joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436c47
Capabilities:
Get file size

Disassembly:
jmp 0x436cad
cmp word [edi], si
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x14], ebx
je 0x436cd6
mov ecx, eax
sub ecx, dword [ebp + 0x50]
and ecx, 0xfffffffe
cmp ecx, 4
je 0x436cd6
push edi
mov dword [ebp + 0x14], edi
call dword [0x4a6508]
mov word [edi + eax*2 - 2], si
jmp 0x436ce1
sub eax, dword [ebp + 0x50]
and eax, 0xfffffffe
cmp eax, 4
jne 0x436ce4
mov dword [ebp + 0x48], esi
cmp dword [ebp + 0x40], esi
jge 0x436cf5
mov eax, dword [ebp + 0x78]
cmp word [eax], si
je 0x436dc6
mov edi, dword [ebp + 0x14]
push esi
push 0x80
push 3
push esi
push 7
push 0x80000000
push edi
lea ecx, [ebp + 0x3c]
call fcn.0043b2df
cmp dword [ebp + 0x48], esi
je 0x436d19
mov word [edi], si
push 7
pop ecx
push esi
xor eax, eax
mov dword [ebp - 0x44], esi
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x2c]
push eax
push 0x20
lea eax, [ebp - 0x44]
push eax
push esi
push esi
push 0x74004
push dword [ebp + 0x3c]
mov dword [ebp + 0x2c], esi
call dword [0x4a6414]
mov eax, dword [ebp - 0x44]
mov edi, dword [ebp + 0x30]
mov ebx, 0x200
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x40]
push esi
push edi
mov dword [ebp - 0xc], eax
call 0x4c8f5c
add esp, 0xc
push esi
lea eax, [ebp + 0x2c]
push eax
push ebx
push edi
push dword [ebp + 0x3c]
call dword [0x4a64e8]
lea ecx, [ebp + 0x3c]
call fcn.00438cd1
mov ebx, dword [ebp + 0x40]
cmp ebx, 3
jne 0x436d8f
mov edi, dword [edi + 0x58]
imul edi, dword [ebp + 0x28]
mov dword [ebp + 0x24], edi
jmp 0x436dc6
cmp ebx, 2
je 0x436d99
cmp ebx, 1
jne 0x436dc6
cmp ebx, 2
movzx edx, word [edi + 0xe]
mov al, byte [edi + 0x10]
movzx ecx, word [edi + 0x11]
jne 0x436dae
mov edi, dword [edi + 0x24]
jmp 0x436db2
movzx edi, word [edi + 0x16]
movzx eax, al
imul eax, edi
add eax, edx
imul eax, dword [ebp + 0x28]
shl ecx, 5
add eax, ecx
mov dword [ebp + 0x24], eax
push esi
push 0x80
push 3
push esi
push 7
push esi
push dword [ebp + 0x60]
lea ecx, [ebp + 0x3c]
call fcn.0043b3ab
cmp dword [ebp + 0x3c], esi
jne 0x436dea
mov dword [ebp + 0x48], esi
jmp 0x436fd1
lea eax, [ebp + 0x34]
push eax
push dword [ebp + 0x3c]
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x38], esi
call dword [0x4a61d4]
push dword [ebp + 0x38]
push dword [ebp + 0x34]
push dword [ebp - 8]
call 0x4bdae9
mov ebx, dword [ebp + 0x28]
imul ebx, dword [ebp]
Function at 0x4371ec
Capabilities:
Write file on windows

Disassembly:
add dword [ebp + 0x14], 0xffffffff
adc dword [ebp + 0x18], 0xffffffff
js 0x437215
jg 0x4371a0
cmp dword [ebp + 0x14], 0
jb 0x437215
mov esi, dword [0x4a6194]
push 0
lea eax, [ebp - 4]
push eax
push 0x200
push dword [ebp + 0x1c]
push dword [ebp + 8]
call esi
lea eax, [ebx - 1]
test eax, eax
mov dword [ebp - 0xc], eax
jl 0x437206
mov eax, dword [ebp + 0x14]
add eax, 0xffffffff
adc dword [ebp + 0x18], 0xffffffff
mov dword [ebp + 0x14], eax
js 0x437206
jg 0x4371d8
test eax, eax
jb 0x437206
xor ecx, ecx
cmp ecx, dword [ebp + 0x18]
jl 0x4371e9
jg 0x4371e5
cmp ebx, eax
jbe 0x4371e9
mov eax, ebx
jmp fcn.004371ec
mov ecx, dword [ebp + 0x18]
imul eax, edi
push 0
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call esi
dec dword [ebp - 0xc]
jns 0x4371c3
inc dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x10]
jb 0x43718e
mov esi, dword [ebp + 0x1c]
and dword [esi], 0
push 0x1a
push str.____________b
push esi
call 0x4c9ad4
mov ebx, dword [ebp + 0x14]
add esp, 0xc
add ebx, 0xffffffff
adc dword [ebp + 0x18], 0xffffffff
js 0x43724e
jg 0x43723d
test ebx, ebx
jb 0x43724e
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [ebp + 8]
call dword [0x4a6194]
mov esi, dword [ebp - 0x18]
add esi, 0xfffffffe
js 0x43727b
add ebx, 0xffffffff
adc dword [ebp + 0x18], 0xffffffff
js 0x43727b
jg 0x437265
test ebx, ebx
jb 0x43727b
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp - 8]
push dword [ebp + 8]
call dword [0x4a6194]
dec esi
jns 0x437256
lea ecx, [ebp - 0x14]
call fcn.0046e499
pop edi
pop esi
pop ebx
leave
ret

Function at 0x437ee7
Capabilities:
Acquire debug privileges

Disassembly:
xor eax, eax
cmp byte [esp + 4], al
push esi
mov esi, ecx
mov byte [esi], al
je 0x437f17
test byte [0x4c1bf0], 4
jne 0x437f17
push eax
push 2
mov byte [esi], 1
or byte [0x4c1bf0], 4
push str.SeDebugPrivilege
call fcn.004119f4

Function at 0x43c718
Capabilities:
Write file on windows

Disassembly:
test ebx, ebx
ja 0x43c729
xor eax, eax
cmp eax, dword [esi]
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
pop ebp
ret
and dword [ebp + 0x14], 0
push 0
lea eax, [ebp + 0x14]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x4a6194]
test eax, eax
je 0x43c760
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x43c757
cmp dword [ebp + 0x10], eax
jg 0x43c754
mov eax, edi
jmp 0x43c757
dec dword [ebp + 0x10]
add dword [esi], eax
add dword [ebp + 0xc], eax
sub ebx, eax
jmp fcn.0043c718
and dword [ebp + 0x10], 0
call dword [0x4a6498]
cmp eax, 0x70
jne 0x43c71c
mov eax, dword [ebp + 0x18]
cmp edi, eax

Function at 0x43d6cc
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
call dword [0x4a666c]
test eax, eax
je 0x43d6eb
xor eax, eax
jmp 0x43d7c7
mov eax, dword [esi]
push edi
mov edi, dword [esi + 8]
push ebx
push ebx
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
Function at 0x441d60
Capabilities:
Query or enumerate registry value

Disassembly:
push dword [ebp + 0x10]
mov ebx, dword [0x4a6074]
push dword [ebp - 4]
call ebx
cmp eax, 0xea
mov dword [ebp - 8], eax
jne 0x441d9d
add dword [esi], 0xa
mov eax, dword [esi]
add eax, 6
push eax
mov ecx, edi
call fcn.0047ee1d
mov eax, dword [edi]
push esi
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call ebx
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [0x4a6060]
or ebx, 0xffffffff
cmp dword [ebp - 8], 0
je 0x441dc0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x441dbb
mov dword [ecx], eax
lea eax, [ebx - 1]
jmp 0x441df1
xor ecx, ecx
cmp dword [esi], ecx
jge 0x441dc8
mov dword [esi], ecx
mov eax, dword [edi]
mov edx, dword [esi]
mov byte [eax + edx], 0
mov eax, dword [esi]
mov edx, dword [edi]
inc eax
shr eax, 1
lea eax, [edx + eax*2]
mov word [eax + 2], cx
mov word [eax], cx
mov eax, dword [esi]
add eax, 5
push eax
mov ecx, edi
call fcn.0047ee83
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x442ef2
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp - 0xc]
lea edi, [ecx + eax]
mov eax, ecx
cdq
push 0x14
pop ebx
idiv ebx
mov al, byte [edx + 0x4ace8c]
xor al, byte [ebp + 0xb]
xor byte [edi], al
inc ecx
cmp ecx, esi
jl fcn.00442ef2

Function at 0x443123
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
xor eax, 0x8a16b60f
dec ebp
or eax, dword [eax - 0x2cf7f4bb]
loop 0x44313c
fiadd dword [esi + 0x3b]
div dword [ebx + 0x22]
or eax, dword [eax - 0x2cf7f4bb]
loop 0x44314f
or edx, ebx
loop 0x44315e
fiadd dword [esi - 0x80]
inc ebp
or ecx, dword [eax]
invalid

Function at 0x44313a
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [ebp + 0xb]
add byte [ebp + 0xb], 8
shl edx, cl
or ebx, edx
fiadd dword [esi + 0x3b]
div dword [ebx + 0xf]

Function at 0x443144
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [ebp + 0xb]
add byte [ebp + 0xb], 8
shl edx, cl
or ebx, edx
fiadd dword [esi + 0x3b]
div dword [ebx + 0xf]

Function at 0x445641
Capabilities:
Delete file
Write file on windows

Disassembly:
xlatb
cmp eax, esi
jg 0x445663
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], 0x63
lea edi, [ebp + eax*2 - 0x2e4]
Function at 0x44567b
Capabilities:
Delete file
Write file on windows

Disassembly:
mov eax, dword [0x4c1350]
cmp eax, esi
je 0x445765
cmp dword [ebp - 0xc], esi
jne 0x445765
call eax
jmp 0x445765
call fcn.0047ed4a
mov ebx, eax
call dword [0x4a64fc]
add ebx, eax
push ebx
call dword [0x4a6490]
push eax
push str.pecmd_bmp._lu._lu.tmp
push edi
call dword [0x4a67d8]
add esp, 0x10
push esi
push 0x80
push 1
push esi
push 5
push 0x40000000
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 8]
call fcn.00449c87
cmp dword [ebp - 8], esi
jne 0x4456d8
push 0xa
call dword [0x4a6484]
dec dword [ebp - 0x10]
jns 0x445674
lea ecx, [ebp - 8]
call fcn.00447629
jmp 0x445646
push esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
mov dword [ebp - 0x14], esi
push dword [eax]
push dword [ebp - 8]
call dword [0x4a6194]
lea ecx, [ebp - 8]
call 0x44764f
push 0x10
push esi
push esi
push esi
lea eax, [ebp - 0x2e4]
push eax
push esi
call dword [0x4a665c]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x44573b
lea eax, [ebp - 0x2e4]
push eax
call fcn.00489c67
mov edi, eax
cmp edi, esi
pop ecx
je 0x44573b
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push edi
call dword [eax + 0xc]
cmp dword [ebp - 4], esi

Function at 0x445b57
Capabilities:
Get disk information

Disassembly:
push ebx
push ebx
push 0x2d1080
push esi
mov dword [ebp - 4], ebx
call dword [0x4a6414]
push esi
mov edi, eax
call dword [0x4a64ec]
cmp edi, ebx
pop edi
je 0x445b7c
mov eax, dword [ebp - 0x34]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x18]
push eax
call dword [0x4a61ec]
cmp dword [ebp + 8], 0xffffffff
je 0x445ba0
push ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call fcn.0048236e
add esp, 0xc
cmp eax, ebx
jne 0x445ba8
xor eax, eax
inc eax
jmp 0x445c47
push ebx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], ebx
Function at 0x4467f2
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
push dword [esi]
lea ecx, [esi + 0xc]
call fcn.0048bed5
movzx edx, byte [esp + 0xc]
mov cl, byte [eax]
xor eax, eax
cmp edx, 0x3c
mov ebx, 0x82
jg 0x4469ac
je 0x446d9d
cmp edx, 0x28
jg 0x4468fa
je 0x446e12
cmp edx, 0x1f
jg 0x44685e
cmp edx, 0x1e
jge 0x446e12
test edx, edx
jle 0x446855
cmp edx, 8
jle fcn.00446c00
cmp edx, 0xd
jle 0x446855
cmp edx, 0x1d
jle fcn.00446c00
or byte [esi + 8], 4
sub edx, 0x25
je 0x446915
dec edx
jne 0x446855
cmp cl, 1
jb 0x446878
cmp cl, 0x1d
jbe fcn.00446c00
cmp cl, 0x82
jb 0x446886
cmp cl, 0x8c
jb fcn.00446c00
cmp cl, 0x5e
je fcn.00446c00
cmp cl, 0x2a
je fcn.00446c00
cmp cl, 0x2f
je fcn.00446c00
cmp cl, 0x25
je fcn.00446c00
cmp cl, 0x2b
je fcn.00446c00
cmp cl, 0x2d
je fcn.00446c00
cmp cl, 0x8c
je fcn.00446c00
cmp cl, 0x8d
je fcn.00446c00
cmp cl, 0x3e
je fcn.00446c00
cmp cl, 0x3c
je fcn.00446c00
cmp cl, 0x3d
je fcn.00446c00
cmp cl, 0x8e
je fcn.00446c00
cmp cl, 0x26
jmp 0x446e0c
sub edx, 0x29
je 0x4469a5
dec edx
je 0x446915
dec edx
je 0x446954
dec edx
dec edx
je 0x446954
dec edx
dec edx
jne 0x446855
cmp cl, 1
jb 0x446923
cmp cl, 0x1d
jbe fcn.00446c00
cmp cl, 0x82
jb 0x446931
cmp cl, 0x8c
jb fcn.00446c00
cmp cl, 0x5e
je fcn.00446c00
cmp cl, 0x2a
je fcn.00446c00
cmp cl, 0x2f
je fcn.00446c00
cmp cl, 0x25
jmp 0x446e0c
cmp cl, 1
jb 0x446962
cmp cl, 0x1d
jbe fcn.00446c00
cmp cl, 0x82
jb 0x446970
cmp cl, 0x8c
jb fcn.00446c00
add byte [eax], al
xor eax, eax
jmp 0x446859
cmp edx, 0x8b
jg 0x446b46
cmp edx, ebx
jge fcn.00446c00
sub edx, 0x3d
je 0x446d1a
dec edx
je 0x446d9d
dec edx
dec edx
je 0x446aae
sub edx, 0x1e
je 0x446a8b
sub edx, 0x1e
jne 0x446855
cmp cl, 1
jb 0x4469f8
cmp cl, 0x1d
jbe fcn.00446c00
cmp cl, bl
jb 0x446a05
cmp cl, 0x8c
jb fcn.00446c00
cmp cl, 0x5e
je fcn.00446c00
cmp cl, 0x2a
je fcn.00446c00
test cl, ch
add dword [eax], eax
invalid
cmp cl, 0x2f
je fcn.00446c00
cmp cl, 1
jb 0x446a99
cmp cl, 0x1d
jbe fcn.00446c00
cmp cl, bl
jb 0x446aa6
cmp cl, 0x8c
jb fcn.00446c00
cmp cl, 0x5e
jmp 0x446e0c
cmp cl, 1
jb 0x446abc
cmp cl, 0x1d
jbe fcn.00446c00
cmp cl, bl
jb 0x446ac9
cmp cl, 0x8c
cmp edx, 0x8c
jl 0x446855
cmp edx, 0x8d
jle 0x446d9d
cmp edx, 0x8e
je 0x446d1a
cmp edx, 0x8f
je 0x446c73
mov ebx, 0x90
cmp edx, ebx
je 0x446c08
invalid
test dword [eax], eax
add byte [eax], al
cmp edx, 0x91
jne 0x446855
cmp cl, 1
jb fcn.00446b99
cmp cl, 0x1d
jbe fcn.00446c00
invalid
cmp cl, 1
jb 0x446c12
cmp cl, 1
jb 0x446c7d
cmp cl, 1
jb fcn.00446d28
cmp cl, 1
jb 0x446dab
cmp cl, 0x1d
jbe fcn.00446c00
cmp cl, bl
jb 0x446db8
cmp cl, 0x8c
jb fcn.00446c00
cmp cl, 0x5e
je fcn.00446c00
cmp cl, 0x2a
je fcn.00446c00
cmp cl, 0x2f
je fcn.00446c00
cmp cl, 0x25
je fcn.00446c00
cmp cl, 0x2b
je fcn.00446c00
cmp cl, 0x2d
je fcn.00446c00
cmp cl, 0x8c
je fcn.00446c00
cmp cl, 0x8d
je fcn.00446c00
invalid
cmp cl, 0x3e
je fcn.00446c00
cmp cl, 0x3c

Function at 0x446b7e
Capabilities:
Parse credit card information

Disassembly:
test byte [ebp - 0x7f000000], al
cli
xchg ecx, eax
add byte [eax], al
add byte [edi], cl
test esi, eax
cld
invalid
Function at 0x44771e
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
add cl, ch
outsd dx, dword [esi]
inc esp
add ch, dh
outsd dx, dword [esi]
inc esp
add byte [ecx], al
jo 0x447761
add byte [ebp + 0x6f], dl

Function at 0x447847
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
inc esp
add byte [edx + 0x1004476], ah
jbe 0x4477f5
add byte [edi - 0x49ffbb8c], ah
je 0x4477fd
add dl, bl
je 0x447801
add byte [ecx + 0x71], dl
inc esp
add byte [eax], al
add dword [edx], eax
add eax, dword [eax + 808453894]
add eax, 808453894
xor byte [eax], dh
xor byte [eax], cl
or dword [edx], ecx
or ecx, dword [ecx + 286265102]
adc dl, byte [ebx]
adc al, 21
push ss
pop ss
push ss
pop ss
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], bl
sbb dword [eax], esi
xor byte [eax], dh
sbb bl, byte [ebx]
xor byte [eax + esi], bl
sbb eax, 808464432
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
invalid
push ds
pop ds
and byte [eax], dh
and dword [eax], esi
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [edx], ah
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [ebx], ah
xor byte [eax], dh
xor byte [eax], dh
xor byte [656811300], bl
sbb byte [edx], ah
sub byte [ecx], ch
and dword [edx], ebp
sub ebp, dword [ebp - 1957351634]
in al, dx
sub esp, 0x24
in al, dx
and al, 0x53
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x5c

Function at 0x447861
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
xor esi, esi
push esi
push ebx
mov dword [ebp - 4], esi
call dword [0x4a65bc]
mov edi, eax
cmp edi, esi
jne 0x4479f5
push 4
push 0x2001b
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
call fcn.0047fbd3
mov ebx, eax
add esp, 0x14
cmp ebx, esi
jne 0x447a29
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
Function at 0x4478a0
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call dword [0x4a609c]
adc eax, 0x4a609c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], eax
jae 0x4478d3
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00484a7e
cmp dword [ebp - 0xc], esi
jne 0x447999
invalid
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x20]
dec eax
cmp eax, esi
mov dword [ebp - 8], eax
jl 0x447943

Function at 0x44790e
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, dword [ebp - 0x10]
push esi
push esi
push esi
lea eax, [eax*4 + 1]
push esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push edi
push dword [ebp - 8]
mov word [edi], si
push dword [ebp - 4]
call dword [0x4a6098]
mov ebx, eax
cmp ebx, esi
jne 0x44793e
push edi
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
call dword [0x4a607c]
dec dword [ebp - 8]
jns 0x4478fd
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, esi
mov dword [ebp - 8], eax
jl 0x447999
mov eax, dword [ebp - 0x10]
push esi
push esi
push esi
lea eax, [eax*4 + 1]
push esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push edi
push dword [ebp - 8]
mov word [edi], si
push dword [ebp - 4]
call dword [0x4a6094]
mov ebx, eax
cmp ebx, esi
je 0x44797e
mov dword [ebp - 0xc], ebx
jmp 0x447994
cmp word [edi], si
je 0x447994
push edi
push dword [ebp - 4]
invalid
invalid

Function at 0x447e54
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push ebx
lea eax, [eax + str.DhcpDefaultGateway]
add byte [eax - 1], dl
jne 0x447e5a
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], esi
call edi
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
call fcn.00480702
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push ebx
lea eax, [eax + str.DhcpNameServer]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], esi
call edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 0xc]
push eax
push ebx
push str.DhcpServer
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], esi
call edi
mov eax, dword [ebp + 0x20]
cmp eax, ebx
je 0x447ed1
cmp dword [ebp - 0x18], ebx
setne cl
add cl, 0x30
movsx cx, cl
mov word [eax], cx
xor ebx, ebx
inc ebx
Function at 0x447e65
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push ebx
lea eax, [eax + str.DhcpDefaultGateway]
add byte [eax - 1], dl
jne 0x447e5a
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], esi
call edi
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
call fcn.00480702
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push ebx
lea eax, [eax + str.DhcpNameServer]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], esi
call edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 0xc]
push eax
push ebx
push str.DhcpServer
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], esi
call edi
mov eax, dword [ebp + 0x20]
cmp eax, ebx
je 0x447ed1
cmp dword [ebp - 0x18], ebx
setne cl
add cl, 0x30
movsx cx, cl
mov word [eax], cx
xor ebx, ebx
inc ebx

Function at 0x44816a
Capabilities:
Set registry value

Disassembly:
je 0x448154
push dword [ebp - 0x18]
lea eax, [ebp - 0x1d8]
push eax
push 7
push ebx
push str.SubnetMask
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp + 0x14]
cmp byte [eax], bl
je 0x448172
push dword [ebp - 0x2c]
lea eax, [ebp - 0xfc]
push eax
push 7
push ebx
push str.DefaultGateway
out 0x4a, eax
add bh, bh
jne 0x448160
call esi
mov eax, dword [ebp + 0x18]
cmp byte [eax], bl
je 0x44818f
push dword [ebp - 0x20]
call edi
push eax
push dword [ebp - 0x20]
push 1
push ebx
push str.NameServer
push dword [ebp - 0x10]
call esi
push 4
lea eax, [ebp - 0x28]
push eax
push 4
push ebx
push str.EnableDHCP
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call dword [0x4a6060]
mov esi, dword [ebp + 0x10]
cmp byte [esi], bl
jne 0x4481e5
cmp byte [ebp - 0x390], bl
je 0x4481e5
mov edi, dword [ebp - 0x30]
push edi

Function at 0x44a19b
Capabilities:
Parse credit card information

Disassembly:
call fcn.0048735f
mov esi, dword [ebp - 0xc]
mov word [esi + 2], 0x3a
mov ax, word [esi]
cmp ax, 0x2c
jne 0x44a1b9
cmp ax, 0x3b
jne 0x44a1c6
mov word [esi], 0xff1b
jmp 0x44a1de
cmp ax, 0x3a
jne 0x44a1d3
mov word [esi], 0xff1a
jmp 0x44a1de
cmp ax, 0x3d
jne 0x44a1de
mov word [esi], 0xff1d

Function at 0x44a38b
Capabilities:
Get disk information

Disassembly:
inc dword [eax]
add dh, dh
rol dword [ecx], 0x57
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0x14], eax
Function at 0x44a398
Capabilities:
Get disk information

Disassembly:
je 0x44a3aa
test cl, 8
je 0x44a3aa
and dword [ebp + 0x10], 0xfffffff7
mov dword [ebp - 0x14], 8
cmp dword [ebp + 0xc], eax
mov dword [ebp - 0x18], eax
and eax, 0x2006cab
add byte [eax], al
lea ecx, [ebp - 0x18]
call fcn.0043dc99
mov eax, dword [ebp - 0x18]
mov dword [ebp + 0xc], eax
push 5
pop ecx
xor eax, eax
mov esi, 0x4aeadc
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push 0x1b
add eax, 0xc
pop edx
and dword [eax + 4], 0
or ecx, 0xffffffff
mov dword [eax + 8], ecx
mov dword [eax], ecx
mov dword [eax - 4], ecx
mov dword [eax - 0xc], ecx
mov dword [eax - 8], ecx
add eax, 0x18
dec edx
jne 0x44a3e5
call dword [0x4a6254]
cmp bx, 0x61
mov dword [ebp - 0x28], eax
jb 0x44a41b
cmp bx, 0x7a
xor eax, eax
cmp bx, 0x41
mov dword [ebp - 0x10], 0x19
jb 0x44a439
cmp bx, 0x5a
ja 0x44a439
invalid

Function at 0x44a455
Capabilities:
Get disk information

Disassembly:
add byte [ebx + 0x4d8bf445], cl
or byte [ebx - 0x7699be40], al
inc ecx
mov word [ebp - 0x48], ax
lea eax, [ebx + ebx*2]
lea esi, [ecx + eax*8]

Function at 0x44a45e
Capabilities:
Get disk information

Disassembly:
add byte [ebx + 0x4d8bf445], cl
or byte [ebx - 0x7699be40], al
inc ecx
mov word [ebp - 0x48], ax
lea eax, [ebx + ebx*2]
lea esi, [ecx + eax*8]

Function at 0x44a47b
Capabilities:
Get disk information

Disassembly:
mov eax, 0xec15ff50
popal
dec edx
add byte [ebx + 0x3ff83f8], cl
cmp edi, 3

Function at 0x44a5aa
Capabilities:
Get disk information via ioctl

Disassembly:
push eax
push eax
push 0x70048
push dword [ebp - 4]
call edi
test eax, eax
mov cx, word [esi]
mov word [ebp - 0x1c], cx
je 0x44a5c9
mov ax, word [ebx + 0x18]
mov word [ebp - 0x1c], ax
and dword [ebp - 0x208], 0
push 0
call dword [0x4a649c]
or dword [ebx + 4], 0xffffffff
xor eax, eax
push eax
lea ecx, [ebp - 0x208]
push ecx
push 0xc
push ebx
push eax
push eax
push 0x2d1080
push dword [ebp - 4]
call edi
mov dword [ebp - 0x20], eax
call dword [0x4a6498]
xor edi, edi
cmp dword [ebp - 0x14], edi
je 0x44a638
cmp dword [ebp - 0x24], 5
jne 0x44a638
cmp dword [ebp - 0x20], edi
je 0x44a68a
push 0x4a7ce0
push edi
lea eax, [ebp - 0x78]
push eax
movzx eax, word [ebx + 4]
push eax
mov word [ebp - 0x78], di
call fcn.0048bae6
add esp, 0x10
cmp word [ebp - 0x78], di
je 0x44a68a
movzx eax, word [ebp - 0x48]
mov dword [esi + 0x10], eax
cmp dword [ebp - 0x20], 0
movsx edi, word [ebp - 0x1c]
mov dword [esi], edi
je 0x44a64b
movsx eax, word [ebx + 4]
mov dword [esi + 4], eax
cmp dword [ebp + 0x10], 4
jne 0x44a660
push dword [ebp - 4]
push 0
call fcn.00489556
pop ecx
pop ecx
mov dword [esi + 0xc], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
mov dword [esi + 8], ecx
movsx edx, word [ebx + 4]
push edx
push edi
push ecx
push eax
lea eax, [ebp - 0x50]
push eax
push str._s:__tpx__d___tp__d__iPartition_d_iDisk_d_r_n
lea ecx, [ebp - 4]
call fcn.0044c5e8
invalid