joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f200
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x240
mov ecx, 0x40
xor eax, eax
lea edx, [esp]
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x10]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x254]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x110]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42f2d2
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, 0xdfcf18
lea edx, [esp + 0x13c]
push 0x80
push edx
push edi
call fcn.004f27c0
add esp, 0xc
lea eax, [esp + 0x110]
inc ebx
add edi, 0x40
push eax
push esi
call ebp
test eax, eax
jne 0x42f2c5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
cmp edi, 0xe3ba18
je 0x42f2d2
cmp esi, 0xffffffff
jne 0x42f292
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov dword [0xe56df0], ebx
pop ebp
mov ax, 1
pop ebx
add esp, 0x240
ret

Function at 0x42f2f0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x240
mov ecx, 0x40
xor eax, eax
lea edx, [esp]
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x10]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x254]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x110]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x42f3a6
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x110]
inc ebx
push edx
push esi
call ebp
test eax, eax
jne 0x42f399
push esi
call edi
or esi, 0xffffffff
cmp ebx, 0xfab
je 0x42f3a6
cmp esi, 0xffffffff
jne 0x42f383
push esi
call edi
pop edi
pop esi
mov dword [0xe56de8], ebx
pop ebp
mov ax, 1
pop ebx
add esp, 0x240
ret
Function at 0x42f3c0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x240
mov ecx, 0x40
xor eax, eax
lea edx, [esp]
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x10]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x254]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x110]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x42f476
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x110]
inc ebx
push edx
push esi
call ebp
test eax, eax
jne 0x42f469
push esi
call edi
or esi, 0xffffffff
cmp ebx, 0xfab
je 0x42f476
cmp esi, 0xffffffff
jne 0x42f453
push esi
call edi
pop edi
pop esi
mov dword [0xe56df4], ebx
pop ebp
mov ax, 1
pop ebx
add esp, 0x240
ret

Function at 0x42f490
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x240
mov ecx, 0x40
xor eax, eax
lea edx, [esp]
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x10]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x254]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x110]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x42f546
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x110]
inc ebx
push edx
push esi
call ebp
test eax, eax
jne 0x42f539
push esi
call edi
or esi, 0xffffffff
cmp ebx, 0xfab
je 0x42f546
cmp esi, 0xffffffff
jne 0x42f523
push esi
call edi
pop edi
pop esi
mov dword [0xe56df0], ebx
pop ebp
mov ax, 1
pop ebx
add esp, 0x240
ret
Function at 0x42feb0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fab40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x324
push ebx
push esi
push edi
lea eax, [ebp - 0x130]
mov dword [ebp - 0x10], esp
push 0x80
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x130]
lea edx, [ebp - 0xb0]
push ecx
push str._sexplorer.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x130]
lea ecx, [ebp - 0x1b0]
push eax
push str._s_system32dllcache_bkexplorer.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0xb0]
push edx
call fcn.004abe70
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x42ff47
lea eax, [ebp - 0xb0]
push 1
lea ecx, [ebp - 0x1b0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.c:endpcache_sigcheck.exe
call fcn.004abe70
add esp, 4
cmp eax, 0xffffffff
jne 0x430020
lea edx, [ebp - 0x230]
push edx
call fcn.004ab6e0
add esp, 4
lea eax, [ebp - 0x30]
push eax
call fcn.00401350
add esp, 4
lea ecx, [ebp - 0x30]
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x230]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x330]
push 0x519708
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x430020
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x330]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x430003
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432c50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fac50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push 0x100
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.004f266a
add esp, 4
mov edi, eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], edi
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x432d3e
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x128]
push ecx
lea eax, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push 0
push ecx
push edi
push edx
push eax
mov dword [ebp - 0x1c], 0x80
mov dword [ebp - 0x24], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x432d3e
mov edx, ebx
or ecx, 0xffffffff
shl edx, 8
xor eax, eax
add edx, 0xd8b8c0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
cmp ebx, 0x100
rep movsb byte es:[edi], byte [esi]
jle 0x432d2f
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x432cb0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
mov dword [0xe56d18], ebx
call fcn.004f265f
add esp, 4
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4339f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4facb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x31c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push 0x100
mov dword [ebp - 4], ebx
mov dword [0xe56d18], ebx
mov dword [ebp - 0x14], ebx
call fcn.004f266a
add esp, 4
mov esi, eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], esi
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push closesocket
mov dword [ebp - 0x20], 1
mov byte [ebp - 0x128], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x433bb8
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x228]
push ecx
lea eax, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push 0
push ecx
push esi
push edx
push eax
mov dword [ebp - 0x28], 0x80
mov dword [ebp - 0x24], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x433bb8
lea edi, [ebp - 0x228]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x128]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, ebx
lea ecx, [ebp - 0x128]
shl esi, 4
sub esi, ebx
push ecx
shl esi, 4
sub esi, ebx
shl esi, 2
call fcn.004fa6c0
push eax
lea edx, [esi + 0xd0a174]
push str.HKCRCLSID_sInprocServer32
push edx
call fcn.004f175f
lea eax, [ebp - 0x128]
push eax
call fcn.004fa6c0
push eax
lea ecx, [esi + 0xd0a0d0]
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x128]
lea eax, [ebp - 0x328]
push edx
push str.CLSID_sInprocServer32
push eax
call fcn.004f175f
mov edi, dword [ebp - 0x18]
push edi
call fcn.004fa6c0
add esp, 0x30
push eax
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [esi + 0xd0a218]
push eax
push str.HKLM
push str._s_s_s
push ecx
call fcn.004f175f
push edi
lea edx, [esi + 0xd0a360]
push 0x51a1dc
push edx
call fcn.004f175f
lea eax, [ebp - 0x128]
lea ecx, [esi + 0xd0a2bc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
add esp, 0x2c
inc ebx
cmp ebx, 0xff
jle 0x433ba9
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x433a63
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov dword [0xe56dfc], ebx
call fcn.004f265f
add esp, 4
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4344c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4facf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push 0x100
mov dword [ebp - 4], edi
call fcn.004f266a
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x18]
mov dword [0xe56de4], edi
push eax
push 0x20019
push edi
push str.SAMSAMDomainsAccountUsersNames
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4345b2
mov dword [ebp - 0x14], edi
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push 0
push ecx
push ebx
push edx
push eax
mov dword [ebp - 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
mov dword [ebp - 0x20], eax
je 0x4345a0
lea esi, [edi + edi*2]
push ebx
shl esi, 7
push str.HKLMSAMSAMDomainsAccountUsersNames_s
lea ecx, [esi + 0xe47750]
push ecx
call fcn.004f175f
push ebx
call fcn.004fa6c0
push eax
lea edx, [esi + 0xe47850]
push 0x50d39c
push edx
call fcn.004f175f
add esp, 0x1c
inc edi
cmp edi, 0x80
jle 0x43459d
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
inc edx
cmp eax, 0x103
mov dword [ebp - 0x14], edx
jne 0x434520
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
mov dword [0xe56de4], edi
call fcn.004f265f
add esp, 4
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434610
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fad00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], esp
push 0x14
call fcn.004f266a
add esp, 4
mov ebx, eax
mov dword [ebp - 0x18], ebx
push 0x80
call fcn.004f266a
mov esi, dword [ebp + 8]
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
xor eax, eax
mov cl, byte [eax + esi]
cmp cl, 0x5c
je 0x43466c
mov byte [eax + ebx], cl
inc eax
jmp 0x43465e
mov byte [eax + ebx], 0
inc eax
xor edx, edx
mov cl, byte [eax + esi]
test cl, cl
je 0x434686
cmp cl, 0x24
mov byte [edx + edi], cl
je 0x434686
inc eax
inc edx
jmp 0x434673
mov byte [edx + edi + 1], 0
or eax, 0xffffffff
mov edi, str.HKCU
mov esi, ebx
mov dl, byte [esi]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x4346bd
test cl, cl
je 0x4346b9
mov dl, byte [esi + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x4346bd
add esi, 2
add edi, 2
test cl, cl
jne 0x434695
xor ecx, ecx
jmp 0x4346c2
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x4346e0
mov eax, dword [ebp - 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push eax
push closesocket
call ebx
neg eax
sbb eax, eax
and al, 0xfe
inc eax
jmp 0x4346e6
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [ebp - 0x18]
mov edi, str.HKCR
mov dl, byte [esi]
mov cl, dl
cmp dl, byte [edi]
jne 0x434712
test cl, cl
je 0x43470e
mov dl, byte [esi + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x434712
add esi, 2
add edi, 2
test cl, cl
jne 0x4346ee
xor ecx, ecx
jmp 0x434717
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x43472d
mov eax, dword [ebp - 0x14]
push eax
push closesocket
call ebx
neg eax
sbb eax, eax
and al, 0xfe
inc eax
mov esi, dword [ebp - 0x18]
mov edi, str.HKLM
mov dl, byte [esi]
mov cl, dl
cmp dl, byte [edi]
jne 0x434759
test cl, cl
je 0x434755
mov dl, byte [esi + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x434759
add esi, 2
add edi, 2
test cl, cl
jne 0x434735
xor ecx, ecx
jmp 0x43475e
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x434774
mov eax, dword [ebp - 0x14]
push eax
push closesocket
call ebx
neg eax
sbb eax, eax
and al, 0xfe
inc eax
mov esi, dword [ebp - 0x18]
mov edi, 0x51a568
mov dl, byte [esi]
mov cl, dl
cmp dl, byte [edi]
jne 0x4347a0
test cl, cl
je 0x43479c
mov dl, byte [esi + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x4347a0
add esi, 2
add edi, 2
test cl, cl
jne 0x43477c
xor ecx, ecx
jmp 0x4347a5
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x4347d6
mov eax, dword [ebp - 0x14]
push eax
push reloc.WS2_32.dll_closesocket
call ebx
neg eax
sbb eax, eax
and al, 0xfe
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446d50
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
xor edi, edi
push eax
push 2
push edi
push str.SOFTWAREClientsStartMenuInternet
push closesocket
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
call ebx
test eax, eax
jne 0x446ea2
push str.iexplore.exe
call fcn.004fa6c0
mov ecx, dword [ebp - 0x14]
add esp, 4
mov esi, eax
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
push 0x200
call fcn.004f266a
add esp, 4
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
push ecx
call fcn.004ae740
add esp, 4
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push 0
push 0xc30c0c
push reloc.WS2_32.dll_closesocket
call ebx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x14]
add ecx, 0x100
push eax
push 0xf003f
push 0
push ecx
push edx
call ebx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push str.SOFTWAREClientsStartMenuInternet
push ecx
call ebx
test eax, eax
jne 0x446e62
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [ebp - 0x14]
not ecx
push ecx
push esi
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
push eax
call edi
mov ecx, dword [ebp - 0x14]
push ecx
call edi
mov edx, dword [ebp - 0x14]
push edx
call edi
mov eax, dword [ebp - 0x14]
push eax
call edi
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004f265f
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450310
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
lea eax, [esp]
mov dword [esp + 8], 4
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicescardM
push closesocket
mov dword [esp + 0x18], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push str.Start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45039a
cmp byte [esp + 0xc], 2
jne 0x450384
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, 2
add esp, 0x8c
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, 3
add esp, 0x8c
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, 3
add esp, 0x8c
ret
Function at 0x45da60
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb358
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0xfcec
call fcn.004f2630
push ebx
push esi
push edi
lea eax, [ebp - 0xfc]
mov dword [ebp - 0x10], esp
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.004ab6e0
add esp, 4
lea ecx, [ebp - 0x7c]
push ecx
call fcn.00401350
add esp, 4
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xfcfc]
mov dword [ebp - 0x14], edi
push edx
push eax
call fcn.004c4810
add esp, 8
lea ecx, [ebp - 0x5c]
push 1
call fcn.004f0653
mov ecx, dword [0x4fe4e8]
mov byte [ebp - 4], 1
push ecx
push 8
push str.c:endpcacheprocess_log.txt
lea ecx, [ebp - 0x5c]
call fcn.004f0727
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x14]
cmp edi, eax
jge 0x45db64
mov edx, edi
lea eax, [ebp - 0x7c]
shl edx, 8
lea esi, [ebp + edx - 0xfcfc]
push esi
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0xfc]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x2fc]
push eax
push 0x52161c
push edx
call fcn.004f175f
add esp, 0x14
push 0x80
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x2fc]
lea ecx, [ebp - 0x50]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
inc edi
jmp 0x45dae9
lea ecx, [ebp - 0x7c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0xfc]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x2fc]
push 0x5215e8
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x45dbf3
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x2fc]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x45dbd6
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x45dbed
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x2fc]
push ecx
lea ecx, [ebp - 0x50]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x5c]
call fcn.004f076e
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x48]
call fcn.004f05fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret