joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f994
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051f0
mov eax, dword [ebp - 8]
call fcn.004051f0
mov eax, dword [ebp - 0xc]
call fcn.004051f0
mov eax, dword [ebp + 8]
call fcn.004051f0
xor eax, eax
push ebp
push 0x45faeb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
push 0xf003f
push 0
push 0x45fb00
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405200
push eax
push 0
push 2
push 0x110
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.00405200
push eax
mov eax, dword [ebp - 4]
call fcn.00405200
push eax
push ebx
call sub.advapi32.dll_CreateServiceA
mov ebx, eax
mov eax, dword [0x4a3ad0]
cmp dword [eax], 0
je 0x45fac0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x400
mov edx, 1
mov eax, dword [ebp + 8]
call fcn.00405260
mov eax, 4
call fcn.00402b2c
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
call fcn.00405000
inc eax
call fcn.00402b2c
mov esi, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], esi
xor eax, eax
push ebp
push 0x45fab9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 0x1c]
call fcn.0040a1ec
mov eax, dword [ebp - 0x18]
push eax
push 1
push ebx
mov eax, dword [0x4a3ad0]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fac0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.00402b5c
mov eax, dword [ebp - 0x18]
call fcn.00402b5c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45faf2
lea eax, [ebp - 0x1c]
call fcn.00404d40
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404d64
lea eax, [ebp + 8]
call fcn.00404d40
ret

Function at 0x45fb04
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051f0
xor eax, eax
push ebp
push 0x45fbb6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x45fb96
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0xf003f
push 0
push 0x45fbc8
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x45fb7e
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00405200
cmpsb byte [esi], byte es:[edi]
push esi
cli
call dword [eax + 0x53]
Function at 0x45fbcc
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051f0
xor eax, eax
push ebp
push 0x45fcad
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
push ebp
push 0x45fc8d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0x45fcc0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x45fc83
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00405200
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
je 0x45fc7d
mov eax, dword [ebp - 8]
sub eax, 1
jb 0x45fc43
je 0x45fc4a
dec eax
je 0x45fc51
jmp 0x45fc56
mov edi, 2
jmp 0x45fc56
mov edi, 3
jmp 0x45fc56
mov edi, 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigA
test eax, eax
je 0x45fc77
mov byte [ebp - 9], 1
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45fc97
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fcb4
lea eax, [ebp - 4]
call fcn.00404d40
ret

Function at 0x460320
Capabilities:
Acquire debug privileges

Disassembly:
add esp, 0xffffffe0
push esp
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x46038a
lea eax, [esp + 8]
push eax
push 0x460390
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x46038a
mov dword [esp + 0x10], 1
mov dword [esp + 0x1c], 2
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0
push 0x10
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
add esp, 0x20
ret

Function at 0x4604c0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
mov ebx, eax
push 0
push 0x460420
call sub.user32.dll_EnumWindows
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, ebx
mov edx, dword [0x4a50ec]
call fcn.00404d94
pop ebx
ret

Function at 0x4604c3
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
mov ebx, eax
push 0
push 0x460420
call sub.user32.dll_EnumWindows
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, ebx
mov edx, dword [0x4a50ec]
call fcn.00404d94
pop ebx
ret
Function at 0x46060c
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004051f0
xor eax, eax
push ebp
push 0x4606ef
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 0
push 0
push 0x460700
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4606d9
push 0
push 0x84000002
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405200
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x460684
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x4606d9
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x411]
xor ecx, ecx
mov edx, 0x401
call fcn.00403664
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x411]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x4606ce
mov eax, esi
lea edx, [ebp - 0x411]
mov ecx, 0x401
call fcn.00404fb0
mov bl, 1
jmp 0x4606d0
xor ebx, ebx
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4606f6
lea eax, [ebp - 4]
call fcn.00404d40
ret

Function at 0x460850
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4608b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00409894
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x4608c8
call fcn.0040504c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4608ba
lea eax, [ebp - 0x24]
call fcn.00404d40
ret
Function at 0x4608cc
Capabilities:
Execute anti-debugging instructions
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4609e7
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetPriorityClass
mov ebx, eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov esi, eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push 0xa
call sub.kernel32.dll_Sleep_1
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.kernel32.dll_Sleep_1
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
lea eax, [ebp - 0x34]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x38], eax
fild qword [ebp - 0x3c]
fdiv dword [0x4609f8]
fstp qword [ebp - 0x10]
wait
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x40]
call fcn.00409894
push dword [ebp - 0x40]
push 0x460a04
fld qword [ebp - 0x10]
fdiv dword [0x460a08]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea edx, [ebp - 0x44]
mov eax, 0x460a14
call fcn.0040b2fc
push dword [ebp - 0x44]
push 0x460a24
mov eax, edi
mov edx, 4
call fcn.004050c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4609ee
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404d64
ret
Function at 0x460c98
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd50
push ebx
xor ecx, ecx
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 0x2ac], ecx
mov dword [ebp - 0x2b0], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051f0
xor eax, eax
push ebp
push 0x460e3c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x19e]
push eax
push 0x101
call sub.ws2_32.dll_WSAStartup
xor edx, edx
push ebp
push 0x460e0f
push dword fs:[edx]
mov dword fs:[edx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x29e]
push eax
call sub.ws2_32.dll_gethostname
lea eax, [ebp - 0x29e]
mov edx, pe_nt_image_headers32
call fcn.00408168
mov eax, dword [ebp - 4]
call fcn.00405000
push eax
mov eax, dword [ebp - 4]
call fcn.00405200
mov edx, eax
lea eax, [ebp - 0x29e]
pop ecx
call fcn.0040814c
lea eax, [ebp - 0x29e]
push eax
call sub.ws2_32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x460df8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x460df2
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x460dec
lea edx, [ebp - 0x2a4]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
call fcn.004097a8
push dword [ebp - 0x2a4]
push 0x460e54
lea edx, [ebp - 0x2a8]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 1]
call fcn.004097a8
push dword [ebp - 0x2a8]
push 0x460e54
lea edx, [ebp - 0x2ac]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 2]
call fcn.004097a8
push dword [ebp - 0x2ac]
push 0x460e54
lea edx, [ebp - 0x2b0]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 3]
call fcn.004097a8
push dword [ebp - 0x2b0]
mov eax, ebx
mov edx, 7
call fcn.004050c0
mov byte [ebp - 5], 1
jmp 0x460dfc
mov byte [ebp - 5], 0
jmp 0x460dfc
mov byte [ebp - 5], 0
jmp 0x460dfc
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460e16
call sub.ws2_32.dll_WSACleanup
ret

Function at 0x460e58
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x460efb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
mov edx, 0x40
call fcn.00408168
push 0x40
lea eax, [ebp - 0x4c]
push eax
call sub.ws2_32.dll_gethostname
lea eax, [ebp - 0x4c]
push eax
call sub.ws2_32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x460ee5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push dword [eax]
call sub.ws2_32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00404f38
lea edx, [esi + 1]
mov eax, ebx
call fcn.00408168
mov eax, dword [ebp - 0xc]
call fcn.00405000
push eax
lea eax, [ebp - 0xc]
call fcn.00405258
mov edx, eax
mov eax, ebx
pop ecx
call fcn.0040814c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460f02
lea eax, [ebp - 0xc]
call fcn.00404d40
ret
Function at 0x460f70
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor ecx, ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0xc], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x461093
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
inc edx
call fcn.00408168
lea eax, [ebp - 0xc]
mov edx, 0x4610a8
call fcn.00404dd8
mov eax, dword [ebp - 0xc]
call fcn.00405000
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405200
mov edx, eax
mov eax, ebx
pop ecx
call fcn.0040814c
lea eax, [ebp - 0x48]
mov edx, 0x38
call fcn.00408168
mov dword [ebp - 4], 0x38
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0xc]
mov edx, 0x4a4d3c
mov ecx, 0xf
call fcn.00404fb0
mov eax, dword [ebp - 0xc]
call fcn.00405200
push eax
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 2
push 0xf
lea eax, [ebp - 0x10]
push eax
call sub.ws2_32.dll_gethostbyaddr
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x461075
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call fcn.00404f38
push dword [ebp - 0xc]
push 0x4610c0
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x38
call fcn.00404fb0
push dword [ebp - 0x4c]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004050c0
mov eax, ebx
mov edx, 0x38
call fcn.00408168
mov eax, dword [ebp - 0xc]
call fcn.00405000
push eax
lea eax, [ebp - 0xc]
call fcn.00405258
mov edx, eax
mov eax, ebx
pop ecx
call fcn.0040814c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46109a
lea eax, [ebp - 0x4c]
call fcn.00404d40
lea eax, [ebp - 0xc]
call fcn.00404d40
ret

Function at 0x46136c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, dword [ebp - 0xc]
xor ebx, ebx
cmp esi, dword [ebp - 0xc]
jge 0x4613df
push 0
push edi
mov eax, dword [ebp - 8]
add eax, esi
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_send
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4613d6
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
jne 0x4613df
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 0
jne 0x4613c6
push 1
call sub.kernel32.dll_Sleep_1
jmp 0x4613da
push 1
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x4613da
add esi, ebx
sub edi, ebx
cmp esi, dword [ebp - 0xc]
jl 0x46138a
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edx, edx
mov eax, ebx
call fcn.004617b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x461474
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, dword [ebp - 0xc]
xor ebx, ebx
cmp esi, dword [ebp - 0xc]
jge 0x4614e1
push 0
push edi
mov eax, dword [ebp - 8]
add eax, esi
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4614d8
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
jne 0x4614e1
cmp dword [ebp + 8], 0
jne 0x4614cb
push 1
call sub.kernel32.dll_Sleep_1
jmp 0x4614dc
push 1
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x4614dc
add esi, ebx
sub edi, ebx
cmp esi, dword [ebp - 0xc]
jl 0x461492
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor edx, edx
mov eax, ebx
call fcn.004617b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46170c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
test ebx, ebx
je 0x46171c
xor eax, eax
mov dword [ebx], eax
mov eax, ebx
call fcn.00404d40
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x461764
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x461764
push 1
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x46175f
push esi
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 4], eax
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404f38
push esi
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x462298
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push ebp
push 0x46231b
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor ecx, ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
call sub.advapi32.dll_RegCreateKeyExA
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404f38
mov eax, dword [ebp - 0xc]
call fcn.00405000
inc eax
push eax
push ebx
push 1
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462322
lea eax, [ebp - 0xc]
call fcn.00404d40
ret
Function at 0x46232c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x46234a
xor eax, eax
mov dword [ebx], eax
mov eax, ebx
call fcn.00404d40
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push edi
push esi
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0x10], 0x104
lea eax, [ebp - 0x114]
mov edx, 0x104
call fcn.00408168
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, ebx
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.00404fb0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4623cc
Capabilities:
Delete registry value

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, ecx
xor ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], 2
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
call sub.advapi32.dll_RegCreateKeyExA
push ebx
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop ecx
pop edx
pop ebx
ret

Function at 0x462418
Capabilities:
Acquire debug privileges

Disassembly:
add esp, 0xffffffe8
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x462468
lea eax, [esp + 0xc]
push eax
push 0x46246c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
add esp, 0x18
ret
Function at 0x462a58
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004051f0
lea esi, [ebp - 0x14]
xor eax, eax
push ebp
push 0x462b71
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 0
push 0
push 0
push 0x462b84
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x462b5b
push 0
push 0
push 0
push 0
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x462b5b
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x417950]
call fcn.0041c764
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x462b54
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov dword [esi], 1
cmp dword [esi], 0
jbe 0x462b2c
push esi
push 0x400
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x418]
mov ecx, dword [esi]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esi], 0
ja 0x462b01
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462b5b
mov eax, dword [ebp - 0x18]
call fcn.00403ef4
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462b78
lea eax, [ebp - 4]
call fcn.00404d40
ret
Function at 0x46457c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
mov edx, 0x4647e0
call fcn.00404d94
lea eax, [ebp - 0xc0]
push eax
call sub.kernel32.dll_GetSystemInfo
xor eax, eax
push ebp
push 0x4647c0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x9c]
call fcn.00464974
test al, al
jne 0x4645cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4647d1
mov eax, dword [ebp - 0x98]
sub eax, 4
je 0x4645ef
dec eax
je 0x464639
dec eax
je 0x4646e5
sub eax, 4
je 0x46478b
jmp 0x4647b6
mov eax, dword [ebp - 0x94]
sub eax, 1
jb 0x464606
je 0x464617
sub eax, 8
je 0x464628
jmp 0x4647b6
mov eax, ebx
mov edx, 0x4647f0
call fcn.00404d94
jmp 0x4647b6
mov eax, ebx
mov edx, 0x464800
call fcn.00404d94
jmp 0x4647b6
mov eax, ebx
mov edx, 0x464810
call fcn.00404d94
jmp 0x4647b6
mov eax, dword [ebp - 0x94]
sub eax, 1
jb 0x46464e
je 0x464676
dec eax
je 0x464687
jmp 0x4647b6
cmp byte [ebp - 2], 1
jne 0x464665
mov eax, ebx
mov edx, 0x464820
call fcn.00404d94
jmp 0x4647b6
mov eax, ebx
mov edx, 0x464830
call fcn.00404d94
jmp 0x4647b6
mov eax, ebx
mov edx, 0x464848
call fcn.00404d94
jmp 0x4647b6
cmp byte [ebp - 2], 1
jne 0x4646a3
cmp word [ebp - 0xc0], 9
jne 0x4646a3
mov eax, ebx
mov edx, 0x464858
call fcn.00404d94
push 0x59
call sub.user32.dll_GetSystemMetrics
test eax, eax
jne 0x4646bc
mov eax, ebx
mov edx, 0x464868
call fcn.00404d94
jmp 0x4646c8
mov eax, ebx
mov edx, 0x464880
call fcn.00404d94
cmp word [ebp - 4], 0x8000
jne 0x4647b6
mov eax, ebx
mov edx, 0x464898
call fcn.00404d94
jmp 0x4647b6
mov eax, dword [ebp - 0x94]
sub eax, 1
jb 0x4646fd
je 0x464725
dec eax
je 0x464747
dec eax
je 0x464769
jmp 0x4647b6
cmp byte [ebp - 2], 1
jne 0x464714
mov eax, ebx
mov edx, 0x4648b0
call fcn.00404d94
jmp 0x4647b6
mov eax, ebx
mov edx, 0x4648c4
call fcn.00404d94
jmp 0x4647b6
cmp byte [ebp - 2], 1
jne 0x464739
mov eax, ebx
mov edx, 0x4648dc
call fcn.00404d94
jmp 0x4647b6
mov eax, ebx
mov edx, 0x4648ec
call fcn.00404d94
jmp 0x4647b6
cmp byte [ebp - 2], 1
jne 0x46475b
mov eax, ebx
mov edx, 0x464904
call fcn.00404d94
jmp 0x4647b6
mov eax, ebx
mov edx, 0x464914
call fcn.00404d94
jmp 0x4647b6
cmp byte [ebp - 2], 1
jne 0x46477d
mov eax, ebx
mov edx, 0x46492c
call fcn.00404d94
jmp 0x4647b6
mov eax, ebx
mov edx, 0x46493c
call fcn.00404d94
jmp 0x4647b6
mov eax, dword [ebp - 0x94]
sub eax, 1
jae 0x4647b6
cmp byte [ebp - 2], 1
jne 0x4647aa
mov eax, ebx
mov edx, 0x464954
call fcn.00404d94
jmp 0x4647b6
mov eax, ebx
mov edx, 0x464964
call fcn.00404d94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4647d1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret