joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b4b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov ebx, dword [0x4a5e60]
test ebx, ebx
je 0x43b4d0
mov eax, dword [0x4a5e60]
mov ebx, dword [ebp - 4]
leave
ret
push ecx
push ecx
push 0
push 0
call sub.KERNEL32.dll_GetTempPathA
mov ebx, eax
pop eax
test ebx, ebx
pop edx
jne 0x43b504
mov ecx, dword [0x4a5e60]
test ecx, ecx
jne 0x43b4c1
sub esp, 0xc
push 0x49ff74
call fcn.00442860
add esp, 0x10
mov dword [0x4a5e60], eax
jmp 0x43b4c1
sub esp, 0xc
push ebx
call fcn.0043b7c0
pop edx
pop ecx
push eax
mov dword [0x4a5e60], eax
push ebx
call sub.KERNEL32.dll_GetTempPathA
pop edx
test eax, eax
pop ecx
jne 0x43b4e3
sub esp, 0xc
mov ebx, dword [0x4a5e60]
push ebx
call sub.msvcrt.dll_free
add esp, 0x10
mov dword [0x4a5e60], 0
jmp 0x43b4ed

Function at 0x43be60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 4
mov esi, 0xb
mov edi, dword [edx]
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 0xc]
cmp edi, ecx
je 0x43bf02
and ebx, 0x10000
lea eax, [edi + 1]
cmp ebx, 1
mov dword [edx], eax
sbb esi, esi
mov ebx, dword [ebp + 8]
xor esi, 0xffffffff
and esi, 0xb
test ebx, ebx
je 0x43bf0a
xor eax, eax
mov ecx, dword [ebp + 8]
mov al, byte [ebp - 0x10]
movsx edx, byte [eax + ecx]
xor eax, eax
mov al, byte [edi]
mov al, byte [eax + ecx]
and eax, 0xff
mov edi, eax
cmp edi, edx
jb 0x43bf02
mov esi, edx
jmp 0x43beef
mov eax, esi
mov edx, dword [ebp + 8]
and eax, 0xff
xor ecx, ecx
mov cl, byte [eax + edx]
mov eax, ecx
mov edx, dword [ebp + 0x10]
shr eax, 3
and ecx, 7
inc esi
lea ebx, [eax + edx]
mov eax, 1
shl eax, cl
mov dl, byte [ebx]
or edx, eax
cmp edi, esi
mov byte [ebx], dl
jb 0x43bf00
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x43bec0
mov ecx, esi
and ecx, 0xff
jmp 0x43becf
xor esi, esi
mov eax, esi
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov al, byte [edi]
and eax, 0xff
movsx edx, byte [ebp - 0x10]
mov edi, eax
jmp 0x43beb5
Function at 0x44cfb0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x18], 0
pop ebp
ret

Function at 0x44db30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov eax, 0x10fc
mov ebp, esp
push edi
push esi
push ebx
call fcn.004521b0
lea eax, [ebp - 0xa8]
push eax
mov edi, dword [ebp + 8]
xor ebx, ebx
call fcn.0044cfb0
lea esi, [ebp - 0x10f0]
pop eax
mov eax, 0x1000
push edi
sub eax, ebx
push eax
lea eax, [esi + ebx]
push 1
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
add ebx, eax
cmp ebx, 0xfff
jbe 0x44db96
test eax, eax
je 0x44db9a
lea eax, [ebp - 0xa8]
xor ebx, ebx
push eax
push 0x1000
push esi
call fcn.0044cff0
add esp, 0xc
jmp 0x44db58
test eax, eax
jne 0x44db58
mov eax, 1
test byte [edi + 0xc], 0x20
jne 0x44dbc0
test ebx, ebx
jne 0x44dbc8
push eax
push eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.0044da60
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
lea eax, [ebp - 0xa8]
push eax
push ebx
push esi
call fcn.0044d900
add esp, 0x10
jmp 0x44dba9

Function at 0x4524c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x4524f3
push edx
push edx
push 0
push eax
mov dword [0x4a6010], eax
call fcn.00457ec0
add esp, 0x10
test eax, eax
sete al
and eax, 0xff
mov dword [0x45b610], eax
leave
ret
call fcn.00457e1c
jmp 0x4524e2

Function at 0x452580
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, edx
mov eax, dword [0x45b610]
mov ebx, dword [edx]
test eax, eax
js 0x4525e0
mov eax, dword [0x45b610]
test eax, eax
jne 0x4525b0
mov dword [0x4a6000], ebx
mov eax, dword [esi]
add eax, 0x20
mov edx, dword [eax + 4]
mov ebp, dword [eax]
mov esp, dword [eax + 8]
jmp edx
push eax
push eax
push ebx
mov ebx, dword [0x4a6010]
push ebx
call sub.KERNEL32.dll_TlsSetValue
pop edx
test eax, eax
pop ecx
jne 0x4525a1
call fcn.00457e1c
mov eax, dword [esi]
add eax, 0x20
mov edx, dword [eax + 4]
mov ebp, dword [eax]
mov esp, dword [eax + 8]
jmp edx
call fcn.00452440
jmp 0x452592
Function at 0x452790
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x45b610]
mov edi, dword [ebp + 0xc]
test eax, eax
js 0x452818
mov eax, dword [0x45b610]
test eax, eax
jne 0x4527f3
mov eax, dword [0x4a6000]
lea esi, [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x4527cd
cmp ebx, 5
je 0x4527e9
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
sbb ebx, ebx
push eax
push eax
push edi
push esi
call dword [ebp + 8]
and ebx, 5
add esp, 0x10
test eax, eax
je 0x4527c0
mov ebx, 3
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [0x4a6010]
call fcn.00457e1c
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
add esp, 0xc
jmp 0x4527b3
call fcn.00452440
jmp 0x4527a5

Function at 0x4528a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x45b610]
mov edi, dword [ebp + 8]
test eax, eax
js 0x452971
mov eax, dword [0x45b610]
test eax, eax
jne 0x452914
mov eax, dword [0x4a6000]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x452907
lea ebx, [ebp - 0x14]
jmp 0x4528d9
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4528fe
push esi
push esi
push ebx
push edi
mov ecx, dword [edi + 4]
push ecx
mov edx, dword [edi]
push edx
push 1
push 1
call eax
add esp, 0x20
cmp eax, 6
je 0x452939
cmp eax, 8
jne 0x452964
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
test eax, eax
jne 0x4528d6
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [0x4a6010]
call fcn.00457e1c
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
add esp, 0xc
jmp 0x4528c7
mov eax, dword [ebp - 0x14]
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, ebx
mov eax, edi
call fcn.00452500
cmp eax, 7
jne 0x45290c
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00452580
lea esp, [ebp - 0xc]
mov eax, 3
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00452440
jmp 0x4528b9
Function at 0x452980
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4529f0
mov eax, dword [0x45b610]
test eax, eax
js 0x452a01
mov eax, dword [0x45b610]
test eax, eax
jne 0x4529c6
mov eax, dword [0x4a6000]
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov edx, ebx
mov eax, edi
call fcn.00452650
cmp eax, 7
je 0x452a08
call sub.msvcrt.dll_abort
mov ebx, dword [0x4a6010]
call fcn.00457e1c
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
add esp, 0xc
jmp 0x4529aa
sub esp, 0xc
push edi
call fcn.004528a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00452440
jmp 0x45299c
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00452580
lea esi, [esi]
lea edi, [edi]

Function at 0x452a20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ecx, dword [0x45b610]
mov edi, dword [ebp + 8]
test ecx, ecx
js 0x452aa0
mov edx, dword [0x45b610]
test edx, edx
jne 0x452a76
mov eax, dword [0x4a6000]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x452a68
lea ebx, [ebp - 0x14]
mov eax, edi
mov edx, ebx
call fcn.00452500
cmp eax, 7
je 0x452aa7
call sub.msvcrt.dll_abort
lea ebx, [ebp - 0x14]
mov eax, edi
mov edx, ebx
call fcn.00452650
jmp 0x452a5e
mov ebx, dword [0x4a6010]
call fcn.00457e1c
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
add esp, 0xc
jmp 0x452a45
call fcn.00452440
jmp 0x452a36
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00452580
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x453410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x11c
mov ebx, dword [esp + 0x130]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x4535ce
cmp byte [ebx], 0
je 0x453590
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x4535bc
test al, 0x10
je 0x453590
push eax
push 0x104
push ebx
lea edi, [esp + 0x24]
push edi
call sub.msvcrt.dll__fullpath
pop eax
mov ecx, edi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x45346e
test edx, 0x8080
je 0x453582
add dl, dl
sbb ecx, 3
sub ecx, edi
lea eax, [ecx + 0x233]
push eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4535aa
lea esi, [eax + 0x22c]
mov ebp, eax
push eax
push eax
push edi
push esi
call sub.msvcrt.dll_strcpy
add esp, 0x10
cmp byte [ebx + 0x22c], 0
jne 0x453534
sub esp, 0xc
push esi
call sub.msvcrt.dll_strlen
add esp, 0xc
mov word [eax + esi], 0x2a
lea eax, [ebx + 0x120]
mov dword [ebx + 0x224], 0xffffffff
mov dword [ebx + 0x228], 0
mov dword [ebx + 0x118], 0
mov word [ebx + 0x11c], 0
mov word [ebx + 0x11e], 0
push 0x104
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
add esp, 0x11c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push esi
call sub.msvcrt.dll_strlen
pop edx
pop ecx
push 0x2f
lea edi, [esi + eax - 1]
push esi
call sub.msvcrt.dll_strrchr
add esp, 0x10
cmp eax, edi
je 0x4534cf
push eax
push eax
push 0x5c
push esi
call sub.msvcrt.dll_strrchr
add esp, 0x10
cmp edi, eax
je 0x4534cf
sub esp, 0xc
push esi
call sub.msvcrt.dll_strlen
add esp, 0x10
mov word [eax + esi], 0x5c
jmp 0x4534cf
shr edx, 0x10
add ecx, 2
jmp 0x453492
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 0x14
add esp, 0x11c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 0xc
jmp 0x453527
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 2
jmp 0x453527
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 0xe
jmp 0x453527
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x489f2f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x4bb604]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov edx, dword [esp + 0x20]
lea eax, [esp + 4]
push edx
push 0x4ae224
push eax
push 8
push 1
push 8
push ecx
mov dword [esp + 0x30], 1
call fcn.0048904d
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.0046e4c8
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.0046e753
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x4012e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x489fa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 2
push eax
push 0x69
call fcn.0046f207
mov ecx, dword [0x4bb604]
lea ebp, [esi + 0x60]
mov dword [ebp], ecx
lea edi, [esi + 0x64]
mov byte [esp + 0x1c], 4
mov ecx, edi
call fcn.0046f7b7
mov dword [edi], vtable.CEdit.0
mov edx, dword [0x4bb604]
lea edi, [esi + 0xa0]
mov dword [edi], edx
mov eax, dword [0x4bb604]
lea ebx, [esi + 0xa4]
mov dword [ebx], eax
mov ecx, dword [0x4bb604]
mov dword [esi + 0xa8], ecx
push 0x4bfab8
mov ecx, edi
mov byte [esp + 0x20], 8
mov dword [esi], method.CDialog.virtual_0
call fcn.0046e8dc
push 0x4bfab8
mov ecx, ebx
call fcn.0046e8dc
push 0x4bfab8
lea ecx, [esi + 0xa8]
call fcn.0046e8dc
lea edx, [esp + 0x2c]
mov ecx, ebp
push edx
call fcn.0046e88c
lea eax, [esp + 0x34]
mov ecx, edi
push eax
call fcn.0046e88c
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebx
call fcn.0046e88c
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
mov dword [esi + 0x5c], edx
mov byte [esp + 0x1c], 1
call fcn.0046e753
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c], 0
call fcn.0046e753
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0046e753
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x401ab0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
or ecx, 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
mov edi, ebx
repne scasb al, byte es:[edi]
mov ebp, dword [esp + 0x1c]
not ecx
sub edi, ecx
lea edx, [ebp + 0x208]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push 0
push str.SystemCurrentControlSetServicesClassNet
push reloc.t40shapi.dll_Ordinal_2
call esi
test eax, eax
jne 0x401b85
lea edx, [esp + 0x1c]
push edx
push 0x20019
push eax
mov eax, dword [esp + 0x2c]
push ebx
push eax
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x401b7c
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push ebp
push edx
push 0
push str.DriverDesc
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401b53
cmp dword [esp + 0x14], 1
je 0x401b75
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
push eax
call ebx
mov ecx, dword [esp + 0x20]
push ecx
call ebx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x401b90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.t40shapi.dll_Ordinal_2
call esi
test eax, eax
jne 0x401cf8
mov edx, dword [esp + 0x18]
lea ecx, [esp + 8]
push ecx
push 0x20019
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
call esi
test eax, eax
jne 0x401ceb
push ebx
mov ebx, dword [esp + 0x18]
push ebp
lea ecx, [esp + 0xc]
push edi
lea ebp, [ebx + 0x208]
push ecx
lea edx, [esp + 0x24]
push ebp
push edx
push eax
mov eax, dword [esp + 0x24]
push str.ServiceName
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401c15
cmp dword [esp + 0x20], 1
je 0x401c37
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ebx
push ecx
push 0
push str.Description
push edx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401c67
cmp dword [esp + 0x20], 1
je 0x401c89
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
lea esi, [ebx + 0x104]
push ecx
lea edx, [esp + 0x24]
push esi
push edx
push 0
push str.Title
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401cbf
cmp dword [esp + 0x20], 1
je 0x401cdd
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0045843b
add esp, 4
push ebx
push eax
push str.__d___s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
pop ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x401de0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x18
lea eax, [esp]
push esi
push eax
push 0x20019
push 0
mov dword [esp + 0x14], 0x10
call fcn.00401a70
push eax
push reloc.t40shapi.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401e55
push eax
push eax
push eax
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edx, dword [esp + 4]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401e53
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.00401dc0
add esp, 8
pop esi
add esp, 0x18
ret
mov eax, esi
pop esi
add esp, 0x18
ret
Function at 0x401ea0
Capabilities:
Check if file exists
Get disk information

Disassembly:
sub esp, 0x404
mov eax, dword [esp + 0x418]
push ebx
push ebp
mov ebp, dword [esp + 0x410]
push esi
push edi
lea ecx, [esp + 0x14]
push 0x200
xor ebx, ebx
push ecx
push ebp
mov byte [esp + 0x1f], 0
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x401f5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x401f52
mov edi, str.Device_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
push ebp
push 1
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x402036
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x402040
mov edi, 0x4ae4cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x214]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xffffffffffffffff
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x218]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 3
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, edx
push 1
push eax
and ecx, 3
lea eax, [esp + 0x22c]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x402003
mov ecx, dword [esp + 0x428]
mov edx, dword [esp + 0x424]
push 0
push ecx
mov ecx, dword [esp + 0x428]
push edx
push ecx
lea edx, [esp + 0x42c]
push 4
push edx
push 0x170002
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x40200b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov al, byte [esp + 0x13]
test al, al
je 0x402040
lea eax, [esp + 0x14]
push eax
push ebp
push 7
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x402040
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret
mov byte [esp + 0x13], 1
jmp 0x401f5c
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x404
ret
Function at 0x402870
Capabilities:
Get disk information

Disassembly:
sub esp, 0x104
push ebp
mov ebp, dword [esp + 0x10c]
push esi
push edi
mov byte [ebp], 0
mov al, byte [0x4bfab8]
mov byte [esp + 0x10], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0xa
push 0
push 0
lea ecx, [esp + 0x18]
push 0
stosw word es:[edi], ax
push ecx
push 0xc
push 0
push 0x4ae5b4
stosb byte es:[edi], al
call esi
test eax, eax
je 0x40295f
mov edx, dword [esp + 0xc]
push edx
push str._08lx
push ebp
call fcn.00458446
push ebp
call fcn.00402450
add esp, 0x10
test eax, eax
je 0x40295b
push 0xa
push 0
push 0
lea eax, [esp + 0x18]
push 0
push eax
push 0xc
push 0
push 0x4ae5b4
call esi
test eax, eax
je 0x40295f
mov ecx, dword [esp + 0xc]
push ebx
push ecx
lea edx, [esp + 0x18]
push str._08lx
push edx
call fcn.00458446
add esp, 0xc
lea esi, [esp + 0x14]
mov eax, ebp
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x402942
test cl, cl
je 0x40293e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x402942
add eax, 2
add esi, 2
test cl, cl
jne 0x40291a
xor eax, eax
jmp 0x402947
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
jne 0x40295b
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x104
ret
mov byte [ebp], 0
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x104
ret