joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6f30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x530630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ebx
mov ebx, dword [esi + 0x134]
push edi
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push ebx
mov dword [ebp - 0x1c], eax
or edi, 0xffffffff
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4b6f82
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push ebx
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.004aa420
add esp, 8
cmp edi, 0xffffffff
jne 0x4b6fb7
mov edx, dword [ebp - 0x1c]
push str.Error_accept__ing_server_connect
push edx
call fcn.004a9660
add esp, 8
pop edi
mov eax, 0x1e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cab85
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
push str.Connection_accepted_from_server_n
push eax
call fcn.004a95e0
push 1
push edi
mov dword [esi + 0x134], edi
call fcn.004c40b0
mov ecx, dword [ebp - 4]
add esp, 0x10
pop edi
xor ecx, ebp
mov dword [esi + 0x13c], 1
xor eax, eax
pop ebx
call fcn.004cab85
mov esp, ebp
pop ebp
ret
Function at 0x4b8150
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
mov ebx, dword [edi]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x4b8184
push str.Couldnt_set_desired_mode
push ebx
call fcn.004a9660
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x4b819b
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.004a95e0
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x4b81b0
mov eax, edi
call fcn.004b7d10
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x4b81c4
push edi
call fcn.004b7d60
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x4b81d6
mov eax, edi
call fcn.004b7e80
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x4b81e4
mov eax, edi
call fcn.004b7e90
mov esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c2090
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x4c20a1
jmp dword [ecx*4 + 0x4c2110]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret

Function at 0x4c22a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x530630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.004d4439
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x4c2304
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x4c2304
lea edx, [ebp - 0x108]
push edx
call dword [0x5305a8]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cab85
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004cab85
mov esp, ebp
pop ebp
ret

Function at 0x4c2320
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c22a0

Function at 0x4c43b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1a8]
test esi, esi
jne 0x4c43cb
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.004adcc0
push edx
push eax
call fcn.004adcf0
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x19c], 0
je 0x4c4418
mov eax, dword [ebx + 0x124]
mov ecx, dword [ebx + 0x120]
push eax
push ecx
call fcn.004adcc0
push edx
push eax
call fcn.004adcf0
mov ecx, dword [edi + 0x19c]
sub ecx, eax
add esp, 0x10
mov eax, ecx
cmp esi, ecx
jge 0x4c441a
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4c5680
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x4c56b3
push 0x2e
push esi
call fcn.004d3100
add esp, 8
test eax, eax
je 0x4c56b1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x4c56c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x4c7470
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x4c7492
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4c7486
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x4c74c2
cmp dword [esi + 8], 0
jne 0x4c74b5
mov ecx, dword [eax + 8]
push 0x50a95c
push ecx
call fcn.004cbb58
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4c74b5
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.004d2bc4
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4c74e4
mov eax, dword [esi + 8]
test eax, eax
je 0x4c74de
push eax
call fcn.004cba28
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x4c7c90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x53059c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4c7cbb
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x4c7d02
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x4c7d05
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x4c7d66
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x4c7d30
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x4c7d9f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push str.6_blank
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x50662b
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x4c7d70
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4cab85
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x530630]
jne 0x4cab8f
repz ret
jmp fcn.004d5e19

Function at 0x4ce17a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4ce1a1
call fcn.004cfb2e
mov dword [eax], esi
call fcn.004cfb1b
push 0x16
pop esi
mov dword [eax], esi
call fcn.004d5694
mov eax, esi
jmp 0x4ce1f6
test dword [ebp + 0xc], 0xfffffff9
jne 0x4ce187
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4ce1ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004cfb41
pop ecx
call fcn.004cfb1b
mov eax, dword [eax]
jmp 0x4ce1f6
test al, 0x10
jne 0x4ce1f4
test al, 1
je 0x4ce1f4
test byte [ebp + 0xc], 2
je 0x4ce1f4
call fcn.004cfb2e
mov dword [eax], 5
call fcn.004cfb1b
mov dword [eax], 0xd
jmp 0x4ce1c5
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4e121e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x530630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004d56db
and dword [ebp - 0x14], 0
cmp dword [0x533678], 0
mov dword [ebp - 0x18], eax
jne 0x4e12d1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4e1379
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4e1379
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x50923c
push ebx
mov dword [0x533678], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x53367c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x533680], eax
call edi
push eax
call esi
mov dword [0x533688], eax
test eax, eax
je 0x4e12d1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x533684], eax
mov eax, dword [0x533684]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4e132a
cmp dword [0x533688], ecx
je 0x4e132a
push eax
call esi
push dword [0x533688]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4e132a
test ebx, ebx
je 0x4e132a
call edi
test eax, eax
je 0x4e1321
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4e1321
test byte [ebp - 8], 1
jne 0x4e132a
or dword [ebp + 0x10], 0x200000
jmp 0x4e135d
mov eax, dword [0x53367c]
cmp eax, dword [ebp - 0x18]
je 0x4e135d
push eax
call esi
test eax, eax
je 0x4e135d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4e135d
mov eax, dword [0x533680]
cmp eax, dword [ebp - 0x18]
je 0x4e135d
push eax
call esi
test eax, eax
je 0x4e135d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x533678]
call esi
test eax, eax
je 0x4e1379
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4e137b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cab85
leave
ret
Function at 0x4e4fed
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x530630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e50c2
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e50b1
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x4e509b
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x4e50b1
push eax
push edi
push dword [ebp - 0x110]
call fcn.004e4f8a
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x4e50c4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004cab85
leave
ret 4
Function at 0x403090
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push esi
push edi
call fcn.00407300
push eax
push str._Consent
push str.ROCred.Privacy
push str.Ai4rei.E.Skal
call fcn.00410cf0
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
mov dword [esp + 0xc], eax
jne 0x4030d0
push eax
call fcn.00410d10
test al, al
jne 0x40314c
mov eax, dword [esp + 0xc]
push eax
mov esi, 1
call fcn.00410d10
test al, al
je 0x403105
mov eax, dword [esp + 0xc]
push eax
call fcn.00410d20
test al, al
je 0x4030f2
mov esi, 3
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00410d30
test al, al
je 0x40310a
or esi, 4
jmp 0x40310a
mov esi, 7
lea edx, [esp + 0xc]
push edx
push str.http:__ai4rei.net_about_telemetry_
push esi
push ebx
push 0xfffffffffffffffa
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call fcn.00410c90
test al, al
je 0x4031a1
mov eax, dword [esp + 0xc]
push eax
call fcn.00407300
push eax
push str._Consent
push str.ROCred.Privacy
push str.Ai4rei.E.Skal
call fcn.00410cc0
test edi, edi
jne 0x4031a1
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00410d10
test al, al
je 0x4031a1
mov edx, dword [esp + 0xc]
push edx
call fcn.00410d20
test al, al
jne 0x403176
mov eax, dword [esp + 0xc]
push eax
call fcn.00410d30
test al, al
je 0x4031a1
lea ecx, [esp + 0x18]
push ecx
push 4
push ebx
push 0x4031b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x4031a1
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x404270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x38
push ebx
push esi
push str.MediaBackground
call fcn.004072a0
mov cl, byte [eax]
xor ebx, ebx
cmp cl, bl
je 0x404385
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404385
mov esi, dword [esp + 0x44]
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
push 0xfffffffffffffffa
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0x7f00
push ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], 0x406550
mov dword [esp + 0x48], str.BackgroundMediaClass
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x2c], 4
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
pop edi
je 0x404385
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov al, byte [0x43d700]
test al, 1
jne 0x40434a
mov dl, al
push 0x404cd0
or dl, 1
mov dword [0x43d714], ebx
mov byte [0x43d700], dl
mov byte [0x43d718], bl
mov byte [0x43d719], bl
mov byte [0x43d71c], bl
mov dword [0x43d710], 0x430b80
call fcn.00426148
add esp, 4
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push 0x43d710
push edx
mov edx, dword [esp + 0x18]
push 0x6b
sub ecx, eax
push esi
push ecx
mov ecx, dword [esp + 0x1c]
sub edx, ecx
push edx
push eax
push ecx
push 0x54000000
push 0x4304a8
push str.BackgroundMediaClass
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
pop esi
mov al, 1
pop ebx
add esp, 0x38
ret
Function at 0x407330
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x214
push ebx
push 0x432cfc
push 0x43d32c
xor bl, bl
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.0041cc90
push 0x4310ec
push str.FontSize
push 0
push str.ROCred
push 0
push 0x43d32c
call fcn.0041c4d0
push 0
push 0x43d32c
call fcn.0041c8a0
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
push ecx
push 0x4310e4
push 0xa
push 0
call fcn.004151b0
test eax, eax
je 0x40748a
lea edx, [esp + 0x114]
push 0x104
push edx
call fcn.00414fa0
test eax, eax
je 0x407476
lea eax, [esp + 0x10]
push 0x104
push eax
push 0
lea ecx, [esp + 0x120]
push str.rcd
push ecx
call fcn.00414de0
test eax, eax
je 0x407476
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x407476
push esi
push eax
push eax
push 3
push eax
push eax
lea edx, [esp + 0x28]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x407466
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push edx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
je 0x407460
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push eax
push 0x43d32c
call fcn.0041ca00
test al, al
je 0x407466
push 0
push 0x4074c0
push 0x43d32c
call fcn.0041c340
mov bl, 1
jmp 0x407466
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test bl, bl
pop esi
jne 0x40748a
push 0x43d32c
call fcn.0041ccb0
xor al, al
pop ebx
add esp, 0x214
ret
push 0x4310d8
push 0
push 0x104
push 0x43d228
push 0
call fcn.00414bf0
test al, al
je 0x4074b5
push 0x43d228
push 0x43d32c
call fcn.0041ca00
mov al, 1
pop ebx
add esp, 0x214
ret

Function at 0x4099c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor bl, bl
cmp byte [eax], 0x2e
jne 0x409a19
lea ecx, [esp + 8]
push ecx
push 1
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409a19
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 8]
push eax
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409a0e
mov bl, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
ret 0xc
Function at 0x409a80
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
push edi
push str.PolicyNoTrayIcon
call fcn.004072c0
test eax, eax
mov ebp, dword [esp + 0x88]
push 0xfffffffffffffffa
push ebp
sete bl
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
mov ecx, 0x15
xor eax, eax
lea edi, [esp + 0x30]
mov dword [esp + 0x2c], 0x58
push 6
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
call edi
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ebp
call edi
test bl, bl
je 0x409b1c
push 1
push esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 6
call fcn.00416bf0
push 0x40
mov dword [esp + 0x44], eax
lea eax, [esp + 0x48]
push eax
push 0x3ec
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0x40
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0xff
push 0xffffffffffffffff
lea edx, [esp + 0x94]
push 0
push edx
push 1
call edi
test eax, eax
je 0x409bb5
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call esi
test eax, eax
je 0x409b9c
lea ecx, [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x409b89
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
call esi
test eax, eax
jne 0x409b63
push 0xff
push 0xffffffffffffffff
lea edx, [esp + 0x94]
push 0
push edx
push 1
call edi
test eax, eax
jne 0x409b50
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
test bl, bl
je 0x409bd5
lea eax, [esp + 0x2c]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 2
push ebp
call esi
push 9
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret 8
Function at 0x409bf0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1a40
call fcn.00426190
push ebp
push esi
push edi
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0x3c
lea edx, [esp + 0x24c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1a5c]
lea eax, [esp + 0x1a60]
push eax
push ecx
push edx
mov byte [esp + 0x1b], 0
call dword [sym.imp.USER32.dll_wvsprintfA]
mov esi, dword [esp + 0x1a58]
mov cl, 0x5c
cmp byte [esi], cl
jne 0x409c7f
cmp byte [esi + 1], cl
jne 0x409c7f
cmp byte [esi + 2], 0x3f
jne 0x409c78
cmp byte [esi + 3], cl
jne 0x409c7f
mov al, byte [esi + 4]
cmp al, 0x55
je 0x409c5d
cmp al, 0x75
jne 0x409c7f
mov al, byte [esi + 5]
cmp al, 0x4e
je 0x409c68
cmp al, 0x6e
jne 0x409c7f
mov al, byte [esi + 6]
cmp al, 0x43
je 0x409c73
cmp al, 0x63
jne 0x409c7f
cmp byte [esi + 7], cl
jne 0x409c7f
mov eax, 1
jmp 0x409c81
xor eax, eax
neg al
mov edi, dword [esp + 0x1a50]
lea ecx, [esp + 0x14c]
sbb eax, eax
push 0x100
and eax, 0x80
push ecx
or eax, 0x441
push str..exe
mov dword [esp + 0x20], eax
lea eax, [esp + 0x258]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 1
call fcn.004099c0
test al, al
je 0x409ce5
lea edx, [esp + 0x14c]
mov dword [esp + 0x38], edx
jmp 0x409ced
mov dword [esp + 0x38], str.exefile
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x409d2e
mov eax, dword [esp + 0x48]
test eax, eax
je 0x409dd1
test byte [esp + 0x1a54], 1
jne 0x409d1d
push eax
push edi
call fcn.00409a80
mov eax, dword [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0xf], 1
jmp 0x409dd1
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x4c7
je 0x409dd1
push 0
lea ecx, [esp + 0x650]
push 0x400
push ecx
push 0x400
call ebp
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea edx, [esp + 0x4c]
push 0x100
push edx
push 0x3f3
push 0xfffffffffffffffa
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x64c]
lea ecx, [esp + 0x24c]
push eax
push ecx
lea edx, [esp + 0x54]
push esi
push edx
lea eax, [esp + 0xa5c]
push 0x1000
push eax
call fcn.00409970
add esp, 0x18
lea ecx, [esp + 0xa4c]
push 0x10
push ecx
push edi
call fcn.00401100
lea edx, [esp + 0xa4c]
push 0x1000
push edx
call fcn.004099a0
lea eax, [esp + 0x24c]
push 0x400
push eax
call fcn.004099a0
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
add esp, 0x1a40
ret