joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422440
Capabilities:
Get mac address on windows

Disassembly:
push ebp
push edi
xor ebp, ebp
xor edi, edi
cmp dword [esp + 0x10], 8
jl 0x422508
push ebx
mov dword [esp + 0x14], 0x288
xor ebx, ebx
push esi
lea ecx, [ecx]
mov eax, dword [esp + 0x18]
push eax
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x4224a0
mov ecx, dword [esp + 0x18]
push ecx
push 0
push esi
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
mov edi, eax
cmp edi, 0x6f
jne 0x4224a8
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
xor esi, esi
add ebx, 1
cmp ebx, 2
jl 0x422460
test edi, edi
jne 0x4224f9
test esi, esi
mov edi, esi
je 0x422506
mov ebx, dword [sym.imp.MSVCR80.dll__strnicmp]
jmp 0x4224c0
push 6
lea eax, [edi + 0x10c]
push str.vmware
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x4224df
mov edi, dword [edi]
test edi, edi
jne 0x4224c0
jmp 0x4224f9
mov ecx, dword [edi + 0x194]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov edx, dword [edi + 0x198]
mov dword [eax + 4], edx
mov ebp, 1
test esi, esi
je 0x422506
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
ret 8

Function at 0x422510
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x42257a
cmp dword [esp + 0xc], 0
je 0x42257a
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x422579
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x422530
sub eax, edx
push edi
mov edi, eax
xor ecx, ecx
test edi, edi
jle 0x422578
sub ebx, ebp
push esi
jmp 0x422550
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [edx + edx*4]
mov edx, ecx
sub edx, eax
mov eax, dword [esp + 0x18]
mov dl, byte [eax + edx*4]
lea esi, [ecx + ebp]
xor dl, byte [ebx + esi]
add ecx, 1
cmp ecx, edi
mov byte [esi], dl
jl 0x422550
pop esi
pop edi
pop ebp
pop ebx
ret
Function at 0x4225b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
lea eax, [esp + 4]
push eax
push 0x20019
xor edi, edi
push edi
push str.SOFTWAREkingsoftAntivirus
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x422658
push esi
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push esi
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x18]
push str.ProgramPath
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0x204
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422657
cmp dword [esp + 0xc], 1
jne 0x422657
cmp dword [esp + 0x10], 6
jb 0x422657
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422620
sub eax, edx
sar eax, 1
movzx eax, word [esi + eax*2 - 2]
cmp ax, 0x5c
je 0x422652
cmp ax, 0x2f
je 0x422652
lea ecx, [esp + 0x18]
push 0x4b43f8
push ecx
call fcn.00421a10
add esp, 8
mov edi, 1
pop esi
mov eax, dword [esp + 4]
test eax, eax
je 0x422667
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
add esp, 0xc
ret

Function at 0x423a40
Capabilities:
Initialize winsock library

Disassembly:
push ebx
xor eax, eax
push esi
mov esi, ecx
lea ecx, [esi + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
xor ebx, ebx
mov dword [ecx + 0x14], eax
call fcn.0040aad0
cmp eax, ebx
jge 0x423a6b
push eax
call fcn.004011d0
lea ecx, [esi + 0x28]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.0040aad0
cmp eax, ebx
jge 0x423a90
push eax
call fcn.004011d0
mov dword [esi], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x40], 0xffffffff
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x2710
cmp dword [0x4dd6f0], ebx
je 0x423acd
push 0x4dd560
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x4dd6f0], eax
mov eax, esi
pop esi
pop ebx
ret

Function at 0x423b40
Capabilities:
Set registry value

Disassembly:
push ecx
push edi
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.CLSID9B7A98EC_7EF9_468c_ACC8_37C793DBD7E0Implemented_CategoriesA5F7140E_4311_4ef9_AABC_F55941B5EBE5
push SysReAllocString
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x423baa
mov edi, dword [esp + 4]
test edi, edi
je 0x423bb9
mov edx, dword [esp + 0xc]
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423b84
sub eax, esi
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push edx
push 1
push 0
push str.svrid
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
mov eax, dword [esp + 4]
test eax, eax
je 0x423bb9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ecx
ret 4
Function at 0x424820
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4dffd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
test eax, eax
push ebx
push esi
lea esi, [ecx + 4]
push edi
mov dword [ebp - 0x18], esi
je 0x42484d
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov dword [esi], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
call dword [0x4e0000]
mov edi, dword [ebp + 8]
xor ebx, ebx
test edi, edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
jne 0x424899
mov dword [ebp - 0x10], ebx
jmp 0x424902
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
add eax, 1
cdq
push 2
push edx
push eax
call fcn.0048e620
mov esi, eax
add eax, 0x80000000
adc edx, ebx
mov dword [ebp - 0x10], edx
jne 0x4248c2
cmp eax, 0xffffffff
jbe 0x4248c7
mov dword [ebp - 0x10], ebx
jmp 0x424902
cmp esi, 0x400
jg 0x4248e7
push esi
call fcn.00423230
add esp, 4
test al, al
je 0x4248e7
mov eax, esi
call fcn.0048e990
mov eax, esp
jmp 0x4248f3
push esi
lea ecx, [ebp - 8]
call fcn.004246f0
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
push ecx
push esi
push edi
push eax
call fcn.00421a90
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x42490d
xor eax, eax
jmp 0x424973
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
add eax, 1
cdq
push 2
push edx
push eax
call fcn.0048e620
mov esi, eax
add eax, 0x80000000
adc edx, 0
mov dword [ebp - 0x3c], edx
jne 0x424937
cmp eax, 0xffffffff
jbe 0x42493b
xor eax, eax
jmp 0x424973
cmp esi, 0x400
jg 0x42495b
push esi
call fcn.00423230
add esp, 4
test al, al
je 0x42495b
mov eax, esi
call fcn.0048e990
mov eax, esp
jmp 0x424967
push esi
lea ecx, [ebp - 8]
call fcn.004246f0
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
push edx
push esi
push edi
push eax
call fcn.00421a90
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x42499c
test eax, eax
je 0x42499c
mov edx, dword [ebp - 0x18]
push edx
lea edx, [ebp - 0x38]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.004177c0
mov eax, esi
jmp 0x4249c1
push 8
call dword [sym.imp.WS2_32.dll_WSASetLastError]
test ebx, ebx
je 0x4249be
mov esi, dword [sym.imp.MSVCR80.dll_free]
mov edi, edi
mov eax, ebx
mov ebx, dword [ebx]
push eax
call esi
add esp, 4
test ebx, ebx
jne 0x4249b0
or eax, 0xffffffff
lea esp, [ebp - 0x4c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e5b2
mov esp, ebp
pop ebp
ret 0x18
Function at 0x425c90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [ecx]
push ebx
push ebp
xor edx, edx
cmp eax, edx
push esi
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
je 0x425d6e
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x28]
push ecx
push edx
push ebx
push eax
call ebp
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x425cdb
cmp eax, 2
jne 0x425d6e
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.00404810
mov ecx, dword [esi]
mov eax, dword [esp + 0x10]
sub ecx, 0x10
shr eax, 1
mov edx, 1
sub edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
add eax, 1
sub ecx, eax
or edx, ecx
jge 0x425d0d
push eax
mov ecx, esi
call fcn.00404a00
mov edi, dword [esi]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
mov edx, dword [ecx]
push edi
lea eax, [esp + 0x28]
push eax
push 0
push ebx
push edx
call ebp
test eax, eax
jne 0x425d6e
mov eax, dword [esp + 0x10]
shr eax, 1
mov word [edi + eax*2], 0
mov edx, dword [esi]
test edx, edx
jne 0x425d40
xor eax, eax
jmp 0x425d56
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x425d45
sub eax, edi
sar eax, 1
js 0x425d7c
cmp eax, dword [edx - 8]
jg 0x425d7c
mov dword [edx - 0xc], eax
mov ecx, dword [esi]
mov word [ecx + eax*2], 0
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
push 0x80070057
call fcn.004011d0
int3
Function at 0x427ef0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4aa9a1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0
call fcn.004079b0
mov edx, dword [0x500de4]
mov eax, dword [edx + 0xc]
mov ebx, 1
mov ecx, 0x500de4
mov dword [esp + 0x24], ebx
call eax
mov esi, dword [esp + 0x2c]
add eax, 0x10
mov dword [esi], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx - 0xc]
test eax, eax
mov dword [esp + 0x10], ebx
jl 0x428072
mov ebp, dword [sym.imp.MSVCR80.dll_wcsstr]
push str.success1
push ecx
call ebp
add esp, 8
test eax, eax
je 0x42806e
mov ecx, dword [esp + 0x30]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x428072
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
call fcn.00425b20
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 2
call fcn.00405e10
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x24], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x427fd9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
cmp dword [ecx - 0xc], 0
jl 0x428072
push 0x4b6e84
push ecx
call ebp
add esp, 8
test eax, eax
je 0x42806e
mov ecx, dword [esp + 0x30]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x428072
mov ecx, dword [ecx - 0xc]
add ecx, 0xfffffffa
push ecx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
call fcn.004262d0
push eax
mov ecx, esi
mov byte [esp + 0x28], 3
call fcn.00405e10
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x24], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x428049
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
call fcn.00426360
mov ecx, eax
call fcn.004263c0
mov eax, dword [esi]
mov ecx, dword [esp + 0x18]
push eax
call fcn.00426f30
test eax, eax
jne 0x42806e
mov ecx, esi
call fcn.00404810
mov ecx, dword [esp + 0x30]
lea eax, [ecx - 0x10]
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428093
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x42a8b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4aacd1
mov eax, dword fs:[0]
push eax
mov eax, 0x36c0
call fcn.0048e800
mov eax, dword [0x4dffd0]
xor eax, esp
mov dword [esp + 0x36bc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x36d4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x36e4]
mov esi, dword [esp + 0x36e8]
xor ebx, ebx
mov eax, 0x1000
lea ecx, [esp + 0x160]
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x2c], 0xb
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0x4b66bc
mov word [esp + 0x48], 0x50
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], 0x2710
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call fcn.004289f0
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
mov dword [esp + 0x36dc], ebx
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
lea eax, [esp + 0x1c]
push eax
push ebp
lea ecx, [esp + 0x168]
mov byte [esp + 0x36e4], 1
mov dword [esp + 0x28], 0x4b6f70
call fcn.0042a810
test al, al
je 0x42aa54
cmp dword [esp + 0x36ac], 0xc8
jne 0x42aa54
mov edx, dword [esp + 0x36b8]
mov eax, dword [esp + 0x1228]
mov ecx, dword [esp + 0x36b4]
add eax, edx
add eax, dword [esp + 0x36bc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00405b80
push ebx
push 0x4b6f6c
lea ecx, [esp + 0x1c]
call fcn.00405b80
lea ecx, [esp + 0x60]
mov dword [esp + 0x5c], ecx
call dword [0x4e0000]
mov edi, dword [esp + 0x14]
push eax
push edi
lea ecx, [esp + 0x64]
call fcn.00404950
mov edx, dword [esp + 0x5c]
push edx
mov ecx, esi
mov byte [esp + 0x36e0], 2
call fcn.00406d50
mov eax, dword [esp + 0x5c]
lea ecx, [esp + 0x60]
cmp eax, ecx
mov byte [esp + 0x36dc], 1
je 0x42aa42
push eax
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov ecx, esi
call fcn.00426360
mov ecx, eax
call fcn.004263c0
xor esi, esi
jmp 0x42aa58
mov esi, dword [esp + 0x18]
add edi, 0xfffffff0
mov byte [esp + 0x36dc], bl
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x42aa7b
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
lea ecx, [esp + 0x160]
mov dword [esp + 0x36dc], 0xffffffff
call fcn.00428480
mov eax, esi
mov ecx, dword [esp + 0x36d4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x36bc]
xor ecx, esp
call fcn.0048e5b2
add esp, 0x36cc
ret 8
Function at 0x42b220
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x248
mov eax, dword [0x4dffd0]
xor eax, esp
mov dword [esp + 0x244], eax
push 0x3c
lea eax, [esp + 4]
push 0
push eax
call sub.MSVCR80.dll_memset
push 0x206
lea ecx, [esp + 0x4e]
push 0
push ecx
mov word [esp + 0x54], 0
call sub.MSVCR80.dll_memset
add esp, 0x18
push 0x104
lea edx, [esp + 0x40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], str.runas
mov dword [esp + 0x14], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42b2a8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.0048e5b2
add esp, 0x248
ret

Function at 0x42b2e0
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
push str.F10BD1D0_329F_4a9e_A5DB_8F0804C70C55
mov ebx, 1
push ebx
push 0
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42b316
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov dword [edi + 0x60], esi
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x42b320
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
push str.DB503150_EDBC_4337_AD4D_23CD7208B769
mov ebx, 1
push ebx
push 0
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42b356
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov dword [edi + 0x64], esi
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x42b720
Capabilities:
Create thread

Disassembly:
push 0x18
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
jne 0x42b72f
ret
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x10]
push 0
push 0
push eax
push 0x42b4b0
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x1c]
push 0
push 0
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
ret
Function at 0x42b810
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
push edi
mov dword [esp + 0x1c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], SysStringLen
xor edi, edi
mov edx, dword [esp + edi*4 + 0x1c]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
push edx
mov dword [esp + 0x34], 0
call ebp
test eax, eax
jne 0x42b88e
mov esi, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.ksearch.exe
push esi
mov dword [esp + 0x2c], 0x2af8
call ebx
test esi, esi
je 0x42b88e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 1
cmp edi, 2
jb 0x42b835
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x42b8a0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4aae5b
mov eax, dword fs:[0]
push eax
sub esp, 0x67c
mov eax, dword [0x4dffd0]
xor eax, esp
mov dword [esp + 0x678], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x690]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6a4]
mov ecx, dword [esp + 0x6ac]
mov ebx, dword [esp + 0x6a0]
mov esi, dword [esp + 0x6a8]
xor ebp, ebp
push 0x206
lea edx, [esp + 0x7a]
push ebp
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov edi, 0x80004005
mov word [esp + 0x80], bp
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp esi, ebp
je 0x42ba48
push 0x104
lea eax, [esp + 0x78]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x42ba48
push 0x40e
lea ecx, [esp + 0x282]
push ebp
push ecx
mov word [esp + 0x288], bp
call sub.MSVCR80.dll_memset
push 0x44
lea edx, [esp + 0x40]
push ebp
push edx
call sub.MSVCR80.dll_memset
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
push esi
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x29c]
push str.__s___Automation__s
push ecx
mov dword [esp + 0x58], 0x44
call fcn.0042b490
add esp, 0x28
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x29c]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [esp + 0x24]
cmp eax, ebp
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x42b9d2
push eax
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x42b9dd
push eax
call esi
mov dword [esp + 0x14], ebp
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.ole32.dll_CoGetClassObject]
mov dword [esp + 0x698], ebp
push 1
call esi
lea edx, [esp + 0x14]
push edx
push 0x4c3134
push ebp
push 4
push ebx
call edi
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x42b9f4
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push edx
mov edx, dword [esp + 0x20]
push 0x4c30a4
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x698], 0xffffffff
je 0x42ba44
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
jmp 0x42ba4a
mov eax, edi
mov ecx, dword [esp + 0x690]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.0048e5b2
add esp, 0x688
ret
Function at 0x42dc50
Capabilities:
Accept command line arguments

Disassembly:
push ecx
cmp byte [0x4e0418], 0
push esi
mov esi, ecx
je 0x42dc65
or eax, 0xffffffff
pop esi
pop ecx
ret 4
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 4]
push ecx
push eax
mov ecx, esi
call fcn.0042d5a0
cmp eax, 1
jne 0x42dcb6
mov edx, dword [esp + 0xc]
push edx
mov ecx, esi
call fcn.0042db00
test eax, eax
jne 0x42dca8
mov ecx, esi
call fcn.0042c530
mov ecx, esi
call fcn.0042b4e0
pop esi
pop ecx
ret 4
jl 0x42dcba
mov ecx, esi
call fcn.0042b4e0
pop esi
pop ecx
ret 4
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4

Function at 0x4309e0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x94]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x430acd
cmp dword [esp + 0xc], 0
push ebx
je 0x430a79
push edi
lea edi, [esi + 0x90]
push 1
mov ecx, edi
mov dword [esi + 0xd0], 0x5a
call fcn.0042fb80
cmp dword [edi + 0x44], 0
mov ebx, dword [sym.imp.USER32.dll_SetTimer]
jne 0x430a35
mov ecx, dword [edi + 4]
push 0
push 0x1e
push 0x64
push ecx
call ebx
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], 0
mov edx, dword [esi + 0x94]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0xf8], 0
mov dword [esi + 0x80], 2
pop edi
jne 0x430ab4
mov eax, dword [esi + 4]
push 0
push 0x1f4
push 0x12e
push eax
call ebx
mov dword [esi + 0xf8], eax
jmp 0x430ab4
mov ecx, dword [esi + 0x94]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0xf8], 0
mov dword [esi + 0x80], 0
je 0x430ab4
mov edx, dword [esi + 4]
push 0x12e
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0xf8], 0
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
mov ecx, esi
call fcn.0042fcd0
pop ebx
xor eax, eax
pop esi
ret 0x10
mov dword [esi + 0x80], 0
xor eax, eax
pop esi
ret 0x10