joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f9b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x60c
mov eax, dword [esp + 0x618]
mov ecx, dword [esp + 0x614]
push ebx
push ebp
push esi
push edi
push 0
push 0x200
push eax
push ecx
call fcn.004b4970
mov edi, edx
push 0
mov ebx, eax
lea edx, [esp + 0x14]
push edx
or eax, 0xffffffff
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x62c]
lea ebp, [esp + 0x228]
push ebx
and ebp, 0xfffffe00
push eax
mov dword [esp + 0x63c], edi
mov dword [esp + 0x2c], 0
lea esi, [ebp + 0x200]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
jne 0x44fb10
mov edx, dword [esp + 0x14]
cmp edx, edi
jne 0x44fb10
mov ecx, dword [esp + 0x620]
push 0
lea eax, [esp + 0x1c]
push eax
push 0x200
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44fb10
mov eax, dword [esp + 0x630]
cmp eax, 1
mov ecx, 0x80
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
jne 0x44fa91
mov ecx, dword [esp + 0x62c]
mov esi, dword [ecx]
lea edx, [ebp + 0x3ce]
mov dword [edx], esi
mov esi, dword [ecx + 4]
mov dword [edx + 4], esi
mov esi, dword [ecx + 8]
mov dword [edx + 8], esi
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0x628]
mov edi, dword [esp + 0x620]
xor edx, edx
cmp eax, 1
setne dl
or eax, 0xffffffff
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push ecx
dec edx
push ebx
and edx, 0xaa55
lea esi, [ebp + 0x200]
push edi
mov word [esi + 0x1fe], dx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edx, dword [esp + 0x10]
cmp edx, ebx
jne 0x44fb10
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x628]
jne 0x44fb10
mov eax, 0x200
mov edx, esi
mov ecx, ebp
call fcn.00449820
test eax, eax
jne 0x44fb10
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x200
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x60c
ret
Function at 0x44fe50
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4eab48
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [esp + 0x28]
mov eax, dword [edi]
push eax
mov eax, 0x26a
call fcn.00449190
xor esi, esi
add esp, 4
cmp eax, esi
mov dword [edi], eax
je 0x44fe8e
mov word [eax + 0x268], si
push 0x196
call fcn.00449130
mov ebx, eax
add esp, 4
cmp ebx, esi
mov dword [esp + 0x10], ebx
je 0x44fea8
mov word [ebx], si
push ebp
mov eax, dword [esp + 0x3c]
mov ecx, eax
and ecx, 0x100
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ecx
movzx esi, al
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [edi]
test esi, esi
sete dl
neg esi
sbb esi, esi
mov ebp, eax
mov eax, dword [esp + 0x38]
and esi, 0x19
test eax, eax
lea edx, [edx + edx - 1]
mov byte [esp + 0x3c], 0
mov byte [esp + 0x13], dl
mov ecx, esi
je 0x44fef7
cmp eax, 1
not ebp
jle 0x44fef7
and ebp, 0xfffffffc
cmp ecx, 0x1a
jge 0x44ff86
mov esi, dword [esp + 0x34]
jmp 0x44ff10
mov dl, byte [esp + 0x13]
lea ebx, [ebx]
test ecx, ecx
jl 0x44ff86
mov eax, 1
shl eax, cl
movsx edx, dl
mov bl, cl
add ecx, edx
add bl, 0x41
test ebp, eax
mov dword [esp + 0x38], ecx
je 0x44ff7d
mov eax, dword [esp + 0x18]
test eax, eax
je 0x44ff4a
movsx ax, bl
push eax
call fcn.004b0a20
mov ecx, dword [esp + 0x3c]
add esp, 4
test eax, eax
je 0x44ff7d
mov al, byte [esp + 0x3c]
test al, al
je 0x44ff62
mov ax, word [esp + 0x30]
test ax, ax
je 0x44ff62
mov word [edi], ax
add edi, 2
movsx dx, bl
mov word [edi], dx
add edi, 2
test esi, esi
mov byte [esp + 0x3c], 1
je 0x44ff7d
mov word [edi], 0x3a
add edi, 2
cmp ecx, 0x1a
mov ebx, dword [esp + 0x14]
jl 0x44ff06
test ebx, ebx
mov eax, dword [esp + 0x2c]
mov word [edi], 0
mov esi, dword [eax]
pop ebp
je 0x44ffa9
mov ecx, dword [0x51d3c8]
add ebx, 0xfffffff8
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x44fff0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
cmp byte [esi], 0x23
sete al
test al, al
push edi
mov byte [esp + 0x14], al
je 0x450007
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx]
inc eax
lea edi, [eax + eax*2]
lea eax, [edi + 1]
push ecx
call fcn.00449190
add esp, 4
test eax, eax
mov dword [ebx], eax
je 0x45002e
mov byte [eax + edi], 0
mov edi, dword [ebx]
mov byte [edi], 0
mov al, byte [esi]
xor edx, edx
xor cl, cl
test al, al
mov ebp, edi
je 0x450059
nop
mov al, byte [esi]
cmp al, 0x3d
jne 0x450098
test cl, cl
jle 0x450051
mov byte [edi], dl
inc edi
xor edx, edx
xor cl, cl
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x450040
push ebp
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov al, byte [esp + 0x14]
test al, al
je 0x450091
xor ecx, ecx
test esi, esi
jle 0x450091
xor edx, edx
mov eax, ecx
mov edi, 0x14
div edi
mov al, byte [ecx + ebp]
mov dl, byte [edx + 0x4f8124]
xor al, dl
mov byte [ecx + ebp], al
inc ecx
cmp ecx, esi
jl 0x450073
mov eax, dword [ebx]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp al, 0x2b
jne 0x4500a0
xor al, al
jmp 0x4500be
cmp al, 0x2f
jne 0x4500a8
mov al, 1
jmp 0x4500be
cmp al, 0x39
ja 0x4500b0
add al, 0xd2
jmp 0x4500be
cmp al, 0x5a
ja 0x4500b8
add al, 0xcb
jmp 0x4500be
cmp al, 0x7a
ja 0x4500f1
add al, 0xc5
movzx eax, al
test eax, eax
jl 0x4500f1
shl eax, cl
or edx, eax
add cl, 6
lea esp, [esp]
cmp cl, 8
jge 0x4500e6
test cl, cl
jle 0x450051
cmp byte [esi], 0
jne 0x450051
mov byte [edi], dl
inc edi
shr edx, 8
add cl, 0xf8
jmp 0x4500d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4503d0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call ebp
inc eax
lea eax, [eax + eax*2]
xor edi, edi
test eax, eax
mov dword [esp + 0x14], edi
jl 0x450406
inc eax
push eax
call fcn.00449130
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
mov edi, eax
je 0x450406
mov byte [eax], 0
mov byte [edi], 0x20
lea edx, [edi + 1]
mov byte [edx], 0
mov al, byte [esi]
xor ebx, ebx
xor cl, cl
test al, al
je 0x45043d
lea esp, [esp]
mov al, byte [esi]
cmp al, 0x3d
jne 0x4504c1
test cl, cl
jle 0x450435
mov byte [edx], bl
inc edx
xor ebx, ebx
xor cl, cl
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x450420
push edi
mov byte [edx], 0
call ebp
mov esi, dword [esp + 0x18]
mov ecx, dword [esi]
mov ebp, eax
lea edi, [ebp + 2]
lea eax, [edi + edi + 4]
push ecx
call fcn.00449190
xor ebx, ebx
add esp, 4
cmp eax, ebx
mov dword [esi], eax
je 0x450468
mov word [eax + edi*2 + 2], bx
mov edx, dword [esi]
push edi
push edx
push ebp
mov ebp, dword [esp + 0x20]
push ebp
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp edi, ebx
jge 0x450486
xor edi, edi
mov eax, dword [esi]
mov word [eax + edi*2], bx
mov ecx, dword [esi]
lea eax, [edi + edi + 4]
push ecx
call fcn.00449190
add esp, 4
cmp eax, ebx
mov dword [esi], eax
je 0x4504a6
mov word [eax + edi*2 + 2], bx
mov edx, dword [0x51d3c8]
mov esi, dword [esi]
add ebp, 0xfffffff8
push ebp
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
cmp al, 0x41
jb 0x4504cd
cmp al, 0x5a
ja 0x4504cd
sub al, 0x41
jmp 0x4504f3
cmp al, 0x61
jb 0x4504d9
cmp al, 0x7a
ja 0x4504d9
sub al, 0x47
jmp 0x4504f3
cmp al, 0x30
jb 0x4504e5
cmp al, 0x39
ja 0x4504e5
add al, 4
jmp 0x4504f3
cmp al, 0x2b
jne 0x4504ed
mov al, 0x3e
jmp 0x4504f3
cmp al, 0x2f
jne 0x450521
mov al, 0x3f
movzx eax, al
shl eax, cl
or ebx, eax
add cl, 6
lea ecx, [ecx]
cmp cl, 8
jge 0x450516
test cl, cl
jle 0x450435
cmp byte [esi], 0
jne 0x450435
mov byte [edx], bl
inc edx
shr ebx, 8
add cl, 0xf8
jmp 0x450500
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
add edi, 0xfffffff8
push edi
mov word [edx], 0
mov eax, dword [0x51d3c8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x451c80
Capabilities:
Clear file content

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
or eax, 0xffffffff
push 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
add esp, 8
ret
Function at 0x454330
Capabilities:
Parse credit card information
Query environment variable

Disassembly:
mov al, byte [ecx + 0x8e]
test al, al
jne 0x454345
test byte [ecx + 0xb], 0xf
jne 0x454345
jmp fcn.004541d0
jmp fcn.00452ca0

Function at 0x454650
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e9e08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov eax, dword [esp + 0x20]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocStringLen
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], esi
call fcn.00417e55
mov edi, dword [esp + 8]
cmp edi, esi
jne 0x4546b1
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push ebp
mov ebp, dword [esp + 0x28]
cmp ebp, esi
mov dword [esp + 0xc], esi
jne 0x4546c2
lea ebp, [esp + 0xc]
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [esp + 0x30]
xor ecx, ecx
cmp ebx, esi
setne cl
mov dword [ebp], eax
push eax
mov esi, ecx
test esi, esi
je 0x454718
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebx], eax
jne 0x45470f
cmp edi, 0xffffffff
je 0x4546fa
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x454720
call fcn.00449130
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x4546ee
mov eax, dword [ebp]
push 0
lea edx, [esp + 0x18]
push edx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test esi, esi
je 0x45474a
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp edi, 0xffffffff
je 0x454756
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
mov eax, ebx
pop ebx
pop ebp
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x454b10
Capabilities:
Check mutex on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
xor ebx, ebx
cmp eax, ebx
push edi
push 0x10
je 0x454b97
call fcn.004cc845
add esp, 4
cmp eax, ebx
je 0x454b40
mov byte [eax + 8], bl
mov dword [eax + 0xc], ebx
mov dword [eax], 0x4f9198
mov dword [eax + 4], ebx
mov esi, eax
jmp 0x454b42
xor esi, esi
push 0x51d5ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push edi
push ebx
push ebx
call ebp
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x51d5ec
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 4], ebx
je 0x454bd0
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 0xb7
mov ecx, dword [esp + 0x20]
sete al
mov dword [ecx], eax
jmp 0x454bca
call fcn.004cc845
mov edi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x454bc8
push edi
push ebx
push ebx
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov dword [esi + 0xc], ebx
mov dword [esi], 0x4f9198
call ebp
mov dword [esi + 4], eax
jmp 0x454bca
xor esi, esi
cmp dword [esi + 4], ebx
jne 0x454be8
nop
push 1
mov ecx, 0x51d2a0
call fcn.0042072b
push edi
push ebx
push ebx
call ebp
cmp eax, ebx
mov dword [esi + 4], eax
je 0x454bd0
cmp byte [esp + 0x1c], bl
je 0x454bfe
mov edx, dword [esi + 4]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [esi + 8], 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x455260
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
push edi
push eax
mov eax, 0x20a
call fcn.00449190
add esp, 4
test eax, eax
mov dword [esi], eax
je 0x455287
mov word [eax + 0x208], 0
mov ecx, dword [esi]
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov word [ecx], 0
mov eax, dword [esi]
push 0x104
push eax
push ebx
call ebp
mov edi, eax
test edi, edi
jle 0x4552d3
mov ecx, dword [esi]
cmp word [ecx], 0
jne 0x4552d3
lea eax, [edi + edi + 6]
push ecx
call fcn.00449190
add esp, 4
test eax, eax
mov dword [esi], eax
je 0x4552cb
mov word [eax + edi*2 + 4], 0
mov edx, dword [esi]
inc edi
push edi
push edx
push ebx
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4567a0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4ea15b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
push ebx
lea eax, [esp + 0xc]
push eax
push str.INDATA
push 0x18
push ebx
mov dword [esp + 0x30], ebx
call fcn.00423fea
mov eax, dword [esp + 0x20]
add esp, 0x14
cmp eax, 0x200
jge 0x456818
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x456806
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
push esi
push 0x18
call fcn.004cc845
add esp, 4
mov dword [esp + 8], eax
cmp eax, ebx
mov byte [esp + 0x20], 1
je 0x45683b
mov ecx, eax
call fcn.0041f928
mov esi, eax
jmp 0x45683d
xor esi, esi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push ebp
push edi
push edx
push eax
mov ecx, esi
mov byte [esp + 0x30], bl
mov dword [0x51d3d0], esi
call fcn.00423daf
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x4568a1
push str.flashop
lea ecx, [esp + 0x14]
call fcn.004564a0
mov eax, dword [eax]
push eax
mov ecx, esi
mov byte [esp + 0x2c], 2
call fcn.0041f964
mov edi, eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0x28], bl
je 0x45689d
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call ebp
cmp edi, ebx
jne 0x4568e0
cmp esi, ebx
je 0x4568b5
mov ecx, esi
call fcn.0041f93e
push esi
call fcn.004cc875
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4568cb
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push edx
call ebp
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4568f5
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push ebx
push eax
call ebp
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop ebp
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4582e0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4ea1c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
movzx eax, word [0x522010]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
lea edi, [ebp + 2]
lea eax, [edi + edi + 4]
push 0
call fcn.00449190
mov esi, eax
add esp, 4
test esi, esi
je 0x458330
mov word [esi + edi*2 + 2], 0
mov ecx, dword [esp + 0x10]
push edi
push esi
push ebp
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
xor ebp, ebp
cmp edi, ebp
jge 0x45834b
xor edi, edi
lea eax, [edi + edi + 4]
push esi
mov word [esi + edi*2], bp
call fcn.00449190
add esp, 4
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x458369
mov word [eax + edi*2 + 2], bp
movzx edx, word [0x522010]
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
lea edi, [ebp + 2]
lea eax, [edi + edi + 4]
push 0
call fcn.00449190
mov esi, eax
add esp, 4
test esi, esi
je 0x4583a3
mov word [esi + edi*2 + 2], 0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
push edi
push esi
push ebp
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jge 0x4583c0
xor edi, edi
lea eax, [edi + edi + 4]
push esi
mov word [esi + edi*2], 0
call fcn.00449190
mov esi, eax
add esp, 4
test esi, esi
mov dword [esp + 0x10], esi
je 0x4583e4
mov word [esi + edi*2 + 2], 0
mov edi, dword [esp + 0x14]
push edi
push esi
push str._r_nRegSetDHCP__s__s__r_n
push 0x51d2a0
mov byte [esp + 0x40], 1
call fcn.004203b8
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0x10
test esi, esi
je 0x458419
mov eax, dword [0x51d3c8]
add esi, 0xfffffff8
push esi
push 0
push eax
call ebp
test edi, edi
je 0x45842c
mov ecx, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push 0
push ecx
call ebp
mov edx, dword [str.0.0.0.0]
mov eax, dword [0x4f98f8]
mov edi, dword [esp + 0x38]
mov cl, byte [0x4f98fc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov dword [esp + 0x20], edx
lea edx, [esp + 0x1c]
push edx
push 4
push 0
mov dword [esp + 0x30], eax
mov eax, dword [edi]
push str.EnableDHCP
push eax
mov byte [esp + 0x3c], cl
mov dword [esp + 0x30], 1
call esi
mov edx, dword [edi]
push 9
lea ecx, [esp + 0x20]
push ecx
push 7
push 0
push str.IPAddress
push edx
call esi
mov ecx, dword [edi]
push 9
lea eax, [esp + 0x20]
push eax
push 7
push 0
push str.SubnetMask
push ecx
call esi
mov edx, dword [edi]
push 1
push 0x4f98cc
push 7
push 0
push str.DefaultGateway
push edx
call esi
test ebx, ebx
mov eax, ebx
je 0x4584db
cmp byte [ebx], 0x2d
jne 0x4584bf
mov ebx, 0x4f004f
cmp byte [eax], 0
je 0x4584db
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [edi]
push ebx
push 1
push 0
push str.NameServer
push eax
call esi
mov ecx, dword [edi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x462360
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
mov edi, dword [esp + 8]
mov eax, dword [edi]
push 0
mov word [eax], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4623a4
push esi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x46239d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.00456630
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, edi
pop edi
ret
Function at 0x465630
Capabilities:
Get disk information

Disassembly:
sub esp, 0x18
push edi
mov eax, esi
call fcn.00455400
mov edi, eax
mov eax, 0x20
mov word [esp + 0xc], ax
mov word [esp + 0x10], ax
mov eax, 0x3a
mov word [esp + 0x14], ax
mov word [esp + 6], ax
lea eax, [esp + 4]
push eax
mov word [esp + 0x12], 0x2a
mov word [esp + 0x16], si
mov word [esp + 0x1a], 0x2c
mov word [esp + 0x1c], 0
mov word [esp + 8], si
mov word [esp + 0xc], 0x5c
mov word [esp + 0xe], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x46569d
cmp edi, 2
je 0x4656ae
push 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x51d2a0
call fcn.0045e370
pop edi
add esp, 0x18
ret
Function at 0x466e80
Capabilities:
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4ea980
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
xor edx, edx
cmp word [esi], 0x23
push edi
mov edi, ecx
jne 0x466eb5
cmp word [esi + 2], 0x26
jne 0x466eb5
mov edx, 0x23
add esi, 2
mov cx, word [esi]
cmp cx, 0x26
je 0x466edc
test byte [edi + 0xb], 0xf
jne 0x466edc
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x466f8d
mov eax, dword [eax + 0x6c]
cmp word [eax], 0x26
jne 0x466f8d
push ebx
xor ebx, ebx
mov dword [esp + 0x20], ebx
cmp dx, bx
mov dword [esp + 0x18], ebx
je 0x466ef2
cmp cx, 0x26
jmp 0x466f04
cmp cx, 0x26
je 0x466eff
push 0x4fa060
jmp 0x466f0b
cmp word [esi + 2], 0x26
je 0x466f24
push 0x4fa062
lea ecx, [esp + 0x24]
call fcn.004566f0
lea ecx, [esp + 0x20]
push esi
call fcn.00449510
mov ebx, dword [esp + 0x20]
mov esi, ebx
mov eax, dword [edi + 0x80]
test eax, eax
je 0x466f30
mov edi, eax
push 0x51d5ec
mov dword [esp + 0x10], 0x51d5ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push ecx
push esi
mov ecx, edi
mov byte [esp + 0x24], 1
call fcn.00420086
push 0x51d5ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x466f79
mov edx, dword [0x51d3c8]
add ebx, 0xfffffff8
push ebx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 8
test cx, cx
je 0x466f7a
mov eax, dword [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4677a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x2c
cmp eax, 0xf8000009
push esi
mov esi, ecx
je 0x4677b4
mov dword [esi + 0x40], eax
push ebx
mov ebx, dword [esp + 0x3c]
test ebx, ebx
push ebp
mov ebp, dword [esi + 0x1c]
push edi
mov edi, dword [ebp + 0x18]
je 0x46781b
cmp word [ebx], 0x23
jne 0x467812
push 0x3a
push ebx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x467812
mov dword [esp + 0x10], ebx
mov word [eax], 0
lea ebx, [eax + 2]
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x4c], SysReAllocStringLen
call fcn.0044ce90
add esp, 8
test eax, eax
je 0x467812
mov eax, dword [esp + 0x44]
test eax, eax
jge 0x46780f
mov eax, SysReAllocStringLen
mov dword [ebp + 0x50], eax
push ebx
lea ecx, [ebp + 0x4c]
call fcn.004566f0
mov ebp, dword [esi + 0x40]
xor edx, edx
test ebp, ebp
setl dl
dec edx
and edx, 5
push edx
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x408
push edi
call ebp
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x40]
cmp eax, 0x64
jg 0x467866
test eax, eax
jl 0x467866
mov eax, dword [esi + 0x40]
push 0
push eax
push 0x402
push edi
call ebp
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x44], eax
jne 0x46787b
test ebx, ebx
je 0x46787b
push 1
push 0
push edi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esi + 0x40]
push ecx
lea edx, [esp + 0x18]
push 0x4f40fc
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esi + 8]
add esp, 0xc
cmp word [eax], 0
pop edi
pop ebp
pop ebx
je 0x4678ac
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esi + 0x30]
push eax
call fcn.00466e80
pop esi
add esp, 0x2c
ret 8

Function at 0x4678c0
Capabilities:
Set environment variable

Disassembly:
mov eax, dword [ecx + 0x6c]
cmp word [eax], 0
je 0x4678d4
mov ecx, dword [ecx + 0x13c]
jmp fcn.00466e80
ret 8