joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416d10
Capabilities:
Check if file exists
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce1b5
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0xd8], edi
mov dword [ebp - 0xd4], 0
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
cmp eax, ecx
je 0x416d9a
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.004114e0
push 1
push 0x4d4b28
lea ecx, [ebp - 0x28]
call fcn.00411400
cmp edi, eax
je 0x416db9
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.004114e0
push 0xffffffffffffffff
push 0
lea eax, [ebp + 0x28]
mov ecx, edi
push eax
call fcn.004112e0
cmp dword [edi + 0x14], 8
jb 0x416dd2
mov eax, dword [edi]
jmp 0x416dd4
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x416e7a
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x24]
movzx eax, ax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0xa8
mov esi, eax
lea eax, [ebp - 0xd0]
push 0
push eax
call fcn.0047bb20
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x416e3d
mov eax, dword [edi]
jmp 0x416e3f
mov eax, edi
push 1
push 0x40
push 0x20
push eax
lea ecx, [ebp - 0xd0]
call fcn.00416990
push 0
push esi
push ebx
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 4
call fcn.00402b66
lea ecx, [ebp - 0xd0]
call fcn.00416f00
lea ecx, [ebp - 0xd0]
call fcn.004027a9
cmp dword [ebp - 0x14], 8
jb 0x416e8b
push dword [ebp - 0x28]
call fcn.0047a557
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp + 0x20], 8
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
jb 0x416eb0
push dword [ebp + 0xc]
call fcn.0047a557
add esp, 4
xor eax, eax
mov dword [ebp + 0x20], 7
cmp dword [ebp + 0x3c], 8
mov dword [ebp + 0x1c], 0
mov word [ebp + 0xc], ax
jb 0x416ed5
push dword [ebp + 0x28]
call fcn.0047a557
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret 0x38
Function at 0x41a8b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce830
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x30], esi
mov word [esi], ax
push 0x104
lea edi, [esi + 0x18]
mov dword [ebp - 4], eax
push edi
push 0x4d5e00
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp word [edi], 0
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
jne 0x41a931
xor ecx, ecx
jmp 0x41a945
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a936
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.004116f0
push 1
push 0x4d5e10
mov ecx, esi
call fcn.00411400
push dword [ebp - 0x2c]
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.00419070
add esp, 0xc
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004112e0
cmp dword [ebp - 0x34], 8
jb 0x41a98d
push dword [ebp - 0x48]
call fcn.0047a557
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x423410
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf638
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x54], 1
jne 0x42344c
xor al, al
jmp 0x423582
push 0x30
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0047bb20
add esp, 0xc
lea ecx, [ebp - 0x58]
push 1
call fcn.0042c650
push 0
lea eax, [esi + 8]
push eax
lea edi, [esi + 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x423445
push 0
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x423445
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
or dword [ebp - 0x70], 0x100
lea ecx, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 0x9c], 0x44
movdqu xmmword [esi + 0x14], xmm0
mov eax, dword [edi]
push 0x4d6988
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
call fcn.0040f510
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x3c]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x28]
call fcn.004112e0
push 0x4d69a4
lea ecx, [ebp - 0x28]
call fcn.004113b0
mov eax, dword [ebp - 0x18]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004780a0
add esp, 4
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov edi, eax
mov edx, edi
cmovae ecx, dword [ebp - 0x28]
lea ecx, [ecx]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x423520
lea eax, [esi + 0x14]
push eax
lea eax, [ebp - 0x9c]
push eax
push edi
lea ecx, [ebp - 0x58]
call fcn.0042c720
push edi
test eax, eax
je 0x42355c
mov byte [esi + 0x54], 1
call fcn.0047b041
mov byte [ebp - 0x9d], 1
jmp 0x423568
call fcn.0047b041
mov byte [ebp - 0x9d], 0
add esp, 4
cmp dword [ebp - 0x14], 8
jb 0x42357c
push dword [ebp - 0x28]
call fcn.0047a557
add esp, 4
mov al, byte [ebp - 0x9d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x423ea0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4fd004], 0xffffffff
push esi
mov esi, dword [ebp + 8]
je 0x423ee1
push 0xffffffffffffffff
push dword [0x501e10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x501e10]
mov dword [0x4fd004], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0x4e4b28
push 1
push 0
push 0x4e4b68
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x423f92
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.004397c0
mov esi, dword [eax]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x423f22
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
push edx
push 0x4e4ab8
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x423f8a
push 8
call fcn.0047a506
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x423f52
xorps xmm0, xmm0
movq qword [ecx], xmm0
jmp 0x423f54
xor ecx, ecx
mov eax, dword [ebp - 8]
push 0x4fd004
push 0
push ecx
push 0x422950
push 0
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
push 0
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x501e10], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
push eax
call fcn.00407ed0
jmp 0x423f98
push eax
call fcn.00407fa0
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0047b06c
mov esp, ebp
pop ebp
ret

Function at 0x424ee0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0
push 1
push 0
mov edi, ecx
lea eax, [ebp - 8]
push 0
push eax
mov byte [edi + 0x10], 0x34
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x424f33
lea eax, [edi + 0x12]
push eax
push 0xf
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x424f33
mov byte [edi + 0x11], 0x62
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
mov byte [edi + 0x11], 0x61
call fcn.0047ad6e
push eax
call fcn.0047d660
add esp, 8
mov esi, 0xf
mov ebx, 0xff
dec esi
call fcn.0047d63f
cdq
idiv ebx
mov byte [edi + esi + 0x12], dl
test esi, esi
jne 0x424f53
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x424f80
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
mov dword [ebp - 8], 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x424ffe
push esi
push dword [ebp - 8]
call fcn.0047d670
mov esi, eax
add esp, 4
test esi, esi
je 0x424ffd
lea eax, [ebp - 8]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x424ff4
mov eax, esi
lea ecx, [ecx]
cmp dword [eax + 0x1a0], 6
je 0x424fe1
mov eax, dword [eax]
test eax, eax
jne 0x424fd0
jmp 0x424ff4
mov ecx, dword [eax + 0x194]
mov dword [edi], ecx
mov ax, word [eax + 0x198]
mov word [edi + 4], ax
push esi
call fcn.0047ad36
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0047b06c
mov esp, ebp
pop ebp
ret 4

Function at 0x425010
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf880
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00409810
mov edx, eax
mov dword [ebp - 0x40], 7
xor eax, eax
mov dword [ebp - 0x44], 0
mov word [ebp - 0x54], ax
cmp word [edx], ax
jne 0x425060
xor ecx, ecx
jmp 0x425074
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425065
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x54]
call fcn.004116f0
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 0
push eax
call fcn.00413ac0
mov ecx, eax
call fcn.00413b70
mov edx, eax
cmp dword [edx + 0x14], 8
mov byte [ebp - 4], 1
jb 0x4250a3
mov edx, dword [edx]
cmp word [edx], 0
jne 0x4250ad
xor ecx, ecx
jmp 0x4250c1
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4250b2
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x54]
call fcn.00411400
cmp dword [ebp - 0x5c], 8
mov byte [ebp - 4], 0
jb 0x4250e0
push dword [ebp - 0x70]
call fcn.0047a557
add esp, 4
cmp dword [ebp - 0x40], 8
lea ecx, [ebp - 0x58]
push ecx
push 0xf003f
lea eax, [ebp - 0x54]
cmovae eax, dword [ebp - 0x54]
push 0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42514f
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x25
push eax
lea eax, [ebp - 0x38]
push eax
push 0
push 0
call fcn.0040bfd0
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x58]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x42514f
cmp dword [ebp - 0x3c], 0x25
jne 0x42514f
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.00425c40
mov ecx, edi
call fcn.004258f0
cmp dword [ebp - 0x40], 8
jb 0x425160
push dword [ebp - 0x54]
call fcn.0047a557
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x4252f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf8dd
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x9c], edi
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
push 0x64
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x98], 1
call fcn.0047bb20
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
push 0x20019
push 0
call fcn.0040df50
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x425435
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x64
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push 0
call fcn.0040e1b0
push eax
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x425429
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x90]
call fcn.004018a0
cmp dword [ebp - 0x7c], 0x10
lea ecx, [ebp - 0x90]
mov esi, dword [edi + 0x14]
lea ebx, [ebp - 0x90]
cmovae ecx, dword [ebp - 0x90]
add ecx, dword [ebp - 0x80]
cmp dword [ebp - 0x7c], 0x10
mov dword [ebp - 4], 1
cmovae ebx, dword [ebp - 0x90]
cmp esi, 8
jb 0x4253f7
mov edx, dword [edi]
jmp 0x4253f9
mov edx, edi
mov eax, dword [edi + 0x10]
lea eax, [edx + eax*2]
cmp esi, 8
jb 0x425408
mov edx, dword [edi]
jmp 0x42540a
mov edx, edi
push ecx
push ebx
push eax
push edx
mov ecx, edi
call fcn.00413740
cmp dword [ebp - 0x7c], 0x10
jb 0x425429
push dword [ebp - 0x90]
call fcn.0047a557
add esp, 4
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret 4
Function at 0x425740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf97b
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x90], 0
jne 0x4258cf
call fcn.00409810
push eax
lea ecx, [ebp - 0x6c]
call fcn.0040f510
lea eax, [ebp - 0x88]
mov dword [ebp - 4], 0
push eax
call fcn.00413ac0
mov ecx, eax
call fcn.00413b70
mov edx, eax
cmp dword [edx + 0x14], 8
mov byte [ebp - 4], 1
jb 0x4257af
mov edx, dword [edx]
cmp word [edx], 0
jne 0x4257b9
xor ecx, ecx
jmp 0x4257cf
mov ecx, edx
lea esi, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4257c0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x6c]
call fcn.00411400
cmp dword [ebp - 0x74], 8
mov byte [ebp - 4], 0
jb 0x4257f1
push dword [ebp - 0x88]
call fcn.0047a557
add esp, 4
cmp dword [ebp - 0x58], 8
lea ecx, [ebp - 0x6c]
mov eax, dword [ebp - 0x5c]
cmovae ecx, dword [ebp - 0x6c]
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], 0
lea eax, [ecx + eax*2]
mov byte [ebp - 0x54], 0
lea ecx, [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x6c]
push eax
push ecx
lea ecx, [ebp - 0x54]
call fcn.00419300
cmp dword [ebp - 0x40], 0x10
lea ecx, [ebp - 0x70]
push ecx
push 0x20019
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x54]
push 0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42589b
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x25
push eax
lea eax, [ebp - 0x38]
push eax
push 0
push 0
call fcn.00409640
push eax
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x70]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x42589b
cmp dword [ebp - 0x3c], 0x25
jne 0x42589b
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.00425c40
mov byte [edi + 0x90], 1
cmp dword [ebp - 0x40], 0x10
jb 0x4258ac
push dword [ebp - 0x54]
call fcn.0047a557
add esp, 4
cmp dword [ebp - 0x58], 8
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], 0
mov byte [ebp - 0x54], 0
jb 0x4258cf
push dword [ebp - 0x6c]
call fcn.0047a557
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x4258f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf9c8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00409810
mov edx, eax
mov dword [ebp - 0x2c], 7
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp word [edx], ax
jne 0x425940
xor ecx, ecx
jmp 0x425954
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425945
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.004116f0
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
call fcn.00413ac0
mov ecx, eax
call fcn.00413b70
mov edx, eax
cmp dword [edx + 0x14], 8
mov byte [ebp - 4], 1
jb 0x425983
mov edx, dword [edx]
cmp word [edx], 0
jne 0x42598d
xor ecx, ecx
jmp 0x4259a1
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425992
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.00411400
cmp dword [ebp - 0x48], 8
mov byte [ebp - 4], 0
jb 0x4259c0
push dword [ebp - 0x5c]
call fcn.0047a557
add esp, 4
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
mov eax, dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
push dword [ebp - 0x44]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
lea eax, [ecx + eax*2]
mov byte [ebp - 0x28], 0
lea ecx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x40]
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00419300
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x44]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x425a78
lea edx, [edi + 0x21]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x425a31
sub ecx, esi
lea eax, [ecx + 1]
push eax
push edx
push 1
push 0
call fcn.00409640
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x425a6f
push 0
push str.Failed_to_set_UUID
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0x10
jb 0x425a89
push dword [ebp - 0x28]
call fcn.0047a557
add esp, 4
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jb 0x425aac
push dword [ebp - 0x40]
call fcn.0047a557
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x425ad0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfa08
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea eax, [ebp - 0x44]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareAppDataLowSoftwareMicrosoftInternet_ExplorerSecurityAntiPhishing49A01FE2_C7CB_42BD_978A_5B721DC10594
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x425c0d
lea eax, [ebp - 0x5c]
push eax
call fcn.00413ac0
mov ecx, eax
call fcn.00413b70
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 0
jb 0x425b42
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x40]
call fcn.0040f510
cmp dword [ebp - 0x48], 8
jb 0x425b5c
push dword [ebp - 0x5c]
call fcn.0047a557
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
mov eax, dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
mov byte [ebp - 4], 3
lea ecx, [ecx + eax*2]
push ecx
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
push eax
mov ecx, eax
call fcn.00419bb0
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
inc eax
push eax
push ecx
push 3
push 0
push str.UserFile
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x425bd7
push eax
push str.Failed_to_set_UserFile
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
cmp dword [ebp - 0x14], 0x10
jb 0x425be8
push dword [ebp - 0x28]
call fcn.0047a557
add esp, 4
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jb 0x425c25
push dword [ebp - 0x40]
call fcn.0047a557
add esp, 4
jmp 0x425c25
push eax
push str.Faile_to_Create_Key_Secuirty
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x429e30
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
push dword [ebp + 0xc]
xorps xmm0, xmm0
or edi, 0xffffffff
push 0x4d7bdc
movdqu xmmword [ebp - 0x34], xmm0
push 0x10
push eax
movdqu xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 1
call fcn.004289c0
add esp, 0x10
cmp dword [esi + 0x14], 0x10
jb 0x429e81
mov esi, dword [esi]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x429ee7
push 0
push 0x400
push 0x5022c8
push 0x400
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x5022c8
push str.getaddrinfo:__s_n
call fcn.0047c808
add eax, 0x40
push eax
call fcn.0047e09e
add esp, 0xc
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x38]
test esi, esi
je 0x429f2e
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x429f23
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x429f2a
push edi
call ebx
or edi, 0xffffffff
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x429ef5
mov esi, dword [ebp - 0x38]
pop ebx
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0047b06c
mov esp, ebp
pop ebp
ret