movzx eax, ax
mov edx, eax
mov dword [esp + 0x3c], eax
mov byte [esp + 0x25], al
push 2
lea eax, [esp + 0x28]
push eax
sar edx, 8
push ecx
mov byte [esp + 0x30], dl
call fcn.00411070
add esp, 0xc
cmp eax, 2
jne 0x404ab2
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push esi
push edx
call fcn.00411070
mov ecx, dword [esp + 0x48]
add esp, 0xc
cmp eax, ecx
je 0x404acc
push str.mDNSSendDNSMessage:_error_sending_message_over_tcp
call fcn.00410bc0
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0xfffeffff
pop ebx
add esp, 0xc
ret
xor eax, eax
jmp 0x404aee
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x28]
push ecx
push eax
push esi
push edx
call fcn.00410c40
add esp, 0x18
test ebp, ebp
mov cx, word [esp + 0x18]
mov dx, word [esp + 0x14]
mov word [esi + 6], cx
movzx ecx, word [esp + 0x10]
mov word [edi], bx
mov word [esi + 8], dx
je 0x404b0d
dec ecx
pop edi
mov word [esi + 0xa], cx
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4062c0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 8
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 0x42de78
xor edi, edi
push 1
push edi
push 0x42de68
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
mov dword [ebx], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, edi
jl 0x406337
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, edi
jl 0x406337
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406310
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
je 0x406332
push 0x3e8
call ebp
mov edx, edi
inc edi
cmp edx, 0x1e
jl 0x406310
test esi, esi
pop ebp
jl 0x406337
xor esi, esi
mov eax, dword [esp + 8]
test eax, eax
je 0x406345
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x406353
mov edx, dword [eax]
push eax
call dword [edx + 8]
pop edi
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x40fca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 0xf64]
test eax, eax
mov ebx, 1
mov dword [esp + 0x10], ebx
lea esi, [ebp + 0xc3c]
jne 0x40fce5
add edi, 0xf68
push edi
push str.Error__Tried_to_register_a_NetworkInterfaceInfo__a_with_zero_InterfaceID
call fcn.00410bc0
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0xfffefff3
pop ebx
pop ecx
ret
mov eax, dword [edi + 0xf7c]
cmp eax, 4
lea ecx, [edi + 0xf7c]
jne 0x40fd04
mov edx, dword [edi + 0xf80]
cmp edx, dword [0x42deac]
jne 0x40fd49
cmp eax, 6
jne 0x410020
mov eax, dword [edi + 0xf80]
cmp edx, dword [ebp - 0x75]
push ebp
mov ebp, esp
mov cl, 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0040fda3
enter 0xffffffffffffd831, 0x48
lea eax, [ebp - 0x58]
push eax
call fcn.0040fdb3
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0040fd68
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x410091
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040fda3
pop ebp
call 0x45ce85b6
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x410940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.0040fdb3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040fd68
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.0040fda3
jb 0x410961
cli
invalid
push cs
mov byte [eax - 0x5135b], 0xff
add byte [eax - 0x5125b], al
inc dword [eax]
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.0040fdb3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040fd68
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.0040fda3
cmpsb byte [esi], byte es:[edi]
jae 0x410a48
invalid
in eax, dx
push 0x104
lea eax, [ebp - 0x334]
Function at 0x4131b0
Capabilities:
Get hostname
Query or enumerate registry value

Disassembly:
sub esp, 0x408
mov eax, dword [0x436090]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi]
xor ebx, ebx
add ecx, 0x44
mov byte [esp + 0x110], bl
mov byte [esp + 0x10], bl
mov edx, dword [ecx]
mov dword [esp + 0x410], eax
xor eax, eax
cmp edx, ebx
jne 0x413201
push ecx
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServiceslanmanserverparameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x413201
mov ecx, dword [edi]
mov dword [ecx + 0x44], ebx
mov ecx, dword [edi]
cmp dword [ecx + 0x44], ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x413279
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x214]
push eax
push ebx
push ebx
mov dword [esp + 0x1c], 0x200
mov ecx, dword [ecx + 0x44]
push str.srvcomment
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x413275
push ebx
push ebx
push 0x100
lea edx, [esp + 0x1c]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x224]
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x413262
xor eax, eax
jmp 0x413271
call esi
test eax, eax
je 0x41326c
call esi
jmp 0x413271
mov eax, 0xffffe5d4
cmp eax, ebx
je 0x41327d
mov byte [esp + 0x10], bl
cmp eax, ebx
jne 0x413283
cmp byte [esp + 0x10], bl
jne 0x4132d5
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x114]
push edx
push 5
mov dword [esp + 0x18], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
jne 0x4132b4
call esi
test eax, eax
je 0x413330
call esi
cmp eax, ebx
jne 0x4132d1
lea eax, [esp + 0x10]
push 0x100
push eax
lea eax, [esp + 0x118]
call fcn.00412070
add esp, 8
cmp eax, ebx
je 0x4132d9
mov byte [esp + 0x10], bl
cmp eax, ebx
jne 0x4132df
cmp byte [esp + 0x10], bl
jne 0x4132fd
mov ecx, dword [str.My_Computer]
mov edx, dword [0x42f6f0]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x42f6f4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x10f], bl
lea esi, [ecx + 1]
jmp 0x413310
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x413310
sub ecx, esi
cmp ecx, 0x3f
jae 0x413337
lea ecx, [esp + 0x10]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x413325
sub ecx, esi
jmp 0x41333c
mov eax, 0xffffe5a8
jmp 0x4132d1
mov ecx, 0x3f
mov byte [edi + 0x8ac], cl
movzx ecx, cl
mov edx, ecx
shr ecx, 2
add edi, 0x8ad
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebx
call fcn.0042373b
add esp, 0x408
ret
Function at 0x413a30
Capabilities:
Create udp socket

Disassembly:
sub esp, 0x14
push ebp
push esi
push 0x11
push 2
xor ebp, ebp
lea eax, [esp + 0x10]
push 2
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x413a72
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x413add
call esi
cmp eax, ebp
jne 0x413c05
push ebx
push edi
mov edi, 0x4c0
push edi
push ebp
call fcn.00423d4d
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x413ad3
mov ebx, dword [sym.imp.WS2_32.dll_WSAIoctl]
nop
mov edx, dword [esp + 0x1c]
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
push edi
push esi
push 0
push 0
push 0x4004747f
push edx
mov dword [esp + 0x3c], esi
call ebx
test eax, eax
je 0x413ae8
inc ebp
cmp ebp, 0x64
jge 0x413c3a
add edi, 0x4c0
push edi
push esi
call fcn.00423d4d
mov esi, eax
add esp, 8
test esi, esi
jne 0x413a90
mov esi, 0x2747
jmp 0x413be0
pop esi
mov eax, 0xffffe5d4
pop ebp
add esp, 0x14
ret
mov ecx, dword [esp + 0x20]
mov eax, 0xaf286bcb
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 6
mov ebp, ecx
test ebp, ebp
jle 0x413c1d
mov ebx, 1
lea edi, [esi + 4]
mov edi, edi
cmp word [edi], 2
jne 0x413c0e
push 0x24
push 1
call fcn.00424006
mov esi, eax
add esp, 8
test esi, esi
je 0x413c33
mov eax, dword [esp + 0x14]
push 0x10
mov dword [eax], esi
mov dword [esp + 0x18], esi
call fcn.00423687
add esp, 4
test eax, eax
mov dword [esi + 4], eax
je 0x413c33
push ebx
push 0x42faf8
push eax
call fcn.004240c1
mov ecx, dword [edi - 4]
add esp, 0xc
mov dword [esi + 8], ecx
cmp word [edi], 2
jne 0x413c0b
push 0x10
push 1
call fcn.00424006
add esp, 8
test eax, eax
mov dword [esi + 0xc], eax
je 0x413c33
mov edx, edi
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
push 0x10
push 1
mov dword [eax + 0xc], edx
call fcn.00424006
mov dword [esi + 0x10], eax
mov word [eax], 2
mov eax, dword [esi + 0x10]
add esp, 8
test eax, eax
je 0x413c33
mov ecx, dword [esi + 0xc]
push eax
lea eax, [esi + 0x20]
push eax
push ecx
call fcn.00411dd0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x413c0e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x413be0
push eax
call fcn.00411cb0
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
pop edi
pop ebx
je 0x413bf3
push eax
call fcn.00423699
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x413c03
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
pop esi
pop ebp
add esp, 0x14
ret
mov dword [esi + 0x20], ebx
add edi, 0x4c
inc ebx
lea edx, [ebx - 1]
cmp edx, ebp
jl 0x413b10
mov eax, dword [esp + 0x28]
xor esi, esi
cmp eax, esi
je 0x413bcf
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov dword [esp + 0x10], esi
jmp 0x413bcf
mov esi, 0x2747
jmp 0x413bcf
mov esi, 0x2741
jmp 0x413be0
Function at 0x415380
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
push eax
push str.SOFTWAREApple_Computer__Inc.Bonjour
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
jne 0x4153fa
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push esi
push 0x42fe00
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x4153fa
mov eax, dword [esp + 4]
push 4
lea edx, [esp + 0xc]
push edx
push 4
push 0
push 0x42fe00
push eax
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x415409
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x415720
Capabilities:
Modify service

Disassembly:
sub esp, 0x24
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov edi, eax
test edi, edi
jne 0x41575a
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x41575a
call ebp
test eax, eax
je 0x415846
call ebp
test eax, eax
jne 0x415840
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x415780
call ebp
test eax, eax
je 0x415851
call ebp
mov esi, eax
test esi, esi
jne 0x41582e
mov eax, dword [esp + 0x34]
push 0x12
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x4157a6
call ebp
test eax, eax
je 0x415858
call ebp
mov esi, eax
test esi, esi
jne 0x415823
mov ecx, dword [esp + 0x38]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea edx, [esp + 0x10]
push edx
push 1
push edi
mov dword [esp + 0x1c], ecx
call ebx
test eax, eax
jne 0x4157d5
call ebp
test eax, eax
je 0x41585f
call ebp
mov esi, eax
test esi, esi
jne 0x415822
xor eax, eax
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, 1
push 2
lea ecx, [esp + 0x20]
push edi
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x28], 0x1f4
mov dword [esp + 0x24], eax
call ebx
test eax, eax
jne 0x415820
call ebp
test eax, eax
je 0x41585f
call ebp
mov esi, eax
test esi, esi
jne 0x415822
xor esi, esi
pop ebx
test edi, edi
je 0x41582e
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41583d
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, esi
pop esi
pop edi
pop ebp
add esp, 0x24
ret
pop edi
mov eax, 0xffffe59d
pop ebp
add esp, 0x24
ret
mov esi, 0xffffe5bf
jmp 0x41582e
mov esi, 0xffffe5b9
jmp 0x415823
mov esi, 0xffffe5cf
jmp 0x415822

Function at 0x415870
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x408
mov eax, dword [0x436090]
mov ecx, dword [0x44bb08]
test ecx, ecx
mov dword [esp + 0x404], eax
mov eax, dword [esp + 0x410]
jne 0x415903
mov ecx, dword [0x44bb10]
test ecx, ecx
lea ecx, [esp + 0x414]
push ecx
push eax
je 0x4158f6
lea edx, [esp + 0xc]
push edx
call fcn.004247d5
mov edx, dword [esp + 0x418]
add esp, 0xc
push 0
lea ecx, [esp + 4]
push ecx
push 0
push 1
push 0
push 0x20000001
lea eax, [esp + 0x1c]
push 0
mov dword [esp + 0x1c], eax
mov eax, dword [0x44bb10]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov ecx, dword [esp + 0x404]
call fcn.0042373b
add esp, 0x408
ret
push 0x4360e0
call fcn.00424778
add esp, 0xc
mov ecx, dword [esp + 0x404]
call fcn.0042373b
add esp, 0x408
ret