joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479478
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4794e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x525de0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4794d3
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00479468
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x479270]
call fcn.00479510
mov dword [0x525e44], eax
mov eax, dword [ebp - 4]
call fcn.00479418
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4794f0
lea eax, [ebp - 8]
call fcn.00405e18
ret

Function at 0x4796eb
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
mov eax, esp
xor ecx, ecx
mov edx, 0x160
call fcn.00402ed4
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x479760
call sub.shell32.dll_SHGetFileInfoA
mov dword [0x525dd8], eax
cmp dword [0x525dd8], 0
je 0x479758
cmp dword [0x525ddc], 0
jne 0x479758
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47f0fc]
call fcn.0047f914
mov dword [0x525ddc], eax
mov edx, dword [0x525dd8]
mov eax, dword [0x525ddc]
call fcn.00456b30
mov eax, dword [0x525ddc]
mov byte [eax + 0x42], 1
mov dl, 1
mov eax, dword [0x525ddc]
call fcn.0048104c
push 0xffffffffffffffff
mov eax, dword [0x525ddc]
call fcn.00456b6c
push eax
call sub.comctl32.dll_ImageList_SetBkColor
add esp, 0x160
ret
Function at 0x49d4b4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.0049d4a0
test eax, eax
jne 0x49d4d5
mov eax, esi
call fcn.0040429c
jmp 0x49d566
mov eax, ebx
call fcn.0049d5fc
test al, al
je 0x49d51b
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.0040438c
test edi, edi
je 0x49d512
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
jmp 0x49d566
mov eax, esi
call fcn.0040429c
jmp 0x49d566
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x49d55f
mov eax, dword [ebp + 0x208]
call fcn.00419c50
test eax, eax
jle 0x49d54d
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.00437c68
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.004042f0
jmp 0x49d566
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x210]
call fcn.004042f0
jmp 0x49d566
mov eax, esi
call fcn.0040429c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49f1e8
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.00406610
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret

Function at 0x4a5f20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a5fda
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004049a8
mov eax, dword [0x5270dc]
cmp dword [eax], 2
jne 0x4a5f8f
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404bf0
mov eax, dword [ebx]
call fcn.00404b14
push eax
mov eax, dword [ebx]
call fcn.00404b04
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404b14
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404bf0
jmp 0x4a5fc1
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.004096c8
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404af4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5fe1
lea eax, [ebp - 0x3f0]
call fcn.0040429c
ret
Function at 0x4b3250
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x528efc
test esi, esi
jne 0x4b326a
xor eax, eax
jmp 0x4b336c
cmp dword [ebp], 0
jne 0x4b3275
call fcn.004b31e0
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4b3345
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4b3281
test edi, edi
jbe 0x4b3367
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4b3349
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dc7a0
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x4dc7b0
call sub.user32.dll_FindWindowA
ret
Function at 0x4f9260
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x4f9278
mov eax, ebx
call fcn.004f8adc
cmp dword [ebx + 0x68], 0
jne 0x4f9285
mov eax, ebx
call fcn.004f8a38
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x4f9435
cmp dword [ebx + 0x68], 0
je 0x4f9435
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.004f88a8
lea eax, [esp + 0x14]
xor edx, edx
call fcn.004fb040
cmp eax, dword [esp]
je 0x4f9307
lea eax, [esp + 0x14]
xor edx, edx
call fcn.004fb054
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4f92e3
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.004fb040
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4f92fc
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4f931a
mov eax, dword [eax + 0x18]
call fcn.00450248
mov esi, eax
jmp 0x4f931d
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x4f9332
or esi, 0xffffffff
jmp 0x4f933c
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.004490a4
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.004490c8
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.004490f0
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00449114
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.0040662c
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00450248
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00450248
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00450248
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042842c
call fcn.00423f9c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00450248
push eax
call dword [0x528f10]
push 4
mov eax, dword [ebx + 0x68]
call fcn.00450248
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f9678
Capabilities:
Allocate or change rwx memory
Find taskbar
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.00402ed4
lea eax, [esp + 0x38]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x4f9864
push 0
push 0x4f986c
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f9864
push 0
push 0x4f987c
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f9864
push 0
push 0x4f988c
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f9864
push 0
push 0x4f989c
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebp, eax
test ebp, ebp
je 0x4f9864
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x4f9864
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x4f9864
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x4f9864
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.KERNEL32.DLL_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x4f9864
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x4f9850
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4f9846
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x1c]
push eax
push esi
push edi
call sub.KERNEL32.DLL_ReadProcessMemory
test eax, eax
je 0x4f9846
test byte [esp + 0x1d], 0xd
jne 0x4f9846
mov al, byte [esp + 0x1c]
and al, 8
cmp al, 8
je 0x4f9846
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
push eax
push edi
call sub.KERNEL32.DLL_ReadProcessMemory
test eax, eax
je 0x4f9846
cmp dword [esp + 0xc], 0
je 0x4f9846
mov eax, dword [0x526eb8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
cmp eax, dword [esp + 0x10]
jne 0x4f9846
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4f9822
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x4f9850
lea eax, [esp + 0x28]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
call fcn.00406670
jmp 0x4f9850
cmp ebx, dword [esp + 4]
jl 0x4f9786
push 0x8000
push 0
push esi
push edi
call sub.KERNEL32.DLL_VirtualFreeEx
push edi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fba84
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.004091d0
test al, al
je 0x4fbb0b
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00402ed4
or esi, 0x100
test esi, esi
jns 0x4fbabf
call fcn.00403400
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.0040475c
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4fbb0b
mov dl, 1
mov eax, dword [0x42201c]
call fcn.004299f8
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00429e04
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x4fbb0b
mov eax, esp
call fcn.0040e538
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x51f560
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffd6c
mov ebx, eax
lea eax, [esp + 4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x51f58a
mov eax, ebx
mov edx, 0x51f5dc
call fcn.004042f0
jmp 0x51f5c4
push pe_nt_image_headers32
lea eax, [esp + 0x198]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 0x194]
push eax
call sub.wsock32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp], eax
push dword [esp]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00404494
call sub.wsock32.dll_WSACleanup
add esp, 0x294
pop ebx
ret
Function at 0x401c80
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x40b594
mov esi, section.DATA
mov edi, 0x40b024
cmp byte [ebx + 0x28], 0
jne 0x401caf
cmp dword [edi], 0
je 0x401caf
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x401c9e
cmp dword [0x40a004], 0
je 0x401cbe
call dword [0x40a060]
cmp byte [ebx + 0x28], 2
jne 0x401cce
cmp dword [esi], 0
jne 0x401cce
xor eax, eax
mov dword [ebx + 0xc], eax
call dword [0x40a028]
cmp byte [ebx + 0x28], 1
jbe 0x401cdf
cmp dword [esi], 0
je 0x401d01
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x401d01
call dword [0x40a020]
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x401d01
test eax, eax
je 0x401d01
push eax
call sub.KERNEL32.DLL_WriteFile
call dword [0x40a02c]
cmp byte [ebx + 0x28], 1
jne 0x401d10
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x401d1b
call fcn.00401c50
cmp dword [ebx], 0
jne 0x401d37
cmp dword [0x40b014], 0
je 0x401d2f
call dword [0x40b014]
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_GetVersionExA
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x401cbe
Function at 0x404cdc
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x404e45
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00401e00
mov eax, dword [ebp - 0x10]
call fcn.00404a58
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x404d2e
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00402158
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.0040518c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x404e03
xor eax, eax
push ebp
push 0x404dfc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00404bb4
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00404e54
test al, al
je 0x404dda
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00401e54
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x404dda
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004020c4
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x404dd4
mov eax, dword [ebp - 0x14]
call fcn.004020c4
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00401e84
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00404cdc
dec ebx
cmp ebx, 0xffffffff
jne 0x404d8d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404e03
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
call fcn.00404bb4
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 0x10]
call fcn.004020c4
push eax
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 9]
call fcn.00404ba0
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404e4c
lea eax, [ebp - 0x3c]
call fcn.00401d68
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00401d8c
ret

Function at 0x404e54
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, edi
xor ecx, ecx
mov edx, 0x1c
call fcn.00401654
lea eax, [edi + 0x14]
push eax
push 0
lea eax, [edi + 0x10]
push eax
lea eax, [edi + 0xc]
push eax
lea eax, [edi + 8]
push eax
push 0
lea eax, [edi + 4]
push eax
push edi
push 0
push 0
push 0
mov eax, dword [esi + 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete bl
cmp byte [0x40b6d8], 0
je 0x404eb4
call fcn.004048b4
cmp al, 3
jb 0x404eb4
mov eax, dword [edi + 4]
add dword [edi + 4], eax
mov eax, dword [edi + 0xc]
add dword [edi + 0xc], eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x405004
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405089
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.00404a6c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004020c4
push eax
mov eax, dword [ebx + 0x18]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x405073
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4050a4
call fcn.00403108
mov eax, dword [ebp - 8]
call fcn.00402a6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405090
lea eax, [ebp - 8]
call fcn.00401d68
ret

Function at 0x4050c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405153
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004020c4
push eax
mov eax, dword [ebx + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40512d
xor ebx, ebx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], esi
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x405170
call fcn.00403108
mov eax, dword [ebp - 8]
call fcn.00402a6c
jmp 0x405130
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00404a9c
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40515a
lea eax, [ebp - 8]
call fcn.00401d68
ret

Function at 0x405544
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004020b4
xor eax, eax
push ebp
push 0x405603
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x4055d2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004020c4
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4055c8
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x4055c8
mov edx, dword [ebp - 8]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp - 8]
mov cl, byte [eax + 1]
mov byte [edx + 1], cl
mov edx, dword [ebp - 8]
mov cl, byte [eax + 2]
mov byte [edx + 2], cl
mov edx, dword [ebp - 8]
mov al, byte [eax + 3]
mov byte [edx + 3], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4055e8
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40560a
lea eax, [ebp - 4]
call fcn.00401d68
ret
Function at 0xb5a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b5a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb5a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb5a06a
add dl, dl
jne 0xb5a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb5a0dc
xor eax, eax
add dl, dl
jne 0xb5a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb5a17d
add dl, dl
jne 0xb5a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb5a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb5a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb5a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb5a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb5a075
mov eax, 1
add dl, dl
jne 0xb5a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb5a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb5a0e1
sub eax, ebx
mov ebx, 1
jne 0xb5a128
mov ecx, 1
add dl, dl
jne 0xb5a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb5a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb5a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb5a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb5a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb5a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb5a136
cmp eax, 0x7d00
jae 0xb5a16d
cmp eax, 0x500
jb 0xb5a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb5a075
cmp eax, 0x7f
ja 0xb5a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb5a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb5a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb5a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x402230
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 0x2c], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00402bd0
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
and esp, 0xfffffff0
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
leave
shl edx, 5
add eax, edx
ret