joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4da1e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x60cf0c
push eax
call fcn.005e00ad
mov esi, eax
add esp, 8
test esi, esi
jne 0x4da1fb
pop esi
ret
push edi
mov edi, dword [esp + 0x10]
push esi
push 0x40
push 1
push edi
call fcn.005e057f
add esp, 0x10
cmp eax, 0x40
je 0x4da221
push esi
call fcn.005dff6d
add esp, 4
pop edi
xor eax, eax
pop esi
ret
mov ecx, dword [edi + 0x3c]
push ebx
push 0
push ecx
push esi
call fcn.005e0626
mov ebx, dword [esp + 0x24]
push esi
push ebx
push 1
push edi
call fcn.005e057f
add esp, 0x1c
cmp eax, ebx
pop ebx
push esi
jne 0x4da214
call fcn.005dff6d
movzx edx, byte [edi]
push edx
call fcn.005e3ae6
add esp, 8
cmp eax, 0x50
jne 0x4da21c
movzx eax, byte [edi + 1]
push eax
call fcn.005e3ae6
add esp, 4
cmp eax, 0x45
jne 0x4da21c
pop edi
mov eax, 1
pop esi
ret

Function at 0x4dabc0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
je 0x4dabfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4dac0d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4dac02
test al, 0x10
je 0x4dac02
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
pop esi
ret
push 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
ret

Function at 0x4dac20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4dac68
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4dac68
cmp byte [ecx], 0
je 0x4dac68
mov edx, 4
mov dword [esp + 8], edx
mov dword [esp], edx
lea edx, [esp + 8]
push edx
push eax
mov dword [eax], 0xffffffff
lea eax, [esp + 8]
push eax
push 0
push ecx
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x4db7a0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x110
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x120]
push ebx
mov ebx, dword [esp + 0x134]
push ebp
mov ebp, dword [esp + 0x134]
push esi
mov esi, dword [esp + 0x134]
push edi
mov edi, dword [esp + 0x134]
push 0xff
lea edx, [esp + 0x21]
push 0
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
mov byte [esp + 0x28], 0
call fcn.005dfd60
add esp, 0xc
test edi, edi
je 0x4db80a
mov byte [edi], 0
test esi, esi
jne 0x4db816
movzx esi, word [esp + 0x128]
mov eax, ebp
test ebp, ebp
jne 0x4db824
movzx eax, word [esp + 0x12c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4db863
test edi, edi
je 0x4db85c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x20]
push 0x100
push eax
call fcn.004d8b50
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
jmp 0x4db928
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
jne 0x4db8a1
test edi, edi
je 0x4db89a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x20]
push 0x100
push edx
call fcn.004d8b50
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
jmp 0x4db928
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4db919
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4db8ed
test edi, edi
je 0x4db8e9
lea edx, [esp + 0x1c]
push 0x100
push edx
call fcn.004d8c20
add esp, 8
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
jmp 0x4db928
cmp dword [esp + 0x10], esi
je 0x4db919
test edi, edi
je 0x4db915
lea ecx, [esp + 0x1c]
push 0x100
push ecx
call fcn.004d8c20
add esp, 8
lea edx, [esp + 0x1c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
jmp 0x4db928
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4db923
mov dword [eax], esi
mov eax, 1
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x110
ret
Function at 0x4dc0d0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 1
test edi, edi
je 0x4dc0f9
mov byte [edi], 0
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov dword [ebp], 0
test eax, eax
je 0x4dc112
mov dword [eax], 0xffffffff
lea eax, [esp + 0xc]
push eax
push 0x647934
push 1
push 0
push 0x647924
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x4dc151
test edi, edi
je 0x4dc214
push esi
push str.Unable_To_Create_An_Instance_Of_INetFwMgr._Reason__x
push edi
call fcn.005dfb23
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test esi, esi
jge 0x4dc194
test edi, edi
je 0x4dc214
push esi
push str.Unable_To_Get_The_Local_Firewall_Policy._Reason__x
push edi
call fcn.005dfb23
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebp
push eax
call edx
mov esi, eax
test esi, esi
jge 0x4dc1b3
test edi, edi
je 0x4dc208
push esi
push str.Failed_To_Get_The_Current_Firewall_Profile._Reason__x
jmp 0x4dc1ff
mov eax, dword [ebp]
test eax, eax
je 0x4dc208
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x4dc208
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
test eax, eax
jne 0x4dc1f5
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp word [esp + 0x14], cx
push eax
setne cl
mov dword [ebp], ecx
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
test edi, edi
je 0x4dc208
push eax
push str.Unable_to_get_FW_Enabled_Status__Reason__x
push edi
call fcn.005dfb23
add esp, 0xc
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x4dc2c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov ebx, 0x100
push 1
push ebx
mov dword [esp + 0x10], ebx
call fcn.005e34ab
mov esi, eax
add esp, 8
test esi, esi
je 0x4dc37e
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x1c]
push edi
lea eax, [esp + 0x10]
push eax
push esi
push ebp
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp edi, 0xea
jne 0x4dc35a
lea ebx, [ebx]
add ebx, 0x100
push ebx
push esi
call fcn.005e25a6
add esp, 8
test eax, eax
je 0x4dc34f
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push eax
push ebp
push 0
mov esi, eax
mov eax, dword [esp + 0x28]
push edx
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp edi, 0xea
je 0x4dc310
jmp 0x4dc35a
push esi
call fcn.005e0865
add esp, 4
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x4dc37a
test edi, edi
je 0x4dc37a
push esi
call fcn.005e0865
add esp, 4
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
pop edi
mov eax, esi
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x4dc420
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 8], ebx
test edi, edi
jne 0x4dc437
pop edi
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
pop esi
jne 0x4dc431
mov eax, dword [esp + 8]
test eax, eax
je 0x4dc496
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push ecx
push edi
push 7
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4dc487
lea ebx, [eax + 1]
mov eax, dword [esp + 8]
test eax, eax
je 0x4dc496
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x4dc4a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push eax
push 1
xor ebp, ebp
push ebp
push ecx
push edx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebp
je 0x4dc4e0
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
push 1
push 0x115
call fcn.005e34ab
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x4dc558
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x10]
push eax
push esi
push ebp
push ebp
push edi
push ecx
call ebx
cmp eax, 0xea
jne 0x4dc548
push esi
call fcn.005e0865
mov edx, dword [esp + 0x14]
add edx, 0x10
push 1
push edx
call fcn.005e34ab
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4dc556
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push esi
push 0
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x4dc556
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x10]
mov dword [edx], esi
pop edi
pop ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4dc567
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
Function at 0x4dd1a0
Capabilities:
Get disk information via ioctl
Get storage device properties

Disassembly:
sub esp, 0x14
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
xor ebp, ebp
push ebp
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x2d1400
push ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
cmp edi, 1
jne 0x4dd21c
cmp esi, ebp
je 0x4dd21c
push ebp
lea ecx, [esp + 0x14]
push ecx
push 0xc
push esi
push ebp
xor eax, eax
push ebp
mov dword [esi], eax
push 0x2d1080
mov dword [esi + 4], eax
push ebx
mov dword [esi + 8], eax
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, edi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x14
ret 0xc

Function at 0x4dd310
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
test byte [eax], 7
je 0x4dd32e
mov ecx, dword [esp + 4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4dd32e
ret
mov eax, 1
ret

Function at 0x4dd340
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
xor esi, esi
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0x10
mov dword [esp + 0x18], esi
call edi
mov eax, dword [esp + 8]
cmp eax, esi
je 0x4dd3d3
lea ecx, [esp + 0xc]
push ecx
push 1
push esi
push str.Control_PanelDesktop
push connect
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4dd3b8
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push esi
push esi
push esi
push str.SCRNSAVE.EXE
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
neg eax
sbb eax, eax
inc eax
push ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
mov eax, dword [esp + 8]
cmp eax, esi
je 0x4dd3d3
push esi
lea edx, [esp + 0xc]
push edx
push esi
push 0x72
mov dword [esp + 0x18], esi
call edi
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret
Function at 0x4dd540
Capabilities:
Get disk size

Disassembly:
sub esp, 0x2c
push esi
xor esi, esi
push 0x646ca8
push 0x61bed4
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x4dd5c2
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x30]
push ecx
push edx
call eax
test eax, eax
je 0x4dd60f
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push esi
push 0x400
push eax
push ecx
call fcn.005e5550
push esi
push 0x400
push edx
push eax
call fcn.005e5550
mov dword [esp + 0x14], edx
pop esi
add esp, 0x2c
ret
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x4dd60f
mov eax, dword [esp + 4]
imul eax, dword [esp + 8]
imul eax, dword [esp + 0xc]
push esi
push 0x400
xor ecx, ecx
push ecx
push eax
jmp 0x4dd5a7
mov eax, esi
pop esi
add esp, 0x2c
ret

Function at 0x4dd960
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x4df510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
cmp edi, ebx
jne 0x4df52a
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
je 0x4df51f
cmp dword [edi + 0x7c], ebx
je 0x4df53d
push edi
call fcn.004d4fc0
add esp, 4
push ebx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
call fcn.004d4dc0
add esp, 0x14
test eax, eax
je 0x4df565
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push esi
push 0x84
call fcn.005e20e4
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4df5a6
push 0x4000
call fcn.005e20e4
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x4df5b2
push esi
call fcn.005e0865
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x4df5fe
lea eax, [esi + 4]
push eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.004d4380
add esp, 4
test eax, eax
jne 0x4df5fe
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x4df628
mov dl, byte [edi + 0x39]
mov byte [esi + 0x80], dl
jmp 0x4df631
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
movzx ecx, byte [esi + 0x6c]
neg ecx
sbb ecx, ecx
push ebp
mov ebp, dword [esp + 0x20]
and ecx, 0xc
lea ebx, [esi + 0x70]
mov dword [esi + 0x7c], ecx
mov dword [ebx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebp, ebp
je 0x4df677
nop
movzx eax, byte [ebp]
test al, al
je 0x4df677
push eax
push ebx
call fcn.004d28e0
add esp, 8
add ebp, 1
jne 0x4df660
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
lea ecx, [edx + eax + 0x1e]
pop ebp
mov dword [esi + 0x3c], ecx
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x4df910
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4df9d6
cmp dword [esi + 4], 0xffffffff
jne 0x4df9d6
push edi
lea edi, [esi + 0x140]
push edi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4df940
sub eax, edx
mov cl, byte [eax + esi + 0x13f]
cmp cl, 0x5c
je 0x4df96a
cmp cl, 0x2f
je 0x4df96a
mov byte [eax + esi + 0x140], 0x2f
mov byte [eax + esi + 0x141], 0
mov edi, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x18]
cmp ebx, 1
jne 0x4df995
push 1
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4df995
pop ebx
pop edi
mov eax, 0x2000000
pop esi
ret 0xc
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ebx
push ecx
push edi
call fcn.004d4430
add esp, 0x10
test eax, eax
jne 0x4df9b7
mov eax, dword [esp + 0x18]
pop ebx
pop edi
pop esi
ret 0xc
push eax
call fcn.004df310
add esp, 4
mov dword [esi], eax
neg eax
sbb eax, eax
pop ebx
and eax, 0xfffffe00
pop edi
add eax, 0x200
pop esi
ret 0xc
mov eax, 0x1000000
pop esi
ret 0xc
Function at 0x4e02e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
mov dword [esp], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
test eax, eax
je 0x4e0308
mov dword [eax], 0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
lea eax, [esp + 4]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x4e0336
xor eax, eax
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x10]
push eax
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push edi
push edx
call ebx
test eax, eax
jne 0x4e03aa
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4e03aa
add eax, 0x50
push 1
push eax
call fcn.005e34ab
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 8
test esi, esi
jne 0x4e038c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0xc
ret
lea ecx, [esp + 0x10]
push ecx
push esi
lea edx, [esp + 0x1c]
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x4e03be
push esi
call fcn.005e0865
add esp, 4
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4e03cd
mov edx, dword [esp + 0x10]
dec edx
mov dword [eax], edx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x4e0670
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4e072f
cmp byte [ebx], 0
je 0x4e072f
mov eax, ebx
lea edx, [eax + 1]
jmp 0x4e0690
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e0690
sub eax, edx
cmp eax, 0x104
ja 0x4e06a9
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebx
ret
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e06b0
push esi
sub eax, edx
push edi
lea esi, [eax + eax + 0x20]
lea eax, [esi + 0x10]
push 1
push eax
call fcn.005e34ab
mov edi, eax
add esp, 8
test edi, edi
jne 0x4e06de
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
ret
cmp byte [ebx], 0x5c
jne 0x4e0704
cmp byte [ebx + 1], 0x5c
jne 0x4e0704
shr esi, 1
lea eax, [ebx + 2]
dec esi
cmp byte [eax], 0x3f
jne 0x4e06fc
push ebx
push 0x628850
jmp 0x4e070d
push eax
push 0x647ee8
jmp 0x4e070d
push ebx
shr esi, 1
push 0x647ed8
dec esi
push esi
push edi
call fcn.005e3c29
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
mov esi, eax
call fcn.005e0865
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
ret
Function at 0x4e0740
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4e080c
cmp word [ebx], 0
je 0x4e080c
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4e0760
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x4e077f
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ebx
ret
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4e0784
sub eax, edx
push esi
sar eax, 1
push edi
lea esi, [eax + eax + 0x20]
lea eax, [esi + 0x10]
push 1
push eax
call fcn.005e34ab
mov edi, eax
add esp, 8
test edi, edi
jne 0x4e07b8
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebx
ret
cmp word [ebx], 0x5c
jne 0x4e07e1
cmp word [ebx + 2], 0x5c
jne 0x4e07e1
shr esi, 1
lea eax, [ebx + 4]
dec esi
cmp word [eax], 0x3f
jne 0x4e07d9
push ebx
push 0x647f28
jmp 0x4e07ea
push eax
push str._UNC_s
jmp 0x4e07ea
push ebx
shr esi, 1
push 0x647f00
dec esi
push esi
push edi
call fcn.005e3c29
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
mov esi, eax
call fcn.005e0865
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
ret
Function at 0x4e0b20
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x228
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
lea eax, [esp + 4]
push eax
push str.EnableDHCP
xor ebx, ebx
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
call fcn.004d5820
test al, al
je 0x4e0b7f
cmp dword [esp + 4], ebx
je 0x4e0b7f
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x228
ret
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
lea ecx, [esp + 0x10]
push ecx
push 9
push ebx
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x4e0c82
push edi
push 0x207
lea edx, [esp + 0x31]
push ebx
push edx
call fcn.005dfd60
add esp, 0xc
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x40]
push edx
push ebx
push eax
xor edi, edi
mov byte [esp + 0x4c], bl
mov dword [esp + 0x3c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4e0c81
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 9
push ebx
lea edx, [esp + 0x38]
push edx
push eax
mov dword [esp + 0x2c], ebx
call ebp
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x4e0c4e
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
push str.EnableDHCP
push eax
mov dword [esp + 0x38], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x10], ebx
jne 0x4e0c81
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x18]
push ebx
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x40]
push ecx
inc edi
push edi
push edx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x3c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4e0bf4
pop edi
mov eax, dword [esp + 0x10]
pop esi
pop ebp
cmp eax, ebx
je 0x4e0c93
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x228]
mov eax, dword [esp + 4]
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x228
ret