joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e20
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 4], 0
je 0x407e49
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], 0
push 0x20
push 0
lea ecx, [ebp - 0x28]
push ecx
call fcn.00445390
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x2c]
add edx, 4
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x409dc0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00409e00
movzx eax, al
test eax, eax
jne 0x409deb
mov ecx, dword [ebp - 4]
push ecx
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, dword [ebp - 4]
mov dword [edx + 0x190], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp dword [eax + 0x190], 0
sete cl
mov al, cl
mov esp, ebp
pop ebp
ret

Function at 0x40a160
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
movzx ecx, byte [eax + 0x44]
test ecx, ecx
je 0x40a17b
mov al, 1
jmp 0x40a236
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x40], 0xffffffff
jne 0x40a18f
xor al, al
jmp 0x40a236
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x40a22a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2733
je 0x40a1d1
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 8]
mov dword [ecx + 0x48], edx
mov byte [ebp - 1], 0
jmp 0x40a22a
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40a226
push 0x2c
push 0
lea ecx, [ebp - 0x34]
push ecx
call fcn.00445390
add esp, 0xc
lea edx, [ebp - 0x34]
push edx
push 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
cmp dword [ebp - 0x20], 0
je 0x40a224
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov dword [edx + 0x48], eax
mov byte [ebp - 1], 0
jmp 0x40a22a
mov byte [ebp - 1], 0
mov ecx, dword [ebp - 0x38]
mov dl, byte [ebp - 1]
mov byte [ecx + 0x44], dl
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8
Function at 0x40a240
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40a272
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x48], 0x2749
xor al, al
jmp 0x40a378
push 0
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40a299
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x48], 0x2734
xor al, al
jmp 0x40a378
mov byte [ebp - 1], 1
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x28
call fcn.00406200
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x40a308
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e5
je 0x40a308
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x48], ecx
mov byte [ebp - 1], 0
movzx edx, byte [ebp - 1]
test edx, edx
je 0x40a36a
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40a366
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x40a354
mov byte [ebp - 1], 1
jmp 0x40a364
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x48], eax
mov byte [ebp - 1], 0
jmp 0x40a36a
mov byte [ebp - 1], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x28
call fcn.00406220
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40a3b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40a3e2
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x48], 0x2749
xor al, al
jmp 0x40a50a
push 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
jne 0x40a409
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x48], 0x2734
xor al, al
jmp 0x40a50a
mov byte [ebp - 9], 1
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
mov dword [ebp - 0x10], 0
push 0x14
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.00445390
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
add ecx, 0x10
call fcn.00406200
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x40a49d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x3e5
je 0x40a49d
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov dword [ecx + 0x48], edx
mov byte [ebp - 9], 0
movzx eax, byte [ebp - 9]
test eax, eax
je 0x40a4fc
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40a4f8
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x40a4e6
mov byte [ebp - 9], 1
jmp 0x40a4f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x48], eax
mov byte [ebp - 9], 0
jmp 0x40a4fc
mov byte [ebp - 9], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x10
call fcn.00406220
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret 8

Function at 0x42854b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x42856b
cmp dword [edi + 0x54], 0
jne 0x42856b
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0042fe00
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00428512
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
Function at 0x42cbe3
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x42cc1c
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00412d20
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00412d50
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x42e226
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x4a87f8
mov ecx, edi
call fcn.00403880
cmp dword [esi + 0x4c], 0
push dword [esp + 0xc]
jne 0x42e279
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x42e28c
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.00412d20
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00412d50
jmp 0x42e28c
mov ecx, esi
call fcn.0042e912
test eax, eax
je 0x42e28c
push edi
mov ecx, eax
call fcn.0042cbe3
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
pop edi
pop esi
ret 8

Function at 0x42e870
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x42e8b3
call fcn.0042fe00
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42e8b3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42e8ce
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0042e427
test ebx, ebx
mov esi, eax
je 0x42e8cc
test edi, edi
je 0x42e8cc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x42eff1
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x47b515
call fcn.0044924e
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x42f016
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x42f062
call fcn.00427785
push eax
lea ecx, [ebp - 0x10]
call fcn.00413ce0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406030
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401330
mov eax, esi
call fcn.00449326
ret 8
Function at 0x434337
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x434340
xor eax, eax
jmp 0x4343a9
cmp dword [esp + 8], 0
jne 0x43434c
call fcn.00427ab9
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.0044a899
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x434387
push dword [esi + 0x10]
call fcn.0044a5de
test eax, eax
pop ecx
jne 0x434387
mov esi, dword [esi + 0xc]
call fcn.00445fae
push esi
push dword [eax]
push 1
call fcn.0043856e
push dword [esi + 0x10]
call fcn.0044a60d
test eax, eax
pop ecx
je 0x4343a6
push dword [esi + 0x10]
call fcn.0044a532
push eax
call fcn.00401000
pop ecx
pop ecx
jmp 0x434375
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x4343b2
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x4343bc
call fcn.00427ab9
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.0044a9ce
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x4343e9
mov esi, dword [esi + 0xc]
call fcn.00445fae
push esi
push dword [eax]
push 1
call fcn.0043856e
pop esi
ret 8

Function at 0x434c4d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x434c93
call fcn.0042fe00
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x434c93
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x434cd6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x434cbf
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x434cbf
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x434cd3
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x436bc1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x436bef
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x436c0d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00436b2b
jmp 0x436c0d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x436c0d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00436b2b
test edi, edi
mov eax, edi
jne 0x436bf7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4be708]
test ecx, ecx
je 0x436cd0
jmp 0x436bc0
ret 8

Function at 0x443d53
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ba494]
jne 0x443d5d
repz ret
jmp fcn.0044b8e0
Function at 0x457a46
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0044ca3b
xor ebx, ebx
cmp dword [0x4bf244], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x457b1b
push 0x4861f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x457a86
xor eax, eax
jmp 0x457bdf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4861ec
push edi
call esi
cmp eax, ebx
je 0x457a7f
push eax
call fcn.0044c9d8
mov dword [esp], 0x4861dc
push edi
mov dword [0x4bf244], eax
call esi
push eax
call fcn.0044c9d8
mov dword [esp], 0x4861c8
push edi
mov dword [0x4bf248], eax
call esi
push eax
call fcn.0044c9d8
mov dword [0x4bf24c], eax
lea eax, [ebp - 8]
push eax
call fcn.0044725f
test eax, eax
pop ecx
pop ecx
je 0x457ae9
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00444ca7
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x457b1b
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0044c9d8
cmp eax, ebx
pop ecx
mov dword [0x4bf254], eax
je 0x457b1b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044c9d8
pop ecx
mov dword [0x4bf250], eax
mov eax, dword [0x4bf250]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x457b94
cmp dword [0x4bf254], esi
je 0x457b94
push eax
call fcn.0044ca44
pop ecx
call eax
cmp eax, ebx
je 0x457b61
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4bf254]
call fcn.0044ca44
pop ecx
call eax
test eax, eax
je 0x457b61
test byte [ebp - 0x18], 1
jne 0x457b94
lea eax, [ebp - 0xc]
push eax
call fcn.00447296
test eax, eax
pop ecx
je 0x457b7c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00444ca7
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x457b8b
or dword [ebp + 0x10], 0x200000
jmp 0x457bc5
or dword [ebp + 0x10], 0x40000
jmp 0x457bc5
mov eax, dword [0x4bf248]
cmp eax, esi
je 0x457bc5
push eax
call fcn.0044ca44
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x457bc5
mov eax, dword [0x4bf24c]
cmp eax, esi
je 0x457bc5
push dword [ebp - 4]
push eax
call fcn.0044ca44
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4bf244]
call fcn.0044ca44
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45e9ef
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4ba494]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0045e984
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00445390
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x45ea3e
cmp dword [ebp - 0x1c], 5
jb 0x45ea56
jmp 0x45ea52
cmp dword [ebp - 0x10], 1
jne 0x45ea56
cmp dword [ebp - 0x1c], 4
ja 0x45ea52
jne 0x45ea56
cmp dword [ebp - 0x18], 0
jbe 0x45ea56
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x487ba0
call fcn.00406240
test eax, eax
jge 0x45ea77
mov byte [0x4bf345], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00443d53
add ebp, 0x78
leave
ret

Function at 0x45edc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x4ba494]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0xa4], ecx
mov byte [ebp - 1], 0
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x45ee0e
cmp dword [ebp - 0x90], 2
jne 0x45ee0e
cmp dword [ebp - 0x9c], 6
jb 0x45ee0e
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00443d53
mov esp, ebp
pop ebp
ret

Function at 0x45f560
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x4ba494]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x444], 0
push 0x38
push 0
lea eax, [ebp - 0x440]
push eax
call fcn.00445390
add esp, 0xc
mov dword [ebp - 0x444], 0x3c
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], str.runas
push 0x400
lea ecx, [ebp - 0x408]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x408]
mov dword [ebp - 0x434], edx
mov dword [ebp - 0x430], 0x487be3
mov dword [ebp - 0x42c], 0x487bf9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x428], 1
lea ecx, [ebp - 0x444]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443d53
mov esp, ebp
pop ebp
ret

Function at 0x45f6b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x4ba494]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 1], 0
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x45f6f8
cmp dword [ebp - 0x90], 2
jne 0x45f6f8
cmp dword [ebp - 0x9c], 6
jb 0x45f6f8
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00443d53
mov esp, ebp
pop ebp
ret
Function at 0x4653d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.http:__www.adwarepro_site.com_support.html
lea ecx, [ebp - 4]
call fcn.00403210
push 1
push 0
push 0
lea ecx, [ebp - 4]
call fcn.0040aa10
push eax
push 0x48de58
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 4]
call fcn.00413390
mov esp, ebp
pop ebp
ret

Function at 0x465410
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.http:__www.adwarepro_site.com_join1.php
lea ecx, [ebp - 4]
call fcn.00403210
push 1
push 0
push 0
lea ecx, [ebp - 4]
call fcn.0040aa10
push eax
push 0x48de24
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 4]
call fcn.00413390
mov esp, ebp
pop ebp
ret
Function at 0x467250
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x4ba494]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x9c], 4
jne 0x4672ac
mov ecx, 0x4bf378
call fcn.0040aa10
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp - 0xa4]
mov dword [ecx + 0xa4], eax
jmp 0x4672cd
mov ecx, 0x4bf37c
call fcn.0040aa10
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, dword [ebp - 0xa4]
mov dword [edx + 0xa4], eax
push 0
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax + 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4672ea
mov al, 1
jmp 0x4672ec
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443d53
mov esp, ebp
pop ebp
ret

Function at 0x467300
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
lea ecx, [ebp + 8]
call fcn.0040aa10
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea ecx, [ebp + 8]
call fcn.00413390
mov esp, ebp
pop ebp
ret 4
Function at 0x467450
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47da75
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4ba494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0xac], 0
jle 0x4675d7
lea ecx, [ebp - 0x10]
call fcn.00401710
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0xac]
push edx
push 0x48ef68
lea eax, [ebp - 0x10]
push eax
call fcn.00404910
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.00402000
movzx ecx, al
test ecx, ecx
jne 0x4675c8
push 0x48e10c
lea ecx, [ebp - 0x14]
call fcn.00403210
mov byte [ebp - 4], 1
push 0x48ef6c
lea ecx, [ebp - 0x14]
call fcn.00405670
push 0x48e148
lea ecx, [ebp - 0x14]
call fcn.00405670
lea ecx, [ebp - 0x14]
call fcn.00402000
movzx edx, al
test edx, edx
jne 0x4675bc
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x14]
call fcn.0040aa10
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x467581
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.0040aa10
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x467581
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00413390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00413390
jmp 0x4675d7
lea ecx, [ebp - 0x10]
call fcn.00412ea0
add eax, 1
push eax
lea ecx, [ebp - 0x10]
call fcn.00412ea0
push eax
lea ecx, [ebp - 0x10]
call fcn.00401fe0
push eax
push 1
push 0
push 0x48e148
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00413390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00413390
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret