joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bde1338
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
lea esi, [ebp - 0x130]
mov ebx, 0x80040201
push 0x64
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0xc]
call sub.OLE32.dll_StringFromGUID2
test eax, eax
je 0x4bde14c7
push 0
push 0
push 0x64
lea edx, [ebp - 0xcc]
push edx
push 0xffffffffffffffff
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
call sub.KERNEL32.dll_WideCharToMultiByte
cmp dword [ebp + 8], 0
je 0x4bde144d
xor eax, eax
mov dword [ebp - 4], eax
push edi
push esi
call sub.KERNEL32.dll_lstrcpyA
push esi
push 0
push dword [ebp + 0x10]
call fcn.4bde14d2
push 0x4be4d16b
push esi
call sub.KERNEL32.dll_lstrcatA
push esi
push 0
lea edx, [ebp - 0xcc]
push edx
call fcn.4bde14d2
push 0x4be4d172
push esi
call sub.KERNEL32.dll_lstrcpyA
lea ecx, [ebp - 0xcc]
push ecx
push esi
call sub.KERNEL32.dll_lstrcatA
push esi
push 0
push dword [ebp + 0x10]
call fcn.4bde14d2
push esi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
add ebx, esi
push 0x4be4d179
push esi
call sub.KERNEL32.dll_lstrcatA
mov byte [ebx], 0
push 0x4be4d181
push esi
call sub.KERNEL32.dll_lstrcatA
push esi
push 0
push dword [ebp + 0x18]
call fcn.4bde14d2
lea eax, [ebp - 4]
push eax
push 2
push 0
push esi
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4bde1449
push 0xa
push 0x4be4d1a0
push 1
push 0
push 0x4be4d191
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
xor ebx, ebx
jmp 0x4bde14c7
push 0x4be4d1aa
push esi
call sub.KERNEL32.dll_lstrcpyA
lea eax, [ebp - 0xcc]
push eax
push esi
call sub.KERNEL32.dll_lstrcatA
push esi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
add ebx, esi
mov byte [ebx], 0
push 0x4be4d1b1
push esi
call sub.KERNEL32.dll_lstrcatA
push esi
call fcn.4bde1532
mov byte [ebx], 0
push 0x4be4d1c1
push esi
call sub.KERNEL32.dll_lstrcatA
mov byte [ebx], 0
push esi
call fcn.4bde1532
push edi
push esi
call sub.KERNEL32.dll_lstrcpyA
push esi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
add ebx, esi
push 0x4be4d1c9
push esi
call sub.KERNEL32.dll_lstrcatA
push esi
call fcn.4bde1532
mov byte [ebx], 0
push esi
call fcn.4bde1532
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4bde14d2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 4]
push edx
push 0
push 0x4001f
push 0
push 0
push 0
push dword [ebp + 0x10]
push 0x80000000
call sub.ADVAPI32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4bde1528
push esi
call fcn.4be41d2c
pop ecx
inc eax
push eax
push esi
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegSetValueExA
mov ebx, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x4bdf30b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x4be5008c
push 0xfa
call sym.idapi32.dll__OsMalloc
pop ecx
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edi
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x4bdf318d
movzx edx, word [ebp + 0xc]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push esi
push 0
push 0
lea eax, [edi + 0x21]
push eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
je 0x4bdf3142
lea edx, [edi + 0x2e]
push edx
call sub.KERNEL32.dll_GetModuleHandleA
push 0xf9
push ebx
push eax
call sub.KERNEL32.dll_GetModuleFileNameA
push ebx
call fcn.4be41d2c
pop ecx
mov byte [ebx + eax - 0xb], 0
lea ecx, [edi + 0x3a]
push ecx
push ebx
call fcn.4be41c6c
add esp, 8
mov ebx, eax
jmp 0x4bdf3183
cmp byte [esi], 0
je 0x4bdf3153
push esi
push ebx
call fcn.4be41cfc
add esp, 8
jmp 0x4bdf3183
lea eax, [edi + 0x44]
push eax
call sub.KERNEL32.dll_GetModuleHandleA
push 0xf9
push ebx
push eax
call sub.KERNEL32.dll_GetModuleFileNameA
push ebx
call fcn.4be41d2c
pop ecx
mov byte [ebx + eax - 0xb], 0
lea edx, [edi + 0x50]
push edx
push ebx
call fcn.4be41c6c
add esp, 8
mov ebx, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
jmp 0x4bdf31bd
lea ecx, [edi + 0x5a]
push ecx
call sub.KERNEL32.dll_GetModuleHandleA
push 0xf9
push ebx
push eax
call sub.KERNEL32.dll_GetModuleFileNameA
push ebx
call fcn.4be41d2c
pop ecx
mov byte [ebx + eax - 0xb], 0
lea eax, [edi + 0x66]
push eax
push ebx
call fcn.4be41c6c
add esp, 8
mov ebx, eax
push ebx
push esi
call fcn.4be41cfc
add esp, 8
push ebx
call sym.idapi32.dll__OsFree
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4bdf31d9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x4be500fc
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x4bdf3232
push esi
call fcn.4be41d2c
pop ecx
inc eax
push eax
push esi
push 1
push 0
push 0x4be5011d
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
je 0x4bdf322a
mov bx, 0x2105
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bdf323c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4be50134
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x4bdf32a5
mov dword [ebp - 8], 0xf
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0x4be50155
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
je 0x4bdf329b
push 0xf
push 0x4be50160
lea eax, [ebp - 0x18]
push eax
call fcn.4be41e34
add esp, 0xc
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
jmp 0x4bdf32b8
push 0xf
push 0x4be50166
lea edx, [ebp - 0x18]
push edx
call fcn.4be41e34
add esp, 0xc
push 0x4be5016c
lea ecx, [ebp - 0x18]
push ecx
call fcn.4be41cd0
add esp, 8
test eax, eax
jne 0x4bdf32d3
xor eax, eax
mov dword [ebx], eax
jmp 0x4bdf32d9
mov dword [ebx], 1
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4bdf3629
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
push dword [ebp + 8]
lea eax, [ebp - 0x90]
push eax
call fcn.4bdf356c
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x90]
push ecx
call sub.KERNEL32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x4bdf366c
mov eax, dword [ebp - 0xc]
imul dword [ebp - 4]
imul dword [ebp - 8]
jmp 0x4bdf366f
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 4

Function at 0x4be029ca
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], 1
mov word [ebp - 0xa], 4
lea eax, [ebp - 8]
push eax
push 7
push 0
call sym.idapi32.dll_DbiGetObjFromObj
test ax, ax
jne 0x4be02a14
lea edx, [ebp - 0xa]
push edx
mov cx, word [ebp - 0xa]
push ecx
lea eax, [ebp - 4]
push eax
push 0xff070001
push dword [ebp - 8]
call sym.idapi32.dll_DbiGetProp
cmp dword [ebp - 4], 1
jne 0x4be02a14
mov eax, dword [ebp - 4]
jmp 0x4be02a80
mov dword [ebp - 4], 1
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
push 0x4be52ae4
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x4be02a7d
mov dword [ebp - 0x1c], 5
lea ecx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x4be52b05
push dword [ebp - 0x10]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x4be02a75
lea edx, [ebp - 0x18]
push edx
push 0x4be52b0f
call sym.idapi32.dll_OsLdMBRStrICmp
cmp eax, 1
sbb ecx, ecx
neg ecx
mov dword [ebp - 4], ecx
push dword [ebp - 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4be0625e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [edi], eax
push 0
push dword [0x4be53f24]
call sym.idapi32.dll_OsMuxLock
push esi
call fcn.4be06c6e
test ax, ax
je 0x4be0628e
mov bx, 0x2706
jmp 0x4be062bf
movsx eax, si
mov edx, dword [0x4be53f28]
mov ecx, dword [edx]
mov eax, dword [ecx + eax*4]
push dword [eax + 0x1ea]
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4be062b5
call fcn.4be057bc
mov ebx, eax
jmp 0x4be062bf
test al, 1
je 0x4be062bf
mov dword [edi], 1
push dword [0x4be53f24]
call sym.idapi32.dll_OsMuxUnlock
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4be071fe
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor edi, edi
push ebx
push 0
call fcn.4be07b14
test eax, eax
jne 0x4be07221
mov ax, 0x2703
jmp 0x4be07272
push 0
push dword [0x4be53f24]
call sym.idapi32.dll_OsMuxLock
call fcn.4be07018
push ebx
push ebx
call sub.USER32.dll_OemToCharA
push ebx
call sub.KERNEL32.dll_DeleteFileA
mov esi, eax
push ebx
push ebx
call sub.USER32.dll_CharToOemA
test si, si
jne 0x4be07265
call fcn.4be057bc
mov edi, eax
push 0
push ebx
push 0x3f11
push esi
push 6
call sym.idapi32.dll_OsSaveErrorByLang
push dword [0x4be53f24]
call sym.idapi32.dll_OsMuxUnlock
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4be07835
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call sub.USER32.dll_OemToCharA
lea edx, [ebp - 0x108]
push edx
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4be07864
mov ax, 0x2b03
jmp 0x4be07870
test al, 0x10
je 0x4be0786c
xor eax, eax
jmp 0x4be07870
mov ax, 0x2b03
mov esp, ebp
pop ebp
ret 4

Function at 0x4be079d5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push dword [ebp + 8]
lea eax, [ebp - 0x80]
push eax
call fcn.4be41c64
add esp, 8
mov byte [eax], 0x5c
inc eax
mov byte [eax], 0
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 4
setne al
and eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4be07a09
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
lea eax, [ebp - 0x108]
push eax
push 0x105
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
jne 0x4be07a2e
call fcn.4be057bc
jmp 0x4be07a3f
push dword [ebp + 8]
lea edx, [ebp - 0x108]
push edx
call sub.USER32.dll_CharToOemA
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4be07a45
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
mov ebx, eax
test ebx, ebx
je 0x4be07a77
push esi
lea eax, [ebp - 0x108]
push eax
call sub.USER32.dll_CharToOemA
test ebx, ebx
je 0x4be07a86
push esi
call sym.idapi32.dll_OsDirExists
test ax, ax
je 0x4be07aae
push 0x104
lea edx, [ebp - 0x108]
push edx
call sub.KERNEL32.dll_GetSystemDirectoryA
test eax, eax
jne 0x4be07aa1
mov ax, 0x2b03
jmp 0x4be07ab0
push esi
lea edx, [ebp - 0x108]
push edx
call sub.USER32.dll_CharToOemA
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4be07ab8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
lea eax, [ebp - 0x210]
push eax
push 0x105
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
jne 0x4be07add
call fcn.4be057bc
jmp 0x4be07b07
lea edx, [ebp - 0x108]
push edx
lea ecx, [ebp - 0x210]
push ecx
call sub.USER32.dll_CharToOemA
push 0
push 0
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sym.idapi32.dll_OsNmPrsFName
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4be07f5e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x1c]
call sub.USER32.dll_OemToCharA
lea edx, [ebp - 0x108]
push edx
push dword [ebp + 0x18]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_GetPrivateProfileStringA
test eax, eax
je 0x4be07fba
lea ecx, [ebp - 0x210]
push ecx
push ebx
call sub.USER32.dll_CharToOemA
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.4be41cfc
add esp, 8
xor eax, eax
jmp 0x4be07fbe
mov ax, 0x2208
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4be08190
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 8]
call fcn.4be095e4
push 0x80
lea edx, [ebp - 0x104]
push edx
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
lea eax, [ebp - 0x84]
push eax
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
jne 0x4be081d7
xor eax, eax
jmp 0x4be0827c
push 3
push 0x4be5436c
lea edx, [ebp - 0x104]
push edx
call sym.idapi32.dll_OsLdMBRStrNICmp
test eax, eax
jne 0x4be08205
cmp dword [ebp - 4], 0xff
jne 0x4be081fe
mov eax, 0x4be54320
jmp 0x4be0827c
mov eax, 0x4be5431c
jmp 0x4be0827c
push 0x4be54370
lea edx, [ebp - 0x104]
push edx
call sym.idapi32.dll_OsLdMBRStrICmp
test eax, eax
jne 0x4be08221
mov eax, 0x4be54324
jmp 0x4be0827c
push 0x4be54375
lea edx, [ebp - 0x104]
push edx
call sym.idapi32.dll_OsLdMBRStrICmp
test eax, eax
jne 0x4be0823d
mov eax, 0x4be54328
jmp 0x4be0827c
push 0x4be5437a
lea edx, [ebp - 0x104]
push edx
call sym.idapi32.dll_OsLdMBRStrICmp
test eax, eax
je 0x4be08267
push 0x4be54383
lea ecx, [ebp - 0x104]
push ecx
call sym.idapi32.dll_OsLdMBRStrICmp
test eax, eax
jne 0x4be08277
cmp dword [ebp - 4], 0xff
jne 0x4be08277
mov eax, 0x4be54320
jmp 0x4be0827c
mov eax, 0x4be5432c
mov esp, ebp
pop ebp
ret 4
Function at 0x4be0876b
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
call fcn.4be095e4
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
lea ecx, [ebp - 0x84]
push ecx
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
jne 0x4be087b0
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.4be05733
jmp 0x4be087bc
mov ax, word [ebp - 4]
mov edx, dword [ebp + 8]
mov word [edx], ax
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x4be094ae
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0xc]
call fcn.4be095e4
push 0
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
jne 0x4be094e9
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.4be05733
jmp 0x4be094eb
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x4be09e3a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4be4f83c], 0
je 0x4be09e4d
mov eax, dword [0x4be610bc]
jmp 0x4be09e58
push dword [0x4be5445f]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x4be09e60
xor eax, eax
pop ebp
ret
cmp word [eax + 0xc], 0
jne 0x4be09e7a
cmp word [eax + 0xe], 2
je 0x4be09e7a
mov word [eax + 0x12], 0
mov word [eax + 0xa], 0
mov ax, word [eax + 0xc]
pop ebp
ret

Function at 0x4be0a05b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [0x4be5445f]
call sub.KERNEL32.dll_TlsGetValue
push 1
push 0x80
call sym.idapi32.dll__OsCalloc
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4be0a086
mov ax, 0x2501
jmp 0x4be0a0b7
push dword [ebp + 0x14]
push ebx
push 0x80
call fcn.4bdf3847
push ebx
mov dx, word [ebp + 0x10]
push edx
mov cx, word [ebp + 0xc]
push ecx
mov al, byte [ebp + 8]
push eax
call sym.idapi32.dll_OsSaveAnsiError
mov esi, eax
test ebx, ebx
je 0x4be0a0b5
push ebx
call sym.idapi32.dll__OsFree
pop ecx
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x18

Function at 0x4be0a2d2
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4be0a2e1
mov eax, ebx
jmp 0x4be0a2ec
push dword [0x4be5445f]
call sub.KERNEL32.dll_TlsGetValue
cmp word [eax + 0xc], 0
jne 0x4be0a306
cmp word [eax + 0xe], 2
je 0x4be0a306
mov word [eax + 0x12], 0
mov word [eax + 0xa], 0
mov ax, word [eax + 0x12]
pop ebx
pop ebp
ret 4

Function at 0x4be0a39e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test esi, esi
je 0x4be0a3b1
mov eax, esi
jmp 0x4be0a3bc
push dword [0x4be5445f]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x4be0a3c4
xor eax, eax
jmp 0x4be0a3e3
test ebx, ebx
je 0x4be0a3df
cmp word [eax + 0xc], 0
je 0x4be0a3d8
mov dx, word [eax + 0xc]
mov word [ebx], dx
jmp 0x4be0a3df
mov cx, word [eax + 0xa]
mov word [ebx], cx
mov ax, word [eax + 0x12]
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4be0a49f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea ebx, [esi + 0xffff]
test edi, edi
je 0x4be0a4b9
mov eax, edi
jmp 0x4be0a4c4
push dword [0x4be5445f]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4be0a558
cmp bx, word [eax + 0x12]
jae 0x4be0a558
cmp dword [ebp + 0x10], 0
je 0x4be0a4f0
movzx edx, bx
imul ecx, edx, 0x85
mov edx, dword [eax + 0x14]
mov cl, byte [edx + ecx]
mov edx, dword [ebp + 0x10]
mov byte [edx], cl
cmp dword [ebp + 0x14], 0
je 0x4be0a50d
movzx ecx, bx
imul edx, ecx, 0x85
mov ecx, dword [eax + 0x14]
mov dx, word [ecx + edx + 1]
mov ecx, dword [ebp + 0x14]
mov word [ecx], dx
cmp dword [ebp + 0x18], 0
je 0x4be0a52a
movzx edx, bx
imul ecx, edx, 0x85
mov edx, dword [eax + 0x14]
mov cx, word [edx + ecx + 3]
mov edx, dword [ebp + 0x18]
mov word [edx], cx
cmp dword [ebp + 0x1c], 0
je 0x4be0a55a
movzx ecx, bx
imul edx, ecx, 0x85
add edx, dword [eax + 0x14]
add edx, 5
mov eax, edx
push 0x7f
push eax
push dword [ebp + 0x1c]
call fcn.4be41e34
add esp, 0xc
mov eax, dword [ebp + 0x1c]
mov byte [eax + 0x7e], 0
jmp 0x4be0a55a
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0x18

Function at 0x4be0a69d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x1f
mov bx, 0x2704
test esi, esi
je 0x4be0a710
cmp byte [esi], 0
je 0x4be0a710
push 0x4be5446c
lea eax, [ebp - 0x114]
push eax
call fcn.4be41cfc
add esp, 8
push esi
lea edx, [ebp - 0x114]
push edx
call fcn.4be41c6c
add esp, 8
push 0x4be54471
lea ecx, [ebp - 0x114]
push ecx
call fcn.4be41c6c
add esp, 8
lea eax, [ebp - 4]
push eax
push 0
lea edx, [ebp - 0x114]
push edx
call sym.idapi32.dll_OsLoadDll
mov ebx, eax
test bx, bx
je 0x4be0a7e6
lea eax, [ebp - 8]
push eax
push 0x4be54476
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4be0a7c6
push 0x1f
push 0
lea edx, [ebp - 0x134]
push edx
call fcn.4be41c34
add esp, 0xc
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x134]
push eax
push 0
push 0
push 0x4be54497
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegQueryValueExA
cmp byte [ebp - 0x134], 0
je 0x4be0a7be
push 0x4be544a0
lea edx, [ebp - 0x114]
push edx
call fcn.4be41cfc
add esp, 8
lea ecx, [ebp - 0x134]
push ecx
lea eax, [ebp - 0x114]
push eax
call fcn.4be41c6c
add esp, 8
push 0x4be544a5
lea edx, [ebp - 0x114]
push edx
call fcn.4be41c6c
add esp, 8
lea ecx, [ebp - 4]
push ecx
push 0
lea eax, [ebp - 0x114]
push eax
call sym.idapi32.dll_OsLoadDll
mov ebx, eax
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
test bx, bx
je 0x4be0a7e6
lea eax, [ebp - 4]
push eax
push 0
push 0x4be544aa
call sym.idapi32.dll_OsLoadDll
mov ebx, eax
test bx, bx
je 0x4be0a7e6
mov eax, ebx
jmp 0x4be0a7f0
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4be2054b
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dx, word [eax]
mov word [ebp - 0xa], dx
mov ecx, dword [ebp + 8]
mov word [ecx], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 1
push 2
call sub.MPR.dll_WNetOpenEnumA
mov edi, eax
test edi, edi
je 0x4be205a3
cmp edi, 0x4c6
je 0x4be20688
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.4be05733
mov word [ebp - 8], ax
jmp 0x4be20688
push 0x3e8
call sym.idapi32.dll__OsMalloc
pop ecx
mov esi, eax
test esi, esi
jne 0x4be205bf
mov word [ebp - 8], 0x2501
jmp 0x4be20688
mov word [ebp - 6], 0
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0x3e8
lea eax, [ebp - 0x14]
push eax
push esi
lea edx, [ebp - 0x10]
push edx
push dword [ebp - 4]
call sub.MPR.dll_WNetEnumResourceA
mov edi, eax
test edi, edi
jne 0x4be2065a
inc word [ebp - 6]
cmp dword [esi + 0x1c], 0
je 0x4be2063a
xor ebx, ebx
jmp 0x4be20612
movzx eax, bx
imul edx, eax, 0x22
add edx, 0x4be55050
push edx
push dword [esi + 0x1c]
call sym.idapi32.dll_OsLdMBRStrICmp
test eax, eax
je 0x4be20626
inc ebx
movzx ecx, bx
mov eax, ecx
shl eax, 4
add eax, ecx
cmp byte [eax*2 + 0x4be55050], 0
jne 0x4be205f8
movzx edx, bx
mov ecx, edx
shl ecx, 4
add ecx, edx
mov ax, word [ecx*2 + 0x4be55070]
jmp 0x4be2063e
mov ax, 4
mov dx, word [ebp - 6]
cmp dx, word [ebp - 0xa]
jae 0x4be2065a
movzx ecx, word [ebp - 6]
mov edx, dword [ebp + 0xc]
mov word [edx + ecx*2 - 2], ax
mov eax, dword [ebp + 8]
inc word [eax]
test edi, edi
je 0x4be205c5
cmp edi, 0x103
je 0x4be20679
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.4be05733
mov word [ebp - 8], ax
push dword [ebp - 4]
call sub.MPR.dll_WNetCloseEnum
push esi
call sym.idapi32.dll__OsFree
pop ecx
mov ax, word [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4be208ca
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 4], 0x105
or edi, 0xffffffff
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
push 0
push dword [0x4be53f24]
call sym.idapi32.dll_OsMuxLock
cmp byte [ebx], 0
je 0x4be2093f
cmp byte [ebx + 1], 0x3a
jne 0x4be2093f
mov al, byte [ebx]
cmp al, 0x61
jb 0x4be20910
cmp al, 0x7a
ja 0x4be20910
add al, 0xe0
cmp al, 0x41
jb 0x4be2093f
cmp al, 0x5a
ja 0x4be2093f
mov edi, eax
and edi, 0xff
add edi, 0xffffffbf
cmp byte [edi + 0x4be550fa], 0
je 0x4be2093f
xor eax, eax
mov al, byte [edi + 0x4be550fa]
dec eax
mov edx, dword [ebp + 8]
mov dword [edx], eax
jmp 0x4be20a24
cmp dword [0x4be5521c], 0
je 0x4be20968
push 0x4be55114
push ebx
call sym.idapi32.dll_OsLdMBRStrICmp
test eax, eax
jne 0x4be20968
mov ecx, dword [0x4be5521c]
dec ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x4be20a24
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x10c]
push ecx
push ebx
call sub.MPR.dll_WNetGetConnectionA
test ax, ax
jne 0x4be20997
mov eax, dword [ebp + 8]
mov dword [eax], 1
test edi, edi
jl 0x4be20a05
mov byte [edi + 0x4be550fa], 2
jmp 0x4be20a24
cmp ax, 0x8ca
jne 0x4be209aa
test edi, edi
jl 0x4be20a05
mov byte [edi + 0x4be550fa], 1
jmp 0x4be20a24
cmp ax, 0x4b0
jne 0x4be20a05
push ebx
call fcn.4be41d2c
pop ecx
mov edi, eax
add edi, ebx
dec edi
cmp byte [ebx + 1], 0x5c
je 0x4be209ce
push ebx
call fcn.4be41d2c
pop ecx
cmp eax, 3
jb 0x4be20a01
cmp byte [edi], 0x5c
je 0x4be209db
inc edi
mov byte [edi], 0x5c
inc edi
mov byte [edi], 0
push ebx
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 4
jne 0x4be209f1
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x4be20a05
cmp eax, 3
jne 0x4be20a05
mov edx, dword [ebp + 8]
mov dword [edx], 1
jmp 0x4be20a05
mov si, 0x2a04
test si, si
jne 0x4be20a24
push ebx
push 0x4be55114
call fcn.4be41cfc
add esp, 8
mov eax, dword [ebp + 8]
mov edx, dword [eax]
inc edx
mov dword [0x4be5521c], edx
push dword [0x4be53f24]
call sym.idapi32.dll_OsMuxUnlock
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8