joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ce70
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9482
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x420], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x424], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x428], esi
mov dword [esi + 0x10], 0
jb 0x46cee3
mov eax, dword [esi]
jmp 0x46cee5
mov eax, esi
push 1
push 0x4fa3a0
mov byte [eax], 0
call fcn.00438c00
push 0
push 0
push 3
push 0
push 3
push 0
mov dword [ebp - 4], 0
push 0x4fa3a4
mov dword [ebp - 0x424], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x46cfc9
push 0x400
xorps xmm0, xmm0
mov dword [ebp - 0x420], 0
lea eax, [ebp - 0x410]
movq qword [ebp - 0x41c], xmm0
push 0
push eax
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0
call fcn.004a8960
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push 0xc
lea eax, [ebp - 0x41c]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x46cfc2
lea ebx, [ebp - 0x410]
add ebx, dword [ebp - 0x400]
movsx eax, byte [ebx]
push eax
call fcn.004bba8e
add esp, 4
test eax, eax
je 0x46cfc2
push ebx
mov ecx, esi
call fcn.0043f210
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
Function at 0x46d2a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9548
mov eax, dword fs:[0]
push eax
sub esp, 0x104
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
jne 0x46d2d9
xor eax, eax
jmp 0x46d447
lea ecx, [ebp - 0x70]
call fcn.0046ce70
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.0046cff0
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.0046d120
cmp dword [ebp - 0x5c], 0x10
lea edx, [ebp - 0x70]
push dword [ebp - 0x60]
cmovae edx, dword [ebp - 0x70]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x110], 0x67452301
mov dword [ebp - 0x10c], 0xefcdab89
mov dword [ebp - 0x108], 0x98badcfe
mov dword [ebp - 0x104], 0x10325476
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0
call fcn.0046cce0
add esp, 4
lea edx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x110]
cmovae edx, dword [ebp - 0x40]
push dword [ebp - 0x30]
call fcn.0046cce0
add esp, 4
lea edx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x110]
cmovae edx, dword [ebp - 0x28]
push dword [ebp - 0x18]
call fcn.0046cce0
add esp, 4
lea ecx, [ebp - 0x110]
mov edx, esi
call fcn.0046cdc0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x46d3cd
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433760
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp eax, 0x10
jb 0x46d3f4
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00433760
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
cmp eax, 0x10
jb 0x46d41b
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00433760
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
cmp eax, 0x10
jb 0x46d442
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.00433760
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
Function at 0x46e8b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
xorps xmm0, xmm0
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa8], 0x67452301
mov dword [ebp - 0xa4], 0xefcdab89
movups xmmword [ebx], xmm0
mov dword [ebp - 0xa0], 0x98badcfe
movups xmmword [edi], xmm0
mov dword [ebp - 0x9c], 0x10325476
movups xmmword [edi + 0x10], xmm0
mov byte [edi + 0x20], 0
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0
jb 0x46e933
mov ecx, dword [ecx]
mov edx, ecx
lea ecx, [ebp - 0xa8]
push eax
call fcn.0046cce0
add esp, 4
lea ecx, [ebp - 0xa8]
mov edx, ebx
call fcn.0046cdc0
xor esi, esi
movzx eax, byte [ebx + esi]
push eax
push str._02x
push 2
push 3
push edi
call fcn.0046c590
inc esi
add esp, 0x14
add edi, 2
cmp esi, 0x10
jb 0x46e953
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov byte [eax + 0x20], 0
pop ebx
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
Function at 0x46f240
Capabilities:
Copy file
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9828
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor dl, dl
lea ecx, [ebp - 0x44]
xor bl, bl
call fcn.0046f5a0
push 0
push 0
push 3
push 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
push 1
cmovae eax, dword [ebp - 0x44]
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46f387
mov dl, 1
lea ecx, [ebp - 0x2c]
call fcn.0046f5a0
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x294]
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push ecx
push eax
call esi
cmp eax, 0xffffffff
je 0x46f2df
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x46f336
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x294]
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push ecx
push eax
call esi
cmp eax, 0xffffffff
je 0x46f336
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
push 0
cmovae ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x46f336
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push 0
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x46f36e
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00433600
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp esi, 0xffffffff
je 0x46f3d3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x10
jb 0x46f3cc
push 0
lea eax, [ebp - 0x298]
mov dword [ebp - 0x298], 0
push eax
push 0x10
push 0x515370
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46f3cc
cmp dword [ebp - 0x298], 0x10
mov eax, 1
movzx ebx, bl
cmove ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x46f3e8
inc ecx
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x44]
call fcn.00433600
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret 4
Function at 0x46f410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9858
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor dl, dl
lea ecx, [ebp - 0x44]
xor bl, bl
call fcn.0046f5a0
push 0
push 0
push 2
push 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
push 1
cmovae eax, dword [ebp - 0x44]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46f4d0
mov dl, 1
lea ecx, [ebp - 0x2c]
call fcn.0046f5a0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push 0
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x46f4b7
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00433600
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp esi, 0xffffffff
je 0x46f4fe
push 0
lea eax, [ebp - 0x48]
push eax
push 0x10
push 0x515370
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46f4f7
cmp dword [ebp - 0x48], 0x10
mov eax, 1
movzx ebx, bl
cmove ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x46f513
inc ecx
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x44]
call fcn.00433600
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret 4
Function at 0x46f5a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d98ad
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, dl
mov esi, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x23c], esi
mov dword [esi + 0x10], 0
jb 0x46f60d
mov eax, dword [esi]
jmp 0x46f60f
mov eax, esi
xor ecx, ecx
mov word [eax], cx
push 0x208
push ecx
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ecx
push eax
mov dword [ebp - 0x234], 1
call fcn.004a8960
add esp, 0xc
mov ecx, 0x1a
test bl, bl
mov eax, 0x23
cmovne eax, ecx
push 1
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x46f6e1
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00438600
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.004403d0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x46f6a6
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00433600
mov ecx, esi
test bl, bl
je 0x46f6b5
push 0x13
push str.TencentDeskUpdate
jmp 0x46f6bc
push 0x10
push str.TencentDesktop
call fcn.004402a0
mov ecx, esi
call fcn.0046f700
test al, al
jne 0x46f6d3
mov ecx, esi
call fcn.0046f810
push 0xa
push str.Global.db
mov ecx, esi
call fcn.004402a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
Function at 0x4721d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6666
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004a5d55
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004a4b49
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x473c30
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [eax]
cmp esi, 0xffffffff
je 0x473cff
mov edi, dword [edi]
cmp edi, 0xffffffff
je 0x473cff
push 0x44
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x30], xmm0
call fcn.004a8960
movups xmm0, xmmword [str.ipconfig__all]
add esp, 0xc
or dword [ebp - 0x4c], 0x101
xor eax, eax
mov dword [ebp - 0x78], 0x44
mov word [ebp - 0x48], ax
mov eax, dword [0x4fa39c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x38], esi
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x3c], esi
movups xmmword [ebp - 0x20], xmm0
push eax
movq xmm0, qword [0x4fa394]
push 0
mov dword [ebp - 0x40], edi
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x473cff
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004a5d13
mov esp, ebp
pop ebp
ret 8
Function at 0x475c70
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd40
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor bl, bl
mov dword [ebp - 0xd3c], edx
push edi
mov dword [ebp - 0xd38], ecx
xor esi, esi
mov dword [ebp - 0xd40], eax
nop
test bl, bl
jne 0x475f04
push 0x200
lea eax, [ebp - 0x50c]
push 0
push eax
call fcn.004a8960
add esp, 0xc
lea eax, [ebp - 0x50c]
push esi
push 0x4fa590
push 0xffffffffffffffff
push 0xff
push eax
call fcn.00456440
add esp, 0x14
lea eax, [ebp - 0x50c]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x475efa
push 0x800
xorps xmm0, xmm0
mov dword [ebp - 0xd34], 0
lea eax, [ebp - 0xd0c]
movq qword [ebp - 0xd30], xmm0
push 0
push eax
mov dword [ebp - 0xd28], 0
mov dword [ebp - 0xd30], 0
mov dword [ebp - 0xd2c], 0
call fcn.004a8960
add esp, 0xc
lea eax, [ebp - 0xd34]
push 0
push eax
push 0x800
lea eax, [ebp - 0xd0c]
push eax
push 0xc
lea eax, [ebp - 0xd30]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x475eed
push 0x100
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.004a8960
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x100
push 0
push eax
call fcn.004a8960
add esp, 0xc
lea eax, [ebp - 0x30c]
push 0x100
push 0
push eax
call fcn.004a8960
mov edx, dword [ebp - 0xcfc]
lea eax, [ebp - 0x20c]
add esp, 0xc
lea ecx, [ebp - 0xd0c]
push eax
push 0
call fcn.00475690
mov edx, dword [ebp - 0xcf8]
lea eax, [ebp - 0x30c]
push eax
push 0
lea ecx, [ebp - 0xd0c]
call fcn.00475690
mov edx, dword [ebp - 0xcf4]
lea eax, [ebp - 0x10c]
push eax
push 1
lea ecx, [ebp - 0xd0c]
call fcn.00475690
movsx eax, byte [ebp - 0x10c]
push eax
call fcn.004bba8e
add esp, 0x1c
test eax, eax
jne 0x475e35
movsx eax, byte [ebp - 0xf9]
push eax
call fcn.004bba8e
add esp, 4
test eax, eax
je 0x475ef3
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0xd24]
call fcn.004387d0
mov ecx, dword [ebp - 0xd38]
push eax
call fcn.0046fcc0
mov eax, dword [ebp - 0xd10]
cmp eax, 0x10
jb 0x475e71
inc eax
lea ecx, [ebp - 0xd24]
push eax
push dword [ebp - 0xd24]
call fcn.00433760
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0xd24]
call fcn.004387d0
mov ecx, dword [ebp - 0xd3c]
push eax
call fcn.0046fcc0
mov eax, dword [ebp - 0xd10]
cmp eax, 0x10
jb 0x475ead
inc eax
lea ecx, [ebp - 0xd24]
push eax
push dword [ebp - 0xd24]
call fcn.00433760
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0xd24]
call fcn.004387d0
mov ecx, dword [ebp - 0xd40]
push eax
call fcn.0046fcc0
mov eax, dword [ebp - 0xd10]
cmp eax, 0x10
jb 0x475ee9
inc eax
lea ecx, [ebp - 0xd24]
push eax
push dword [ebp - 0xd24]
call fcn.00433760
mov bl, 1
jmp 0x475ef3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, 0x10
jl 0x475ca0
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
Function at 0x476800
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x11c]
push edi
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov dword [ebp - 0x10c], 0x104
mov ebx, 3
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
call esi
test eax, eax
jne 0x4769ce
push edi
push str._sConnection
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.0046c590
add esp, 0x14
lea eax, [ebp - 0x118]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x11c]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4769c6
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x110], 4
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x10c], 4
push eax
push 0
push str.MediaSubType
push dword [ebp - 0x118]
call edi
test eax, eax
jne 0x4769be
push 0x104
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 1
push eax
mov dword [ebp - 0x10c], 0x103
call fcn.004a8960
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.PnpInstanceID
push dword [ebp - 0x118]
call edi
test eax, eax
jne 0x4769be
mov eax, dword [ebp - 0x114]
cmp eax, 1
jne 0x4769af
push ebx
lea eax, [ebp - 0x108]
push 0x4fa698
push eax
call fcn.004bc550
add esp, 0xc
test eax, eax
jne 0x47697d
xor ebx, ebx
jmp 0x4769be
mov eax, dword [ebp - 0x114]
cmp eax, 1
jne 0x4769af
push 3
lea eax, [ebp - 0x108]
push 0x4fa698
push eax
call fcn.004bc550
add esp, 0xc
test eax, eax
je 0x4769a9
mov ebx, 2
jmp 0x4769be
mov eax, dword [ebp - 0x114]
xor ebx, ebx
cmp eax, 2
setne bl
lea ebx, [ebx*2 + 1]
push dword [ebp - 0x118]
call esi
push dword [ebp - 0x11c]
call esi
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a5d13
mov esp, ebp
pop ebp
ret

Function at 0x476ad0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
test ecx, ecx
je 0x476b43
test edx, edx
jle 0x476b43
test esi, esi
je 0x476b43
push edx
mov edx, ecx
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
call fcn.00476e20
add esp, 4
lea edx, [ebp - 0x64]
mov ecx, esi
call fcn.00476ef0
mov al, 1
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor al, al
xor ecx, ebp
pop esi
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
Function at 0x476c30
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9f7b
mov eax, dword fs:[0]
push eax
mov eax, 0x217c
call fcn.004a6d20
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2180], edx
xor ebx, ebx
mov dword [ebp - 0x2188], ebx
mov dword [ebp - 0x2184], ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x476ca5
call fcn.00433120
test eax, eax
jns 0x476cad
xor eax, eax
jmp 0x476e02
mov ebx, eax
mov dword [ebp - 0x2188], ebx
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
xorps xmm0, xmm0
mov byte [ebp - 0x20], 0
movq qword [ebp - 0x1f], xmm0
mov dword [ebp - 0x17], 0
mov word [ebp - 0x13], 0
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x2164], 0
mov dword [ebp - 0x2168], 0
mov dword [ebp - 0x2178], 0x67452301
mov dword [ebp - 0x2174], 0xefcdab89
mov dword [ebp - 0x2170], 0x98badcfe
mov dword [ebp - 0x216c], 0x10325476
nop dword [eax]
push 0
lea eax, [ebp - 0x217c]
mov dword [ebp - 0x217c], 0
push eax
push 0x2000
lea eax, [ebp - 0x2120]
push eax
push ebx
call esi
test eax, eax
jne 0x476d3b
call fcn.00433120
mov eax, dword [ebp - 0x217c]
test eax, eax
je 0x476d5c
push eax
lea edx, [ebp - 0x2120]
lea ecx, [ebp - 0x2178]
call fcn.00476e20
add esp, 4
jmp 0x476d10
test ebx, ebx
je 0x476d6f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov dword [ebp - 0x2188], ebx
lea edx, [ebp - 0x2178]
lea ecx, [ebp - 0x20]
call fcn.00476ef0
push 0x100
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004a8960
add esp, 0xc
lea edi, [ebp - 0x120]
xor esi, esi
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x20]
push eax
push str._.2x
push 0xffffffffffffffff
push 3
push edi
call fcn.00456440
inc esi
add esp, 0x14
add edi, 4
cmp esi, 0x10
jb 0x476da0
lea edx, [ebp - 0x120]
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x476dd0
mov ecx, dword [ebp - 0x2180]
lea eax, [ebp - 0x120]
sub edx, esi
sar edx, 1
push edx
push eax
call fcn.0041ccd0
test ebx, ebx
je 0x476dfd
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret