joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x7ea1bc]
sub esp, 0x484
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetDateFormatA]
mov ebp, 0x2443831
cmp eax, 0x47
jne 0x414f86
xor eax, eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x78]
push ecx
push 0x403790
mov dword [esp + 0x6c], 0
call esi
xor eax, eax
push eax
mov dword [esp + 0x56], eax
mov dword [esp + 0x5a], eax
mov dword [esp + 0x5e], eax
mov word [esp + 0x62], ax
lea eax, [esp + 0x94]
push eax
push 0x4037e4
xor edx, edx
lea ecx, [esp + 0x5c]
push ecx
push edx
push edx
mov word [esp + 0x68], dx
call edi
dec ebp
mov eax, dword [0x439d90]
mov dword [0x7ea1bc], eax
jne 0x414f25
mov dword [esp + 0x20], 0x764d11c7
mov dword [esp + 0x4c], 0x26b44f20
mov dword [esp + 0x24], 0x1f33c7de
mov dword [esp + 0x10], 0x2e56cff9
mov dword [esp + 0x28], 0x6cde8df8
mov dword [esp + 0x14], 0x796abd53
mov dword [esp + 0x34], 0x3ce56ad4
mov dword [esp + 0x1c], 0x581868fc
mov dword [esp + 0x18], 0xc596c70
mov dword [esp + 0x3c], 0x6d5e9115
mov dword [esp + 0x30], 0x22f372d9
mov dword [esp + 0x40], 0x2ad541d0
mov dword [esp + 0x38], 0x7a5f7c43
mov dword [esp + 0x2c], 0x28d520e
mov dword [esp + 0x48], 0x73f3bc07
mov dword [esp + 0x44], 0x51f578e1
add dword [esp + 0x4c], 0x73e38130
mov eax, 0x3a9c3a87
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x24], 0x6b053f58
add dword [esp + 0x20], 0x2818faf9
add dword [esp + 0x4c], 0x3ab2fc3
sub dword [esp + 0x20], 0x30ad2d47
sub dword [esp + 0x20], 0x4442fc9b
sub dword [esp + 0x28], 0x2285667
add dword [esp + 0x4c], 0x262c99c6
sub dword [esp + 0x14], 0x4dc74448
mov eax, 0x53cf4e1b
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x24], 0x1b067f32
mov eax, 0x67698c83
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
sub dword [esp + 0x28], 0x7674af1e
mov eax, 0x173863dd
mul dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, 0x3d786fdd
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, 0x38471b91
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, 0x45f07edf
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
add dword [esp + 0x18], 0x6fea1ecd
sub dword [esp + 0x34], 0x32f1f16e
add dword [esp + 0x34], 0x6e380599
sub dword [esp + 0x18], 0x3ca08c1e
add dword [esp + 0x30], 0x154e8e1
add dword [esp + 0x14], 0x53bb032d
sub dword [esp + 0x14], 0x11166d6c
sub dword [esp + 0x18], 0x2a6a1594
add dword [esp + 0x14], 0x4fb1fe05
mov eax, 0x4b3ce8e6
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x3c], 0x1bc84bb6
sub dword [esp + 0x30], 0x687c0c2b
add dword [esp + 0x48], 0x36e578c2
sub dword [esp + 0x10], 0x7b5e58ec
mov eax, 0x38d0a1fb
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x40], 0x15793cf4
mov edx, dword [0x439d84]
mov dword [0x7ea5d0], edx
call fcn.00414b40
pop edi
xor eax, eax
pop esi
pop ebp
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40131f
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0xfb8]
mov eax, 0x1038
call fcn.004104f0
mov eax, dword [0x43c814]
xor eax, ebp
mov dword [ebp + 0xfb4], eax
push edi
mov edi, dword [ebp + 0xfc0]
lea eax, [ebp - 0x7c]
push eax
call fcn.00407111
pop ecx
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
jne 0x401364
push 5
call fcn.0040997a
pop ecx
jmp 0x401450
push esi
call fcn.004081ea
push eax
push 0x5c
call fcn.00408b5e
push eax
push 0x4360e8
mov esi, 0x400
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.004081b2
push dword [ebp - 0x7c]
lea eax, [ebp + 0x7ac]
push 0x4360f8
push esi
push eax
call fcn.004081b2
and dword [ebp - 0x64], 0
lea eax, [ebp + 0x7ac]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
mov dword [ebp - 0x74], str.JavaWSSplashScreen
mov dword [ebp - 0x70], 0x436128
mov dword [ebp - 0x68], edi
call fcn.00408ab8
add esp, 0x34
test eax, eax
jne 0x401447
mov word [ebp - 0x64], ax
lea edi, [ebp - 0x62]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4013ff
push 6
jmp 0x401449
push 0
push 6
lea eax, [ebp + 0xfac]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 6
je 0x40141a
push 7
jmp 0x401449
lea eax, [ebp + 0xfac]
push eax
call fcn.00410b66
pop ecx
mov dword [0x4360e0], eax
test eax, eax
jg 0x401434
push 8
jmp 0x401449
push esi
call fcn.00407fb1
push dword [ebp - 0x78]
call fcn.00407fb1
pop ecx
xor eax, eax
jmp 0x40144e
push 0
call fcn.0040997a
pop ecx
pop esi
mov ecx, dword [ebp + 0xfb4]
xor ecx, ebp
pop edi
call fcn.0040fefe
add ebp, 0xfb8
leave
ret
Function at 0x406e2f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1198]
mov eax, 0x1218
call fcn.004104f0
mov eax, dword [0x43c814]
xor eax, ebp
mov dword [ebp + 0x1194], eax
push edi
push 0x437e10
push 0x437e40
push 0xffffffffffffffff
lea eax, [ebp - 0x74]
push 0x1000
push eax
call fcn.004100e6
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x74]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406e91
xor eax, eax
jmp 0x406f15
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xf8c]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push str.Path
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
test eax, eax
je 0x406ec6
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406e8a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], 1
jne 0x406e8a
mov eax, dword [esi + 4]
test eax, eax
je 0x406ee0
push eax
call fcn.0041059a
pop ecx
push edi
call fcn.00410c3e
lea ecx, [esi + 8]
push ecx
push eax
mov dword [esi + 4], eax
call fcn.00406b6d
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x406f03
push eax
call fcn.0041059a
pop ecx
lea eax, [ebp + 0xf8c]
push eax
call fcn.00410c3e
mov dword [esi], eax
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp + 0x1194]
xor ecx, ebp
call fcn.0040fefe
add ebp, 0x1198
leave
ret
Function at 0x406f2a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [0x43c814]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
mov eax, dword [ebp + 0x1d0]
push ebx
push esi
xor ebx, ebx
push str.FORCED_FX_ROOT
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], 0x1fe
xor esi, esi
mov dword [ebp - 0x6c], ebx
call fcn.004106e9
add esp, 0xc
cmp dword [ebp - 0x6c], ebx
je 0x406fb8
cmp eax, ebx
jne 0x406fb8
push 0x34
push 1
call fcn.0041019b
push str.2.0
mov esi, eax
call fcn.00410c3e
lea ecx, [esi + 8]
push ecx
push eax
mov dword [esi + 4], eax
call fcn.00406b6d
push dword [ebp - 0x6c]
call fcn.00410c3e
mov dword [esi], eax
push dword [ebp - 0x6c]
call fcn.0041059a
add esp, 0x1c
jmp 0x407073
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push ebx
push str.SoftwareOracleJavaFX
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406fdd
xor eax, eax
jmp 0x407075
push edi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x407056
cmp dword [ebp - 0x78], ebx
je 0x407012
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x78]
call fcn.00406dce
pop ecx
pop ecx
jmp 0x407015
xor eax, eax
inc eax
cmp eax, ebx
je 0x407056
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00406b6d
pop ecx
pop ecx
cmp esi, ebx
je 0x407041
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00406c11
pop ecx
pop ecx
test eax, eax
je 0x407056
jmp 0x40704e
push 0x34
push 1
call fcn.0041019b
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x3c]
call fcn.00406e2f
inc dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x1fe
cmp dword [ebp - 0x80], ebx
je 0x406fde
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
mov ecx, dword [ebp + 0x1c4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fefe
add ebp, 0x1c8
leave
ret
Function at 0x407111
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x43c814]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
xor eax, eax
push esi
push edi
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x1c], 0x10
call fcn.00407f12
push 2
pop eax
push 0x437eec
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 0
push 1
push 2
mov dword [ebp - 0x10], eax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
jne 0x407171
mov eax, edi
jmp 0x4071c1
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, edi
jne 0x40718b
push esi
call fcn.00407fb1
pop ecx
jmp 0x40716d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_getsockname]
cmp eax, edi
je 0x407182
push SysReAllocString
push esi
call dword [sym.imp.WSOCK32.dll_listen]
cmp eax, edi
je 0x407182
push dword [ebp - 0x12]
call dword [sym.imp.WSOCK32.dll_ntohs]
mov ecx, dword [ebp - 0x18]
movzx eax, ax
mov dword [ecx], eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040fefe
leave
ret

Function at 0x407269
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43c814]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
push edi
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.00407f12
push 2
pop eax
push dword [ebp + 8]
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_htons]
push 0x437f04
mov word [ebp - 0x12], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 0
push 1
push 2
mov dword [ebp - 0x10], eax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
jne 0x4072c9
mov eax, edi
jmp 0x4072e5
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, edi
jne 0x4072e3
push esi
call fcn.00407fb1
pop ecx
jmp 0x4072c5
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040fefe
leave
ret
Function at 0x4073d0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp dword [esp + 8], 0
jne 0x4073da
xor eax, eax
ret
mov eax, dword [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4073e1
sub eax, edx
sar eax, 1
push esi
lea esi, [eax + eax + 6]
lea eax, [esi + esi]
push edi
push eax
call fcn.00410107
mov edi, eax
pop ecx
test edi, edi
je 0x407450
push dword [esp + 0x10]
push str._s_r_n
push esi
push edi
call fcn.004081b2
mov eax, edi
add esp, 0x10
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x40741e
sub eax, ecx
sar eax, 1
push 0
add eax, eax
push eax
push edi
push dword [esp + 0x18]
call dword [sym.imp.WSOCK32.dll_send]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push edi
mov esi, ecx
call fcn.0041059a
pop ecx
mov eax, esi
pop edi
pop esi
ret

Function at 0x407453
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, 0x44a0d8
xor ebx, ebx
mov esi, edi
push 0
push 2
push esi
push dword [esp + 0x1c]
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
je 0x40749a
test eax, eax
je 0x40749e
movzx eax, word [esi]
cmp eax, 0xa
je 0x40749e
cmp eax, 0xd
je 0x407488
inc ebx
add esi, 2
cmp esi, 0x44a8d6
jl 0x40745f
xor eax, eax
mov word [0x44a8d6], ax
jmp 0x4074a8
xor eax, eax
jmp 0x4074aa
xor eax, eax
mov word [ebx*2 + 0x44a0d8], ax
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x407f12
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x43c814]
xor eax, esp
mov dword [esp + 0x190], eax
cmp dword [0x451170], 0
jne 0x407f9c
push esi
push edi
xor edi, edi
push str.ws2_32.dll
inc edi
call fcn.0040b0ff
mov esi, eax
pop ecx
test esi, esi
jne 0x407f66
push str.wsock32.dll
call fcn.0040b0ff
mov esi, eax
xor edi, edi
pop ecx
test esi, esi
jne 0x407f66
push 0xd
call fcn.0040997a
pop ecx
push eax
call fcn.00407e73
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x407f7b
push 0xe
jmp 0x407f5a
test edi, edi
je 0x407f90
push str.WSASendDisconnect
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45116c], eax
pop edi
mov dword [0x451170], 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0040fefe
add esp, 0x194
ret
Function at 0x408331
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.004104f0
mov eax, dword [0x43c814]
xor eax, ebp
mov dword [ebp + 0xf94], eax
mov eax, dword [ebp + 0xfa0]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x439728
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x7c], 0x400
mov dword [ebp - 0x70], 1
call esi
test eax, eax
jne 0x408432
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x794]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.CurrentVersion
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4083b8
and dword [ebp - 0x70], 0
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4083c9
and dword [ebp - 0x70], 0
lea eax, [ebp + 0x794]
push eax
push str.SoftwareJavaSoftJava_Runtime_Environment
push 0x43971c
lea eax, [ebp - 0x6c]
push 0x400
push eax
call fcn.004100c8
add esp, 0x14
lea eax, [ebp - 0x74]
push eax
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
push edi
call esi
test eax, eax
jne 0x408432
lea eax, [ebp + 0xfa4]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x4397f8
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x408422
mov dword [ebp - 0x70], ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x408432
mov dword [ebp - 0x70], ebx
mov ecx, dword [ebp + 0xf94]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fefe
add ebp, 0xf98
leave
ret

Function at 0x408554
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4085a3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x408711
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x43c814]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x408747
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040fefe
leave
ret
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x40876d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x408739
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp + 8]
je 0x408787
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
jmp 0x40875e
mov esi, dword [ebp - 0x218]
jmp 0x408762

Function at 0x40878f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4087e6
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 0
push 0
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
test eax, eax
jne 0x4087e0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret
Function at 0x4096ea
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x43c814]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 9
pop ecx
mov dword [ebp - 0x10], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x40], esi
lea edi, [ebp - 0x3c]
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00407111
pop ecx
mov dword [0x451998], eax
cmp eax, 0xffffffff
jne 0x40973e
push 5
call fcn.0040997a
pop ecx
push eax
call fcn.00409600
cmp dword [ebp + 8], esi
jg 0x409747
push 0x13
jmp 0x409732
push dword [ebp + 8]
call fcn.00407269
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
jne 0x40975b
push 0x11
jmp 0x409732
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push 0x439ca8
push 0xffffffffffffffff
push 6
pop edi
push edi
push eax
call fcn.004140d5
add esp, 0x14
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, edi
je 0x40978a
push 0x14
jmp 0x409732
push ebx
call fcn.00407fb1
pop ecx
cmp dword [ebp - 0x10], esi
je 0x40985a
mov ebx, dword [ebp - 0x14]
push 0x7f00
push esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x409650
mov dword [ebp - 0x30], ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0x439cac
call dword [sym.imp.USER32.dll_RegisterClassW]
push esi
push ebx
push esi
push esi
mov eax, SysReAllocString
push eax
push eax
push eax
push eax
push 0xcf0000
push str.Win32Splash
push str.SplashDummy
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x40964a
push 0x4e20
mov edi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
jne 0x40980f
push 0x15
jmp 0x409732
call fcn.00409590
push dword [ebp - 0x10]
call fcn.004095b0
pop ecx
push 8
push 0x401
push edi
push dword [0x451998]
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x40984d
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x5c]
push eax
call edi
test eax, eax
jne 0x409839
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040fefe
leave
ret
Function at 0x409b6b
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
fild dword [ebp + 0xc]
push esi
push edi
test eax, eax
jns 0x409b82
fadd qword [0x42e340]
fdiv qword [0x42e338]
push ecx
push ecx
fstp qword [esp]
call fcn.004143b0
fmul qword [0x42e330]
fstp qword [ebp - 8]
fld qword [ebp - 8]
call fcn.00414586
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
inc eax
push 1
push eax
call fcn.0041019b
mov edi, eax
xor esi, esi
add esp, 0x10
mov dword [ebp + 0x10], edi
cmp edi, esi
jne 0x409bc6
xor eax, eax
jmp 0x409c72
cmp esi, dword [ebp + 0xc]
jae 0x409c48
mov ecx, dword [ebp + 8]
movzx ecx, byte [esi + ecx]
inc esi
cmp esi, dword [ebp + 0xc]
jae 0x409be2
mov edx, dword [ebp + 8]
movzx edi, byte [esi + edx]
inc esi
jmp 0x409be4
xor edi, edi
cmp esi, dword [ebp + 0xc]
jae 0x409bf3
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
inc esi
jmp 0x409bf5
xor edx, edx
shl ecx, 8
add ecx, edi
shl ecx, 8
add ecx, edx
mov edx, ecx
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], dl
mov edx, ecx
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 6
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], dl
mov byte [eax + 3], cl
add eax, 4
cmp esi, dword [ebp + 0xc]
jb 0x409bcb
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 3
xor edx, edx
pop ecx
div ecx
mov esi, dword [edx*4 + 0x43b380]
test esi, esi
je 0x409c70
fld qword [ebp - 8]
call fcn.00414550
lea eax, [eax + edi - 1]
mov byte [eax], 0x3d
dec eax
dec esi
jne 0x409c69
mov eax, edi
pop edi
pop esi
leave
ret