joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2638
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4c26e7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
mov edx, 0x4c2700
call fcn.00404a80
mov eax, edi
call fcn.0040a168
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4c26d1
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4c26d1
mov ebx, dword [edx]
lea eax, [ebp - 4]
push eax
xor eax, eax
mov al, byte [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
xor eax, eax
mov al, byte [ebx + 1]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
xor eax, eax
mov al, byte [ebx + 3]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x24]
mov ecx, 3
mov eax, 0x4c2710
call fcn.0040a674
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00404a80
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c26ee
lea eax, [ebp - 4]
call fcn.00404a2c
ret

Function at 0x4c2a74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c2b46
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
call sub.kernel32.dll_GetTempPathA
mov ebx, eax
imul esi, ebx, 1
jno 0x4c2aaa
call fcn.00403b58
mov eax, esi
call fcn.004027e0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c2aed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404c24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2af4
mov eax, dword [ebp - 0xc]
call fcn.00402800
ret

Function at 0x4c2b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c2c0b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
call sub.kernel32.dll_GetWindowsDirectoryA
mov ebx, eax
imul esi, ebx, 1
jno 0x4c2b93
call fcn.00403b58
mov eax, esi
call fcn.004027e0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c2bd6
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404c24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2bdd
mov eax, dword [ebp - 8]
call fcn.00402800
ret
Function at 0x4c54f8
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404edc
xor eax, eax
push ebp
push 0x4c5576
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404eec
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x4c5541
mov eax, dword [ebx + 4]
call fcn.00404eec
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c557d
lea eax, [ebp - 4]
call fcn.00404a2c
ret

Function at 0x4c6548
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c66e5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402b68
cmp word [ebx + 0xa2], 0
je 0x4c6591
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4c65a5
lea esi, [ebp - 8]
jmp 0x4c65a7
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x4c65b4
xor edi, edi
jmp 0x4c65c1
mov eax, dword [ebx + 0x80]
call fcn.00404eec
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00404eec
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004c5cb0
mov eax, dword [ebp - 0x14]
call fcn.00404eec
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00404eec
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404eec
push eax
mov eax, ebx
call fcn.004c5de4
push eax
mov eax, ebx
call fcn.004c5db8
push eax
mov eax, ebx
call fcn.004c5d6c
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004c5b7c
mov eax, dword [ebp - 0x18]
call fcn.00404eec
push eax
mov eax, dword [ebx + 8]
call fcn.00404eec
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0xc], 0
jne 0x4c664a
call fcn.0040fb98
xor edx, edx
push ebp
push 0x4c66c3
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4c6688
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x4c667e
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c66ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c66ca
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x4c66f4
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x4c6720
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404eec
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4c6745
call fcn.0040fb98
xor eax, eax
push ebp
push 0x4c677c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x4c6765
call fcn.0040fb98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6783
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x4ca4a4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ecx, eax
xor eax, eax
push ebp
push 0x4ca539
push dword fs:[eax]
mov dword fs:[eax], esp
test ecx, ecx
setl byte [ebp - 1]
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
cmp byte [ebp - 1], 0
je 0x4ca4dc
dec ebx
not ebx
mov eax, esi
call fcn.00404a2c
mov edi, ebx
and edi, 0xff
shr ebx, 8
lea eax, [ebp - 8]
mov edx, edi
call fcn.00404c14
mov edx, dword [ebp - 8]
mov ecx, dword [esi]
mov eax, esi
call fcn.00404d38
test ebx, ebx
jne 0x4ca4e3
cmp byte [ebp - 1], 0
jne 0x4ca523
mov eax, dword [esi]
cmp byte [eax], 0x7f
jbe 0x4ca523
mov ecx, dword [esi]
mov eax, esi
mov edx, 0x4ca550
call fcn.00404d38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca540
lea eax, [ebp - 8]
call fcn.00404a2c
ret
Function at 0x4cf064
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd1c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cf283
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
lea eax, [ebp - 0x2de]
mov edx, 0x200
call fcn.00407af4
lea eax, [ebp - 0x7a]
mov edx, 0x64
call fcn.00407af4
lea eax, [ebp - 0xde]
mov edx, 0x64
call fcn.00407af4
mov eax, dword [ebp - 8]
call fcn.00404cec
mov esi, eax
sub esi, 3
jl 0x4cf0f2
inc esi
mov eax, 3
lea edx, [ebp - 0x7a]
mov ecx, dword [ebp - 8]
cmp byte [ecx + eax - 1], 0x5c
je 0x4cf0f2
mov ecx, dword [ebp - 8]
mov cl, byte [ecx + eax - 1]
mov byte [edx], cl
inc eax
inc edx
dec esi
jne 0x4cf0da
lea eax, [ebp - 0x2e4]
lea edx, [ebp - 0x7a]
mov ecx, 0x64
call fcn.00404c9c
mov eax, dword [ebp - 0x2e4]
call fcn.00404cec
mov dword [ebp - 0x10], eax
xor eax, eax
lea edx, [ebp - 0x7a]
cmp eax, dword [ebp - 0x10]
jl 0x4cf127
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x41
jmp 0x4cf14e
movzx esi, byte [edx]
mov ecx, esi
shr ecx, 4
add ecx, 0x41
jno 0x4cf139
call fcn.00403b58
mov byte [ebp - 0x16], cl
mov ecx, esi
and ecx, 0xf
add ecx, 0x41
jno 0x4cf14b
call fcn.00403b58
mov byte [ebp - 0x15], cl
mov cl, byte [ebp - 0x16]
mov byte [ebp + ebx - 0xde], cl
mov cl, byte [ebp - 0x15]
mov byte [ebp + ebx - 0xdd], cl
add ebx, 2
jno 0x4cf16c
call fcn.00403b58
inc eax
inc edx
cmp eax, 0x10
jne 0x4cf118
mov byte [ebp - 0x2de], 0x81
mov byte [ebp - 0x2db], 0x48
mov byte [ebp - 0x2da], 0x20
lea edx, [ebp - 0xde]
lea eax, [ebp - 0x2d9]
mov ecx, ebx
call fcn.00407aec
mov eax, ebx
add eax, 6
jno 0x4cf1a7
call fcn.00403b58
mov byte [ebp + eax - 0x2de], 0x20
lea eax, [ebp - 0x14]
mov edx, 0x4cf29c
call fcn.00404ac4
mov eax, ebx
add eax, 0x25
jno 0x4cf1c8
call fcn.00403b58
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
call fcn.00404f44
mov edx, eax
add ebx, 7
jno 0x4cf1df
call fcn.00403b58
lea eax, [ebp + ebx - 0x2de]
mov ecx, 0x20
call fcn.00407aec
push 0
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x2de]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_send
inc eax
je 0x4cf262
mov eax, 0x54633c
mov edx, 0x2000
call fcn.00407af4
push 0
push 0x2000
push 0x54633c
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_recv
inc eax
je 0x4cf262
xor eax, eax
mov al, byte [0x54635d]
imul eax, eax, 0x100
jno 0x4cf244
call fcn.00403b58
xor edx, edx
mov dl, byte [0x54635c]
add eax, edx
jno 0x4cf255
call fcn.00403b58
mov dword [0x546138], eax
mov eax, 0x54633c
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf28a
lea eax, [ebp - 0x2e4]
call fcn.00404a2c
lea eax, [ebp - 0x14]
call fcn.00404a2c
ret
Function at 0x4cf2c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4cf2c9
mov eax, dword [ebp - 4]
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404edc
mov eax, dword [ebp - 0xc]
call fcn.00404edc
lea ebx, [ebp - 0x2020]
xor eax, eax
push ebp
push 0x4cf4d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 8]
call fcn.00404cec
mov esi, eax
mov eax, dword [ebp - 0xc]
call fcn.00404cec
add esi, eax
jno 0x4cf32b
call fcn.00403b58
mov eax, esi
add eax, 2
jno 0x4cf337
call fcn.00403b58
mov edx, eax
add edx, 0x37
jno 0x4cf343
call fcn.00403b58
mov ecx, eax
test ecx, ecx
jns 0x4cf34f
add ecx, 0xff
sar ecx, 8
mov dword [ebp - 0x14], ecx
and eax, 0x800000ff
jns 0x4cf363
dec eax
or eax, 0xffffff00
inc eax
mov dword [ebp - 0x18], eax
mov esi, edx
test esi, esi
jns 0x4cf372
add esi, 0xff
sar esi, 8
mov edi, edx
and edi, 0x800000ff
jns 0x4cf387
dec edi
or edi, 0xffffff00
inc edi
mov eax, dword [ebp - 0xc]
call fcn.00404cec
add eax, 1
jno 0x4cf399
call fcn.00403b58
mov edx, eax
test edx, edx
jns 0x4cf3a5
add edx, 0xff
sar edx, 8
mov dword [ebp - 0x1c], edx
and eax, 0x800000ff
jns 0x4cf3b9
dec eax
or eax, 0xffffff00
inc eax
mov dword [ebp - 0x20], eax
mov eax, ebx
mov edx, 0x2000
call fcn.00407af4
mov eax, esi
mov byte [ebx + 2], al
mov eax, edi
mov byte [ebx + 3], al
mov byte [ebx + 4], 0xff
mov byte [ebx + 5], 0x53
mov byte [ebx + 6], 0x4d
mov byte [ebx + 7], 0x42
mov byte [ebx + 8], 0x73
mov byte [ebx + 0xd], 0x18
mov byte [ebx + 0xe], 1
mov byte [ebx + 0xf], 0x20
mov byte [ebx + 0x1f], 0x28
mov byte [ebx + 0x24], 0xa
mov byte [ebx + 0x25], 0xff
mov byte [ebx + 0x29], 4
mov byte [ebx + 0x2a], 0x11
mov byte [ebx + 0x2b], 2
mov eax, dword [ebp - 0x20]
mov byte [ebx + 0x33], al
mov eax, dword [ebp - 0x1c]
mov byte [ebx + 0x34], al
mov eax, dword [ebp - 0x18]
mov byte [ebx + 0x39], al
mov eax, dword [ebp - 0x14]
mov byte [ebx + 0x3a], al
mov eax, dword [ebp - 0xc]
call fcn.00404cec
push eax
lea eax, [ebp - 0xc]
call fcn.00404f44
mov edx, eax
lea eax, [ebx + 0x3b]
pop ecx
call fcn.00407aec
mov eax, dword [ebp - 8]
call fcn.00404cec
push eax
lea eax, [ebp - 8]
call fcn.00404f44
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404cec
add eax, 0x3c
jno 0x4cf462
call fcn.00403b58
lea eax, [ebx + eax]
pop edx
pop ecx
call fcn.00407aec
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404cec
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.00404cec
add esi, eax
jno 0x4cf489
call fcn.00403b58
add esi, 0x3d
jno 0x4cf493
call fcn.00403b58
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_send
inc eax
je 0x4cf4bd
push 0
push 0x400
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_recv
inc eax
je 0x4cf4bd
xor eax, eax
mov al, byte [ebx + 9]
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf4df
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404a50
ret
Function at 0x4d019c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d0424
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
lea eax, [ebp - 0x14]
call fcn.00404a2c
mov eax, dword [ebp - 4]
call fcn.00404a2c
mov byte [ebp - 0x21], 0
mov eax, dword [ebp - 0xc]
mov byte [eax], 1
xor edx, edx
push ebp
push 0x4d0366
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push 0x4d0438
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
xor edx, edx
push ebp
push 0x4d0355
push dword fs:[edx]
mov dword fs:[edx], esp
cmp eax, 5
jne 0x4d0251
call fcn.004d3730
call fcn.00404490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d03fe
cmp dword [ebp - 0x18], 0
je 0x4d033e
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 0x101
lea eax, [ebp - 0x121]
mov edx, pe_nt_image_headers32
call fcn.00407af4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x121]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x4d044c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d02a0
mov byte [ebp - 0x21], 1
lea eax, [ebp - 0x128]
lea edx, [ebp - 0x121]
mov ecx, pe_nt_image_headers32
call fcn.00404c9c
mov eax, dword [ebp - 0x128]
lea edx, [ebp - 0x14]
call fcn.00409114
lea eax, [ebp - 0x121]
mov edx, pe_nt_image_headers32
call fcn.00407af4
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 0x101
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x121]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x4d0450
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d0309
mov byte [ebp - 0x21], 1
lea eax, [ebp - 0x130]
lea edx, [ebp - 0x121]
mov ecx, pe_nt_image_headers32
call fcn.00404c9c
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x12c]
call fcn.00409114
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 4]
call fcn.00404a80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d035c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d042b
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.00404a50
lea eax, [ebp - 0x14]
call fcn.00404a2c
ret
Function at 0x4d11a0
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x4d11a9
mov eax, dword [ebp - 4]
add esp, 0xfffff150
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
lea edi, [ebp - 0xc]
xor eax, eax
push ebp
push 0x4d12c2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi], 0
jne 0x4d11f6
mov dl, 1
mov eax, dword [0x4197c4]
call fcn.00403be8
mov dword [esi], eax
mov eax, dword [esi]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x10]
mov ecx, 0x4d12dc
mov edx, ebx
call fcn.00404d38
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x20
call fcn.00403254
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 2
lea eax, [ebp - 0x10]
call fcn.00404f44
mov dword [ebp - 0x20], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0
push 2
call sub.mpr.dll_WNetOpenEnumA
mov dword [edi], 1
mov dword [ebp - 8], 0x3e80
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x3eb4]
push eax
push edi
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
mov ebx, eax
test ebx, ebx
jne 0x4d1293
cmp dword [edi], 1
jne 0x4d1293
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x3ea0]
call fcn.0040a184
mov eax, dword [esi]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp dword [edi], 1
jne 0x4d129c
test ebx, ebx
je 0x4d124e
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d12c9
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404a50
ret
Function at 0x4d3430
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov esi, edx
xor edi, edi
push 1
push 0
push eax
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x4d3474
push 4
push esi
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
je 0x4d346e
push esp
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4d3468
mov edi, dword [esp + 4]
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov eax, edi
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x4d34dc
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00404edc
mov eax, dword [ebp - 8]
call fcn.00404edc
mov eax, dword [ebp - 0xc]
call fcn.00404edc
xor eax, eax
push ebp
push 0x4d36f0
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040b3f4
fstp qword [ebp - 0x18]
wait
cmp bl, 1
jne 0x4d3536
xor ebx, ebx
jmp 0x4d36c8
lea ecx, [ebp - 0x3c]
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.0043d994
mov eax, dword [ebp - 0x3c]
mov edx, 0x4d370c
call fcn.00404e38
je 0x4d3565
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4d370c
call fcn.00404d38
lea ecx, [ebp - 0x40]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0043da04
mov eax, dword [ebp - 0x40]
mov edx, 0x4d3718
call fcn.00404e38
jne 0x4d359b
mov eax, dword [ebp - 4]
call fcn.00404cec
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.00404f8c
lea eax, [ebp - 0x10]
mov ecx, 0x4d3724
mov edx, dword [ebp - 4]
call fcn.00404d38
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x20
call fcn.00403254
mov eax, 0x4d372c
mov dword [ebp - 0x28], eax
mov eax, 0x4d372c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
call fcn.00404eec
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 1
cmp bl, 3
jne 0x4d35f1
lea eax, [ebp - 0xc]
call fcn.00404a2c
lea eax, [ebp - 8]
call fcn.00404a2c
push 0
mov eax, dword [ebp - 8]
call fcn.00404eec
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404eec
push eax
lea eax, [ebp - 0x38]
push eax
call sub.mpr.dll_WNetAddConnection2A
mov ebx, eax
cmp ebx, 0x35
je 0x4d36c8
cmp ebx, 0x37
je 0x4d36c8
cmp ebx, 0x4c6
je 0x4d36c8
cmp ebx, 0x43
je 0x4d36c8
call fcn.0040b3f4
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.004ad5a4
cmp edx, 0
jne 0x4d365a
cmp eax, 7
jb 0x4d365c
jmp 0x4d36c8
jge 0x4d36c8
cmp byte [ebp + 8], 0
je 0x4d36c8
test ebx, ebx
je 0x4d36c8
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404eec
mov esi, eax
push esi
call sub.mpr.dll_WNetCancelConnection2A
mov ebx, eax
test ebx, ebx
jne 0x4d36c8
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x20
call fcn.00403254
mov eax, 0x4d372c
mov dword [ebp - 0x28], eax
mov eax, 0x4d372c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x34], 1
push 0
mov eax, dword [ebp - 8]
call fcn.00404eec
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404eec
push eax
lea eax, [ebp - 0x38]
push eax
call sub.mpr.dll_WNetAddConnection2A
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d36f7
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.00404a50
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404a50
ret
Function at 0x4d37dc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
xor eax, eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d3890
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x88], 2
jne 0x4d386f
cmp dword [ebp - 0x94], 5
jne 0x4d386f
cmp dword [ebp - 0x90], 1
jne 0x4d386f
lea eax, [ebp - 4]
lea edx, [ebp - 0x84]
mov ecx, 0x80
call fcn.00404c9c
cmp dword [ebp - 4], 0
je 0x4d386d
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 4]
call fcn.00408f00
mov edx, dword [ebp - 0x9c]
mov eax, 0x4d38a8
call fcn.00405030
test eax, eax
jne 0x4d386f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3897
lea eax, [ebp - 0x9c]
call fcn.00404a2c
lea eax, [ebp - 4]
call fcn.00404a2c
ret

Function at 0x4d3d60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4d3e50
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
call fcn.00409a1c
test al, al
je 0x4d3e35
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404ac4
mov eax, dword [0x54471c]
cmp dword [eax], 2
jne 0x4d3df7
lea eax, [ebp - 8]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404f4c
mov eax, dword [ebp - 8]
mov edx, 0x4d3e68
call fcn.00404e38
jne 0x4d3de7
lea eax, [ebp - 4]
mov ecx, 2
mov edx, 1
call fcn.00404f8c
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4d3e74
call fcn.00404d38
jmp 0x4d3df7
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4d3e88
call fcn.00404d38
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404eec
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4d3e35
push 0
push esi
call sub.kernel32.dll_GetFileSize_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4d3e2f
xor ebx, ebx
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3e57
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a50
ret