joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e385
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004093db
and dword [ebp - 4], 0
cmp dword [0x41af5c], 0
mov ebx, eax
jne 0x40e436
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40e4e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x412a9c
push edi
call esi
test eax, eax
je 0x40e4e7
push eax
call fcn.00409369
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41af5c], eax
call esi
push eax
call fcn.00409369
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41af60], eax
call esi
push eax
call fcn.00409369
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41af64], eax
call esi
push eax
call fcn.00409369
pop ecx
mov dword [0x41af6c], eax
test eax, eax
je 0x40e436
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00409369
pop ecx
mov dword [0x41af68], eax
mov eax, dword [0x41af68]
cmp eax, ebx
je 0x40e48e
cmp dword [0x41af6c], ebx
je 0x40e48e
push eax
call fcn.004093e4
push dword [0x41af6c]
mov esi, eax
call fcn.004093e4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40e48e
test edi, edi
je 0x40e48e
call esi
test eax, eax
je 0x40e485
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40e485
test byte [ebp - 0xc], 1
jne 0x40e48e
or dword [ebp + 0x10], 0x200000
jmp 0x40e4c7
mov eax, dword [0x41af60]
cmp eax, ebx
je 0x40e4c7
push eax
call fcn.004093e4
pop ecx
test eax, eax
je 0x40e4c7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40e4c7
mov eax, dword [0x41af64]
cmp eax, ebx
je 0x40e4c7
push eax
call fcn.004093e4
pop ecx
test eax, eax
je 0x40e4c7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41af5c]
call fcn.004093e4
pop ecx
test eax, eax
je 0x40e4e7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40e4e9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
xor ebx, ebx
push str.RunProgram_start
mov dword [ebp - 4], ebx
call fcn.00403cd5
mov esi, dword [ebp + 0xc]
pop ecx
cmp byte [esi + 0x52c], bl
lea eax, [esi + 0x52c]
je 0x40102d
mov dword [ebp - 4], eax
lea edi, [esi + 0x428]
push eax
push edi
push str.Running_program__s_in_directory__s
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x2a], bx
mov dword [ebp - 0x28], ebx
call fcn.00403cd5
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 4]
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401084
push dword [ebp + 8]
push esi
call fcn.00403ed0
pop ecx
jmp 0x4010b7
push str.Waiting_for_program_to_finish
call fcn.00403cd5
pop ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 8], 0x103
je 0x40108f
push str.RunProgram_end
call fcn.00403cd5
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40123f
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.UserIsLoggedOn_start
call fcn.00403cd5
lea eax, [ebp - 0x104]
mov dword [esp], 0x104
push eax
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.WSOCK32.dll_bind
call fcn.004063e4
add esp, 0x14
test al, al
jne 0x40128e
push str.Cannot_read_HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonShell
call fcn.00403cd5
mov dword [esp], str.UserIsLoggedOn_end__assume_user_is_logged_on
jmp 0x4012bb
lea eax, [ebp - 0x104]
push eax
push str.Check_for_program__s
call fcn.00403cd5
pop ecx
lea eax, [ebp - 0x104]
pop ecx
push eax
push 0x401227
call fcn.00405d2a
test eax, eax
jne 0x4012c6
push str.UserIsLoggedOn_end__user_is_logged_on
call fcn.00403cd5
pop ecx
push 1
pop eax
leave
ret
push str.UserIsLoggedOn_end__user_is_NOT_logged_on
call fcn.00403cd5
pop ecx
xor eax, eax
leave
ret
Function at 0x4012d5
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
movsx eax, word [esi + 0x7d8]
push eax
push dword [esi]
push str.DoExitWindowsEx_start__action_d__force_d
call fcn.00403cd5
mov eax, dword [esi]
add esp, 0xc
sub eax, 0
je 0x40131f
dec eax
je 0x40131b
dec eax
je 0x401316
dec eax
jne 0x401356
mov ebx, dword [esi + 0x750]
dec ebx
neg ebx
sbb ebx, ebx
and ebx, 7
inc ebx
jmp 0x401359
push 1
pop ebx
jmp 0x401359
push 2
jmp 0x401318
cmp dword [esi + 0x750], 2
jne 0x401352
push esi
call fcn.0040123f
test eax, eax
pop ecx
jne 0x401352
push str.Wanted_to_LOGOFF_the_user__but_nobody_was_logged_on
push 4
push esi
call fcn.00403e40
push str.DoExitWindowsEx_end
call fcn.00403cd5
add esp, 0x10
jmp 0x40142e
xor ebx, ebx
jmp 0x401359
mov ebx, dword [ebp + 8]
cmp word [esi + 0x7d8], 0
je 0x401366
or ebx, 4
movsx eax, word [esi + 0x7d4]
lea edi, [esi + 0x7d4]
push eax
push str.Warning_d
call fcn.00403cd5
cmp word [edi], 0
pop ecx
pop ecx
je 0x40139d
push esi
push dword [ebp + 8]
call fcn.0040c41b
pop ecx
test eax, eax
pop ecx
jne 0x40139d
push 1
pop eax
jmp 0x401430
movsx eax, word [esi + 0x7d6]
lea edi, [esi + 0x7d6]
push eax
push str.Run_Program_d
call fcn.00403cd5
cmp word [edi], 0
pop ecx
pop ecx
je 0x4013c8
push esi
push dword [ebp + 8]
call section..text
pop ecx
pop ecx
push esi
call fcn.004010bd
push eax
push str.Initiating__s
push 4
push esi
call fcn.00403e40
add esp, 0x14
cmp word [esi + 0x14], 0
je 0x4013f6
push str.ExitWindowsEx
push dword [ebp + 8]
push esi
call fcn.00403da0
jmp 0x401420
push 0
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x401413
push dword [ebp + 8]
push esi
call fcn.00403ed0
pop ecx
or eax, 0xffffffff
pop ecx
jmp 0x401430
push str.ExitWindowsEx_executed_succesfully_
push 4
push esi
call fcn.00403e40
add esp, 0xc
push str.DoExitWindowsEx_end
call fcn.00403cd5
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401659
Capabilities:
Connect network resource
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
push str.DoInitiateSystemShutdown_start
call fcn.00403cd5
mov esi, dword [ebp + 0xc]
pop ecx
lea edi, [esi + 0x130]
push edi
push esi
call fcn.004010bd
pop ecx
push eax
push str.Initiating__s_on_remote_computer__s
push 4
push esi
call fcn.00403e40
xor ebx, ebx
add esp, 0x14
cmp word [esi + 0x14], bx
je 0x4016b0
push str.InitiateSystemShutdown
push dword [ebp + 8]
push esi
call fcn.00403da0
add esp, 0xc
jmp 0x40178b
movsx eax, word [esi + 0x1fc]
push eax
push str.current_credentials_d
call fcn.00403cd5
cmp word [esi + 0x1fc], bx
pop ecx
pop ecx
jne 0x401730
cmp byte [edi], 0x5c
push edi
je 0x4016da
push str._s_admin_
jmp 0x4016df
push 0x417518
lea eax, [ebp - 0x124]
push eax
call fcn.0040c87c
lea eax, [ebp - 0x124]
add esp, 0xc
mov dword [ebp - 0xc], eax
lea eax, [esi + 0x1fe]
push ebx
push eax
lea eax, [esi + 0x1d2]
mov dword [ebp - 0x20], 2
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
jne 0x401764
push str.InitiateSystemShutdown
call fcn.00403cd5
xor eax, eax
cmp dword [esi], 1
pop ecx
sete al
push eax
movsx eax, word [esi + 0x7d8]
push eax
lea eax, [esi + 0x258]
push dword [esi + 0x254]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
test eax, eax
jne 0x401774
push dword [ebp + 8]
push esi
call fcn.00403ed0
pop ecx
or eax, 0xffffffff
pop ecx
jmp 0x4017bc
cmp word [esi + 0x1fc], bx
jne 0x40178b
push ebx
lea eax, [ebp - 0x124]
push ebx
push eax
call sub.MPR.dll_WNetCancelConnection2A
mov edi, str.Remote_computer_has_accepted_the_request
push edi
push 4
push esi
call fcn.00403e40
add esp, 0xc
cmp word [esi + 0xc], bx
je 0x4017af
push edi
push dword [ebp + 8]
push esi
call fcn.00403dee
add esp, 0xc
push str.DoInitiateSystemShutdown_end
call fcn.00403cd5
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401cf4
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e8
push ebx
push esi
push edi
push str.SendClientCommand_start
call fcn.00403cd5
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 0x3e8]
push dword [ebp + 0x14]
push eax
call fcn.0040ca1b
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x1f4]
push 0x417800
push eax
call fcn.0040c87c
mov esi, dword [ebp + 0xc]
add esp, 0x1c
cmp dword [esi + 0x124], 0xffffffff
je 0x401ea2
lea eax, [ebp - 0x1f4]
push eax
push str.Sending__s_to_remote_machine
call fcn.00403cd5
pop ecx
xor ebx, ebx
pop ecx
lea eax, [ebp - 0x1f4]
push ebx
push eax
call fcn.0040c9a0
pop ecx
push eax
lea eax, [ebp - 0x1f4]
push eax
push dword [esi + 0x124]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x401e92
push str.Waiting_for_a_reply
call fcn.00403cd5
pop ecx
lea eax, [ebp - 0x1f4]
push ebx
push 0x1f4
push eax
push dword [esi + 0x124]
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x401e92
cmp edi, ebx
jle 0x401e92
lea eax, [ebp - 0x1f4]
push eax
push str.Received__s_from_remote_machine
call fcn.00403cd5
lea eax, [ebp - 0x1f4]
mov byte [ebp + edi - 0x1f4], bl
push eax
call fcn.0040c9a0
add esp, 0xc
test eax, eax
jbe 0x401e3b
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040c9a0
cmp byte [ebp + eax - 0x1f5], 0xa
pop ecx
je 0x401e18
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040c9a0
cmp byte [ebp + eax - 0x1f5], 0xd
pop ecx
jne 0x401e3b
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040c9a0
mov byte [ebp + eax - 0x1f5], bl
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040c9a0
pop ecx
pop ecx
jmp 0x401de6
lea eax, [ebp - 0x1f4]
push 0x20
push eax
call fcn.0040c8e0
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x401e5b
mov byte [esi], bl
inc esi
push esi
call fcn.00408244
pop ecx
cmp byte [ebp - 0x1f4], 0x32
je 0x401ea2
cmp byte [ebp - 0x1f4], 0x35
jne 0x401e70
push esi
jmp 0x401e75
push str.Unknown_response_received
push dword [ebp + 0x10]
call fcn.0040c700
push dword [ebp + 0x10]
push str.SendClientCommand_ended_with_error__s
call fcn.00403cd5
add esp, 0x10
push 0xfffffffffffffffe
pop eax
jmp 0x401eaf
push esi
push dword [ebp + 8]
call fcn.0040bf9e
pop ecx
or eax, 0xffffffff
pop ecx
jmp 0x401eaf
push str.SendClientCommand_end
call fcn.00403cd5
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401eb4
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
push str.GetServerVersion_start
call fcn.00403cd5
mov esi, dword [ebp + 0xc]
pop ecx
cmp dword [esi + 0x124], 0xffffffff
je 0x402069
push str.Sending_VERSION_to_remote_machine
call fcn.00403cd5
pop ecx
xor ebx, ebx
push ebx
push 8
push str.VERSION_n
push dword [esi + 0x124]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x402059
push str.Waiting_for_a_reply
call fcn.00403cd5
pop ecx
lea eax, [ebp - 0x204]
push ebx
push 0x1f4
push eax
push dword [esi + 0x124]
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x402059
cmp edi, ebx
jle 0x402059
lea eax, [ebp - 0x204]
push eax
push str.Received__s_from_remote_machine
call fcn.00403cd5
lea eax, [ebp - 0x204]
mov byte [ebp + edi - 0x204], bl
push eax
call fcn.0040c9a0
add esp, 0xc
test eax, eax
jbe 0x401fb8
lea eax, [ebp - 0x204]
push eax
call fcn.0040c9a0
cmp byte [ebp + eax - 0x205], 0xa
pop ecx
je 0x401f95
lea eax, [ebp - 0x204]
push eax
call fcn.0040c9a0
cmp byte [ebp + eax - 0x205], 0xd
pop ecx
jne 0x401fb8
lea eax, [ebp - 0x204]
push eax
call fcn.0040c9a0
mov byte [ebp + eax - 0x205], bl
lea eax, [ebp - 0x204]
push eax
call fcn.0040c9a0
pop ecx
pop ecx
jmp 0x401f63
lea eax, [ebp - 0x204]
push 0x20
push eax
call fcn.0040c8e0
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x401fd8
mov byte [esi], bl
inc esi
push esi
call fcn.00408244
pop ecx
cmp byte [ebp - 0x204], 0x32
jne 0x40202b
push str.SendClientCommand_end
call fcn.00403cd5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push str._d._d._d._d
push esi
call fcn.0040ca6c
mov esi, dword [ebp - 8]
imul esi, esi, 0x64
add esi, dword [ebp - 0x10]
imul esi, esi, 0x64
add esi, dword [ebp - 4]
imul esi, esi, 0x64
add esi, dword [ebp - 0xc]
push esi
push str.version_d
call fcn.00403cd5
add esp, 0x24
jmp 0x40206c
cmp byte [ebp - 0x204], 0x35
jne 0x402037
push esi
jmp 0x40203c
push str.Unknown_response_received
push dword [ebp + 0x10]
call fcn.0040c700
push dword [ebp + 0x10]
push str.SendClientCommand_ended_with_error__s
call fcn.00403cd5
add esp, 0x10
push 0xfffffffffffffffe
pop eax
jmp 0x402079
push esi
push dword [ebp + 8]
call fcn.0040bf9e
pop ecx
or eax, 0xffffffff
pop ecx
jmp 0x402079
mov esi, dword [ebp + 0x10]
push str.GetServerVersion_end
call fcn.00403cd5
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403e40
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push str.WriteEvent_start
call fcn.00403cd5
xor esi, esi
mov dword [esp], 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], eax
push ecx
push dword [ebp + 0x10]
push eax
call fcn.0040ca1b
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x750], 2
jne 0x403eb8
push str.Poweroff
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edi, eax
cmp edi, esi
jne 0x403e9c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x403ecc
lea eax, [ebp - 4]
push esi
push eax
push esi
push 1
push esi
push esi
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push str.WriteEvent_end
call fcn.00403cd5
pop ecx
pop edi
pop esi
leave
ret
Function at 0x405184
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push esi
lea eax, [ebp - 8]
push edi
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0x900
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov edi, dword [ebp + 8]
mov dword [0x41f960], edi
call fcn.0040bc33
lea eax, [ebp - 0x808]
push eax
call fcn.0040a681
pop ecx
call fcn.0040513e
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea eax, [ebp - 0x808]
push eax
call esi
push eax
call fcn.00402aca
pop ecx
test eax, eax
pop ecx
jne 0x4051ef
lea eax, [ebp - 0x808]
push eax
call fcn.0040a751
pop ecx
push str.3.0.1.3
push str.Starting_poweroff__s
call fcn.00403cd5
pop ecx
pop ecx
call esi
push eax
push str.Commandline:__s
call fcn.00403cd5
xor esi, esi
pop ecx
cmp word [0x41f3ec], si
pop ecx
je 0x405227
lea eax, [ebp - 0x808]
push eax
call fcn.0040b264
pop ecx
cmp dword [ebp - 0xb8], 2
lea eax, [ebp - 0xb4]
push eax
jne 0x405250
push dword [ebp - 0xbc]
push dword [ebp - 0xc0]
push dword [ebp - 0xc4]
push str.PC_is_running_Windows_NT_version__d._d_build__d___s_
jmp 0x405269
movzx eax, word [ebp - 0xbc]
push eax
push dword [ebp - 0xc0]
push dword [ebp - 0xc4]
push str.PC_is_running_Windows_9x_version__d._d_build__d___s_
call fcn.00403cd5
add esp, 0x14
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x808]
push esi
push eax
push 0x40a401
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x75
push dword [0x41f960]
call dword [sym.imp.USER32.dll_LoadMenuA]
mov dword [0x41f964], eax
lea eax, [ebp - 0x808]
push eax
push dword [ebp + 0x14]
push edi
push esi
call fcn.004050f9
add esp, 0x10
test eax, eax
je 0x405315
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push esi
push esi
lea eax, [ebp - 0x28]
push esi
push eax
call edi
cmp eax, 1
jne 0x4052fa
lea eax, [ebp - 0x28]
push eax
push dword [0x41f968]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x4052f1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push esi
lea eax, [ebp - 0x28]
push esi
push eax
jmp 0x4052c2
push str.Poweroff_stopped
call fcn.00403cd5
lea eax, [ebp - 0x808]
push eax
call fcn.0040531b
mov eax, dword [ebp - 0x20]
pop ecx
pop ecx
pop edi
pop esi
leave
ret 0x10
Function at 0x40576b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
push dword [esi]
push dword [ebp + 0xc]
push str.GetPerfData_start__szObjectIndex_s_pDataSize_d_
call fcn.00403cd5
mov edi, dword [ebp + 0x10]
add esp, 0xc
cmp dword [edi], 0
jne 0x40579c
push dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
push dword [edi]
push str.ppData_p
call fcn.00403cd5
pop ecx
mov ebx, 0xea
pop ecx
mov eax, dword [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push dword [edi]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push str.dwR_d
mov dword [ebp + 0x14], eax
call fcn.00403cd5
cmp dword [ebp + 0x14], ebx
pop ecx
pop ecx
jne 0x40580b
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
add dword [esi], 0x400
push dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
push dword [esi]
push eax
push str.ppData_p__size_d
call fcn.00403cd5
add esp, 0xc
cmp dword [edi], 0
je 0x405817
cmp dword [ebp + 0x14], ebx
jne 0x40582f
jmp 0x4057af
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.GetPerfData_end__ERROR_NOT_ENOUGH_MEMORY_
call fcn.00403cd5
pop ecx
push 8
pop eax
jmp 0x405841
push dword [ebp + 0x14]
push str.GetPerfData_end__dwR_d_
call fcn.00403cd5
mov eax, dword [ebp + 0x14]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40631d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push dword [ebp + 0x14]
call fcn.0040c9a0
mov esi, eax
pop ecx
lea eax, [ebp - 8]
inc esi
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push str.REG_SZ
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x406375
push esi
push dword [ebp + 0x14]
push 1
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x406379
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x406384
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
leave
ret

Function at 0x406387
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0x20006
push 0
push str.REG_DWORD
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4063d3
lea eax, [ebp + 0x14]
push 4
push eax
push 4
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4063d7
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop ebp
ret
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop ebp
ret

Function at 0x4063e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40642f
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 8]
push dword [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
mov esi, eax
test esi, esi
je 0x406433
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x40643b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
pop ebp
ret

Function at 0x40643e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
mov dword [ebp - 4], 4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406491
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push dword [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
mov esi, eax
test esi, esi
je 0x406495
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x40649d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
leave
ret
Function at 0x4064a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
mov dword [ebp - 4], 4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4064f5
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
mov esi, eax
test esi, esi
je 0x4064f9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x40650b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x14]
mov cx, word [ebp + 8]
mov word [eax], cx
mov al, 1
pop esi
leave
ret

Function at 0x40650e
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push esi
push eax
push 2
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40654c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp + 0xc]
mov esi, eax
test esi, esi
je 0x406550
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x406558
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
pop ebp
ret

Function at 0x408387
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
push esi
push str.ReturnClientError_start
call fcn.00403cd5
mov esi, dword [ebp + 0xc]
pop ecx
cmp dword [esi + 0x124], 0xffffffff
je 0x408416
push dword [ebp + 0x10]
lea eax, [ebp - 0x1f4]
push 0x1f5
push str._d__s_r_n
push eax
call fcn.0040c87c
lea eax, [ebp - 0x1f4]
push eax
push str.Sending_error__s_to_client
call fcn.00403cd5
add esp, 0x18
lea eax, [ebp - 0x1f4]
push 0
push eax
call fcn.0040c9a0
pop ecx
push eax
lea eax, [ebp - 0x1f4]
push eax
push dword [esi + 0x124]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
jne 0x408416
push str.send
push esi
call fcn.0040b709
push esi
push dword [ebp + 8]
call fcn.0040bf9e
add esp, 0x10
jmp 0x408421
push str.ReturnClientError_end
call fcn.00403cd5
pop ecx
pop esi
leave
ret