joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b1e
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
cmp dword [ebp + 0x14], 0x40
jle 0x403b79
lea eax, [ebp - 0x170]
push eax
call fcn.0040337c
add esp, 4
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x170]
push eax
call fcn.004034bf
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x170]
push edx
call fcn.004033f2
add esp, 8
lea eax, [ebp - 0x108]
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], 0x14
push 0x41
push 0
lea ecx, [ebp - 0xf4]
push ecx
call fcn.0048a490
add esp, 0xc
push 0x41
push 0
lea edx, [ebp - 0x44]
push edx
call fcn.0048a490
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xf4]
push edx
call fcn.0048a150
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.0048a150
add esp, 0xc
mov dword [ebp - 0xb0], 0
jmp 0x403be2
mov eax, dword [ebp - 0xb0]
add eax, 1
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x40
jge 0x403c21
mov ecx, dword [ebp - 0xb0]
mov dl, byte [ebp + ecx - 0xf4]
xor dl, 0x36
mov eax, dword [ebp - 0xb0]
mov byte [ebp + eax - 0xf4], dl
mov ecx, dword [ebp - 0xb0]
mov dl, byte [ebp + ecx - 0x44]
xor dl, 0x5c
mov eax, dword [ebp - 0xb0]
mov byte [ebp + eax - 0x44], dl
jmp 0x403bd3
lea ecx, [ebp - 0xac]
push ecx
call fcn.0040337c
add esp, 4
push 0x40
lea edx, [ebp - 0xf4]
push edx
lea eax, [ebp - 0xac]
push eax
call fcn.004034bf
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xac]
push eax
call fcn.004034bf
add esp, 0xc
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0xac]
push edx
call fcn.004033f2
add esp, 8
lea eax, [ebp - 0xac]
push eax
call fcn.0040337c
add esp, 4
push 0x40
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0xac]
push edx
call fcn.004034bf
add esp, 0xc
push 0x14
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0xac]
push ecx
call fcn.004034bf
add esp, 0xc
mov edx, dword [ebp + 0x18]
push edx
lea eax, [ebp - 0xac]
push eax
call fcn.004033f2
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x40522f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.0048a150
add esp, 0xc
mov eax, dword [ebp + 0x1c]
sar eax, 0x18
and eax, 0xff
mov ecx, dword [ebp + 0x14]
mov byte [ebp + ecx - 0x24], al
mov edx, dword [ebp + 0x1c]
sar edx, 0x10
and edx, 0xff
mov eax, dword [ebp + 0x14]
mov byte [ebp + eax - 0x23], dl
mov ecx, dword [ebp + 0x1c]
sar ecx, 8
and ecx, 0xff
mov edx, dword [ebp + 0x14]
mov byte [ebp + edx - 0x22], cl
mov eax, dword [ebp + 0x1c]
and eax, 0xff
mov ecx, dword [ebp + 0x14]
mov byte [ebp + ecx - 0x21], al
lea edx, [ebp - 0x3c]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x14]
add edx, 4
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.00403b1e
add esp, 0x14
push 0x14
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp + 0x20]
push edx
call fcn.0048a150
add esp, 0xc
mov dword [ebp - 0x28], 1
jmp 0x4052d3
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp + 0x18]
jge 0x40533a
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x14
lea edx, [ebp - 0x3c]
push edx
call fcn.00403b1e
add esp, 0x14
push 0x14
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.0048a150
add esp, 0xc
mov dword [ebp - 0x40], 0
jmp 0x405319
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 0x14
jge 0x405338
mov eax, dword [ebp + 0x20]
add eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov dl, byte [eax]
xor dl, byte [ebp + ecx - 0x24]
mov eax, dword [ebp + 0x20]
add eax, dword [ebp - 0x40]
mov byte [eax], dl
jmp 0x405310
jmp 0x4052ca
mov esp, ebp
pop ebp
ret
Function at 0x40de60
Capabilities:
Get file size
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov byte [0x503cb8], 1
mov dword [ebp - 4], 0
mov dword [ebp - 0x40c], 1
mov dword [ebp - 0x428], 0
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x42c]
push ecx
call fcn.0042c922
add esp, 4
mov dword [ebp - 0x430], eax
mov edx, dword [ebp - 0x430]
mov eax, dword [edx]
push eax
push str._sRtWlan.LOG
push 0x503bb4
call fcn.0048a750
add esp, 0xc
lea ecx, [ebp - 0x42c]
call fcn.004a32a4
push 0x503bb4
call fcn.0048a4f0
add esp, 4
mov word [ebp - 0x410], ax
push 0
push 0
push 4
push 0
push 1
push 0xc0000000
push 0x503bb4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40df20
mov byte [0x503cb8], 0
mov dword [ebp - 0x40c], 0
jmp 0x40e03b
lea ecx, [ebp - 0x408]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0xffffffff
je 0x40df73
cmp dword [ebp - 0x428], 0xc800
jbe 0x40df73
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
push 0x503bb4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x503bb4
mov edx, dword [ebp - 0x418]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x41a]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x41c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x41e]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x422]
and eax, 0xffff
push eax
push str.__02i_Month__02i_Day___02i:_02i:_02i__Log_FileName_s_
lea ecx, [ebp - 0x404]
push ecx
call fcn.0048a750
add esp, 0x20
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4ee3a0
push 0x503bb4
call fcn.0048af31
add esp, 8
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x40e03b
push 2
push 0
mov eax, dword [ebp - 0x414]
push eax
call fcn.0048ae47
add esp, 0xc
mov ecx, dword [ebp - 0x414]
push ecx
lea edx, [ebp - 0x404]
push edx
call fcn.0048adf9
add esp, 8
mov eax, dword [ebp - 0x414]
push eax
call fcn.0048ad7c
add esp, 4
mov eax, dword [ebp - 0x40c]
mov esp, ebp
pop ebp
ret
Function at 0x40e045
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
xor eax, eax
mov al, byte [0x503cb8]
test eax, eax
jne 0x40e060
xor eax, eax
jmp 0x40e112
mov dword [ebp - 0x408], 1
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x40c]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x40e]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x410]
and edx, 0xffff
push edx
push str.__02i:_02i:_02i_______s_____n
lea eax, [ebp - 0x404]
push eax
call fcn.0048a750
add esp, 0x18
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4ee3c8
push 0x503bb4
call fcn.0048af31
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e10c
push 2
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.0048ae47
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.0048adf9
add esp, 8
mov edx, dword [ebp - 4]
push edx
call fcn.0048ad7c
add esp, 4
mov eax, dword [ebp - 0x408]
mov esp, ebp
pop ebp
ret

Function at 0x40e116
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
xor eax, eax
mov al, byte [0x503cb8]
test eax, eax
jne 0x40e131
xor eax, eax
jmp 0x40e1e7
mov dword [ebp - 0x408], 1
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x40c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x40e]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x410]
and eax, 0xffff
push eax
push 0x4ee3cc
lea ecx, [ebp - 0x404]
push ecx
call fcn.0048a750
add esp, 0x1c
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4ee3e8
push 0x503bb4
call fcn.0048af31
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e1e1
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.0048ae47
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x404]
push edx
call fcn.0048adf9
add esp, 8
mov eax, dword [ebp - 4]
push eax
call fcn.0048ad7c
add esp, 4
mov eax, dword [ebp - 0x408]
mov esp, ebp
pop ebp
ret
Function at 0x40e2c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
xor eax, eax
mov al, byte [0x503cb8]
test eax, eax
jne 0x40e2db
xor eax, eax
jmp 0x40e391
mov dword [ebp - 0x408], 1
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x40c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x40e]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x410]
and eax, 0xffff
push eax
push str.__02i:_02i:_02i___s___ld_n
lea ecx, [ebp - 0x404]
push ecx
call fcn.0048a750
add esp, 0x1c
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4ee428
push 0x503bb4
call fcn.0048af31
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e38b
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.0048ae47
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x404]
push edx
call fcn.0048adf9
add esp, 8
mov eax, dword [ebp - 4]
push eax
call fcn.0048ad7c
add esp, 4
mov eax, dword [ebp - 0x408]
mov esp, ebp
pop ebp
ret

Function at 0x40e395
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
xor eax, eax
mov al, byte [0x503cb8]
test eax, eax
jne 0x40e3b0
xor eax, eax
jmp 0x40e46a
mov dword [ebp - 0x408], 1
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x40c]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x40e]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x410]
and ecx, 0xffff
push ecx
push 0x4ee42c
lea edx, [ebp - 0x404]
push edx
call fcn.0048a750
add esp, 0x20
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4ee44c
push 0x503bb4
call fcn.0048af31
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e464
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0048ae47
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.0048adf9
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call fcn.0048ad7c
add esp, 4
mov eax, dword [ebp - 0x408]
mov esp, ebp
pop ebp
ret
Function at 0x40e547
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
xor eax, eax
mov al, byte [0x503cb8]
test eax, eax
jne 0x40e562
xor eax, eax
jmp 0x40e61c
mov dword [ebp - 0x408], 1
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x40c]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x40e]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x410]
and ecx, 0xffff
push ecx
push str.__02i:_02i:_02i___s_____s__ld_n
lea edx, [ebp - 0x404]
push edx
call fcn.0048a750
add esp, 0x20
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4ee494
push 0x503bb4
call fcn.0048af31
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e616
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0048ae47
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.0048adf9
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call fcn.0048ad7c
add esp, 4
mov eax, dword [ebp - 0x408]
mov esp, ebp
pop ebp
ret

Function at 0x410a54
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
call fcn.00410454
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x410b8e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xf0], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xf0], 0xffffffff
je 0x410aa1
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x410aa8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xf4], 0
je 0x410b2b
push 0
push 0
push 0x12
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0xf4]
call fcn.004070f0
push 0xffffffffffffffff
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xf4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xf4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x410b17
push 1
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
call dword [eax + 4]
mov dword [ebp - 0x18], eax
jmp 0x410b1e
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xf4], 0
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0xf0], 0xffffffff
je 0x410b87
push 0x3e8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xf0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x410b87
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xf0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xf0], 0xffffffff
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4116c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x41310e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
call fcn.004132f0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x412a3b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc8], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc8], 0xffffffff
je 0x41315b
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x413162
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc8], 0xffffffff
je 0x4131ce
push 0x3e8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc8]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4131ce
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0xc8], 0xffffffff
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x423c94
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x200
push 0
push 0x5054cc
call fcn.0048a490
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push 0x200
push 0x5054cc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 0x5054cc
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428065
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5d68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
mov byte [0x505a88], 0
cmp dword [0x521a00], 0x67
jg 0x428098
jmp 0x4282f1
push 0x4f2b2c
push 0x4f2b30
push 0x4f2b38
call fcn.00429a0e
add esp, 0xc
push 0x4f2b48
lea ecx, [ebp - 0x418]
call fcn.004a3364
mov dword [ebp - 4], 0
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x41c]
push ecx
call fcn.0042c922
add esp, 4
mov dword [ebp - 0x420], eax
mov edx, dword [ebp - 0x420]
mov dword [ebp - 0x424], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x424]
push eax
lea ecx, [ebp - 0x74]
push ecx
call fcn.004a34d3
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x41c]
call fcn.004a32a4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x418]
call fcn.004a32a4
push 0
lea ecx, [ebp - 0x74]
call fcn.00406f50
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x578804
push 0x5787d0
push 0x5787cc
call dword [sym.imp.RtlICS.dll_Ordinal_3]
add esp, 0xc
and eax, 0xff
test eax, eax
je 0x428176
mov dword [0x5787cc], 0
push 0x578804
push 0x5787d0
mov edx, dword [0x5787cc]
push edx
call dword [sym.imp.RtlICS.dll_Ordinal_2]
add esp, 0xc
push 0x5060c8
call dword [sym.imp.RtlICS.dll_Ordinal_5]
add esp, 4
call dword [sym.imp.RtlICS.dll_Ordinal_7]
push 0x4f2b60
push 0x4f2b70
push 0
push 0x505f74
call dword [sym.imp.RtlLib.dll_RT_SetSoftAP_TcpIpAddress]
add esp, 0x10
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x78]
call fcn.00406f30
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x80]
call fcn.00406f30
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x84]
call fcn.00406f30
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x88]
call fcn.00406f30
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x414]
call fcn.00406f30
mov byte [ebp - 4], 9
push 0x4f2b80
lea ecx, [ebp - 0x78]
call fcn.004a342d
push 0x4f2b90
lea ecx, [ebp - 0x80]
call fcn.004a342d
push 0x4f2b9c
lea ecx, [ebp - 0x84]
call fcn.004a342d
mov dword [ebp - 0x7c], 0xa
lea ecx, [ebp - 0x84]
call fcn.00406f50
push eax
lea ecx, [ebp - 0x78]
call fcn.0042e0a0
test eax, eax
jne 0x42829d
cmp dword [ebp - 0x7c], 0
je 0x42829d
mov eax, dword [ebp - 0x7c]
sub eax, 1
mov dword [ebp - 0x7c], eax
push 0x388
push 0
lea ecx, [ebp - 0x410]
push ecx
call fcn.0048a490
add esp, 0xc
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.RtlLib.dll_RT_GetMacAddress]
add esp, 4
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.IpLib.dll_GetIpInformation]
add esp, 8
lea edx, [ebp - 0x410]
push edx
push 0x4f2bac
lea eax, [ebp - 0x78]
push eax
call fcn.0049faa5
add esp, 0xc
jmp 0x428225
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x414]
call fcn.004a32a4
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x88]
call fcn.004a32a4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x84]
call fcn.004a32a4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x80]
call fcn.004a32a4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x78]
call fcn.004a32a4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.004a32a4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4294cf
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
mov al, byte [0x521f4a]
test eax, eax
je 0x4294e8
jmp 0x42968b
mov byte [0x521f4a], 1
push 0x4f2ed8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [0x5217a2], 1
xor ecx, ecx
mov cl, byte [0x521db0]
test ecx, ecx
je 0x429656
xor edx, edx
mov dl, byte [0x521a05]
test edx, edx
je 0x429656
call dword [sym.imp.RtlLib.dll_RT_ACM_Disconnect]
call dword [sym.imp.RtlLib.dll_RT_Stop]
mov byte [0x521a05], 0
mov dword [0x4f7478], 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.0042935c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x429656
cmp dword [0x521a40], 1
je 0x429567
cmp dword [0x521a40], 2
jne 0x42959f
mov byte [0x521a44], 0
mov ecx, 0x521854
call fcn.00406f50
push eax
push 0
call fcn.00411680
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42959f
push 0
push 0
push 0x43c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x5217b0], 0
je 0x4295b3
mov ecx, dword [0x5217b0]
call fcn.004370b2
call dword [sym.imp.RtlLib.dll_RT_AP_GetIsAPMode]
and eax, 0xff
test eax, eax
jne 0x42962d
cmp dword [0x52133c], 0
je 0x42962d
cmp dword [0x52133c], 0xdddddddd
je 0x42962d
push 0
mov edx, dword [0x521334]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42962d
mov byte [0x521dad], 1
mov dword [ebp - 0x10], 5
push 0
mov eax, dword [0x521334]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x429626
cmp dword [ebp - 0x10], 0
je 0x429626
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x4295f8
mov byte [0x521dad], 0
mov byte [0x5217b5], 0
mov byte [0x521a3d], 1
push 1
mov ecx, dword [ebp - 0x14]
call fcn.00429c18
push 1
mov ecx, dword [ebp - 0x14]
call fcn.00429385
mov byte [0x4f747c], 1
mov ecx, dword [ebp - 0x14]
call fcn.00424f9d
push 0
mov ecx, dword [ebp - 0x14]
call fcn.0042935c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x429679
mov ecx, dword [ebp - 4]
call fcn.00448843
push str.___Do_Unplug____n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [0x521f4a], 0
mov esp, ebp
pop ebp
ret
Function at 0x4298ee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp - 8], 0
je 0x429a0a
cmp dword [ebp - 0xc], 0
je 0x429a0a
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
mov dword [ebp - 8], 0xffffffff
push 0x4f3010
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048ab80
add esp, 8
test eax, eax
jne 0x4299bd
mov edx, dword [0x521864]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x4f3020
lea ecx, [ebp - 0x114]
push ecx
call fcn.0048a750
add esp, 0x10
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x114]
push eax
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4299bd
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 0
mov dword [ebp - 0x14], 1
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x429a0a
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 8]
push eax
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret