joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x404a5d
pop dword [ebp - 0x34]
mov eax, 0x630f3c00
sub eax, 0x62cef1a3
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3fc75
push 0
mov eax, 0x5d7d7f48
add eax, 0xa2c4d2d0
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x7d0cc692
sub ecx, 0x7d0c76b2
mov edi, eax
mov edx, 0x129c6a34
add edx, 0xeda6e9cc
add edx, dword [ebp - 0x34]
mov esi, 0x83753961
sub esi, 0x3b82c318
sub dword [ebp - 8], 0xcf0ac298
mov ebx, dword [edx]
xor dword [ebp - 8], eax
sub ebx, esi
xor dword [ebp - 0x1c], ecx
mov dword [edi], ebx
add dword [ebp - 0x14], eax
add edi, 4
add edx, 0x510068f8
sub edx, 0x510068f4
loop 0x404abc
add eax, 0x13253
xor ebx, ebx
add ebx, eax
add eax, 0xbbd630b8
add eax, 0x4429cf4d
mov ecx, 0x2591d6e6
add ecx, 0xdaae291a
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x10032346
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x10032389
call fcn.10025ea4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
je 0x10032389
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x100323a4
push edi
call dword [sym.imp.kernel32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.1001f5ee
test ebx, ebx
mov esi, eax
je 0x100323a2
test edi, edi
je 0x100323a2
push edi
call dword [sym.imp.kernel32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x1003bf37
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x1003bf57
cmp dword [edi + 0x54], 0
jne 0x1003bf57
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.10025ea4
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1003befe
push ebx
mov esi, eax
call dword [sym.imp.kernel32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x10040165
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1008a740]
jne 0x1004016f
repz ret
jmp fcn.100475c4
Function at 0x1001ca50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001caeb
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001caa2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001caa2
cmp esi, ebx
jge 0x1001caa2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001cae5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001cae5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e0]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e0]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001cafd
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x1001cd20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
mov eax, dword [ebp + 8]
je 0x1001cd48
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cd62
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10001523
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022ac0
leave
ret 4

Function at 0x1001cf30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cf66
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cfc5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10001523
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10001523
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10001523
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022ac0
leave
ret 0x10
Function at 0x1001cfe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d00c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d03d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d03b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10001523
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d03d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022ac0
leave
ret 8
Function at 0x4020d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40211b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402114
test esi, esi
je 0x402114
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020f0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402300
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402350
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402428
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40238e
cmp eax, 4
jne 0x4023b0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40239e
cmp edx, 4
je 0x40239e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402300
Function at 0x402610
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.SHELL32.DLL_CommandLineToArgvW]
sub esp, 8
test eax, eax
je 0x40271f
mov edi, eax
mov eax, dword [esp + 0x2c]
lea ebx, [eax*4 + 4]
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x14], eax
call eax
mov dword [esp + 8], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov dword [esp + 0x1c], eax
call eax
sub esp, 0xc
mov dword [esp + 0x18], eax
test eax, eax
je 0x40271f
mov edx, dword [esp + 0x2c]
test edx, edx
jle 0x402757
xor ebp, ebp
jmp 0x4026e7
mov dword [esp], eax
call sym._SDL_strlen
mov ebx, eax
mov eax, dword [esp + 0x14]
call eax
lea ecx, [ebx + 1]
mov dword [esp + 4], 8
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call eax
sub esp, 0xc
mov edx, dword [esp + 0x18]
mov dword [edx + ebp*4], eax
test eax, eax
je 0x40271f
mov dword [esp + 8], ebx
add ebp, 1
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._SDL_memcpy
mov dword [esp], esi
call sym._SDL_free
cmp dword [esp + 0x2c], ebp
jle 0x402750
mov eax, dword [edi + ebp*4]
mov dword [esp], eax
call sym._SDL_wcslen
lea eax, [eax + eax + 2]
mov dword [esp + 0xc], eax
mov eax, dword [edi + ebp*4]
mov dword [esp + 4], str.UTF_16LE
mov dword [esp + 8], eax
mov dword [esp], str.UTF_8
call sym._SDL_iconv_string
mov esi, eax
test eax, eax
jne 0x402690
mov dword [esp + 0xc], 0
xor edi, edi
mov dword [esp + 8], str.Out_of_memory___aborting
mov dword [esp + 4], str.Fatal_Error
mov dword [esp], 0x10
call sym._SDL_ShowSimpleMessageBox
add esp, 0x3c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x18]
lea eax, [eax + ebp*4]
mov dword [eax], 0
xor ebx, ebx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
call sym._SDL_SetMainReady
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dbg.SDL_main
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, eax
mov eax, dword [esp + 0x2c]
test eax, eax
jle 0x4027cb
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x1c], edi
mov edi, ebx
nop
mov ebx, dword [ebp + edi*4]
mov eax, dword [esp + 0x14]
add edi, 1
call eax
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov dword [esp], eax
call esi
sub esp, 0xc
cmp dword [esp + 0x2c], edi
jg 0x4027a0
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
call eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], ecx
call esi
mov eax, edi
sub esp, 0xc
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404460
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call sym.___main
call sym._GetCommandLineA_0
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._GetStartupInfoA_4
sub esp, 4
test ebx, ebx
jne 0x404496
jmp 0x4044ce
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x404493
cmp al, 9
je 0x404493
cmp al, 0x22
jne 0x4044b7
jmp 0x404516
cmp al, 9
je 0x4044c3
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x4044b0
jmp 0x4044c3
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x4044c0
cmp al, 9
je 0x4044c0
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x4044dd
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test al, al
je 0x404522
mov edx, ebx
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x22
jne 0x404512
cmp al, 0x22
jne 0x4044c3
lea ebx, [edx + 2]
jmp 0x4044c3
Function at 0x401321
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0xfb8]
mov eax, 0x1038
call fcn.004105e0
mov eax, dword [0x43cddc]
xor eax, ebp
mov dword [ebp + 0xfb4], eax
push edi
mov edi, dword [ebp + 0xfc0]
lea eax, [ebp - 0x7c]
push eax
call fcn.004102c3
pop ecx
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
jne 0x401366
push 5
call fcn.00409a61
pop ecx
jmp 0x401452
push esi
call fcn.004082d1
push eax
push 0x5c
call fcn.00408c45
push eax
push 0x4360e8
mov esi, 0x400
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00408299
push dword [ebp - 0x7c]
lea eax, [ebp + 0x7ac]
push 0x4360f8
push esi
push eax
call fcn.00408299
and dword [ebp - 0x64], 0
lea eax, [ebp + 0x7ac]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
mov dword [ebp - 0x74], str.JavaWSSplashScreen
mov dword [ebp - 0x70], 0x436128
mov dword [ebp - 0x68], edi
call fcn.004102c3
add esp, 0x34
test eax, eax
jne 0x401449
mov word [ebp - 0x64], ax
lea edi, [ebp - 0x62]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401401
push 6
jmp 0x40144b
push 0
push 6
lea eax, [ebp + 0xfac]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 6
je 0x40141c
push 7
jmp 0x40144b
lea eax, [ebp + 0xfac]
push eax
call fcn.004102c3
pop ecx
mov dword [0x4360e0], eax
test eax, eax
jg 0x401436
push 8
jmp 0x40144b
push esi
call fcn.00408098
push dword [ebp - 0x78]
call fcn.00408098
pop ecx
xor eax, eax
jmp 0x401450
push 0
call fcn.00409a61
pop ecx
pop esi
mov ecx, dword [ebp + 0xfb4]
xor ecx, ebp
pop edi
call fcn.0040ffe6
add ebp, 0xfb8
leave
ret
Function at 0x406f15
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1198]
mov eax, 0x1218
call fcn.004105e0
mov eax, dword [0x43cddc]
xor eax, ebp
mov dword [ebp + 0x1194], eax
push edi
push 0x437f38
push 0x437f68
push 0xffffffffffffffff
lea eax, [ebp - 0x74]
push 0x1000
push eax
call fcn.004102c3
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x74]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406f77
xor eax, eax
jmp 0x406ffb
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xf8c]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push str.Path
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
test eax, eax
je 0x406fac
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406f70
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], 1
jne 0x406f70
mov eax, dword [esi + 4]
test eax, eax
je 0x406fc6
push eax
call fcn.004102c3
pop ecx
push edi
call fcn.004102c3
lea ecx, [esi + 8]
push ecx
push eax
mov dword [esi + 4], eax
call fcn.00406c53
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x406fe9
push eax
call fcn.004102c3
pop ecx
lea eax, [ebp + 0xf8c]
push eax
call fcn.004102c3
mov dword [esi], eax
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp + 0x1194]
xor ecx, ebp
call fcn.0040ffe6
add ebp, 0x1198
leave
ret
Function at 0x407010
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [0x43cddc]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
mov eax, dword [ebp + 0x1d0]
push ebx
push esi
xor ebx, ebx
push str.FORCED_FX_ROOT
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], 0x1fe
xor esi, esi
mov dword [ebp - 0x6c], ebx
call fcn.004107d9
add esp, 0xc
cmp dword [ebp - 0x6c], ebx
je 0x40709e
cmp eax, ebx
jne 0x40709e
push 0x34
push 1
call fcn.004102c3
push str.2.0
mov esi, eax
call fcn.004102c3
lea ecx, [esi + 8]
push ecx
push eax
mov dword [esi + 4], eax
call fcn.00406c53
push dword [ebp - 0x6c]
call fcn.004102c3
mov dword [esi], eax
push dword [ebp - 0x6c]
call fcn.004102c3
add esp, 0x1c
jmp 0x407159
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push ebx
push str.SoftwareOracleJavaFX
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4070c3
xor eax, eax
jmp 0x40715b
push edi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x40713c
cmp dword [ebp - 0x78], ebx
je 0x4070f8
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x78]
call fcn.00406eb4
pop ecx
pop ecx
jmp 0x4070fb
xor eax, eax
inc eax
cmp eax, ebx
je 0x40713c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00406c53
pop ecx
pop ecx
cmp esi, ebx
je 0x407127
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00406cf7
pop ecx
pop ecx
test eax, eax
je 0x40713c
jmp 0x407134
push 0x34
push 1
call fcn.004102c3
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x3c]
call fcn.00406f15
inc dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x1fe
cmp dword [ebp - 0x80], ebx
je 0x4070c4
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
mov ecx, dword [ebp + 0x1c4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ffe6
add ebp, 0x1c8
leave
ret

Function at 0x4074b6
Capabilities:
Send data
Send data on socket

Disassembly:
cmp dword [esp + 8], 0
jne 0x4074c0
xor eax, eax
ret
mov eax, dword [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4074c7
sub eax, edx
sar eax, 1
push esi
lea esi, [eax + eax + 6]
lea eax, [esi + esi]
push edi
push eax
call fcn.004102c3
mov edi, eax
pop ecx
test edi, edi
je 0x407536
push dword [esp + 0x10]
push str._s_r_n
push esi
push edi
call fcn.00408299
mov eax, edi
add esp, 0x10
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x407504
sub eax, ecx
sar eax, 1
push 0
add eax, eax
push eax
push edi
push dword [esp + 0x18]
call dword [sym.imp.WSOCK32.dll_send]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push edi
mov esi, ecx
call fcn.004102c3
pop ecx
mov eax, esi
pop edi
pop esi
ret
Function at 0x407539
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, 0x44a698
xor ebx, ebx
mov esi, edi
push 0
push 2
push esi
push dword [esp + 0x1c]
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
je 0x407580
test eax, eax
je 0x407584
movzx eax, word [esi]
cmp eax, 0xa
je 0x407584
cmp eax, 0xd
je 0x40756e
inc ebx
add esi, 2
cmp esi, 0x44ae96
jl 0x407545
xor eax, eax
mov word [0x44ae96], ax
jmp 0x40758e
xor eax, eax
jmp 0x407590
xor eax, eax
mov word [ebx*2 + 0x44a698], ax
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x407ff9
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x43cddc]
xor eax, esp
mov dword [esp + 0x190], eax
cmp dword [0x451730], 0
jne 0x408083
push esi
push edi
xor edi, edi
push str.ws2_32.dll
inc edi
call fcn.004102c3
mov esi, eax
pop ecx
test esi, esi
jne 0x40804d
push str.wsock32.dll
call fcn.004102c3
mov esi, eax
xor edi, edi
pop ecx
test esi, esi
jne 0x40804d
push 0xd
call fcn.00409a61
pop ecx
push eax
call fcn.00407f5a
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x408062
push 0xe
jmp 0x408041
test edi, edi
je 0x408077
push str.WSASendDisconnect
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x45172c], eax
pop edi
mov dword [0x451730], 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0040ffe6
add esp, 0x194
ret
Function at 0x408418
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.004105e0
mov eax, dword [0x43cddc]
xor eax, ebp
mov dword [ebp + 0xf94], eax
mov eax, dword [ebp + 0xfa0]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x439880
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x7c], 0x400
mov dword [ebp - 0x70], 1
call esi
test eax, eax
jne 0x408519
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x794]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.CurrentVersion
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40849f
and dword [ebp - 0x70], 0
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4084b0
and dword [ebp - 0x70], 0
lea eax, [ebp + 0x794]
push eax
push str.SoftwareJavaSoftJava_Runtime_Environment
push 0x439874
lea eax, [ebp - 0x6c]
push 0x400
push eax
call fcn.004102c3
add esp, 0x14
lea eax, [ebp - 0x74]
push eax
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
push edi
call esi
test eax, eax
jne 0x408519
lea eax, [ebp + 0xfa4]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x439950
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x408509
mov dword [ebp - 0x70], ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x408519
mov dword [ebp - 0x70], ebx
mov ecx, dword [ebp + 0xf94]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ffe6
add ebp, 0xf98
leave
ret