joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51e59d
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x51e672
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x51e661
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x51e64b
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x51e661
push eax
push edi
push dword [ebp - 0x110]
call fcn.0051e53a
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x51e674
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0051eacc
leave
ret 4

Function at 0x51eacc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x575494]
jne 0x51ead6
repz ret
jmp fcn.00522158

Function at 0x520cf3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x520d1a
call fcn.0052107c
mov dword [eax], esi
call fcn.00521069
push 0x16
pop esi
mov dword [eax], esi
call fcn.00522814
mov eax, esi
jmp 0x520d6f
test dword [ebp + 0xc], 0xfffffff9
jne 0x520d00
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x520d47
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0052108f
pop ecx
call fcn.00521069
mov eax, dword [eax]
jmp 0x520d6f
test al, 0x10
jne 0x520d6d
test al, 1
je 0x520d6d
test byte [ebp + 0xc], 2
je 0x520d6d
call fcn.0052107c
mov dword [eax], 5
call fcn.00521069
mov dword [eax], 0xd
jmp 0x520d3e
xor eax, eax
pop esi
pop ebp
ret
Function at 0x52b6f2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.005253d8
and dword [ebp - 0x14], 0
cmp dword [0x57b210], 0
mov dword [ebp - 0x18], eax
jne 0x52b7a5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x52b84d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x54ecbc
push ebx
call edi
test eax, eax
je 0x52b84d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x54ecac
push ebx
mov dword [0x57b210], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x57b214], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x57b218], eax
call edi
push eax
call esi
mov dword [0x57b220], eax
test eax, eax
je 0x52b7a5
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x57b21c], eax
mov eax, dword [0x57b21c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x52b7fe
cmp dword [0x57b220], ecx
je 0x52b7fe
push eax
call esi
push dword [0x57b220]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x52b7fe
test ebx, ebx
je 0x52b7fe
call edi
test eax, eax
je 0x52b7f5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x52b7f5
test byte [ebp - 8], 1
jne 0x52b7fe
or dword [ebp + 0x10], 0x200000
jmp 0x52b831
mov eax, dword [0x57b214]
cmp eax, dword [ebp - 0x18]
je 0x52b831
push eax
call esi
test eax, eax
je 0x52b831
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x52b831
mov eax, dword [0x57b218]
cmp eax, dword [ebp - 0x18]
je 0x52b831
push eax
call esi
test eax, eax
je 0x52b831
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x57b210]
call esi
test eax, eax
je 0x52b84d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x52b84f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051eacc
leave
ret
Function at 0x4afe7b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, ecx
movzx ecx, word [eax + 0x14]
push ebx
movzx ebx, word [eax + 6]
lea edx, [ecx + eax + 0x18]
push esi
xor ecx, ecx
push edi
test ebx, ebx
jle 0x4afebe
lea eax, [edx + 8]
mov edi, dword [eax]
test edi, edi
jne 0x4afea7
mov edi, dword [eax + 8]
mov esi, dword [eax + 4]
cmp dword [ebp + 0xc], esi
jb 0x4afeb6
add esi, edi
cmp dword [ebp + 0xc], esi
jb 0x4afec5
inc ecx
add eax, 0x28
cmp ecx, ebx
jl 0x4afe9e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
imul ecx, ecx, 0x28
add ecx, edx
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
jmp 0x4afec0

Function at 0x4afed8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
mov edx, 0x5a4d
add eax, ecx
cmp word [ecx], dx
je 0x4afef1
xor eax, eax
pop ebp
ret
cmp dword [eax], 0x4550
jne 0x4afeed
mov edx, 0xe0
cmp word [eax + 0x14], dx
jb 0x4afeed
push dword [eax + 0x88]
push ecx
call fcn.004afe7b
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b8e90
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x4c]
xor al, al
mov bl, 1
cmp ecx, 0xffffffff
je 0x4b9015
push edi
mov edi, 0x10000000
cmp ecx, 0x7c
je 0x4b9014
cmp ecx, 0x29
jne 0x4b8ed4
cmp dword [esi + 0x1c], 0
jne 0x4b9014
test dword [esi + 0x50], edi
jne 0x4b8ed4
push 5
call 0x505dac
pop ecx
jmp 0x4b8ffd
cmp ecx, 0x2e
jne 0x4b8eef
push 5
lea ecx, [esi + 0x24]
call fcn.004b3ba5
mov ecx, esi
call fcn.004b4ec0
jmp 0x4b8ffd
cmp ecx, 0x5c
jne 0x4b8f4c
mov ecx, esi
call fcn.004b4ec0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x4b8f21
cmp byte [esi + 0x4a], 0x62
jne 0x4b8f21
push 4
lea ecx, [esi + 0x24]
call fcn.004b3ba5
mov ecx, esi
call fcn.004b4ec0
jmp 0x4b9004
test eax, eax
je 0x4b8f40
cmp byte [esi + 0x4a], 0x42
jne 0x4b8f40
push 4
lea ecx, [esi + 0x24]
call fcn.004b3ba5
mov eax, dword [esi + 0x28]
add eax, 8
or dword [eax], 1
jmp 0x4b8f15
mov ecx, esi
call fcn.004b7ba0
jmp 0x4b8ffd
cmp ecx, 0x5b
jne 0x4b8f6f
mov ecx, esi
call fcn.004b4ec0
mov ecx, esi
call fcn.004b8e44
push 4
push 0x5d
mov ecx, esi
call fcn.004b4f50
jmp 0x4b8ffd
cmp ecx, 0x28
jne 0x4b8f91
mov ecx, esi
call fcn.004b4ec0
mov ecx, esi
call fcn.004b4f73
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.004b4f50
jmp 0x4b8ff9
cmp ecx, 0x5e
jne 0x4b8f9d
push 2
jmp 0x4b8f0d
cmp ecx, 0x24
jne 0x4b8fa9
push 3
jmp 0x4b8f0d
cmp ecx, 0x2a
je 0x4b8ff1
cmp ecx, 0x2b
je 0x4b8ff1
cmp ecx, 0x3f
je 0x4b8ff1
cmp ecx, 0x7b
je 0x4b8ff1
cmp ecx, 0x7d
jne 0x4b8fce
test dword [esi + 0x50], edi
jne 0x4b8fce
push 6
jmp 0x4b8ec9
cmp ecx, 0x5d
jne 0x4b8fdf
test dword [esi + 0x50], edi
jne 0x4b8fdf
push 4
jmp 0x4b8ec9
movzx eax, byte [esi + 0x4a]
push eax
lea ecx, [esi + 0x24]
call fcn.004b726a
jmp 0x4b8ee3
push 0xa
call 0x505dac
pop ecx
test bl, bl
je 0x4b9004
mov ecx, esi
call fcn.004b7623
mov ecx, dword [esi + 0x4c]
mov al, 1
mov bl, al
cmp ecx, 0xffffffff
jne 0x4b8eaa
pop edi
pop esi
pop ebx
ret
Function at 0x401750
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [edx]
xor al, 0x8b
or eax, 0x40c04f
push eax
sbb eax, 0x746840e0
rol byte [eax], cl
push 0x40d274
push ecx
call dword [0x40bd80]
mov eax, dword [0x424102f2]
les ebx, es:[edx + 0xfc2dc85]
push eax
push str.Total_of__d_requests_completed_n
rol byte [eax], cl
inc dword [edx + str.Stale_NFS_file_handle]
add esp, 8
xor dword [ecx], eax
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x410278]
jecxz 0x401760
mov eax, dword [0x4140ba]
je 0x4017bb
push 0x413c40
push eax
call fcn.00405850
mov cx, word [0xef410274]
jmp 0x4017cf
mov edx, dword [0x411800]
push edx
cdq
call fcn.00405850
mov cx, word [0x411cf4]
jno 0x4017d9
sbb byte [ecx], al
mov eax, dword [0x410288]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_printf]
mov word [0x410bcd], cx
test eax, eax
imul esp, dword [ebx*2 - 0x1bffea54], 0x69
add byte [ecx + 0x68], bh
cwde
aam 0x40
add bh, bh
salc
mov eax, dword [0x410278]
add esp, 8
test eax, eax
je 0x40181c
inc ebx
mov bl, 0x9d
sahf
cmp dl, byte [eax + 0x68]
inc eax
cmp al, 0x41
mov dh, 0x68
paddq mm0, qword [eax]
push dword [ecx - 0x5e343b14]
adc al, 0x40
add byte [ebp - 0x2b7f4793], al
inc eax
mov eax, dword [0x40d080]
test dword [ebp - 0x48], ebp
adc ah, 0x40
add byte [edx + 5], al
mov eax, 0x6bd47c
cmp al, 0x68
insb byte es:[edi], dx
ret 0x40
Function at 0x408db0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
xor esp, dword [eax - 0x6af0bb7b]
ror dword [ecx + 0x4d8b034d], 0xc
cmp ecx, 0x40
push esi
jg 0xa69003
vmwrite eax, dword [edi]
add al, byte [eax]
add dl, bh
cmp ecx, 0xf
ja 0x4090de
xor edx, edx
inc eax
xchg ecx, eax
adc byte [ecx + 0x24ff0040], dl
xchg ebp, eax
clc
nop
inc eax
add byte [ebx - 0x2dccf78b], cl
mov ecx, dword [esi + 0x38]
mov ecx, esp
wait
cmp cl, 2
sete dl
cmp ebp, ecx
das
mov ecx, dword [esi + 4]
lea eax, [ebp - 4]
push 4
push eax
push 8
push 0xf5ff
push ecx
call dword [0x4059b8]
inc ebp
clc
cmp cl, byte [edi]
test byte [ebx + 2], al
add byte [eax], al
mov eax, dword [ebp + 0x10]
test eax, eax
mov eax, dword [esi + 0x38]
je 0x408e3a
or al, 2
sbb al, 0x46
les esi, [ebx]
add ebx, dword [0xc25de560]
xor eax, dword [ebx]
sbb eax, 0xc25de560
or al, 0
and al, 0xfd
mov dword [esi], edx
jns 0x408e73
rcr byte [esi - 0x75], 0xe5
pop ebp
js 0x408e53
add byte [ebx - 0x36ccf78b], cl
mov edx, dword [esi + 0x38]
or edi, 8
cmp dl, 4
sete cl
cmp eax, ecx
je 0x408e31
mov eax, dword [esi + 4]
invalid
add byte [ebx - 0x7bf00008], al
sbb al, byte [ecx]
add byte [eax], al
mov eax, dword [ebp + 0x10]
test eax, eax
mov eax, dword [esi + 0x38]
je 0x408e95
mov bh, 4
mov dword [esi + 0x38], eax
xor eax, eax
pop esi
mov esp, ebp
inc esi
cmp byte [ebx], dh
rcr byte [esi - 0x75], 0xe5
pop ebp
ret 0x420c
and al, 0xfb
mov dword [ebx + 0x3ac03338], ecx
mov esp, ebp
faddp st(2)
or al, 0
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [esi + 0x38]
and ecx, 0x10
cmp cl, 0x10
sete dl
in eax, 0xc2
mov byte [ebp + eax*8 - 0x7400ecd6], al
arpl word [ecx*4 - 0x41fa03bb], ax
push eax
push 4
push 0xffff
push ecx
call [edx - 0x158c3e48]
cmp eax, 0xffffffff
je 0x409046
mov eax, dword [ebp + 0x10]
test dword [esi + 0x7461468b], edx
push cs
or al, 0x10
mov dword [esi + 0x38], eax
aaa
jge 0x408e8a
in eax, 0x5d
ret 0x5e4
je 0xce408d93
mov ecx, dword [esi + 4]
lea eax, [ebp + 0x10]
push 4
push eax
push 1
push 0xffffffffffffff80
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
sbb esi, 0xffffffff
jne 0x409086
mov esi, dword [0x5940c1d8]
call esi
test dword [ebp + edx*8 + 7], edx
inc edi
mov esp, ebp
into
sti
jne 0x409078
call esi
sbb dword [esi], eax
cld
or al, byte [eax]
pop esi
mov esp, ebp
pop ebp
ret 0xf7e1
mov esp, esp
adc byte [eax + eax*8 - 0x75], cl
inc esi
lodsd eax, dword [esi]
je 0x40909f
or ah, 2
mov dword [esi + 0x38], eax
xor ebp, esp
pop esi
mov esp, ebp
pop ebp
ret 0xfa
invalid

Function at 0x40b2ce
Capabilities:
Write file on windows

Disassembly:
wait
out dx, eax
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x55]
mov al, byte [esi - 0x67]
test al, al
je 0xffe8a1
mov ecx, dword [esi + 0x48]
enter 0x53c0, 0xffffffffffffff83
stc
add dword [edi - 0x77], edx
inc ebp
cld
out 0x45, al
or byte [edi], cl
test dword [eax + eax + 0x7e8b0000], ebx
invalid

Function at 0x40b590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test cl, ah
inc esp
stc
imul byte [ebx + 0x2a]
in al, 0x34
Function at 0x40ea40
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40eb15
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40eb30
push ebx
push 0x40eb40
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040513c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403250
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x40eac0
mov al, 0x6a
call fcn.0040e660
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040ea14
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40eac9
call fcn.0040ea14
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eb1c
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40ec30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ecfb
jmp 0x40ecef
cmp dword [esi + 0x10], 0x1000
jne 0x40ecdb
test byte [esi + 0x15], 1
jne 0x40ecdb
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x40ec8c
cmp ebp, 2
je 0x40ec8c
cmp ebp, 0x10
je 0x40ec8c
cmp ebp, 0x20
jne 0x40eca8
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40eca8
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x40ecb9
mov eax, dword [esi]
add eax, ebx
call fcn.0040ec28
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x40ecac
cmp byte [esp + 4], 0
je 0x40ecdb
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ecfb
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x40ec61
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x100016e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x1007d484]
lea eax, [esp]
push eax
push 0x1007d408
push 0
push 0
push 0x100090fc
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x1007d408
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001710
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x1000173d
mov edx, eax
and edx, 0x80000001
jns 0x10001730
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x1007d408], dl
inc eax
cmp eax, ecx
jl 0x10001721
pop ecx
ret

Function at 0x10001740
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x1007d484]
lea eax, [esp]
push eax
push 0x1007d418
push 0
push 0
push 0x10009114
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x1007d418
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001770
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x1000179d
mov edx, eax
and edx, 0x80000001
jns 0x10001790
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x1007d418], dl
inc eax
cmp eax, ecx
jl 0x10001781
pop ecx
ret

Function at 0x100017a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x1007d484]
lea eax, [esp]
push eax
push 0x1007d428
push 0
push 0
push 0x1000912c
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x1007d428
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100017d0
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x100017fd
mov edx, eax
and edx, 0x80000001
jns 0x100017f0
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x1007d428], dl
inc eax
cmp eax, ecx
jl 0x100017e1
pop ecx
ret

Function at 0x10001800
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x1007d484]
lea eax, [esp]
push eax
push 0x1007d438
push 0
push 0
push 0x10009144
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x1007d438
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001830
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x1000185d
mov edx, eax
and edx, 0x80000001
jns 0x10001850
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x1007d438], dl
inc eax
cmp eax, ecx
jl 0x10001841
pop ecx
ret
Function at 0x100027b0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x278
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
mov ebp, dword [esp + 0x284]
push esi
push edi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x100
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x130], ebp
mov dword [esp + 0x12c], 1
call sub.MSVCR90.dll_memset
mov eax, dword [0x10077378]
add esp, 0xc
push eax
lea ecx, [esp + 0x22c]
push 0x100081d0
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10002851
sub eax, esi
push eax
lea edx, [esp + 0x22c]
push edx
mov esi, ebp
call fcn.10004ce0
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, 0x41
lea esi, [esp + 0x128]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10002995
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
mov byte [esp + eax + 0x234], bl
call sub.MSVCR90.dll_memset
mov edx, dword [0x1007884c]
add esp, 0xc
push edx
lea eax, [esp + 0x22c]
push 0x100081d0
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10002910
sub eax, esi
push eax
lea ecx, [esp + 0x22c]
push ecx
mov esi, ebp
call fcn.10004ce0
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x41
lea esi, [esp + 0x130]
lea edi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10002995
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea edx, [esp + 0x230]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
jmp 0x10002997
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007058
add esp, 0x278
ret
Function at 0x100037b0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x278
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
mov ebp, dword [esp + 0x284]
push esi
push edi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x100
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x130], ebp
mov dword [esp + 0x12c], 1
call sub.MSVCR90.dll_memset
mov eax, dword [0x1007887c]
add esp, 0xc
push eax
lea ecx, [esp + 0x22c]
push 0x100081d0
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10003851
sub eax, esi
push eax
lea edx, [esp + 0x22c]
push edx
mov esi, ebp
call fcn.10004ce0
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, 0x41
lea esi, [esp + 0x128]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10003995
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
mov byte [esp + eax + 0x234], bl
call sub.MSVCR90.dll_memset
mov edx, dword [0x10079d50]
add esp, 0xc
push edx
lea eax, [esp + 0x22c]
push 0x100081d0
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10003910
sub eax, esi
push eax
lea ecx, [esp + 0x22c]
push ecx
mov esi, ebp
call fcn.10004ce0
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x41
lea esi, [esp + 0x130]
lea edi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10003995
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea edx, [esp + 0x230]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
jmp 0x10003997
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007058
add esp, 0x278
ret