joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10048030
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.10049c40
add esp, 4
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x8004667e
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x10048094
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
call sym.vmtools.dll_Err_Errno2String
push eax
push esi
push edi
push str.SOCKET_failed_to_make_fd__d_non_blocking_:__d___s_n
call sym.vmtools.dll_Warning
mov eax, dword [ebp + 0x10]
add esp, 0x14
test eax, eax
je 0x1004808b
mov dword [eax], 1
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10047a40
mov esi, eax
add esp, 4
cmp dword [esi + 0x17c], 0
mov dword [esi + 0xc], ebx
mov dword [esi + 8], edi
mov dword [esi + 0x10], 0
jne 0x100480d1
push ebx
mov dword [esi + 0x14], 0x10076e68
call fcn.10049ba0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
mov dword [esi + 0x14], 0x10076e9c
call fcn.10049ba0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100489c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [esi + 8]
push edi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x1007
push 0xffff
push edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
je 0x10048a23
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
mov dword [esi + 0x1c], edi
call sym.vmtools.dll_Err_Errno2String
push eax
mov eax, dword [esi + 8]
push edi
push eax
push str.SOCKET_getsockopt_for_connect_on_fd__d_failed_with_error__d_:__s_n
call sym.vmtools.dll_Warning
add esp, 0x14
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test eax, eax
je 0x10048a37
mov dword [esi + 0x1c], eax
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 8]
lea eax, [esi + 0xb0]
push eax
lea ecx, [esi + 0x30]
push ecx
push edx
mov dword [eax], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x10048a84
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
mov dword [esi + 0x1c], edi
call sym.vmtools.dll_Err_Errno2String
push eax
mov eax, dword [esi + 8]
push edi
push eax
push str.SOCKET_getsockname_for_connect_on_fd__d_failed_with_error__d:__s_n
call sym.vmtools.dll_Warning
add esp, 0x14
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x148]
mov edx, dword [esi + 0x13c]
push ecx
push esi
mov dword [esi + 4], 2
call edx
add esp, 8
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10048e50
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x150]
push esi
push edi
test eax, eax
je 0x10048e6c
push eax
call sym.vmtools.dll_MXUser_AcquireRecLock
add esp, 4
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebx + 8]
push eax
push esi
push ecx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x10048ec5
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
jne 0x10048ea8
mov edx, dword [ebp + 0x1c]
push edx
push 1
mov eax, 8
mov ecx, ebx
call fcn.10048de0
add esp, 8
jmp 0x10048ed9
call edi
mov esi, eax
push esi
call sym.vmtools.dll_Err_Errno2String
push eax
push esi
push str.SOCKET_connect_failed__error__d:__s_n
call sym.vmtools.dll_Log
mov esi, 6
jmp 0x10048f04
mov eax, dword [ebp + 0x1c]
push 0
push eax
push 0
xor eax, eax
mov ecx, ebx
call fcn.10048de0
add esp, 0xc
test eax, eax
je 0x10048f40
mov ecx, dword [ebx + 8]
push ecx
push ebx
call fcn.10047c50
add esp, 4
push eax
push str.SOCKET__d___d_
call sym.vmtools.dll_Warning
push str.failed_to_register_callback_in_connect__n
call sym.vmtools.dll_Warning
mov esi, 8
mov edx, dword [ebx + 0xc]
add esp, 0x10
push edx
call fcn.10049bb0
mov eax, dword [ebx + 0x150]
add esp, 4
test eax, eax
je 0x10048f26
push eax
call sym.vmtools.dll_MXUser_ReleaseRecLock
add esp, 4
push ebx
call dword [sym.imp.MSVCR90.dll_free]
mov eax, dword [ebp + 0x24]
add esp, 4
test eax, eax
je 0x10048f39
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov dword [ebx + 0x13c], eax
mov eax, dword [ebx + 0x150]
mov dword [ebx + 0x148], ecx
lea edi, [ebx + 0xb8]
mov ecx, 0x20
mov dword [ebx + 4], 1
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x138], edx
test eax, eax
je 0x10048f82
push eax
call sym.vmtools.dll_MXUser_ReleaseRecLock
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x100499c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x1008f486], 0
je 0x100499f0
call fcn.10049cb0
cmp eax, 0x100498c0
je 0x100499f0
push eax
push 0x100498c0
push str.SSLCheckLockingCallback
push str._s:_locking_callback_overwritten__Expected__p__saw__p_n
call sym.vmtools.dll_Warning
add esp, 0x10
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0xa], 0
je 0x10049a0b
push 0x271d
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
pop esi
pop ebp
ret
cmp byte [esi + 8], 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
je 0x10049a3e
mov edx, dword [esi]
push ebx
push eax
push ecx
push edx
call fcn.10049c70
mov ebx, eax
mov eax, dword [esi]
add esp, 0xc
call fcn.10049820
mov dword [esi + 0x10], eax
test eax, eax
je 0x10049a38
or ebx, 0xffffffff
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov edx, dword [esi + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
pop esi
pop ebp
ret
Function at 0x10049ac0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x1008f486], 0
je 0x10049af0
call fcn.10049cb0
cmp eax, 0x100498c0
je 0x10049af0
push eax
push 0x100498c0
push str.SSLCheckLockingCallback
push str._s:_locking_callback_overwritten__Expected__p__saw__p_n
call sym.vmtools.dll_Warning
add esp, 0x10
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0xa], 0
je 0x10049b0b
push 0x271d
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
pop esi
pop ebp
ret
cmp byte [esi + 8], 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
je 0x10049b3e
mov edx, dword [esi]
push ebx
push eax
push ecx
push edx
call fcn.10049c80
mov ebx, eax
mov eax, dword [esi]
add esp, 0xc
call fcn.10049820
mov dword [esi + 0x10], eax
test eax, eax
je 0x10049b38
or ebx, 0xffffffff
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov edx, dword [esi + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
pop esi
pop ebp
ret
Function at 0x10049df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [0x1008c21c]
push esi
lea eax, [ebp - 8]
push eax
push 0x20019
xor esi, esi
push esi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10049e65
mov edx, dword [0x1008c21c]
push edx
push 0x10078148
push str._s:_Couldnt_open_key___S_._n
call sym.vmtools.dll_Debug
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10078148
push str._s:_RegOpenKeyExW_error_0x_x._n
call sym.vmtools.dll_Debug
add esp, 0xc
jmp 0x10049f4b
mov ecx, dword [0x1008c220]
mov edx, dword [ebp - 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push ecx
push edx
call edi
test eax, eax
je 0x10049ebd
mov eax, dword [0x1008c220]
push eax
push 0x10078148
push str._s:_Couldnt_get_length_of_value___S_._n
call sym.vmtools.dll_Debug
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10078148
push str._s:_RegQueryValueExW_error_0x_x._n
call sym.vmtools.dll_Debug
add esp, 0xc
jmp 0x10049f4a
mov ecx, dword [ebp - 4]
add ecx, 2
push ecx
call dword [sym.imp.MSVCR90.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x10049eeb
mov edx, dword [ebp - 4]
push edx
push 0x10078148
push str._s:_Couldnt_allocate__d_bytes._n
call sym.vmtools.dll_Debug
add esp, 0xc
jmp 0x10049f4a
mov eax, dword [ebp - 4]
mov edx, dword [0x1008c220]
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0
push 0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push edx
push eax
call edi
test eax, eax
je 0x10049f3f
mov ecx, dword [0x1008c220]
push ecx
push 0x10078148
push str._s:_Couldnt_get_data_for_value___S_._n
call sym.vmtools.dll_Debug
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10078148
push str._s:_RegQueryValueExW_error_0x_x._n
call sym.vmtools.dll_Debug
add esp, 0xc
jmp 0x10049f4a
mov edx, dword [ebp - 4]
shr edx, 1
xor eax, eax
mov word [esi + edx*2], ax
pop edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x10049f59
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004a3a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
xor edi, edi
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call sym.vmtools.dll_W32Util_GetVmwareCommonAppDataFilePath
mov esi, eax
add esp, 4
cmp esi, edi
je 0x1004a492
push ebx
call sym.vmtools.dll_ProductState_GetName
push eax
push 0x5c
push esi
push str._s_c_s
push edi
call sym.vmtools.dll_Str_SafeAsprintf
mov ebx, dword [sym.imp.MSVCR90.dll_free]
push esi
mov edi, eax
call ebx
push edi
call sym.vmtools.dll_File_Exists
add esp, 0x1c
test al, al
jne 0x1004a48f
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.1004a2c0
mov esi, eax
add esp, 8
test esi, esi
je 0x1004a417
push esi
push str.GuestAppGetOrCreateConfPath
push str._s:_Error:_Get_security_info_failed__u_n
jmp 0x1004a458
mov edx, dword [ebp - 4]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1004a460
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x1004a44d
push eax
push str.GuestAppGetOrCreateConfPath
push str._s:_Error:_CreateDirectory_path_exists__u_n
call sym.vmtools.dll_Debug
add esp, 0xc
xor esi, esi
jmp 0x1004a460
push esi
push str.GuestAppGetOrCreateConfPath
push str._s:_Error:_CreateDirectory_failed__u_n
call sym.vmtools.dll_Warning
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x1004a47c
mov eax, dword [eax + 4]
push eax
call ebx
mov ecx, dword [ebp - 8]
push ecx
call ebx
mov edx, dword [ebp - 4]
push edx
call ebx
add esp, 0xc
test esi, esi
je 0x1004a48f
push edi
call ebx
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004abe0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1008f4a8], 0
je 0x1004ac0c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.icmp.dll
call esi
test eax, eax
jne 0x1004ac45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.Failed_to_load_icmp.dll:__d
call sym.vmtools.dll_Debug
add esp, 8
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.IpHlpApi.dll
call esi
test eax, eax
jne 0x1004ac7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.Failed_to_load_iphlpapi.dll:__d
call sym.vmtools.dll_Debug
add esp, 8
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
mov dword [0x1008f4a8], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, eax
test esi, esi
je 0x1004acba
push esi
push str.Failed_to_startup_winsock:__d
call sym.vmtools.dll_Debug
add esp, 8
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x1004accb
shr eax, 8
cmp al, 2
je 0x1004ace3
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.NetUtil_LoadIpHlpApiDll
push str._s:_Failed_to_get_WinSock_Version_2.2
call sym.vmtools.dll_Debug
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret

Function at 0x1004b2b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x808]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E966_E325_11CE_BFC1_08002BE103180000
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x80c], 0x7fe
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004b37e
lea ecx, [ebp - 0x80c]
push ecx
lea edx, [ebp - 0x804]
push edx
push eax
push eax
mov eax, dword [ebp - 0x808]
push str.DriverDesc
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004b371
mov ecx, dword [ebp - 0x80c]
lea eax, [ebp - 0x804]
shr ecx, 1
xor edx, edx
push eax
mov word [ebp + ecx*2 - 0x804], dx
call dword [sym.imp.MSVCR90.dll__wcslwr]
mov ecx, dword [ebp - 0x808]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x804]
push str.acpi
push edx
call dword [sym.imp.MSVCR90.dll_wcsstr]
add esp, 8
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x808]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
Function at 0x1004b520
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 1
xor edi, edi
push eax
mov dword [ebp - 4], edi
call sym.vmtools.dll_Unicode_GetAllocBytes
mov edx, dword [ebp + 0x10]
add esp, 8
lea ecx, [ebp - 4]
push ecx
push edi
push edx
mov ebx, eax
mov eax, dword [ebp + 8]
push edi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x1004b5bb
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
cmp eax, 1
je 0x1004b56a
cmp eax, 2
je 0x1004b56a
mov esi, 0x8000ffff
jmp 0x1004b5bb
mov ecx, dword [ebp - 4]
add ecx, 2
push ecx
call dword [sym.imp.MSVCR90.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x1004b585
lea esi, [eax + 0xe]
jmp 0x1004b5bb
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push edi
push esi
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x1004b5bb
mov ecx, dword [ebp - 4]
push 1
shr ecx, 1
xor edx, edx
push 0xffffffffffffffff
push edi
mov word [edi + ecx*2], dx
call sym.vmtools.dll_Unicode_AllocWithLength
mov ecx, dword [ebp + 0xc]
add esp, 0xc
mov dword [ecx], eax
push edi
mov edi, dword [sym.imp.MSVCR90.dll_free]
call edi
push ebx
call edi
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004b730
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
xor edi, edi
cmp byte [ebp + 8], 0
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
je 0x1004b754
mov dword [ebp - 8], reloc.OLEAUT32.dll_SysReAllocString
mov eax, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
jmp 0x1004b78b
lea eax, [ebp - 8]
push eax
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov esi, eax
cmp esi, edi
je 0x1004b786
push esi
push str.RegOpenCurrentUser_failed__err_d__n
call sym.vmtools.dll_Debug
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or edi, 0xffffffff
jmp 0x1004b867
mov eax, str.Environment
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push edi
push eax
push edx
call sym.vmtools.dll_Win32U_RegOpenKeyEx
mov esi, eax
add esp, 0x14
cmp esi, edi
je 0x1004b7b0
push esi
push str.Win32U_RegOpenKeyEX_failed__err_d__n
jmp 0x1004b76f
mov eax, dword [ebp + 0xc]
push ebx
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
mov ebx, eax
mov eax, dword [ebp + 0x10]
add esp, 8
test eax, eax
je 0x1004b817
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
add esp, 8
mov esi, eax
lea edx, [eax + 2]
jmp 0x1004b7e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1004b7e0
sub eax, edx
mov edx, dword [ebp - 4]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
mov ebx, dword [sym.imp.MSVCR90.dll_free]
mov edi, eax
call ebx
push esi
call ebx
add esp, 8
jmp 0x1004b824
mov eax, dword [ebp - 4]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
pop ebx
test edi, edi
je 0x1004b847
mov ecx, dword [ebp + 0xc]
push edi
push ecx
push str.Setting_the_key__s_failed__err_d__n
call sym.vmtools.dll_Debug
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or edi, 0xffffffff
jmp 0x1004b867
push 0x1008f4b0
push 0x2710
push 2
push str.Environment
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1004b877
push eax
call esi
cmp byte [ebp + 8], 0
jne 0x1004b887
mov eax, dword [ebp - 8]
test eax, eax
je 0x1004b887
push eax
call esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004b920
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x14], ebx
call sym.vmtools.dll_Hostinfo_GetOSType
mov dword [ebp - 0x10], ebx
cmp eax, 0x1869f
jne 0x1004b976
push str.System_IsUserAdmin__:_Unknown_GOS_n
call sym.vmtools.dll_Debug
add esp, 4
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1004b9b7
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1004b9ad
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x10], 1
pop ebx
sete al
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret

Function at 0x1004bc90
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push SysReAllocString
push 0
or esi, 0xffffffff
push 0
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1004bcd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10078d10
push str._s:_failed_to_open_service_control_manager__error_0x_lx.
call sym.vmtools.dll_Debug
add esp, 0xc
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
push SysReAllocString
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x1004bd07
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x10078d10
push str._s:_failed_to_open_service__s__error_0x_lx.
call sym.vmtools.dll_Debug
add esp, 0x10
jmp 0x1004bd38
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1004bd32
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x10078d10
push str._s:_failed_to_get_status_of__s_service__error_0x_lx.
call sym.vmtools.dll_Debug
add esp, 0x10
jmp 0x1004bd38
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x1004bd45
push esi
call ebx
push edi
call ebx
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004bea0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call sym.vmtools.dll_Hostinfo_GetOSType
push 1
push str.SeShutdownPrivilege
mov edi, eax
call sym.vmtools.dll_System_SetProcessPrivilege
mov bl, byte [ebp + 8]
add esp, 8
test bl, bl
je 0x1004beca
mov esi, 2
jmp 0x1004beda
call fcn.1004b2b0
movsx esi, al
neg esi
sbb esi, esi
and esi, 7
inc esi
cmp edi, 4
jl 0x1004bf3b
cmp edi, 5
je 0x1004bf2f
cmp edi, 6
jne 0x1004bef2
call fcn.1004b490
test eax, eax
je 0x1004bf2f
movsx edi, bl
mov ebx, dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
push edi
push 0
push 0
push 0
push 0
call ebx
test eax, eax
jne 0x1004bf44
push edi
push 1
push eax
push eax
push eax
call ebx
test eax, eax
jne 0x1004bf44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
jne 0x1004bf44
push 0
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.1004b9d0
cmp al, 1
jne 0x1004bf3b
or esi, 4
push 0
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1004c1a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0x800
mov dword [ebp - 4], 0x800
mov dword [ebp - 0xc], 1
call sym.vmtools.dll_UtilSafeMalloc0
mov edi, eax
mov eax, dword [ebp + 0xc]
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
mov esi, eax
push 1
push ebx
mov dword [ebp - 0x14], esi
call sym.vmtools.dll_Unicode_GetAllocBytes
mov edx, dword [ebp + 8]
add esp, 0x14
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push esi
push edx
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x1004c215
mov eax, dword [ebp + 0xc]
push ebx
push eax
push str.WinRegGetSZInt
push str._s:_A_Windows_registry_operation_failed:_Failed_to_open_key._key_path:__s__value_name:__s_n
call sym.vmtools.dll_Log
add esp, 0x10
jmp 0x1004c2af
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push edi
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x1004c27a
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
push ebx
push edx
push eax
push str.WinRegGetSZInt
push str._s:_A_Windows_registry_operation_failed:_buffer_too_small__need__d_bytes._key_path:__s__value_name:__s.__Resizing_buffer_to_retry._n
call sym.vmtools.dll_Log
mov ecx, dword [ebp - 4]
push ecx
push edi
call sym.vmtools.dll_UtilSafeRealloc0
mov ecx, dword [ebp - 0x10]
add esp, 0x1c
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
mov edi, eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
cmp ecx, 1
je 0x1004c2d2
cmp ecx, 2
je 0x1004c2d2
mov edx, dword [ebp + 0xc]
push ebx
push edx
push ecx
push esi
push str.WinRegGetSZInt
push str._s:_A_Windows_registry_operation_failed:__d._registry_value_TYPE_is__d._key_path:__s__value_name:__s_n
call sym.vmtools.dll_Log
add esp, 0x18
mov esi, 0xd
push edi
mov edi, dword [sym.imp.MSVCR90.dll_free]
call edi
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call edi
mov edx, dword [ebp - 0x10]
push edx
call edi
add esp, 8
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x1004c2af
mov eax, dword [ebp - 4]
cmp eax, 2
jb 0x1004c2aa
mov edx, eax
shr edx, 1
cmp word [edi + edx*2 - 2], si
je 0x1004c2fd
push str.WinRegGetSZInt
push str._s:_Registry_string_not_terminated_correctly_n
call sym.vmtools.dll_Log
add esp, 8
jmp 0x1004c2aa
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x1004c306
mov dword [edx], eax
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x1004c30f
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov edi, dword [sym.imp.MSVCR90.dll_free]
jmp 0x1004c2bb