joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4566a4
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
mov esi, eax
mov bl, 1
lea edx, [esi + 0x1a75]
mov ecx, ebx
mov eax, esi
call fcn.00455794
xor edx, edx
mov dl, bl
mov byte [esi + edx + 0x95f], al
inc ebx
cmp bl, 0x41
jne 0x4566ae
mov bl, 1
mov eax, 0x497c28
cmp bl, 0x20
ja 0x4566f2
xor edx, edx
mov dl, byte [eax]
mov dl, byte [esi + edx + 0x95f]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x9df], dl
jmp 0x456708
xor edx, edx
mov dl, byte [eax]
mov dl, byte [esi + edx + 0x95f]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x9df], dl
inc ebx
inc eax
cmp bl, 0x41
jne 0x4566d5
mov byte [esp], 1
xor eax, eax
mov al, byte [esp]
add eax, eax
lea eax, [eax + eax*2]
mov edx, edi
shl edx, 5
lea edx, [edx + edx*2]
lea edx, [esi + edx*8]
lea edx, [edx + eax*8 - 0x308]
mov eax, esi
call fcn.00455a18
mov bl, 1
xor eax, eax
mov al, bl
mov dl, byte [esi + eax + 0x9df]
xor byte [esi + eax + 0xa1f], dl
inc ebx
cmp bl, 0x21
jne 0x456738
push esi
push edi
lea edi, [esi + 0x9e0]
add esi, 0xa00
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [esi + 0xa00]
add esi, 0xa20
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
inc byte [esp]
cmp byte [esp], 0x11
jne 0x456713
mov bl, 1
mov eax, 0x497c68
mov dl, byte [eax]
cmp dl, 0x20
ja 0x4567af
and edx, 0xff
mov dl, byte [esi + edx + 0x9ff]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x99f], dl
jmp 0x4567c7
and edx, 0xff
mov dl, byte [esi + edx + 0x9bf]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x99f], dl
inc ebx
inc eax
cmp bl, 0x41
jne 0x45678e
mov bl, 1
xor eax, eax
mov al, bl
mov al, byte [esi + eax + 0x99f]
push eax
lea edx, [esi + 0x1a75]
mov ecx, ebx
mov eax, esi
call fcn.004557c0
inc ebx
cmp bl, 0x41
jne 0x4567d0
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x45682c
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
mov esi, eax
mov bl, 1
lea edx, [esi + 0x1a75]
mov ecx, ebx
mov eax, esi
call fcn.00455794
xor edx, edx
mov dl, bl
mov byte [esi + edx + 0x95f], al
inc ebx
cmp bl, 0x41
jne 0x456836
mov bl, 1
mov eax, 0x497c28
cmp bl, 0x20
ja 0x45687a
xor edx, edx
mov dl, byte [eax]
mov dl, byte [esi + edx + 0x95f]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x9df], dl
jmp 0x456890
xor edx, edx
mov dl, byte [eax]
mov dl, byte [esi + edx + 0x95f]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x9df], dl
inc ebx
inc eax
cmp bl, 0x41
jne 0x45685d
mov byte [esp], 1
xor eax, eax
mov al, byte [esp]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
mov edx, edi
shl edx, 5
lea edx, [edx + edx*2]
lea edx, [esi + edx*8]
lea edx, [edx + eax*8 - 0x308]
mov eax, esi
call fcn.00455a18
mov bl, 1
xor eax, eax
mov al, bl
mov dl, byte [esi + eax + 0x9df]
xor byte [esi + eax + 0xa1f], dl
inc ebx
cmp bl, 0x21
jne 0x4568c9
push esi
push edi
lea edi, [esi + 0x9e0]
add esi, 0xa00
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [esi + 0xa00]
add esi, 0xa20
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
inc byte [esp]
cmp byte [esp], 0x11
jne 0x45689b
mov bl, 1
mov eax, 0x497c68
mov dl, byte [eax]
cmp dl, 0x20
ja 0x456940
and edx, 0xff
mov dl, byte [esi + edx + 0x9ff]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x99f], dl
jmp 0x456958
and edx, 0xff
mov dl, byte [esi + edx + 0x9bf]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x99f], dl
inc ebx
inc eax
cmp bl, 0x41
jne 0x45691f
mov bl, 1
xor eax, eax
mov al, bl
mov al, byte [esi + eax + 0x99f]
push eax
lea edx, [esi + 0x1a75]
mov ecx, ebx
mov eax, esi
call fcn.004557c0
inc ebx
cmp bl, 0x41
jne 0x456961
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4569d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
mov eax, dword [esi + 0xa70]
mov dword [esp], eax
xor edx, edx
mov dl, byte [esi + 0x1ab5]
mov ecx, dword [esp]
mov eax, esi
call fcn.004561bc
mov ebx, eax
mov eax, dword [esi + 0xa68]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
test bl, bl
jbe 0x456ac5
xor ecx, ecx
mov cl, byte [esi + 0x1ab5]
lea edx, [esi + 0x1a75]
mov eax, dword [esi + 0xa48]
call fcn.00402804
mov eax, esi
call fcn.004567f8
mov edi, ebx
and edi, 0xff
dec edi
test di, di
jb 0x456a65
inc edi
xor eax, eax
movzx edx, ax
mov ecx, edx
add ecx, dword [esp + 4]
mov cl, byte [esi + ecx + 0xa74]
xor cl, byte [esi + edx + 0x1a75]
push ecx
mov ecx, dword [esp + 0xc]
add ecx, edx
pop edx
mov byte [ecx], dl
inc eax
dec di
jne 0x456a3e
mov al, byte [esi + 0x1ab5]
cmp bl, al
jne 0x456a84
xor ecx, ecx
mov cl, al
mov edx, dword [esi + 0xa48]
mov eax, dword [esp + 8]
call fcn.00402804
jmp 0x456a9a
xor eax, eax
mov al, bl
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0xa48]
mov eax, esi
call fcn.004561c8
xor eax, eax
mov al, bl
sub dword [esp], eax
add dword [esp + 8], eax
add dword [esp + 4], eax
xor edx, edx
mov dl, byte [esi + 0x1ab5]
mov ecx, dword [esp]
mov eax, esi
call fcn.004561bc
mov ebx, eax
test bl, bl
ja 0x456a0d
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x456acc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
mov eax, dword [esi + 0xa70]
mov dword [esp], eax
xor edx, edx
mov dl, byte [esi + 0x1ab5]
mov ecx, dword [esp]
mov eax, esi
call fcn.004561bc
mov ebx, eax
mov eax, dword [esi + 0xa68]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
test bl, bl
jbe 0x456bcf
xor ecx, ecx
mov cl, byte [esi + 0x1ab5]
lea edx, [esi + 0x1a75]
mov eax, dword [esi + 0xa48]
call fcn.00402804
mov eax, esi
call fcn.004567f8
mov al, byte [esi + 0x1ab5]
cmp bl, al
jne 0x456b4f
xor ecx, ecx
mov cl, al
mov edx, dword [esi + 0xa48]
mov eax, dword [esp + 4]
lea eax, [esi + eax + 0xa74]
call fcn.00402804
jmp 0x456b6c
xor eax, eax
mov al, bl
push eax
mov eax, dword [esp + 8]
lea ecx, [esi + eax + 0xa74]
mov edx, dword [esi + 0xa48]
mov eax, esi
call fcn.004561c8
mov edi, ebx
and edi, 0xff
dec edi
test di, di
jb 0x456ba4
inc edi
xor eax, eax
movzx edx, ax
mov ecx, edx
add ecx, dword [esp + 4]
mov cl, byte [esi + ecx + 0xa74]
xor cl, byte [esi + edx + 0x1a75]
push ecx
mov ecx, dword [esp + 0xc]
add ecx, edx
pop edx
mov byte [ecx], dl
inc eax
dec di
jne 0x456b7d
xor eax, eax
mov al, bl
sub dword [esp], eax
add dword [esp + 4], eax
add dword [esp + 8], eax
xor edx, edx
mov dl, byte [esi + 0x1ab5]
mov ecx, dword [esp]
mov eax, esi
call fcn.004561bc
mov ebx, eax
test bl, bl
ja 0x456b09
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x456cf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov eax, dword [ebx + 0xa68]
mov dword [esp], eax
xor esi, esi
jmp 0x456d11
mov byte [ebx + ecx + 0xa74], 0
inc dword [ebx + 0xa70]
xor eax, eax
mov al, byte [ebx + 0x1ab5]
push eax
mov ecx, dword [ebx + 0xa70]
mov eax, ecx
pop edx
mov edi, edx
cdq
idiv edi
test edx, edx
jne 0x456d03
xor ecx, ecx
mov cl, byte [ebx + 0x1ab5]
lea edx, [ebx + 0x1a75]
lea eax, [ebx + esi + 0xa74]
call fcn.00402804
xor edx, edx
mov dl, byte [ebx + 0x1ab5]
dec edx
test dx, dx
jb 0x456d70
inc edx
xor eax, eax
movzx edi, ax
mov ecx, dword [ebx + 0xa48]
mov cl, byte [ecx + edi]
xor byte [ebx + edi + 0x1a75], cl
inc eax
dec dx
jne 0x456d57
mov eax, ebx
call fcn.004567f8
xor ecx, ecx
mov cl, byte [ebx + 0x1ab5]
mov edx, dword [ebx + 0xa48]
lea eax, [ebx + 0x1a75]
call fcn.00402804
mov eax, dword [esp]
lea edx, [eax + esi]
xor ecx, ecx
mov cl, byte [ebx + 0x1ab5]
lea eax, [ebx + 0x1a75]
call fcn.00402804
xor eax, eax
mov al, byte [ebx + 0x1ab5]
add esi, eax
cmp esi, dword [ebx + 0xa70]
jne 0x456d2c
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x456dc4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov eax, dword [ebx + 0xa68]
mov dword [esp], eax
xor esi, esi
jmp 0x456de5
mov byte [ebx + ecx + 0xa74], 0
inc dword [ebx + 0xa70]
xor eax, eax
mov al, byte [ebx + 0x1ab5]
push eax
mov ecx, dword [ebx + 0xa70]
mov eax, ecx
pop edx
mov edi, edx
cdq
idiv edi
test edx, edx
jne 0x456dd7
xor ecx, ecx
mov cl, byte [ebx + 0x1ab5]
lea edx, [ebx + 0x1a75]
lea eax, [ebx + esi + 0xa74]
call fcn.00402804
mov eax, ebx
call fcn.00456988
xor edx, edx
mov dl, byte [ebx + 0x1ab5]
dec edx
test dx, dx
jb 0x456e4b
inc edx
xor eax, eax
movzx edi, ax
mov ecx, dword [ebx + 0xa48]
mov cl, byte [ecx + edi]
xor byte [ebx + edi + 0x1a75], cl
inc eax
dec dx
jne 0x456e32
xor ecx, ecx
mov cl, byte [ebx + 0x1ab5]
mov edx, dword [ebx + 0xa48]
lea eax, [ebx + esi + 0xa74]
call fcn.00402804
mov eax, dword [esp]
lea edx, [eax + esi]
xor ecx, ecx
mov cl, byte [ebx + 0x1ab5]
lea eax, [ebx + 0x1a75]
call fcn.00402804
xor eax, eax
mov al, byte [ebx + 0x1ab5]
add esi, eax
cmp esi, dword [ebx + 0xa70]
jne 0x456e00
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x463f40
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4640a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403b7c
mov eax, dword [ebp - 0x10]
call fcn.00463bbc
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x463f92
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00403fc0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00464568
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x464067
xor eax, eax
push ebp
push 0x464060
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00463d24
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004640d8
test al, al
je 0x46403e
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403bc8
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x46403e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403f40
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x464038
mov eax, dword [ebp - 0x14]
call fcn.00403f40
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403c98
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00463f40
dec ebx
cmp ebx, 0xffffffff
jne 0x463ff1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464067
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00463d24
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00403f40
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00463d10
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4640b0
lea eax, [ebp - 0x3c]
call fcn.00403ae4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403b08
ret
Function at 0x464067
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4640a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403b7c
mov eax, dword [ebp - 0x10]
call fcn.00463bbc
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x463f92
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00403fc0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00464568
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x464067
xor eax, eax
push ebp
push 0x464060
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00463d24
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004640d8
test al, al
je 0x46403e
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403bc8
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x46403e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403f40
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x464038
mov eax, dword [ebp - 0x14]
call fcn.00403f40
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403c98
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00463f40
dec ebx
cmp ebx, 0xffffffff
jne 0x463ff1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464067
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00463d24
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00403f40
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00463d10
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4640b0
lea eax, [ebp - 0x3c]
call fcn.00403ae4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403b08
ret

Function at 0x4640d8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402b6c
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x49a670]
cmp byte [edx + 8], 0
je 0x46413c
mov edx, dword [0x49a664]
cmp dword [edx], 2
jne 0x46413c
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x464140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4641f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004640d8
test al, al
je 0x4641da
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403bc8
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x4641da
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403f40
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00403f40
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403c98
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x464193
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4641ff
lea eax, [ebp - 0x2c]
call fcn.00403ae4
lea eax, [ebp - 0xc]
call fcn.00403ae4
ret

Function at 0x464404
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464495
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.00463bd0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403f40
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x46447f
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x49a410]
call fcn.00405624
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x463a1c]
call fcn.0040b2bc
call fcn.00403558
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46449c
lea eax, [ebp - 0x10]
call fcn.00403ae4
ret
Function at 0x4644a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464543
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403f40
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x46451d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x49a67c]
call fcn.00405624
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x463a1c]
call fcn.0040b2bc
call fcn.00403558
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00463c00
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46454a
lea eax, [ebp - 0x10]
call fcn.00403ae4
ret

Function at 0x4675d4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x467602
mov eax, ebx
call fcn.00468078
cmp dword [ebx + 0x3c], 0
je 0x4675fb
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x467673
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x467665
cmp dword [ebx + 8], 0
je 0x467624
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x467636
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x467665
cmp dword [ebx + 8], 0
je 0x467617
cmp eax, 3
je 0x467649
dec eax
jne 0x467617
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x467617
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x467617
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x467691
cmp dword [ebx + 0x10], 0xcc
je 0x467691
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046769c
pop ebx
ret
Function at 0x480828
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x480831
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4809ab
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [edx + 0xa], 0
jbe 0x480864
mov byte [ebx + 0xb4], 0
jmp 0x48086b
mov byte [ebx + 0xb4], 1
mov eax, dword [edx]
sub eax, 0x465
je 0x48088e
dec eax
je 0x480965
dec eax
je 0x480991
dec eax
je 0x48099a
jmp 0x4809a1
movzx eax, word [edx + 8]
cmp eax, 8
jg 0x4808b0
je 0x48094d
dec eax
je 0x48093b
dec eax
je 0x480944
jmp 0x4809a1
sub eax, 0x10
je 0x4808bf
sub eax, 0x10
je 0x4808eb
jmp 0x4809a1
cmp byte [ebx + 0xb4], 0
je 0x4809a1
mov byte [ebx + 0x2a0], 1
cmp word [ebx + 0x3a], 0
je 0x4809a1
mov edx, ebx
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
jmp 0x4809a1
push 0
push 0x3fff
lea eax, [ebp - 0x4000]
push eax
movzx eax, word [ebx + 0x294]
push eax
call sub.wsock32.dll_recv
mov esi, eax
test esi, esi
jle 0x48091f
lea edx, [ebp - 0x4000]
mov eax, dword [ebx + 0x29c]
mov ecx, esi
call fcn.004126e4
dec esi
jl 0x48092b
cmp byte [ebx + 0x84], 0
je 0x4808eb
mov byte [ebx + 0x2a0], 0
mov eax, ebx
call fcn.00480e54
jmp 0x4809a1
mov eax, ebx
call fcn.004809bc
jmp 0x4809a1
mov eax, ebx
call fcn.00480bf0
jmp 0x4809a1
mov byte [ebx + 0x2a0], 1
cmp word [ebx + 0x32], 0
je 0x4809a1
mov edx, ebx
mov eax, dword [ebx + 0x34]
call dword [ebx + 0x30]
jmp 0x4809a1
mov byte [ebx + 0xd4], 1
cmp word [edx + 8], 8
jne 0x4809a1
mov byte [ebx + 0x2a0], 1
test byte [ebx + 0x20], 8
jne 0x4809a1
cmp word [ebx + 0x42], 0
je 0x4809a1
mov edx, ebx
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
jmp 0x4809a1
mov eax, ebx
call fcn.00480bf0
jmp 0x4809a1
mov eax, ebx
call fcn.004809bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4809b5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4809bc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x4809c5
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x4010], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x480be2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x84], 0
je 0x480a40
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x294]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov eax, dword [ebp - 4]
cmp word [eax + 0x28e], 0
je 0x480a40
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x290]
call dword [ebx + 0x28c]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x79], 0
jne 0x480bc1
xor eax, eax
push ebp
push 0x480bba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x79], 1
lea edx, [ebp - 0x4010]
mov eax, dword [0x49a1cc]
call fcn.00405624
mov ecx, dword [ebp - 0x4010]
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.0048100c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x29c]
mov eax, ebx
call fcn.00412630
mov edx, eax
mov eax, ebx
call fcn.00412624
push 0
push 0x3fff
lea eax, [ebp - 0x4009]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x294]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
je 0x480b2f
lea edx, [ebp - 0x4009]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
mov ecx, ebx
call fcn.004126e4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x78], 0
je 0x480b07
mov eax, dword [ebp - 4]
add dword [eax + 0xc0], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0xc6], 0
je 0x480b07
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc8]
call dword [esi + 0xc4]
mov byte [ebp - 9], 1
cmp ebx, 0x3fff
jne 0x480b89
mov eax, dword [ebp - 4]
push eax
push 0
push 0x468
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
call sub.user32.dll_PostMessageA
jmp 0x480b89
call sub.wsock32.dll_WSAGetLastError
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x88], ebx
lea ecx, [ebp - 8]
mov edx, ebx
cmp edx, 0xffff
jbe 0x480b51
call fcn.00402db4
mov eax, dword [ebp - 4]
call fcn.004802c0
mov eax, dword [ebp - 4]
cmp word [eax + 0x4a], 0
je 0x480b89
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
cmp ecx, 0xffff
jbe 0x480b7d
call fcn.00402db4
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x4c]
call dword [ebx + 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480bc1
mov eax, dword [ebp - 4]
mov byte [eax + 0x79], 0
cmp byte [ebp - 9], 0
je 0x480bb9
mov eax, dword [ebp - 4]
cmp word [eax + 0x2a], 0
je 0x480bb9
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2c]
call dword [ebx + 0x28]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480be9
lea eax, [ebp - 0x4010]
call fcn.00403ae4
lea eax, [ebp - 8]
call fcn.00403ae4
ret