joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412870
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cba08
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4f96c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x494]
mov dword [ebp - 0x2c], 0xf
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
call fcn.00401720
push 5
mov dword [ebp - 4], 0
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
push 0
cmovae eax, dword [ebp - 0x40]
push str._auto__delay__service
push eax
push 0x4e823c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x464]
mov dword [ebp - 0x14], 0xf
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00401720
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 5
cmovae eax, dword [ebp - 0x28]
push 0
push str._service
push eax
push 0x4e823c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [ebp - 0x14], 0x10
jb 0x412941
push dword [ebp - 0x28]
call fcn.004a8256
add esp, 4
cmp dword [ebp - 0x2c], 0x10
jb 0x412952
push dword [ebp - 0x40]
call fcn.004a8256
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a79be
mov esp, ebp
pop ebp
ret

Function at 0x412980
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4f96c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x538], 0x10
push esi
lea esi, [ecx + 0x524]
push edi
jb 0x4129a5
mov eax, dword [esi]
jmp 0x4129a7
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4129cd
push str.CreateDllLogic
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4129c6
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.00401720
xor edx, edx
lea ecx, [ebp - 0x1c]
call fcn.004039a0
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x412a02
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 8], 8
jb 0x412a1a
push dword [ebp - 0x1c]
call fcn.004a8256
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004a79be
mov esp, ebp
pop ebp
ret
Function at 0x412c50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4f96c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xffffffffffffffff
lea eax, [ecx + 0x464]
mov dword [ebp - 8], 0xf
push 0
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00401720
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push 5
cmovae eax, dword [ebp - 0x1c]
push 0
push str._default
push eax
push 0x4e823c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [ebp - 8], 0x10
jb 0x412cb8
push dword [ebp - 0x1c]
call fcn.004a8256
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.004a79be
mov esp, ebp
pop ebp
ret
Function at 0x416110
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb24b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4f96c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ecx, ecx
mov dword [esi + 8], eax
mov edx, 4
mov eax, 0x53
mov dword [esi], vtable.DuiLib::CWindowWnd.0
mul edx
mov dword [esi + 4], 0
mov byte [esi + 0xc], 0
seto cl
mov dword [esi + 0x1c], 0
neg ecx
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
or ecx, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x20], vtable.DuiLib::CNotifyPump.0
push ecx
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0x53
call fcn.004a71b0
push 0x14c
push 0
push eax
mov dword [esi + 0x24], eax
call fcn.004ad1e0
add esp, 0x10
mov dword [ebp - 4], 0
lea ecx, [esi + 0x3c]
mov dword [esi + 0x30], vtable.DuiLib::INotifyUI.0
mov dword [esi + 0x34], vtable.DuiLib::IMessageFilterUI.0
mov dword [esi + 0x38], vtable.DuiLib::IDialogBuilderCallback.0
mov dword [esi], vtable.DuiLib::WindowImplBase.1.0
mov dword [esi + 0x20], vtable.DuiLib::WindowImplBase.2.0
mov dword [esi + 0x30], vtable.DuiLib::WindowImplBase.3.0
mov dword [esi + 0x34], vtable.DuiLib::WindowImplBase.4.0
mov dword [esi + 0x38], vtable.DuiLib::WindowImplBase.0
call fcn.0042d080
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x416250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x4f96c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x88]
push edi
mov edi, dword [ebp + 0xc]
push eax
push 0xf003f
push 0
push edx
push ecx
mov dword [ebp - 0x88], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4162a1
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a79be
mov esp, ebp
pop ebp
ret
push 0x7f
lea eax, [ebp - 0x83]
mov byte [ebp - 0x84], 0
push 0
push eax
call fcn.004ad1e0
add esp, 0xc
mov dword [ebp - 0x8c], 0x80
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x90], 1
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x90]
push eax
push 0
push esi
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41628f
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x84], 0
jne 0x416310
xor ecx, ecx
jmp 0x416329
lea ecx, [ebp - 0x84]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416320
sub ecx, edx
push ecx
lea eax, [ebp - 0x84]
mov ecx, edi
push eax
call fcn.004018d0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004a79be
mov esp, ebp
pop ebp
ret
Function at 0x416350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push str.SOFTWAREFeiRar
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x416382
xor al, al
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
push 0
push 0x4e88e8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41637c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4163c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0xf003f
push 0
mov edi, edx
mov dword [ebp - 4], 0
mov esi, ecx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x416426
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x416426
push 0x91
push str.register_tools.cpp
push str.false
call fcn.004abe96
add esp, 0xc
xor bl, bl
jmp 0x416456
push dword [ebp + 0x1c]
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
push 1
push 0
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x41644b
xor bl, bl
jmp 0x416456
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
cmp dword [ebp + 0x20], 0x10
jb 0x416467
push dword [ebp + 0xc]
call fcn.004a8256
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416470
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.00416590
add esp, 8
test al, al
je 0x4164bf
push dword [ebp + 0x1c]
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
push 1
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4164bf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x4164c1
xor bl, bl
cmp dword [ebp + 0x20], 0x10
jb 0x4164d2
push dword [ebp + 0xc]
call fcn.004a8256
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4164e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
mov esi, edx
mov edi, ecx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x416546
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x416546
push 0x91
push str.register_tools.cpp
push str.false
call fcn.004abe96
add esp, 0xc
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x41657f
push 0x83
push str.register_tools.cpp
push str.false
call fcn.004abe96
add esp, 0xc
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4177a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x4f96c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x124
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x134], ecx
push 0
push eax
mov dword [ebp - 0x130], 0x128
call fcn.004ad1e0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x417838
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x417831
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x417810
push dword [ebp - 0x134]
lea eax, [ebp - 0x10c]
push eax
call edi
test eax, eax
jne 0x41784b
lea eax, [ebp - 0x130]
push eax
push esi
call ebx
test eax, eax
jne 0x417810
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a79be
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a79be
mov esp, ebp
pop ebp
ret

Function at 0x4188a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4f96c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x22]
push edi
xor edi, edi
mov esi, 1
sub ecx, eax
jmp 0x4188d0
lea eax, [ecx + esi*2]
mov ax, word [ebp + eax - 0x24]
add ax, di
add ax, ax
movzx edi, ax
mov word [ebp + esi*2 - 0x24], di
inc esi
cmp esi, 0xf
jle 0x4188d0
xor edi, edi
test edx, edx
js 0x41892e
mov eax, edx
movzx edx, word [ebx + edi*4 + 2]
test edx, edx
je 0x418929
movzx eax, word [ebp + edx*2 - 0x24]
mov esi, eax
inc eax
mov word [ebp + edx*2 - 0x24], ax
xor eax, eax
lea esp, [esp]
mov ecx, esi
dec edx
and ecx, 1
shr esi, 1
or eax, ecx
add eax, eax
test edx, edx
jg 0x418910
shr eax, 1
mov word [ebx + edi*4], ax
mov eax, dword [ebp - 0x28]
inc edi
cmp edi, eax
jle 0x4188f4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a79be
mov esp, ebp
pop ebp
ret
Function at 0x41bd00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cbfb0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x4f96c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040a1b0
push ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00409fd0
add esp, 4
mov byte [ebp - 4], 2
or ebx, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, ebx
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41bd6c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0041cbb0
mov edi, eax
add esp, 4
test edi, edi
jne 0x41bd85
xor esi, esi
jmp 0x41be8d
push edi
mov edx, 0x41d010
lea ecx, [ebp - 0x3c]
call fcn.0041c080
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
movdqu xmm0, xmmword [edi + 0x38]
push esi
movdqu xmmword [ebp - 0x50], xmm0
call fcn.0040a1b0
push 0
push esi
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax - 0xc]
test edx, edx
je 0x41bdeb
lea ecx, [edx - 1]
test ecx, ecx
js 0x41bec2
cmp ecx, edx
jg 0x41bec2
cmp word [eax + ecx*2], 0x5c
je 0x41bdeb
push 0x4e7770
lea ecx, [ebp - 0x10]
call fcn.0041bee0
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x18], 0
test ecx, ecx
jb 0x41be60
mov eax, dword [ebp - 0x50]
ja 0x41be02
test eax, eax
je 0x41be60
add eax, 0xffffffff
xorps xmm0, xmm0
mov dword [ebp - 0x24], eax
mov eax, ecx
movlpd qword [ebp - 0x30], xmm0
adc eax, 0xffffffff
mov ebx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov edi, edi
mov edx, dword [ebp - 0x10]
mov ecx, edi
call fcn.0041b840
cmp ebx, dword [ebp - 0x20]
ja 0x41be45
jb 0x41be36
cmp esi, dword [ebp - 0x24]
jae 0x41be45
mov ecx, edi
call fcn.0041d540
test eax, eax
jne 0x41becc
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cdq
mov ebx, edx
mov esi, eax
cmp ebx, dword [ebp - 0x4c]
ja 0x41be5d
jb 0x41be20
cmp esi, dword [ebp - 0x50]
jb 0x41be20
or ebx, 0xffffffff
mov esi, 1
mov byte [ebp - 4], 3
mov ecx, ebx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41be85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x3c]
call fcn.0041c120
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0x1c]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x41beae
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00403440
xor esi, esi
or ebx, 0xffffffff
jmp 0x41be65
Function at 0x41e0a0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cc07b
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x4f96c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
or esi, 0xffffffff
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
push 0x104
push 0
push 0x105
mov dword [ebp - 4], 0
push eax
mov dword [edi], 0
call fcn.004ace0d
push 0x104
lea eax, [ebp - 0x117]
mov byte [ebp - 0x118], 0
push 0
push eax
call fcn.004ad1e0
add esp, 0x1c
lea eax, [ebp - 0x118]
push eax
push 0
push 0
push 0x801a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x41e15a
mov dword [edi], 3
jmp 0x41e2b6
cmp byte [ebp - 0x118], 0
jne 0x41e167
xor ecx, ecx
jmp 0x41e179
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e170
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x130]
call fcn.004018d0
push str.GlobalMgr.db
lea edx, [ebp - 0x130]
lea ecx, [ebp - 0x14c]
call fcn.004063a0
mov esi, eax
add esp, 4
lea eax, [ebp - 0x130]
cmp eax, esi
je 0x41e1ef
cmp dword [ebp - 0x11c], 0x10
jb 0x41e1c8
push dword [ebp - 0x130]
call fcn.004a8256
add esp, 4
push esi
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
call fcn.004022c0
cmp dword [ebp - 0x138], 0x10
jb 0x41e206
push dword [ebp - 0x14c]
call fcn.004a8256
add esp, 4
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
push 0
cmovae eax, dword [ebp - 0x130]
push 0x80
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41e242
mov dword [edi], 0x50
jmp 0x41e281
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x41e2b0
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
push 0
cmovae eax, dword [ebp - 0x130]
push 0x80
push 2
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41e2b0
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
push 0x104
cmovae eax, dword [ebp - 0x130]
push eax
push 0x105
push dword [ebp - 0x134]
call fcn.004ace78
add esp, 0x10
jmp 0x41e2b6
mov dword [edi], 0x65f
cmp dword [ebp - 0x11c], 0x10
jb 0x41e2cd
push dword [ebp - 0x130]
call fcn.004a8256
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a79be
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41ed30
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x4f96c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
xorps xmm0, xmm0
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa0], 0x67452301
mov dword [ebp - 0x9c], 0xefcdab89
movdqu xmmword [ebx], xmm0
mov dword [ebp - 0x98], 0x98badcfe
movdqu xmmword [edi], xmm0
mov dword [ebp - 0x94], 0x10325476
movdqu xmmword [edi + 0x10], xmm0
mov byte [edi + 0x20], 0
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
jb 0x41edb6
mov ecx, dword [ecx]
mov edx, ecx
lea ecx, [ebp - 0xa0]
push eax
call fcn.004205a0
add esp, 4
lea ecx, [ebp - 0xa0]
mov edx, ebx
call fcn.00420680
xor esi, esi
movzx eax, byte [ebx + esi]
push eax
push str._02x
push 2
push 3
push edi
call fcn.004a85b5
inc esi
add esp, 0x14
add edi, 2
cmp esi, 0x10
jb 0x41edd6
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov byte [eax + 0x20], 0
pop ebx
call fcn.004a79be
mov esp, ebp
pop ebp
ret
Function at 0x420900
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2aa8
call fcn.004af800
mov eax, dword [0x4f96c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov ebx, ecx
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004ad1e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4e8fe4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2aa8], eax
test eax, eax
jne 0x420984
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a79be
mov esp, ebp
pop ebp
ret
push str.GetAdaptersInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x420a8d
lea ecx, [ebp - 0x2a90]
mov dword [ebp - 0x2a90], 0x2880
push ecx
lea ecx, [ebp - 0x2a8c]
push ecx
call eax
test eax, eax
jne 0x420a8d
mov eax, ebx
mov dword [ebp - 0x2aa0], 3
lea ecx, [ebp - 0x2a98]
push esi
sub eax, ecx
push edi
lea edi, [ebp - 0x2a8c]
mov dword [ebp - 0x2aa4], eax
lea esp, [esp]
lea ecx, [edi + 8]
call fcn.00420af0
mov dword [ebp - 0x2a9c], eax
xor eax, eax
mov dword [ebp - 0x2a98], eax
xor ecx, ecx
mov word [ebp - 0x2a94], ax
mov eax, dword [ebp - 0x2aa4]
lea esi, [ebp - 0x2a98]
add esi, ecx
mov dl, byte [eax + esi]
cmp dl, byte [esi]
jne 0x420a22
inc ecx
cmp ecx, 6
jb 0x420a05
mov ecx, dword [ebp - 0x2a9c]
jmp 0x420a40
mov eax, dword [edi + 0x1a0]
cmp eax, 6
je 0x420a32
cmp eax, 0x17
jne 0x420a81
mov ecx, dword [ebp - 0x2a9c]
cmp dword [ebp - 0x2aa0], ecx
jle 0x420a81
movzx eax, byte [edi + 0x194]
mov byte [ebx], al
movzx eax, byte [edi + 0x195]
mov byte [ebx + 1], al
movzx eax, byte [edi + 0x196]
mov byte [ebx + 2], al
movzx eax, byte [edi + 0x197]
mov byte [ebx + 3], al
movzx eax, byte [edi + 0x198]
mov byte [ebx + 4], al
movzx eax, byte [edi + 0x199]
mov byte [ebx + 5], al
mov dword [ebp - 0x2aa0], ecx
mov edi, dword [edi]
test edi, edi
jne 0x4209e0
pop edi
pop esi
push dword [ebp - 0x2aa8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
xor edx, edx
mov dword [ebp - 0x2a98], eax
mov word [ebp - 0x2a94], ax
lea eax, [ebp - 0x2a98]
sub ebx, eax
lea ecx, [ebp - 0x2a98]
add ecx, edx
mov al, byte [ebx + ecx]
cmp al, byte [ecx]
jne 0x420acb
inc edx
cmp edx, 6
jb 0x420ab2
mov cl, 1
jmp 0x420acd
xor cl, cl
xor eax, eax
test cl, cl
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop ebx
call fcn.004a79be
mov esp, ebp
pop ebp
ret
Function at 0x420af0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4f96c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x11c]
push edi
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.WS2_32.dll_bind
mov edi, ecx
mov dword [ebp - 0x114], 0x104
mov ebx, 3
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x10c], 0
call esi
test eax, eax
jne 0x420cbe
push edi
push str._sConnection
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.004a85b5
add esp, 0x14
lea eax, [ebp - 0x118]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x11c]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x420cb6
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x110], 4
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], 4
push eax
push 0
push str.MediaSubType
push dword [ebp - 0x118]
call edi
test eax, eax
jne 0x420cae
push 0x104
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 1
push eax
mov dword [ebp - 0x114], 0x103
call fcn.004ad1e0
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.PnpInstanceID
push dword [ebp - 0x118]
call edi
test eax, eax
jne 0x420cae
mov eax, dword [ebp - 0x10c]
cmp eax, 1
jne 0x420c9f
push ebx
lea eax, [ebp - 0x108]
push 0x4e9090
push eax
call fcn.004ad050
add esp, 0xc
test eax, eax
jne 0x420c6d
xor ebx, ebx
jmp 0x420cae
mov eax, dword [ebp - 0x10c]
cmp eax, 1
jne 0x420c9f
push 3
lea eax, [ebp - 0x108]
push 0x4e9090
push eax
call fcn.004ad050
add esp, 0xc
test eax, eax
je 0x420c99
mov ebx, 2
jmp 0x420cae
mov eax, dword [ebp - 0x10c]
xor ebx, ebx
cmp eax, 2
setne bl
lea ebx, [ebx*2 + 1]
push dword [ebp - 0x118]
call esi
push dword [ebp - 0x11c]
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a79be
mov esp, ebp
pop ebp
ret