joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404610
Capabilities:
Check mutex on windows
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x24
mov eax, dword [0x446c44]
test eax, eax
je 0x404820
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
cmp byte [0x446b40], 0
je 0x404790
mov dword [esp + 4], 0x431a35
mov dword [esp], 0x446b40
call sym._fopen
test eax, eax
mov ebx, eax
je 0x404746
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._fseek
mov dword [esp], ebx
call sym._ftell
mov dword [esp], ebx
mov esi, eax
call sym._fclose
cmp esi, 0x9c4000
jg 0x404760
mov dword [esp + 4], 0x431a38
mov dword [esp], 0x446b40
call sym._fopen
test eax, eax
mov ebx, eax
je 0x404746
call dbg.currentDateTimeString
mov dword [esp + 4], ebx
mov dword [esp], eax
lea esi, [esp + 0x10]
call sym._fputs
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x431a3b
call sym._fwrite
mov dword [esp + 4], ebx
mov dword [esp], 0x44f260
call sym._fputs
call sym._GetCurrentThreadId_0
mov dword [esp + 8], str.___007d_:
mov dword [esp + 0xc], eax
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], esi
call sym.___mingw_snprintf
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._fputs
lea eax, [esp + 0x34]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sym._vfprintf
mov dword [esp], ebx
call sym._fclose
mov eax, dword [0x446c44]
test eax, eax
je 0x40475a
mov dword [esp], eax
call sym._ReleaseMutex_4
sub esp, 4
add esp, 0x24
pop ebx
pop esi
ret
mov dword [esp + 4], 0x4313ab
mov dword [esp], 0x446b40
call sym._fopen
test eax, eax
je 0x404696
mov dword [esp], eax
call sym._fclose
jmp 0x404696
call dbg.currentTempDirectoryPathname
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
mov dword [esp], 0x446b40
call sym._strncpy
mov edx, 0x446b40
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4047b2
test eax, 0x8080
jne 0x4047d5
shr eax, 0x10
add edx, 2
mov ecx, eax
add cl, al
sbb edx, 0x446b43
mov dword [edx + 0x446b40], 0x6f6d6572
mov dword [edx + 0x446b44], 0x796c6574
mov dword [edx + 0x446b48], 0x696c635f
mov dword [edx + 0x446b4c], 0x2e746e65
mov dword [edx + 0x446b50], 0x676f6c
jmp 0x404642
mov dword [esp + 8], str.Global_Remotely_Client_Logging_Mutex
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateMutexA_12
sub esp, 0xc
test eax, eax
mov dword [0x446c44], eax
je 0x404635
jmp 0x404622
Function at 0x404980
Capabilities:
Set registry value

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x44
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x38]
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareImage_Retail_Solutions_LtdRemotely_
mov dword [esp], 0x80000002
mov dword [esp + 0x1c], eax
call sym._RegCreateKeyExA_36
sub esp, 0x24
test eax, eax
jne 0x404a50
mov dword [esp], ebx
call sym._strlen
add eax, 1
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], 0
mov dword [esp + 4], str.ContractID
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
test eax, eax
mov esi, eax
je 0x404a70
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_set_value_for_contract_ID_in_registry__due_to_error_code__d_r_n
call dbg.logEvent
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sym._RegCloseKey_4
xor eax, eax
sub esp, 4
test esi, esi
sete al
add esp, 0x44
pop ebx
pop esi
ret
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_create_registry_key_to_hold_config__due_to_error_code__d_r_n
call dbg.logEvent
add esp, 0x44
xor eax, eax
pop ebx
pop esi
ret
mov dword [esp + 4], ebx
mov dword [esp], str.Contract_ID__s_stored_in_registry_r_n
call dbg.logEvent
jmp 0x404a2a
Function at 0x404e00
Capabilities:
Get mac address on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2bc
mov dword [esp], 0x280
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], 0x280
call sym._malloc
test eax, eax
mov dword [esp + 0x1c], eax
je 0x405057
lea ebx, [esp + 0x2c]
mov dword [esp], eax
mov esi, eax
mov dword [esp + 4], ebx
call sym._GetAdaptersInfo_8
sub esp, 8
cmp eax, 0x6f
je 0x40500d
lea edi, [esp + 0x30]
xor eax, eax
mov ecx, 0xa0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._GetAdaptersInfo_8
sub esp, 8
test eax, eax
jne 0x405040
mov dword [esp + 0x14], 0
mov ebx, dword [esp + 0x1c]
lea esi, [esp + 0x30]
mov eax, dword [esp + 0x14]
nop
lea esi, [esi]
mov edi, dword [ebx + 0x190]
shl eax, 6
xor ebp, ebp
mov dword [esp + 0x10], eax
test edi, edi
je 0x404ef4
mov dword [esp], esi
call sym._strlen
lea edx, [edi - 1]
cmp edx, ebp
movzx edx, byte [ebx + ebp + 0x194]
mov dword [esp + 0xc], edx
je 0x404f90
mov edx, 0x40
lea ecx, [esp + 0x30]
mov dword [esp + 8], str._.2X:
sub edx, eax
add eax, dword [esp + 0x10]
add ebp, 1
mov dword [esp + 4], edx
add eax, ecx
mov dword [esp], eax
call sym.___mingw_snprintf
mov edi, dword [ebx + 0x190]
cmp edi, ebp
ja 0x404ea3
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x1a0]
mov dword [esp], str.NIC_adapter__d_found__of_type__d._MAC_address___s_r_n
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call dbg.logEvent
mov eax, dword [esp + 0x18]
test eax, eax
je 0x404fd0
cmp dword [ebx + 0x1a0], 6
je 0x404fd0
mov ebx, dword [ebx]
add dword [esp + 0x14], 1
add esi, 0x40
mov eax, dword [esp + 0x14]
test ebx, ebx
je 0x404f4a
cmp eax, 9
jle 0x404e90
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sym._free
cmp byte [0x44f160], 0
je 0x404ffa
mov dword [esp + 4], 0x44f160
mov dword [esp], str.MAC_address__s_chosen_as_UID_r_n
call dbg.logEvent
mov eax, 1
add esp, 0x2bc
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0x40
lea ecx, [esp + 0x30]
mov dword [esp + 8], str._.2X
sub edx, eax
add eax, dword [esp + 0x10]
mov ebp, edi
mov dword [esp + 4], edx
add eax, ecx
mov dword [esp], eax
call sym.___mingw_snprintf
mov edi, dword [ebx + 0x190]
cmp edi, ebp
ja 0x404ea3
jmp 0x404ef4
cmp byte [0x44f160], 0
jne 0x404f2f
mov dword [esp + 8], 0x12
mov dword [esp + 4], esi
mov dword [esp], 0x44f160
call sym._strncpy
jmp 0x404f2f
mov dword [esp], str.Could_not_find_NIC_of_desired_type..._r_n
call dbg.logEvent
xor eax, eax
jmp 0x404f7c
mov dword [esp], esi
call sym._free
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._malloc
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x404e4c
mov dword [esp], str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_r_n
call dbg.logEvent
xor eax, eax
jmp 0x404f7c
mov dword [esp + 4], eax
mov dword [esp], str.GetAdaptersInfo_failed_with_error:__d_r_n
call dbg.logEvent
xor eax, eax
jmp 0x404f7c
mov dword [esp], str.Error_allocating_memory_for_GetAdaptersInfo_call_r_n
call dbg.logEvent
xor eax, eax
jmp 0x404f7c
Function at 0x405070
Capabilities:
Set registry value

Disassembly:
push edi
sub esp, 0x48
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x38]
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareImage_Retail_Solutions_LtdRemotely_
mov dword [esp], 0x80000002
mov dword [esp + 0x1c], eax
call sym._RegCreateKeyExA_36
sub esp, 0x24
test eax, eax
jne 0x405129
or ecx, 0xffffffff
mov edi, 0x44f160
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0x44f160
not ecx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 4], str.DeviceUid
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
test eax, eax
je 0x40513e
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_set_value_for_UID_in_registry__due_to_error_code__d_r_n
call dbg.logEvent
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sym._RegCloseKey_4
push eax
jmp 0x405139
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_create_registry_key_to_hold_config__due_to_error_code__d_r_n
call dbg.logEvent
add esp, 0x48
pop edi
ret
mov dword [esp + 4], 0x44f160
mov dword [esp], str.UID_of__s_stored_in_registry_r_n
call dbg.logEvent
jmp 0x40511a
Function at 0x405160
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
sub esp, 0x38
mov byte [0x44f160], 0
mov dword [esp], str.Checking_registry_for_cached_MAC_UID..._r_n
call dbg.logEvent
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareImage_Retail_Solutions_LtdRemotely
mov dword [esp], 0x80000002
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], 0x40
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
je 0x4051e6
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_obtain_cached_UID_from_registry__RegOpenKeyExA_call_failed_with_error_code__d__r_n
call dbg.logEvent
call dbg.registryIsAvailable
test eax, eax
je 0x4052c2
call dbg.createUidForClient
test eax, eax
je 0x40526e
call dbg.cacheMacAddressInRegistry
add esp, 0x38
pop ebx
ret
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 0x44f160
mov dword [esp + 8], 0
mov dword [esp + 4], str.DeviceUid
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._RegQueryValueExA_24
sub esp, 0x18
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._RegCloseKey_4
test ebx, ebx
push eax
jne 0x40529e
mov eax, dword [esp + 0x28]
mov dword [esp + 4], 0x44f160
mov dword [esp], str.Cached_UID_read_from_registry___s_r_n
mov byte [eax + 0x44f160], 0
call dbg.logEvent
cmp dword [esp + 0x28], 0xa
ja 0x4051e1
mov dword [esp], str.Cached_UID_address_too_short._Ignoring__r_n
mov byte [0x44f160], 0
call dbg.logEvent
jmp 0x4051cf
mov eax, 1
call dbg.setMacAddressOfSystem
test eax, eax
jne 0x4051dc
call dbg.setMacAddressOfSystem
test eax, eax
jne 0x4051dc
mov dword [esp], str.Nothing_to_use_as_the_UID_as_cant_generate_a_UUID_and_cant_find_a_MAC__r_n
call dbg.logEvent
jmp 0x4051e1
mov dword [esp + 4], ebx
mov dword [esp], str.Unable_to_obtain_cached_UID_address_from_registry__RegQueryValueExA_failed_with_error_code__d__r_n
mov byte [0x44f160], 0
call dbg.logEvent
call dbg.registryIsAvailable
test eax, eax
jne 0x4051cf
call dbg.immediatelyExitProcess
mov esi, esi
lea edi, [edi]

Function at 0x4052d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], 0x44cdc0
mov dword [esp], 0x400
call sym._GetTempPathA_8
mov edx, 0x400
sub esp, 8
sub edx, eax
add eax, 0x44cdc0
mov dword [esp + 4], str.remotely.dat
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._strncpy
mov dword [esp + 4], 0x44cdc0
mov dword [esp], str.Temp_file_path___s_r_n
call dbg.logEvent
add esp, 0x1c
ret

Function at 0x405390
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call sym._WSAStartup_8
sub esp, 8
test eax, eax
je 0x4053c8
mov dword [esp + 4], eax
mov dword [esp], str.WSAStartup_failed_with_result:__d_r_n
call dbg.logEvent
add esp, 0x1ac
ret
mov dword [esp], str.WSAStartup_success__r_n
call dbg.logEvent
jmp 0x4053c1
Function at 0x4053e0
Capabilities:
Copy file
Query environment variable

Disassembly:
push ebp
push edi
mov ecx, 0x41
push esi
push ebx
xor esi, esi
mov eax, esi
sub esp, 0x53c
lea edi, [esp + 0x1c]
lea ebx, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], str.WINDIR
call sym._GetEnvironmentVariableA_12
sub esp, 0xc
test eax, eax
jne 0x405427
add esp, 0x53c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp], str.WINDIR_environment_var___s_r_n
lea edi, [esp + 0x120]
call dbg.logEvent
mov eax, esi
mov ecx, 0x41
lea ebp, [esp + 0x328]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x224]
mov ecx, 0x41
lea esi, [esp + 0x42c]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x328]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [esp + 0x42c]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [esp + 0x120]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._sSysnativewbemen_ushtable.xsl
mov dword [esp + 4], 0x104
mov dword [esp], edi
call sym.___mingw_snprintf
lea eax, [esp + 0x224]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._sSysnativewbemen_ushform.xsl
mov dword [esp + 4], 0x104
mov dword [esp], eax
call sym.___mingw_snprintf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._sSysnativewbemhtable.xsl
mov dword [esp + 4], 0x104
mov dword [esp], ebp
call sym.___mingw_snprintf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._sSysnativewbemhform.xsl
mov dword [esp + 4], 0x104
mov dword [esp], esi
call sym.___mingw_snprintf
mov dword [esp + 8], 1
mov dword [esp + 4], ebp
mov dword [esp], edi
call sym._CopyFileA_12
sub esp, 0xc
lea eax, [esp + 0x224]
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._CopyFileA_12
sub esp, 0xc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._sSystem32wbemen_ushtable.xsl
mov dword [esp + 4], 0x104
mov dword [esp], edi
call sym.___mingw_snprintf
lea eax, [esp + 0x224]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._sSystem32wbemen_ushform.xsl
mov dword [esp + 4], 0x104
mov dword [esp], eax
call sym.___mingw_snprintf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._sSystem32wbemhtable.xsl
mov dword [esp + 4], 0x104
mov dword [esp], ebp
call sym.___mingw_snprintf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._sSystem32wbemhform.xsl
mov dword [esp + 4], 0x104
mov dword [esp], esi
call sym.___mingw_snprintf
mov dword [esp + 8], 1
mov dword [esp + 4], ebp
mov dword [esp], edi
call sym._CopyFileA_12
sub esp, 0xc
lea eax, [esp + 0x224]
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._CopyFileA_12
sub esp, 0xc
jmp 0x40541c
Function at 0x405700
Capabilities:
Resolve dns

Disassembly:
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x34
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 8
mov dword [esp + 4], 1
mov dword [esp + 0x10], eax
mov dword [esp], ebx
call sym._DnsQuery_A_24
sub esp, 0x18
test eax, eax
jne 0x405773
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0x18]
mov dword [esi], eax
mov dword [esp], eax
call sym._inet_ntoa_4
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], str.Hostname__s_resolved_to__s__r_n
call dbg.logEvent
add esp, 0x34
mov eax, 1
pop ebx
pop esi
ret
mov dword [esp + 4], ebx
mov dword [esp], str.Unable_to_resolve_hostname__s_r_n
call dbg.logEvent
add esp, 0x34
xor eax, eax
pop ebx
pop esi
ret

Function at 0x405790
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push edi
push esi
mov edi, eax
push ebx
mov esi, edx
sub esp, 0x40
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sym._socket_12
sub esp, 0xc
mov ebx, eax
mov eax, edi
lea edx, [esp + 0x14]
call dbg.ipAddressFromHostname
test eax, eax
je 0x405900
movzx esi, si
mov eax, 2
mov dword [esp + 0x20], 0
mov dword [esp], esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov word [esp + 0x20], ax
call sym._htons_4
sub esp, 4
mov word [esp + 0x22], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 8], 0x10
mov dword [esp], ebx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call sym._connect_12
sub esp, 0xc
test eax, eax
jne 0x4058f0
lea eax, [esp + 0x18]
mov dword [esp + 4], 0x8004667e
mov dword [esp], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 8], eax
call sym._ioctlsocket_12
sub esp, 0xc
test eax, eax
je 0x405875
mov dword [esp], str.Unable_to_put_socket_into_non_blocking_mode_r_n
call dbg.logEvent
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
lea eax, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0x1c], 0x10
mov dword [esp + 8], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call sym._getsockname_12
sub esp, 0xc
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sym._inet_ntoa_4
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], str.Local_IP_address___s_r_n
call dbg.logEvent
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sym._inet_ntoa_4
sub esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x432685
mov dword [esp + 4], 0x40
mov dword [esp], 0x430060
call sym.___mingw_snprintf
add esp, 0x40
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov eax, 0xfffffffb
jmp 0x40586e
mov dword [esp], str.Unable_to_resolve_IP_r_n
call dbg.logEvent
mov eax, 0xffffffff
jmp 0x40586e
Function at 0x405920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov dword [esp], 0x80000002
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], 0x40
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
jne 0x4059ea
lea eax, [esp + 0x28]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProductName
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._RegQueryValueExA_24
sub esp, 0x18
test eax, eax
je 0x4059d0
mov dword [esp + 4], eax
mov byte [ebx], 0
mov dword [esp], str.Unable_to_obtain_Windows_product_name_from_registry__RegQueryValueExA_failed_with_error_code__d__r_n
call dbg.logEvent
call dbg.registryIsAvailable
test eax, eax
je 0x4059ff
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
add esp, 0x38
pop ebx
ret
mov eax, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp], str.Windows_product_name_read_from_registry___s_r_n
mov byte [ebx + eax], 0
call dbg.logEvent
jmp 0x4059b8
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_obtain_Windows_product_name_from_registry__RegOpenKeyExA_call_failed_with_error_code__d__r_n
call dbg.logEvent
call dbg.immediatelyExitProcess
call dbg.immediatelyExitProcess
lea esi, [esi]
lea edi, [edi]

Function at 0x405a10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3c
mov dword [esp], str.Checking_registry_for_Internet_down_counter..._r_n
mov dword [esp + 0x20], 0
call dbg.logEvent
lea eax, [esp + 0x24]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareImage_Retail_Solutions_LtdRemotely
mov dword [esp], 0x80000002
mov dword [esp + 0x10], eax
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
jne 0x405af0
lea eax, [esp + 0x2c]
mov dword [esp + 8], 0
mov dword [esp + 4], str.InternetCounter
mov dword [esp + 0x2c], 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._RegQueryValueExA_24
sub esp, 0x18
test eax, eax
je 0x405ad0
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_obtain_cached_counter_from_registry__RegQueryValueExA_failed_with_error_code__d_._Perhaps_first_time_referenced__r_n
call dbg.logEvent
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
mov eax, dword [esp + 0x20]
add esp, 0x3c
ret
mov eax, dword [esp + 0x20]
mov dword [esp], str.Counter_value_from_registry___d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x405ab1
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_obtain_counter_from_registry__RegOpenKeyExA_call_failed_with_error_code__d__r_n
call dbg.logEvent
mov eax, dword [esp + 0x20]
add esp, 0x3c
ret
Function at 0x405b10
Capabilities:
Set registry value

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareImage_Retail_Solutions_LtdRemotely_
mov dword [esp + 0x1c], eax
mov dword [esp], 0x80000002
call sym._RegCreateKeyExA_36
sub esp, 0x24
test eax, eax
jne 0x405bd0
lea eax, [esp + 0x3c]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.InternetCounter
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
test eax, eax
je 0x405be4
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_set_value_for_Internet_counter_in_registry__due_to_error_code__d_r_n
call dbg.logEvent
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
add esp, 0x5c
ret
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_create_registry_key_to_hold_Internet_counter__due_to_error_code__d_r_n
call dbg.logEvent
add esp, 0x5c
ret
mov eax, dword [esp + 0x3c]
mov dword [esp], str.Internet_counter_value__d_stored_in_registry_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x405bb5
Function at 0x405c00
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push edi
push ebx
mov ebx, eax
sub esp, 0x194
mov dword [esp + 4], eax
mov dword [esp], str.Running_netsh_to_configure_firewall_using_script_file__s_r_n
call dbg.logEvent
call sym._GetCurrentProcess_0
lea edx, [esp + 0x34]
mov dword [esp + 4], 0xf00ff
mov dword [esp], eax
mov dword [esp + 8], edx
call sym._OpenProcessToken_12
sub esp, 0xc
test eax, eax
jne 0x405c60
call sym._GetLastError_0
mov dword [esp], str.Call_to_OpenProcessToken_failed_in_runNetShScript___with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x194
pop ebx
pop edi
ret
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x8c]
mov dword [esp + 8], str.netsh.exe__f__s
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call sym.___mingw_snprintf
lea edx, [esp + 0x48]
xor eax, eax
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x24], edx
mov dword [esp + 8], ebx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], 0x8000000
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x50], str.winsta0default
call sym._CreateProcessAsUserA_44
sub esp, 0x2c
mov ebx, eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
test ebx, ebx
jne 0x405d30
call sym._GetLastError_0
mov dword [esp], str.Call_to_CreateProcessAsUserA_failed_in_runNetShScript___with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x194
pop ebx
pop edi
ret
mov eax, dword [esp + 0x40]
mov dword [esp], str.NETSH_process_HANDLE___d__PID___d_successfully_launched._Closing_handles..._r_n
mov dword [esp + 8], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
call dbg.logEvent
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
add esp, 0x194
pop ebx
pop edi
ret

Function at 0x405d80
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x22c
lea ebp, [esp + 0x18]
mov dword [esp], str.Request_to_remove_firewall_entries..._r_n
call dbg.logEvent
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebp
mov dword [esp], str._TEMP__rmwfirewall.rules
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
mov dword [esp + 4], 0x4313ab
mov dword [esp], ebp
call sym._fopen
test eax, eax
je 0x405e1f
lea esi, [esp + 0x11c]
mov edi, eax
mov ebx, 1
mov esi, esi
lea edi, [edi]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.advfirewall_firewall_delete_rule_name_Remotely_IP_Block__d__r_n
add ebx, 1
mov dword [esp + 4], 0x104
mov dword [esp], esi
call sym.___mingw_snprintf
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._fputs
cmp ebx, 0x15
jne 0x405de0
mov dword [esp], edi
call sym._fclose
mov eax, ebp
call dbg.runNetShScript
add esp, 0x22c
pop ebx
pop esi
pop edi
pop ebp
ret