joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0000
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
xor eax, eax
push edi
mov edi, dword [esp + 0x20]
push 4
cmp byte [esi + 0xa9f], al
setne al
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WSOCK32.DLL_setsockopt]
test eax, eax
jns 0x4b004a
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.004a8420
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret
push dword [esi + 0xa3c]
mov dword [esp + 0x10], 1
call fcn.004ae870
push dword [esi + 0xa40]
imul eax, eax, 0x3e8
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
call fcn.004ae870
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0xc
lea eax, [esp + 0x24]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.DLL_WSAIoctl]
test eax, eax
je 0x4b00c1
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.004a8420
add esp, 0x10
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4b00d0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x84
mov eax, dword [esp + 0x88]
push esi
push 4
mov dword [esp + 8], 1
mov esi, dword [eax]
lea eax, [esp + 8]
push eax
push 1
push 6
push dword [esp + 0xa0]
call dword [sym.imp.WSOCK32.DLL_setsockopt]
test eax, eax
jns 0x4b0131
push pe_nt_image_headers32
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
push eax
call fcn.004c2460
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004a8420
add esp, 0x18
pop esi
add esp, 0x84
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.004a8420
add esp, 8
pop esi
add esp, 0x84
ret
Function at 0x4bae60
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1000
call fcn.0040a160
push dword [esp + 0x1004]
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4baead
push 0x1000
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4baead
lea eax, [esp]
push eax
call dword [0x51e614]
add esp, 4
add esp, 0x1000
ret
xor eax, eax
add esp, 0x1000
ret
Function at 0x4c1940
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
mov dword [esp + 4], ebp
mov dword [eax], ebp
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.DLL_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4c1ad3
push ebx
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4c1abd
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x4c198f
lea ebx, [eax + 0xe]
jmp 0x4c199b
cmp eax, 0x17
jne 0x4c1a4a
lea ebx, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x4c1a4a
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4c1a4a
cmp eax, ebx
jb 0x4c1a4a
push 0x20
call dword [0x51e608]
mov esi, eax
add esp, 4
test esi, esi
je 0x4c1ab2
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x51e608]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x4c1aa1
push ebx
push dword [edi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x4c1a35
push eax
call dword [0x51e614]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x4c1a87
test ebp, ebp
jne 0x4c1a3b
mov ebp, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c1a46
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4c1982
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x4c1a69
push eax
call dword [sym.imp.WS2_32.DLL_freeaddrinfo]
test ebx, ebx
je 0x4c1ab9
push ebp
call fcn.004c1900
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebp, ebp
mov dword [eax], ebp
mov eax, ebx
pop edi
pop ebx
pop ebp
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebx, 8
call dword [0x51e60c]
push esi
call dword [0x51e60c]
add esp, 8
jmp 0x4c1a59
push esi
mov ebx, 8
call dword [0x51e60c]
add esp, 4
jmp 0x4c1a59
mov ebx, 8
jmp 0x4c1a59
test ebp, ebp
jne 0x4c1ac9
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WSOCK32.DLL_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebp
mov eax, ebx
pop ebx
pop ebp
add esp, 0xc
ret
Function at 0x4c6110
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [sym.imp.WSOCK32.DLL_socket]
push edi
push 6
push 1
push 2
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x14], 1
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x4c6142
pop edi
or eax, eax
pop esi
add esp, 0x30
ret
xor eax, eax
mov dword [esp + 0x10], eax
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, 2
push 0x7f000001
mov word [esp + 0x18], ax
call dword [sym.imp.WSOCK32.DLL_htonl]
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
xor eax, eax
push 4
mov word [esp + 0x1a], ax
lea eax, [esp + 0x10]
push eax
push 4
push 0xffff
push edi
mov dword [ebx + 4], 0xffffffff
mov dword [ebx], 0xffffffff
call dword [sym.imp.WSOCK32.DLL_setsockopt]
cmp eax, 0xffffffff
je 0x4c62d7
push 0x10
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WSOCK32.DLL_bind]
cmp eax, 0xffffffff
je 0x4c62d7
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WSOCK32.DLL_getsockname]
cmp eax, 0xffffffff
je 0x4c62d7
push 1
push edi
call dword [sym.imp.WSOCK32.DLL_listen]
cmp eax, 0xffffffff
je 0x4c62d7
push 0
push 1
push 2
call esi
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x4c62d7
push 0x10
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.WSOCK32.DLL_connect]
cmp eax, 0xffffffff
je 0x4c62d7
push 0
push 0
push edi
call dword [sym.imp.WSOCK32.DLL_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x4c62d7
push ebx
push 0x4fcb60
lea eax, [esp + 0x2c]
push 0xc
push eax
call fcn.004b9aa0
lea esi, [esp + 0x34]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4c6244
push 0
sub esi, ecx
lea eax, [esp + 0x28]
push esi
push eax
push dword [ebx]
call dword [sym.imp.WSOCK32.DLL_send]
cmp eax, esi
jne 0x4c62d7
push 0
push 0xc
lea eax, [esp + 0x38]
push eax
push dword [ebx + 4]
call dword [sym.imp.WSOCK32.DLL_recv]
cmp eax, esi
jne 0x4c62d7
lea ecx, [esp + 0x24]
lea edx, [esp + 0x30]
sub esi, 4
jb 0x4c6295
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4c629a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4c6284
cmp esi, 0xfffffffc
je 0x4c62c7
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4c62d7
cmp esi, 0xfffffffd
je 0x4c62c7
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4c62d7
cmp esi, 0xfffffffe
je 0x4c62c7
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4c62d7
cmp esi, 0xffffffff
je 0x4c62c7
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4c62d7
push edi
call dword [sym.imp.WSOCK32.DLL_closesocket]
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret
mov esi, dword [sym.imp.WSOCK32.DLL_closesocket]
push edi
call esi
push dword [ebx]
call esi
push dword [ebx + 4]
call esi
pop ebx
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x30
ret
Function at 0x4d17bf
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x521d2c], 0
push ebx
push esi
mov esi, 0x521d34
jne 0x4d17eb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x521d4c], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x521d2c], 1
push dword [0x521d4c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4d1888
push 0x14
push 8
push dword [0x520bbc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4d18b2
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x521d30]
test eax, eax
je 0x4d182d
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x521d30], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x4d18b7
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x521d4c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x520bbc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4d18b2
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8
Function at 0x4115a2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x14
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
push esi
lea esi, [eax*2 + 2]
jb 0x4115be
mov edx, dword [edx]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4115c9
mov eax, dword [eax]
push esi
push edx
push 1
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4115e1
pop esi
leave
ret 8
push str.Cannot_write_string_value:_RegSetValueExW_failed.
push eax
lea ecx, [ebp - 0x14]
call fcn.004116c1
push 0x4bd41c
lea eax, [ebp - 0x14]
push eax
call fcn.00466072
int3

Function at 0x4115fe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24
mov eax, 0x48e7d9
call fcn.0044f992
mov ebx, ecx
mov esi, dword [ebp + 0xc]
xor edx, edx
mov edi, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edx
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x14], edx
jb 0x41162a
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push edx
push edx
push 2
push eax
push edx
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4116a4
mov eax, dword [ebp - 0x14]
mov ecx, edi
push 0x20
shr eax, 1
push eax
call fcn.004059b5
xor edx, edx
mov eax, edi
mov dword [ebp - 4], edx
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x18], 1
jb 0x411665
mov eax, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x41166d
mov esi, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
push edx
push 2
push esi
push edx
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x41168a
push str.Cannot_get_string_value:_RegGetValueW_failed.
jmp 0x4116a9
mov ecx, dword [ebp - 0x14]
shr ecx, 1
dec ecx
push 0
push ecx
mov ecx, edi
call fcn.00413d0c
mov eax, edi
call fcn.0044f93c
ret 8
push str.Cannot_get_size_of_string_value:_RegGetValueW_failed.
push eax
lea ecx, [ebp - 0x30]
call fcn.004116c1
push 0x4bd41c
lea eax, [ebp - 0x30]
push eax
call fcn.00466072
int3
Function at 0x439770
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491a28
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4bf114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x4397e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x4397e6
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x439804
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044e8ec
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [ebp - 0x28]
call fcn.00405b55
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.004398d0
push 0x4b9ecc
lea eax, [ebp - 0x50]
push eax
call fcn.00466072
int3
Function at 0x409d2c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x45cda4], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x409d69
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x409d54
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x409d46
mov dword [ecx*4 + 0x45cda0], eax
inc ecx
cmp ecx, 0x100
jne 0x409d3f
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x409d8b
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x45cda0]
jmp 0x409d73
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40149d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x466eb0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x401532
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x4014ef
cmp dword [ebp + 0x10], ebx
jne 0x401526
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.0040149d
test eax, eax
jne 0x401501
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014d6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.004064cf
cmp eax, ebx
je 0x401539
push ebx
push dword [0x466eb0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401532
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x466eb0], ebx
jne 0x40152f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40152f
jmp 0x401532
Function at 0x40343a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x4271ec]
sub esi, dword [0x4271f8]
push edi
add esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1f4
mov dword [0x466e20], eax
call fcn.004033ac
xor edi, edi
cmp esi, edi
jle 0x4035a2
push dword [0x4271f4]
call fcn.00403423
push edi
push edi
push dword [0x4271f8]
push dword [0x40b014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x4271e4], esi
mov dword [0x4271e0], edi
mov eax, dword [0x4271f0]
sub eax, dword [0x4271f4]
mov ebx, 0x200000
cmp eax, ebx
jg 0x4034b0
mov ebx, eax
push ebx
push dword [0x4271e8]
call fcn.004033f1
test eax, eax
je 0x4035b3
mov eax, dword [0x4271e8]
add dword [0x4271f4], ebx
mov dword [0x427170], eax
mov dword [0x427174], ebx
cmp dword [0x466ddc], edi
je 0x40350a
cmp dword [0x466ea0], edi
jne 0x40350a
mov eax, dword [0x4271e4]
sub eax, dword [0x4271ec]
push edi
sub eax, dword [ebp + 8]
add eax, dword [0x4271f8]
mov dword [0x4271e0], eax
call fcn.0040330a
pop ecx
mov eax, dword [0x41f154]
mov ecx, 0x427158
mov dword [0x427178], eax
mov dword [0x42717c], 0x400000
call fcn.004074e5
test eax, eax
js 0x4035b8
mov esi, dword [0x427178]
mov eax, dword [0x41f154]
sub esi, eax
je 0x40356f
push edi
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push dword [0x40b014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4035bd
cmp esi, dword [ebp - 4]
jne 0x4035bd
add dword [0x4271f8], esi
cmp dword [0x427174], edi
jne 0x4034da
jmp 0x40357b
cmp dword [0x427174], edi
jne 0x4035b8
cmp ebx, edi
je 0x4035b8
mov eax, dword [0x4271ec]
mov ecx, eax
sub ecx, dword [0x4271f8]
add ecx, dword [ebp + 8]
test ecx, ecx
jg 0x40349a
push edi
push edi
push eax
push dword [0x40b014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
call fcn.0040330a
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
or eax, 0xffffffff
jmp 0x4035ac
push 0xfffffffffffffffd
pop eax
jmp 0x4035ac
push 0xfffffffffffffffe
jmp 0x4035ba
Function at 0x4035c1
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
call fcn.004033ac
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jl 0x4035f0
add eax, dword [0x466e18]
push ebx
push ebx
push eax
push dword [0x40b014]
mov dword [0x4271ec], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.0040343a
cmp eax, ebx
jl 0x4036e6
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push dword [0x40b014]
call edi
test eax, eax
je 0x4036e2
cmp dword [ebp - 8], esi
jne 0x4036e2
push dword [ebp - 4]
add dword [0x4271ec], esi
call fcn.0040343a
mov dword [ebp + 8], eax
cmp eax, ebx
jl 0x4036e5
cmp dword [ebp + 0x10], ebx
je 0x4036d7
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x14]
jl 0x403658
mov eax, dword [ebp + 0x14]
push ebx
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40b014]
call edi
test eax, eax
je 0x4036e2
mov eax, dword [ebp - 8]
add dword [0x4271ec], eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
jmp 0x4036e5
mov esi, 0x200000
cmp dword [ebp - 4], esi
jge 0x40368b
mov esi, dword [ebp - 4]
push ebx
lea eax, [ebp - 8]
push eax
push esi
push dword [0x4271e8]
push dword [0x40b014]
call edi
test eax, eax
je 0x4036e2
cmp esi, dword [ebp - 8]
jne 0x4036e2
push ebx
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 8]
push dword [0x4271e8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4036de
cmp dword [ebp + 0x14], esi
jne 0x4036de
mov eax, dword [ebp - 8]
add dword [ebp + 8], eax
sub dword [ebp - 4], eax
add dword [0x4271ec], eax
cmp dword [ebp - 4], ebx
jg 0x40367e
jmp 0x403679
push 0xfffffffffffffffe
jmp 0x4036e4
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x405e12
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x44b290
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x44b290], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405e4d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x406003
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406020
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x406023
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [eax + 1]
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x406052
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40969c]
mov dword [ebp - 8], eax
mov eax, dword [0x4096a0]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4060a2
test edi, edi
jne 0x40605f
mov word [esi], ax
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x40609c

Function at 0x4060a6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40611f
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x4008
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406108
cmp dword [ebp + 0x14], 1
je 0x40610d
cmp dword [ebp + 0x14], 2
je 0x40610d
xor eax, eax
mov word [esi], ax
push dword [ebp + 0x18]
xor eax, eax
mov word [esi + 0x4006], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 0x14