joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409d70
Capabilities:
Set registry value

Disassembly:
jmp 0x409d70
sub esp, 0x608
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x604], eax
push ebx
mov ebx, dword [esp + 0x614]
push ebp
mov ebp, dword [esp + 0x614]
test ebp, ebp
push esi
mov esi, dword [esp + 0x624]
mov dword [esp + 0xc], ebx
jne 0x409dbe
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x604]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x608
ret
test ebx, ebx
je 0x409da4
push edi
mov edi, dword [esp + 0x624]
test edi, edi
je 0x409e43
test esi, esi
je 0x409e43
push 0x200
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0041be10
add esp, 0xc
cmp edi, 1
jne 0x409dfc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push edi
jmp 0x409ebf
cmp edi, 3
jne 0x409ebb
push 0x400
xor edi, edi
lea ecx, [esp + 0x218]
push edi
push ecx
call fcn.0041be10
push esi
lea edx, [esp + 0x224]
push 0x200
push edx
call fcn.0041c22f
lea eax, [esp + 0x22c]
push eax
call fcn.004012a3
mov ebx, eax
add esp, 0x1c
test ebx, ebx
jne 0x409e4a
xor eax, eax
jmp 0x409ed2
push ebx
lea ecx, [esp + 0x18]
push 0x200
push ecx
call fcn.0041cd94
add esp, 0xc
cmp byte [esp + 0x14], 0
je 0x409e98
mov al, byte [esp + edi + 0x14]
cmp al, 0x40
jle 0x409e74
cmp al, 0x47
jge 0x409e74
sub al, 0x37
jmp 0x409e8a
cmp al, 0x60
jle 0x409e88
cmp al, 0x67
jge 0x409e88
add word [esp + edi*2 + 0x214], 0xffa9
jmp 0x409e8e
sub al, 0x30
mov byte [esp + edi + 0x14], al
add edi, 1
cmp byte [esp + edi + 0x14], 0
jne 0x409e64
mov eax, dword [esp + 0x10]
push edi
lea edx, [esp + 0x18]
push edx
push 3
push 0
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
mov esi, eax
call fcn.0041cb40
add esp, 4
jmp 0x409ecb
push 4
push esi
push edi
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
xor eax, eax
test esi, esi
sete al
mov ecx, dword [esp + 0x614]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x608
ret
Function at 0x4101c0
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
jmp 0x4101c0
sub esp, 0x514
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
mov ebx, dword [esp + 0x520]
push esi
mov esi, dword [esp + 0x520]
test esi, esi
jne 0x410201
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x514
ret
test ebx, ebx
je 0x4101e8
push 0x200
lea eax, [esp + 0x31c]
push 0
push eax
call fcn.0041be10
push 0xfe
lea ecx, [esp + 0x228]
push 0
push ecx
call fcn.0041be10
push 0xfe
lea edx, [esp + 0x134]
push 0
push edx
call fcn.0041be10
push 0x88
lea eax, [esp + 0x30]
push 0
push eax
call fcn.0041be10
push 0x88
lea ecx, [esp + 0xc4]
push 0
push ecx
call fcn.0041be10
push 0x5c
push ebx
call fcn.004010eb
add esp, 0x44
add eax, 2
push eax
lea edx, [esp + 0x31c]
push 0x100
push edx
call fcn.0041c1b5
add esp, 0xc
lea eax, [esp + 0x218]
push eax
push 0x7f
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4101e8
push edi
push 0x104
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [esp + 0x31c]
push eax
lea ecx, [esp + 0x120]
push 0x7f
push ecx
call fcn.0041c1b5
add esp, 0xc
push 0
lea edx, [esp + 0x10]
push edx
push esi
call sub.LZ32.dll_LZOpenFileW
mov esi, eax
push 0x1000
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x124]
push ecx
call sub.LZ32.dll_LZOpenFileW
mov edi, eax
push edi
push esi
call sub.LZ32.dll_LZCopy
test eax, eax
jge 0x410328
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x514
ret
push ebp
push esi
mov ebp, 1
call sub.LZ32.dll_LZClose
push edi
call sub.LZ32.dll_LZClose
mov ecx, ebx
lea eax, [esp + 0x120]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x410369
test dx, dx
je 0x410365
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x410369
add eax, 4
add ecx, 4
test dx, dx
jne 0x410343
xor eax, eax
jmp 0x41036e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4103a2
push 0
push ebx
lea edx, [esp + 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x410389
xor ebp, ebp
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4103a2
or dword [0x44fe2c], 2
mov ecx, dword [esp + 0x520]
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x514
ret
Function at 0x41a5b0
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
jmp 0x41a5b0
sub esp, 0xa2c
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0xa28], eax
cmp dword [0x46b138], 1
jne 0x41a5e7
mov eax, 1
mov ecx, dword [esp + 0xa28]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xa2c
ret
push esi
push edi
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0041be10
push 0x410
push 0
push 0x4781d8
call fcn.0041be10
push 0x410
lea ecx, [esp + 0x22c]
push 0
push ecx
call fcn.0041be10
push 0x410
lea edx, [esp + 0x648]
push 0
push edx
call fcn.0041be10
mov eax, dword [0x486308]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0x30
test eax, eax
jne 0x41a71e
push 0x45e730
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x45e730
push 0x4781d8
call edi
push 0x435bfc
push 0x4781d8
call esi
push 0x4781b0
push 0x4781d8
call esi
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x4781d8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [0x486308], eax
jne 0x41a71e
mov ecx, dword [0x486304]
push 0x100
lea eax, [esp + 0x214]
push eax
push 0x452
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x44fc20
lea edx, [esp + 0x214]
push edx
lea eax, [esp + 0x628]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
lea ecx, [esp + 0x630]
push ecx
push 0
call fcn.004010be
mov edx, dword [0x486308]
add esp, 0x18
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xa28]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xa2c
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x478e2c], 1
jne 0x41a739
call fcn.004011d6
cmp dword [0x486308], 0
je 0x41a7f2
push 0x44fc20
call fcn.00401208
add esp, 4
push 0x46b190
lea eax, [esp + 0xc]
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 8]
push ecx
call edi
cmp word [esp + eax*2 + 6], 0x5c
je 0x41a780
push 0x435bfc
lea edx, [esp + 0xc]
push edx
jmp 0x41a7a7
lea eax, [esp + 8]
push eax
call edi
lea ecx, [esp + eax*2 + 6]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.00401113
add esp, 8
test eax, eax
jne 0x41a7a9
push 0x435bfc
lea eax, [esp + 0xc]
push eax
call esi
push 0x44fc20
lea ecx, [esp + 0xc]
push ecx
call esi
mov edx, dword [0x486308]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea eax, [esp + 0xc]
push eax
push 0x4781d8
mov dword [0x486308], 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x4781d8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 8]
call fcn.0040c9a0
cmp dword [0x478e20], 0
je 0x41a812
cmp word [0x450c58], 0
je 0x41a812
push 0x450c58
call fcn.00401212
add esp, 4
mov ecx, dword [esp + 0xa30]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0xa2c
ret
Function at 0x41bdf4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e1b4]
jne 0x41bdfe
repz ret
jmp fcn.0041d43c

Function at 0x421804
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x44ea90]
je 0x42181f
inc edi
cmp edi, 0x17
jb 0x421810
cmp edi, 0x17
jae 0x42199f
push ebp
push 3
call fcn.0042a357
cmp eax, 1
pop ecx
je 0x42196b
push 3
call fcn.0042a357
test eax, eax
pop ecx
jne 0x421853
cmp dword [0x44e1c0], 1
je 0x42196b
cmp ebx, 0xfc
je 0x42199e
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x491898
push ebp
call fcn.0041cd94
add esp, 0xc
test eax, eax
je 0x421889
push esi
push esi
push esi
push esi
push esi
call fcn.0041d991
add esp, 0x14
push 0x104
mov esi, 0x4918b1
push esi
push 0
mov byte [0x4919b5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4218cd
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0041cd94
add esp, 0xc
test eax, eax
je 0x4218cd
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0041d991
add esp, 0x14
push esi
call fcn.00425ed0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x421912
push esi
call fcn.00425ed0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x491bac
push 0x437df4
sub ecx, eax
push ecx
push eax
call fcn.004255e6
add esp, 0x14
test eax, eax
je 0x421912
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0041d991
add esp, 0x14
jmp 0x421914
xor esi, esi
push 0x437df0
push ebx
push ebp
call fcn.00425526
add esp, 0xc
test eax, eax
je 0x421934
push esi
push esi
push esi
push esi
push esi
call fcn.0041d991
add esp, 0x14
push dword [edi*8 + 0x44ea94]
push ebx
push ebp
call fcn.00425526
add esp, 0xc
test eax, eax
je 0x421956
push esi
push esi
push esi
push esi
push esi
call fcn.0041d991
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0042a19a
add esp, 0xc
jmp 0x42199e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x42199e
cmp ebp, 0xffffffff
je 0x42199e
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x44ea94]
push dword [esi]
call fcn.00425ed0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x42a19a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0041f5f7
xor ebx, ebx
cmp dword [0x491d08], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x42a270
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x42a350
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x42a350
push eax
call fcn.0041f589
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x491d08], eax
call esi
push eax
call fcn.0041f589
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x491d0c], eax
call esi
push eax
call fcn.0041f589
mov dword [0x491d10], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042146f
test eax, eax
pop ecx
pop ecx
je 0x42a23e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041d991
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x42a270
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0041f589
cmp eax, ebx
pop ecx
mov dword [0x491d18], eax
je 0x42a270
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041f589
pop ecx
mov dword [0x491d14], eax
mov eax, dword [0x491d14]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x42a2f5
cmp dword [0x491d18], ecx
je 0x42a2f5
push eax
call fcn.0041f600
push dword [0x491d18]
mov esi, eax
call fcn.0041f600
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x42a2f5
cmp edi, ebx
je 0x42a2f5
call esi
cmp eax, ebx
je 0x42a2c2
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42a2c2
test byte [ebp - 0x18], 1
jne 0x42a2f5
lea eax, [ebp - 0x10]
push eax
call fcn.0042151e
test eax, eax
pop ecx
je 0x42a2dd
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041d991
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x42a2ec
or dword [ebp + 0x10], 0x200000
jmp 0x42a330
or dword [ebp + 0x10], 0x40000
jmp 0x42a330
mov eax, dword [0x491d0c]
cmp eax, dword [ebp - 8]
je 0x42a330
push eax
call fcn.0041f600
cmp eax, ebx
pop ecx
je 0x42a330
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42a330
mov eax, dword [0x491d10]
cmp eax, dword [ebp - 8]
je 0x42a330
push eax
call fcn.0041f600
cmp eax, ebx
pop ecx
je 0x42a330
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x491d08]
call fcn.0041f600
cmp eax, ebx
pop ecx
je 0x42a350
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42a352
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401bc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
je 0x401bd7
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
ja 0x401bdc
or eax, 0xffffffff
jmp 0x401c4f
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0
je 0x401bed
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
jmp 0x401c4f
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 4], 0
jne 0x401c4c
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
cmp ecx, dword [ebp - 4]
jae 0x401c36
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov byte [ecx + eax], 0
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401a50
add esp, 8
xor eax, eax
jmp 0x401c4f
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 0xc

Function at 0x401c60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jle 0x401c75
cmp dword [ebp + 0xc], 0
jne 0x401c7a
or eax, 0xffffffff
jmp 0x401cf1
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040fead
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x401c9c
mov eax, 0xfffffffe
jmp 0x401cf1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040fb70
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00401a50
add esp, 8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
push 3
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0040f9de
add esp, 4
mov eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402670
Capabilities:
Check if file exists
Create directory
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa2c
mov eax, dword [0x420070]
xor eax, ebp
mov dword [ebp - 8], eax
push 0
call fcn.0040ffe7
add esp, 4
push eax
call fcn.0040ffb8
add esp, 4
push 0x104
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
je 0x40271c
lea ecx, [ebp - 0x628]
push ecx
call fcn.0040f9f0
add esp, 4
movsx edx, byte [ebp + eax - 0x629]
cmp edx, 0x5c
je 0x4026dc
push 0x41a614
lea eax, [ebp - 0x628]
push eax
call fcn.0040fed0
add esp, 8
call fcn.0040ffc5
cdq
mov ecx, 0x1f40
idiv ecx
add edx, 0x3f2
push edx
lea edx, [ebp - 0x628]
push edx
push str._s_d
lea eax, [ebp - 0x518]
push eax
call fcn.0041005f
add esp, 0x10
lea ecx, [ebp - 0x518]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4026dc
mov dword [ebp - 0x51c], 0x400
lea edx, [ebp - 0x40c]
push edx
push 0xf003f
push 0
mov eax, dword [0x420c00]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x520], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x520], 0
je 0x4027e5
lea ecx, [ebp - 0x518]
push ecx
push 0x420c60
call fcn.0040fec0
add esp, 8
lea edx, [ebp - 0x40c]
push edx
mov eax, dword [0x420c00]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x4027e0
lea ecx, [ebp - 0x518]
push ecx
call fcn.0040f9f0
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x518]
push eax
call fcn.00401a50
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x518]
push edx
push 3
push 0
push 0x41a620
mov eax, dword [ebp - 0x40c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4028c0
mov dword [ebp - 0xa2c], 0x3ff
mov dword [ebp - 0xa2c], 0x400
lea ecx, [ebp - 0xa2c]
push ecx
lea edx, [ebp - 0xa28]
push edx
push 0
push 0
push 0x41a624
mov eax, dword [ebp - 0x40c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x402866
mov ecx, dword [ebp - 0xa2c]
mov byte [ebp + ecx - 0xa28], 0
mov edx, dword [ebp - 0xa2c]
push edx
lea eax, [ebp - 0xa28]
push eax
call fcn.00401a50
add esp, 8
lea ecx, [ebp - 0xa28]
push ecx
push 0x420c60
call fcn.0040fec0
add esp, 8
jmp 0x4028c0
lea edx, [ebp - 0x518]
push edx
push 0x420c60
call fcn.0040fec0
add esp, 8
lea eax, [ebp - 0x518]
push eax
call fcn.0040f9f0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x518]
push edx
call fcn.00401a50
add esp, 8
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x518]
push ecx
push 3
push 0
push 0x41a628
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x40c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x420c60
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4028e9
push 0
push 0x420c60
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00410051
mov esp, ebp
pop ebp
ret
Function at 0x402950
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x403e50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004102b0
mov eax, dword [0x420070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, dword [0x420050]
ja 0x403ec2
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x100c], ecx
push 0x1000
push 0
lea edx, [ebp - 0x1008]
push edx
call fcn.004100c0
add esp, 0xc
mov eax, dword [ebp - 0x100c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x1008]
push edx
call fcn.0041024a
add esp, 0xc
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov dword [ebp - 0x100c], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410051
mov esp, ebp
pop ebp
ret
Function at 0x405a20
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
cmp dword [ebp + 8], 0
je 0x405a35
cmp dword [ebp + 0xc], 0
jg 0x405a3c
xor eax, eax
jmp 0x405b66
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0xc]
push eax
push 9
push 0
push 0x41a8ac
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405aa7
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405a9d
mov eax, 1
jmp 0x405b66
mov eax, 2
jmp 0x405b66
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x405af0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405ae9
mov eax, 1
jmp 0x405b66
mov eax, 3
jmp 0x405b66
push 0x100
call fcn.0040fead
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x405b42
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.00405b70
test eax, eax
jne 0x405b37
xor eax, eax
jmp 0x405b66
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x405b06
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.0040f9de
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], eax
mov eax, 2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405b70
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x420070]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x42c], ecx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov eax, dword [ebp + 8]
push eax
push 0x41a8f0
lea ecx, [ebp - 0x428]
push ecx
call fcn.0041005f
add esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0x208
lea edx, [ebp - 8]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x428]
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405bf6
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405bef
mov eax, 1
jmp 0x405c47
mov eax, 2
jmp 0x405c47
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push str.ProxyServer
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x405c24
mov eax, 2
jmp 0x405c47
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp - 0x42c]
call fcn.00405c60
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00410051
mov esp, ebp
pop ebp
ret 4