joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423160
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push str.ROOTCIMV2
or ebx, 0xffffffff
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x30
push 1
mov ebp, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.00428198
push 4
push 1
mov esi, eax
call fcn.00428198
add esp, 0x10
mov edi, eax
mov dword [edi], esi
push 0
push 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x4238b0
mov dword [esi + 0x18], 0x423820
mov dword [esi + 0x1c], 0x423790
mov dword [esi + 0x20], 0x4235e0
mov dword [esi + 0x24], 0x423500
mov dword [esi + 0x28], 0x4234a0
mov dword [esi + 0x2c], 0x4234e0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [esi], eax
test eax, eax
jns 0x42322a
cmp eax, 0x80010106
je 0x42322a
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x423347
mov edx, dword [ecx + 4]
test edx, edx
je 0x423347
push 0x1f9
push eax
push 0xe
push dword [ecx]
call edx
add esp, 0x10
jmp 0x423347
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x423278
cmp eax, 0x80010119
je 0x423278
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x423347
mov edx, dword [ecx + 4]
test edx, edx
je 0x423347
push 0x200
push eax
push 0xe
push dword [ecx]
call edx
add esp, 0x10
jmp 0x423347
lea eax, [esp + 0x14]
push eax
push 0x4cc698
push 1
push 0
push 0x4cc688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4232c0
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x423347
mov edx, dword [ecx + 4]
test edx, edx
je 0x423347
push 0x208
push eax
push 0xe
push dword [ecx]
call edx
add esp, 0x10
jmp 0x423347
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push ebp
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jns 0x423302
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x423347
mov edx, dword [ecx + 4]
test edx, edx
je 0x423347
push 0x20f
push eax
push 0xe
push dword [ecx]
call edx
add esp, 0x10
jmp 0x423347
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x2c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x42333e
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x423347
mov edx, dword [ecx + 4]
test edx, edx
je 0x423347
push 0x21f
push eax
push 0xe
push dword [ecx]
call edx
add esp, 0x10
jmp 0x423347
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov dword [esi + 8], eax
push ebp
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x42335e
mov eax, dword [ecx]
push ecx
mov eax, dword [eax + 8]
call eax
test ebx, ebx
je 0x423375
push edi
call fcn.00423380
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x424d70
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4d1ce0]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, dword [esp + 0x19c]
lea eax, [esp + 4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, eax
test ecx, ecx
jne 0x424dc5
push 0x424d60
call fcn.00403cbc
add esp, 4
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00404be0
add esp, 0x194
ret
test esi, esi
je 0x424ddc
mov eax, dword [esi + 4]
test eax, eax
je 0x424ddc
push 0x4a
push ecx
push 2
push dword [esi]
call eax
add esp, 0x10
mov ecx, dword [esp + 0x194]
pop esi
xor ecx, esp
call fcn.00404be0
add esp, 0x194
ret

Function at 0x436380
Capabilities:
Terminate process

Disassembly:
push 0
mov dword [0x4da658], 1
call fcn.00437470
add esp, 4
call fcn.00437c00
test eax, eax
je 0x4363b3
push 0
push 0
push 0
push 0
push 0
push 0
push 0x11
call fcn.00437a60
add esp, 0x1c
push esi
push 0
push 0
call fcn.00437dd0
mov esi, dword [esp + 0x10]
add esp, 8
push 0
push 1
call fcn.004354b0
cmp esi, 0x18
jne 0x4363e1
push str.daemon_shutdown_requested___shutting_down_n
call fcn.00435180
add esp, 0xc
jmp 0x436408
cmp esi, 0x17
jle 0x4363fa
lea eax, [esi - 0x17]
push eax
push esi
push str.EXITING_DUE_TO_SIGNAL__d_Exit_reason__d_n
call fcn.00435180
add esp, 0x14
jmp 0x436408
push esi
push str.EXITING_DUE_TO_SIGNAL__d_n
call fcn.00435180
add esp, 0x10
push edi
call fcn.0041e330
call fcn.0040dd80
mov edi, eax
test edi, edi
je 0x436430
push 0
push 1
call fcn.004354b0
push edi
push str.ts_cleanup_returns__d_n
call fcn.00435180
add esp, 0x10
cmp dword [0x4d20d0], 0
pop edi
jne 0x436444
push 1
call fcn.00436970
add esp, 4
push str.on_exit
push 0x4d256c
call fcn.00438fb0
push dword [0x4da654]
call fcn.00438fa0
add esp, 0xc
call fcn.004368c0
cmp esi, 0x20
je 0x436475
push 1
call fcn.0041e330
add esp, 4
cmp esi, 0x18
jne 0x436481
push 0x25
call fcn.00401ac1
push esi
call fcn.00401ac1
int3
Function at 0x43c180
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x118
mov eax, dword [0x4d1ce0]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x12c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x128]
mov ebx, 0xffffff77
push edi
mov edi, dword [esp + 0x140]
movzx ebp, ax
mov eax, dword [esp + 0x148]
push 0x103
mov dword [esp + 0x20], eax
lea eax, [esp + 0x25]
push 0
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0
mov byte [esp + 0x2c], 0
call fcn.004056e0
add esp, 0xc
cmp dword [0x4dc130], 0
je 0x43c2ea
test bp, bp
je 0x43c1ff
test edi, edi
je 0x43c2ea
inc ebp
movzx eax, bp
mov dword [esp + 0x10], eax
shl eax, 2
push eax
push esi
call fcn.0043eed0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x43c2e3
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
lea eax, [esp + 0x24]
push 0x4bc0a8
push eax
call fcn.00427717
mov esi, 1
lea eax, [esp + 0x2c]
add esp, 0xc
mov dword [ebx], eax
cmp dword [esp + 0x10], esi
jle 0x43c26b
lea eax, [esp + 0x18]
push eax
push dword [edi]
call fcn.0043c500
add esp, 8
mov dword [ebx + esi*4], eax
test eax, eax
je 0x43c2de
inc esi
add edi, 4
cmp esi, dword [esp + 0x10]
jl 0x43c247
push dword [esp + 0x1c]
push ebx
push dword [esp + 0x14c]
push ebp
push 0
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push dword [0x4dc130]
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
je 0x43c2a7
mov dword [esp + 0x14], 0
mov esi, 1
movzx edi, bp
cmp edi, esi
jle 0x43c2cf
mov eax, dword [ebx + esi*4]
test eax, eax
je 0x43c2ca
push eax
call fcn.0043eeb0
add esp, 4
mov dword [ebx + esi*4], 0
inc esi
cmp esi, edi
jl 0x43c2b3
push ebx
call fcn.0043eeb0
mov eax, dword [esp + 0x18]
add esp, 4
jmp 0x43c2ec
movzx ebp, si
jmp 0x43c2a7
mov eax, 0xffffffd8
jmp 0x43c2ec
mov eax, ebx
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00404be0
add esp, 0x118
ret
Function at 0x43c310
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x4d1ce0]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
push edi
mov edi, dword [esp + 0x224]
lea eax, [esp + 0x15]
push 0x103
push 0
push eax
mov dword [esp + 0x14], 0
mov byte [esp + 0x20], 0
call fcn.004056e0
push 0x103
lea eax, [esp + 0x129]
mov byte [esp + 0x128], 0
push 0
push eax
call fcn.004056e0
add esp, 0x18
mov dword [esp + 0xc], 0
xor esi, esi
mov dword [esp + 0x10], 0x104
test edi, edi
je 0x43c428
push edi
lea eax, [esp + 0x18]
push str._s_EventLoggingMode
push eax
call fcn.00427717
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x14]
add esp, 0xc
push eax
push 0x20019
push esi
push str.SOFTWAREFNPlmLicense_Server
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x43c3d3
lea eax, [esp + 8]
push eax
push 0x20019
push esi
push str.SOFTWAREFlexeraFLEXlm_License_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x43c419
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43c419
lea eax, [esp + 0x118]
push str.ENABLE
push eax
call fcn.00433c95
add esp, 8
mov ecx, 1
test eax, eax
cmove esi, ecx
mov eax, dword [esp + 8]
test eax, eax
je 0x43c428
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00404be0
add esp, 0x218
ret

Function at 0x43c9d0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
test esi, esi
je 0x43ca25
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x43ca25
push edi
lea ecx, [esp + 8]
push ecx
push eax
call fcn.0043c640
mov edi, eax
add esp, 8
test edi, edi
je 0x43ca1f
push esi
push edi
call fcn.0043d460
push edi
mov esi, eax
call fcn.0043eeb0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x43ca30
Capabilities:
Get session user name

Disassembly:
call fcn.0043c7f0
cmp eax, 2
je 0x43cf20
jmp 0x43cfe0
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x18]
xor esi, esi
mov dword [esp + 0xc], 0
test edi, edi
je 0x43cf42
test ebx, ebx
je 0x43cfc9
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x43cfc9
push ebp
push eax
call fcn.00404c32
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x43cfc8
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x43cfbf
lea eax, [esp + 0x10]
push eax
push ebp
call fcn.0043c470
add esp, 8
mov dword [esp + 0x1c], eax
test eax, eax
je 0x43cfbf
test edi, edi
je 0x43cfbb
cmp dword [esp + 0x10], edi
jle 0x43cf9d
lea eax, [edi - 1]
mov dword [esp + 0x10], eax
push 0
push edi
push 0
push ebx
call fcn.0041a4e0
push 0
push dword [esp + 0x24]
push dword [esp + 0x34]
push ebx
call fcn.0041a450
add esp, 0x20
mov esi, dword [esp + 0x10]
push ebp
call fcn.0043eeb0
add esp, 4
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x10], 0
test edi, edi
je 0x43d005
test ebp, ebp
je 0x43d0a0
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43d0a0
add eax, eax
push eax
call fcn.00404c32
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
je 0x43d0a0
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x43d087
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x20]
call fcn.0043c640
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x43d087
test edi, edi
je 0x43d083
cmp dword [esp + 0x10], edi
jle 0x43d068
lea eax, [edi - 1]
mov dword [esp + 0x10], eax
push 0
push edi
push 0
push ebp
call fcn.0041a4e0
push 0
push dword [esp + 0x24]
push ebx
push ebp
call fcn.0041a450
add esp, 0x20
mov esi, dword [esp + 0x10]
push dword [esp + 0x1c]
call fcn.0043eeb0
add esp, 4
test ebx, ebx
je 0x43d0a0
push ebx
call fcn.0043eeb0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x43cb10
Capabilities:
Query or enumerate registry value

Disassembly:
call fcn.0043c7f0
cmp eax, 2
je 0x43d0b0
jmp 0x43d1b0
sub esp, 8
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 8], esi
cmp dword [esp + 0x14], esi
je 0x43d1a8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43d1a8
push ebx
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x43d19f
push ebp
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x43d195
lea ecx, [esp + 0x10]
mov dword [ebp], esi
push ecx
push eax
mov dword [ebx], esi
call fcn.0043c500
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
je 0x43d195
cmp dword [esp + 0x10], esi
je 0x43d17c
lea ecx, [esp + 0x10]
push ecx
push esi
push ebx
push esi
push eax
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43d17c
mov eax, dword [esp + 0x10]
inc eax
push eax
call fcn.00404c32
mov edi, eax
add esp, 4
test edi, edi
je 0x43d17c
lea eax, [esp + 0x10]
push eax
push edi
push ebx
push esi
push dword [esp + 0x24]
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43d17c
mov eax, dword [ebx]
cmp eax, 1
je 0x43d170
cmp eax, 2
je 0x43d170
mov eax, dword [esp + 0x10]
mov esi, edi
xor edi, edi
mov dword [ebp], eax
jmp 0x43d17c
push ebp
push edi
call fcn.0043c470
add esp, 8
mov esi, eax
push dword [esp + 0x14]
call fcn.0043eeb0
add esp, 4
test edi, edi
je 0x43d195
push edi
call fcn.0043eeb0
add esp, 4
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 8
ret
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 8
ret
pop edi
mov eax, esi
pop esi
add esp, 8
ret
sub esp, 8
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 8], esi
cmp dword [esp + 0x14], esi
je 0x43d2a8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43d2a8
push ebx
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x43d29f
push ebp
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x43d295
lea ecx, [esp + 0x10]
mov dword [ebp], esi
push ecx
push eax
mov dword [ebx], esi
call fcn.0043c5d0
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
je 0x43d295
cmp dword [esp + 0x10], esi
je 0x43d27c
lea ecx, [esp + 0x10]
push ecx
push esi
push ebx
push esi
push eax
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43d27c
mov eax, dword [esp + 0x10]
inc eax
push eax
call fcn.00404c32
mov edi, eax
add esp, 4
test edi, edi
je 0x43d27c
lea eax, [esp + 0x10]
push eax
push edi
push ebx
push esi
push dword [esp + 0x24]
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43d27c
mov eax, dword [ebx]
cmp eax, 1
je 0x43d270
cmp eax, 2
je 0x43d270
mov eax, dword [esp + 0x10]
mov esi, edi
xor edi, edi
mov dword [ebp], eax
jmp 0x43d27c
push ebp
push edi
call fcn.0043c640
add esp, 8
mov esi, eax
push dword [esp + 0x14]
call fcn.0043eeb0
add esp, 4
test edi, edi
je 0x43d295
push edi
call fcn.0043eeb0
add esp, 4
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 8
ret
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 8
ret
pop edi
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x43cb30
Capabilities:
Set registry value

Disassembly:
call fcn.0043c7f0
cmp eax, 2
je 0x43d2b0
jmp 0x43d380
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], 0
test ebp, ebp
je 0x43d37a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43d37a
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x43d373
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x43d373
push ebx
mov ebx, dword [esp + 0x20]
cmp ebx, 1
je 0x43d30f
cmp ebx, 2
je 0x43d30f
push ecx
push edi
push ebx
push esi
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
lea ecx, [esp + 0x10]
push ecx
push eax
call fcn.0043c500
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
je 0x43d36b
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0043c500
mov edi, eax
add esp, 8
test edi, edi
je 0x43d351
push dword [esp + 0x10]
push edi
push ebx
mov ebx, dword [esp + 0x24]
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
jmp 0x43d355
mov ebx, dword [esp + 0x18]
push ebx
call fcn.0043eeb0
add esp, 4
test edi, edi
je 0x43d36b
push edi
call fcn.0043eeb0
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret
mov eax, esi
pop esi
pop ebp
pop ecx
ret
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], 0
test ebp, ebp
je 0x43d44d
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43d44d
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x43d446
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x43d446
push ebx
mov ebx, dword [esp + 0x20]
cmp ebx, 1
je 0x43d3df
cmp ebx, 2
je 0x43d3df
push ecx
push edi
push ebx
push esi
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
lea ecx, [esp + 0x10]
push ecx
push eax
call fcn.0043c5d0
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
je 0x43d43e
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0043c5d0
mov edi, eax
add esp, 8
test edi, edi
je 0x43d424
mov ecx, dword [esp + 0x10]
add ecx, ecx
push ecx
push edi
push ebx
mov ebx, dword [esp + 0x24]
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x43d428
mov ebx, dword [esp + 0x18]
push ebx
call fcn.0043eeb0
add esp, 4
test edi, edi
je 0x43d43e
push edi
call fcn.0043eeb0
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret
mov eax, esi
pop esi
pop ebp
pop ecx
ret
Function at 0x44c150
Capabilities:
Delete registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x20]
push edi
push esi
mov dword [esp + 0x10], 0
call fcn.0044cc80
push esi
mov esi, dword [esp + 0x1c]
mov ebx, eax
push esi
call fcn.0044cbb0
add esp, 0xc
mov edi, eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44c1f5
push 0
call fcn.0044c9e0
push 1
call fcn.0044c9e0
add esp, 8
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44c1f5
push edi
call fcn.0043eeb0
add esp, 4
test esi, esi
je 0x44c1eb
push 0
push 0xff
push 0
push 0
push 0x1de
push 0xffffffffffffffc1
push esi
mov dword [esi + 0x80], 0xffffffc1
call fcn.0043dcc0
add esp, 0x1c
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
push edi
call fcn.0043eeb0
mov esi, dword [esp + 0x20]
add esp, 4
test esi, esi
je 0x44c25d
mov edi, dword [esp + 0x20]
test edi, edi
jne 0x44c229
push edi
push esi
call fcn.0041a8d0
add esp, 8
test eax, eax
je 0x44c25d
push edi
push esi
call fcn.0041a8d0
add esp, 8
inc eax
jmp 0x44c22b
mov eax, edi
push eax
xor eax, eax
test edi, edi
push esi
setne al
lea eax, [eax*2 + 1]
push eax
push dword [esp + 0x24]
push dword [esp + 0x1c]
call fcn.0043cb30
add esp, 0x14
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push dword [esp + 0x18]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x44e880
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0xc], 0
mov dword [esi + 8], 0
je 0x44e8c4
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
push 0x8004667e
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x44e8c4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
call fcn.004430e0
mov ecx, dword [esp + 4]
test eax, eax
push 4
lea eax, [esp + 8]
mov edx, 1
push eax
push 0x1b
push 0x29
push dword [esi + 4]
cmovne ecx, edx
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
pop ecx
ret
Function at 0x451050
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x4dc798], ebx
jne 0x4510de
push ebp
xor edi, edi
mov ebp, 0x4dc7a0
mov ebx, 0x100
lea ecx, [ecx]
movzx eax, di
mov esi, 8
mov dword [esp + 0x10], 0
mov dx, ax
mov dword [esp + 0x14], eax
mov ax, word [esp + 0x10]
lea esp, [esp]
mov cl, byte [esp + 0x14]
xor cl, byte [esp + 0x10]
test cl, 1
je 0x4510b1
mov ecx, 0x74ba
xor cx, ax
shr cx, 1
movzx eax, cx
mov dword [esp + 0x10], eax
jmp 0x4510b9
shr ax, 1
mov word [esp + 0x10], ax
shr dx, 1
mov word [esp + 0x14], dx
dec esi
jne 0x451090
mov word [ebp], ax
inc edi
add ebp, 2
cmp di, bx
jb 0x451070
mov dword [0x4dc798], 1
xor ebx, ebx
pop ebp
mov esi, dword [esp + 0x1c]
xor edx, edx
test esi, esi
jle 0x45110d
mov edi, dword [esp + 0x18]
lea esp, [esp]
movzx ecx, byte [edx + edi]
inc edx
movzx eax, bl
xor ecx, eax
shr bx, 8
xor bx, word [ecx*2 + 0x4dc7a0]
movzx ebx, bx
cmp edx, esi
jl 0x4510f0
pop edi
pop esi
mov ax, bx
pop ebx
add esp, 8
ret

Function at 0x455960
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push dword [esp + 0x10]
call fcn.0042b3f2
add esp, 4
mov dword [0x4dc9b4], eax
test eax, eax
jne 0x4559e3
lea eax, [esp]
push eax
push 1
push 0
push str.SOFTWAREFLEXlm_License_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4559e1
lea eax, [esp + 4]
mov dword [esp + 4], 0x400
push eax
push 0x4dc9b8
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x20]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp]
test eax, eax
jne 0x4559db
mov dword [0x4dc9b4], 0x4dc9b8
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4dc9b4]
add esp, 0xc
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0xc
ret
Function at 0x45e570
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 8]
mov eax, edx
push esi
sar eax, 8
mov esi, ebx
push edi
mov edi, dword [esp + 0x14]
mov byte [esp + 0x15], al
mov eax, edx
mov byte [esp + 0x14], dl
sar eax, 0x10
sar edx, 0x18
mov byte [esp + 0x16], al
mov byte [esp + 0x17], dl
test edi, edi
je 0x45e5ba
mov al, byte [esp + ecx + 0x14]
lea esi, [esi + 1]
xor byte [esi - 1], al
inc ecx
xor eax, eax
cmp ecx, 3
cmovg ecx, eax
dec edi
jne 0x45e5a4
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x488a30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
mov dword [esp + 4], 0x4e5d54
push eax
lea eax, [esp + 8]
push eax
push dword [esp + 0x18]
call fcn.00490a90
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.00490be0
mov eax, dword [esp + 0x1c]
add esp, 0x14
add eax, 0xa
push 0x40
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x488a81
pop esi
add esp, 8
ret
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push esi
call fcn.0041a450
push 0
push dword [esp + 0x1c]
push 0
push dword [esp + 0x20]
call fcn.0041a4e0
push dword [esp + 0x24]
call fcn.0043eeb0
add esp, 0x24
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x488ed0
Capabilities:
Get disk information

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x488ee2
jmp 0x488ef0
cmp al, 4
jae 0x488edd
jmp 0x4890a0
sub esp, 0x24
mov eax, dword [0x4d1ce0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
push 0
lea eax, [esp + 0x18]
push 0x4c9430
push eax
call fcn.0041a780
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add esp, 0xc
xor esi, esi
lea esp, [esp]
lea eax, [esp + 0x14]
push eax
call edi
cmp eax, 3
je 0x488f36
dec byte [esp + 0x14]
inc esi
cmp esi, 3
jl 0x488f20
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 8]
pop edi
pop esi
xor ecx, esp
call fcn.00404be0
add esp, 0x24
ret
push ecx
push ebx
push esi
push edi
push str.Kernel32.Dll
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.UTRegister
push edi
call ebx
mov esi, eax
test esi, esi
je 0x489159
push str.UTUnRegister
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x489159
push 0
push 0
lea eax, [esp + 0x14]
push eax
push str.UTProc
push 0
push str.VSN16.DLL
push dword [0x4e5d4c]
call esi
test eax, eax
je 0x489108
mov ecx, dword [esp + 0xc]
test ecx, ecx
jne 0x489129
push 0
push 0
lea eax, [esp + 0x14]
push eax
push str.UTProc
push 0
push str.VSN16.DLL
push dword [0x4e5d4c]
call esi
mov ecx, dword [esp + 0xc]
test eax, eax
je 0x489151
test ecx, ecx
je 0x489151
push 0
push 0
push 0
call ecx
push dword [0x4e5d4c]
mov esi, eax
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
push dword [0x4e5d4c]
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret