joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47aebe
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4dc
push edi
push 0x90
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.004eed90
add esp, 0xc
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47aefc
xor eax, eax
jmp 0x47b029
push dword [ebp + 8]
lea eax, [ebp - 0x3d8]
push eax
call fcn.004efe30
lea eax, [ebp - 0x3d8]
push 0x5c
push eax
call fcn.004f1884
add esp, 0x10
test eax, eax
je 0x47af24
and byte [eax + 1], 0
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x3d8]
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.004efe30
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.004efe40
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.0047ad84
add esp, 0x18
test eax, eax
je 0x47b008
push 0x104
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.004eed90
add esp, 0xc
cmp dword [ebp + 0x10], 1
jne 0x47afe2
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004efe30
lea eax, [ebp - 0x194]
push 0x583b50
push eax
call fcn.004efe40
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004efe40
lea eax, [ebp - 0x194]
push 0x588d98
push eax
call fcn.004efe40
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004efe40
add esp, 0x28
jmp 0x47aff7
lea eax, [ebp - 0x10]
push 0x10
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004ef020
add esp, 0xc
lea eax, [ebp - 0x194]
mov ecx, esi
push eax
push dword [esi + 8]
call fcn.005088e3
lea eax, [ebp - 0x2d4]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x47af28
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push 1
pop eax
pop esi
pop edi
leave
ret
Function at 0x49d767
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x53b7d4
call fcn.004eec88
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push 0x5cc
call fcn.0050e17d
xor edi, edi
cmp eax, edi
je 0x49d799
cmp dword [esi + 0x864], edi
je 0x49d799
push edi
mov ecx, eax
call fcn.0050e450
mov eax, dword [esi + 0x528]
push str.CERT
lea ecx, [ebp - 0x10]
mov dword [eax + 0x9e9], 1
call fcn.00509ffe
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [eax - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042e42d
pop ecx
mov ebx, dword [eax]
mov eax, dword [esi + 0x5e0]
push edi
push 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
call fcn.0050a3c0
push eax
push ebx
push 0xb
push dword [ebp - 0x14]
call fcn.004b70ba
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00509f90
mov eax, dword [esi + 0x528]
push dword [eax + 0x9e9]
call fcn.004b6bc2
push dword [esi + 0x1c]
mov edi, eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49d8ca
push 5
push 0x3e9
mov ecx, esi
call fcn.0050e17d
mov ecx, eax
call fcn.0050e450
push 5
push 0x454
mov ecx, esi
call fcn.0050e17d
mov ecx, eax
call fcn.0050e450
test edi, edi
je 0x49d869
push 0x455
mov ecx, esi
call fcn.0050e17d
mov ecx, eax
call fcn.0050e4b9
mov ecx, esi
call fcn.0049da68
jmp 0x49d8ca
mov ecx, esi
call fcn.0049e313
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
cmp eax, dword [esi + 0x1c]
je 0x49d8ca
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 1
call ebx
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, esi
call fcn.0050e4b9
push 0
call ebx
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00509f90
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x49d8e5
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x53b7f0
call fcn.004eec88
sub esp, 0xc
push esi
push edi
mov esi, ecx
push 0x5cc
call fcn.0050e17d
xor edi, edi
cmp eax, edi
je 0x49d917
cmp dword [esi + 0x864], edi
je 0x49d917
push 5
mov ecx, eax
call fcn.0050e450
mov eax, dword [esi + 0x528]
push ebx
push 0x589654
lea ecx, [ebp - 0x10]
mov dword [eax + 0x9e9], edi
call fcn.00509ffe
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [eax - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042e42d
pop ecx
mov ebx, dword [eax]
mov eax, dword [esi + 0x5e0]
push edi
push 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
call fcn.0050a3c0
push eax
push ebx
push 0xb
push dword [ebp - 0x14]
call fcn.004b70ba
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00509f90
mov eax, dword [esi + 0x528]
push dword [eax + 0x9e9]
call fcn.004b6bc2
test eax, eax
je 0x49d9b6
push 0x455
mov ecx, esi
call fcn.0050e17d
mov ecx, eax
call fcn.0050e4b9
push 0
push 1
push 0x28
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, esi
call fcn.0049da68
jmp 0x49da17
mov ecx, esi
call fcn.0049e313
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
cmp eax, dword [esi + 0x1c]
je 0x49da17
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 1
call ebx
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, esi
call fcn.0050e4b9
push 0
call ebx
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp dword [esi + 0x860], 0
push 5
pop edi
pop ebx
jne 0x49da26
xor edi, edi
push edi
push 0x3e9
mov ecx, esi
call fcn.0050e17d
mov ecx, eax
call fcn.0050e450
push edi
push 0x454
mov ecx, esi
call fcn.0050e17d
mov ecx, eax
call fcn.0050e450
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00509f90
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x49fed6
Capabilities:
Delete file

Disassembly:
mov eax, 0x53bb90
call fcn.004eec88
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x534], ebx
je 0x49ffce
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.004ef85f
pop ecx
lea edi, [esi + 0x524]
mov ecx, edi
call fcn.00509f1b
mov dword [ebp - 0x14], 5
call fcn.004ef86c
push 0xa
cdq
pop ecx
idiv ecx
mov ecx, edi
mov al, byte [edx + str.0123456789]
push eax
call fcn.0050a393
dec dword [ebp - 0x14]
jne 0x49ff17
push str.authcode.bmp
lea ecx, [ebp - 0x10]
call fcn.00509ffe
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 4], ebx
call fcn.00509d05
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00509d05
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.004a01ae
push 0x2010
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
push dword [ebp - 0x10]
mov dword [esi + 0x5b8], eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x59758c
push 0x3eb
mov ecx, esi
call fcn.0050e17d
mov ecx, eax
call fcn.0050e326
lea eax, [ebp - 0x28]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x28]
push ebx
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00509f90
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4a7129
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
mov ebx, ecx
push eax
call fcn.00506279
push 0
lea ecx, [ebp - 4]
call fcn.0050628c
mov esi, dword [eax + 0x14]
push 0
lea ecx, [ebp - 4]
add esi, 0x76c
call fcn.0050628c
mov edi, dword [eax + 0x10]
push 0
lea ecx, [ebp - 4]
inc edi
call fcn.0050628c
imul esi, esi, 0x64
add esi, edi
mov eax, dword [eax + 0xc]
imul esi, esi, 0x64
mov edx, dword [ebp + 8]
lea ecx, [ebx + 0xf1]
add eax, esi
test edx, edx
mov dword [ecx], 1
jne 0x4a718a
and dword [ecx], edx
mov edx, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4a7193
mov ecx, eax
mov dword [ebx + 0xc7], ecx
lea ecx, [ebx + 0xcb]
mov dword [ebx + 0xc3], edx
call fcn.004707e2
and dword [ebx + 0xe8], 0
push str.DataDown.Log
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4ae609
Capabilities:
Delete file
Terminate process

Disassembly:
mov eax, 0x53d610
call fcn.004eec88
sub esp, 0x114
push ebx
push esi
push edi
mov edi, 0x80a1
push edi
mov esi, ecx
push 5
call fcn.004afb66
cmp al, 0x59
je 0x4ae83c
push edi
push 0xc
mov ecx, esi
call fcn.004afb66
cmp al, 0x30
je 0x4ae83c
mov eax, dword [0x5927d4]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
mov ecx, esi
mov byte [ebp - 4], 1
push dword [ebp + 8]
call fcn.004ae1a3
mov edi, eax
cmp edi, 5
jne 0x4ae75d
push 0x80b0
lea ecx, [ebp - 0x10]
call fcn.0050f456
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0x80ae
push eax
call fcn.00505f1c
add esp, 0xc
push ebx
push ebx
push dword [ebp - 0x14]
call fcn.00518473
push str.VirusScan.dll
lea ecx, [ebp - 0x1c]
call fcn.00509ffe
mov byte [ebp - 4], 2
call fcn.005245be
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x120]
push 0x104
push ecx
push dword [eax + 0x68]
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x120]
lea ecx, [ebp + 0xc]
push eax
call fcn.00509ffe
push 0x5c
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.00505b61
inc eax
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00505ae9
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.0050a0c9
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00509f90
lea eax, [ebp + 0xc]
push str.VirusScan.new
push eax
lea eax, [ebp + 8]
push eax
call fcn.0050a225
push dword [ebp + 8]
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push ebx
push 4
mov ecx, esi
call fcn.004ae1a3
lea ecx, [ebp + 8]
mov edi, eax
mov byte [ebp - 4], 3
call fcn.00509f90
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.00509f90
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00509f90
mov eax, edi
sub eax, ebx
je 0x4ae7a7
sub eax, 3
je 0x4ae776
dec eax
jne 0x4ae813
push 0x80ad
jmp 0x4ae77b
push 0x80a9
lea ecx, [ebp - 0x10]
call fcn.0050f456
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0x80a8
push eax
call fcn.00505f1c
add esp, 0xc
push ebx
push ebx
push dword [ebp - 0x14]
call fcn.00518473
push ebx
call fcn.004f1a27
push 0x80af
lea ecx, [ebp - 0x10]
call fcn.0050f456
lea eax, [ebp + 8]
push eax
call fcn.00506279
lea eax, [ebp + 0xc]
push str._Y__m__d__H:_M:_S
push eax
lea ecx, [ebp + 8]
call fcn.00506312
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
push ebx
call fcn.0050570e
mov ecx, dword [esi + 0x1c]
cmp ecx, ebx
je 0x4ae7f3
push ebx
push str.error.log
push dword [ebp - 0x10]
call fcn.004438e7
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0x80b1
push eax
call fcn.00505f1c
add esp, 0xc
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00509f90
cmp edi, 3
je 0x4ae797
cmp edi, 4
je 0x4ae797
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00509f90
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00509f90
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4b1d59
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x53db8c
call fcn.004eec88
sub esp, 0x18
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.005245be
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x4b1d98
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
test edi, edi
jne 0x4b1d9d
or eax, 0xffffffff
jmp 0x4b1e18
call fcn.0042e317
test eax, eax
mov dword [ebp - 0x14], eax
jle 0x4b1e0b
mov eax, dword [0x5927d4]
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push edi
call fcn.00510e5c
add esp, 0xc
test eax, eax
je 0x4b1dff
push edi
lea ecx, [ebp - 0x24]
call fcn.00510cab
push dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
push dword [ebp + 8]
call fcn.00510ecb
lea ecx, [ebp - 0x24]
call fcn.00510d48
and byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
mov edi, eax
call fcn.00510d3a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00509f90
mov ecx, dword [ebp - 0x18]
push esi
push dword [ebp + 0xc]
push edi
call fcn.0050ed83
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x4b2cc0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x5983fc]
test eax, eax
jne 0x4b2cd7
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov dword [0x5983fc], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x4b4030
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
cmp esi, 1
mov dword [0x5e6cbc], ebx
jl 0x4b4048
cmp esi, 9
jle 0x4b4055
push str.bad_pack_level
call fcn.004b32f0
add esp, 4
push edi
mov ecx, 0x4000
xor eax, eax
mov edi, 0x5d6c80
rep stosd dword es:[edi], eax
lea eax, [esi + esi*2]
push 0x10000
push 0x5c6c60
lea eax, [esi + eax*4]
mov ecx, dword [eax + 0x58a36c]
mov edx, dword [eax + 0x58a368]
mov dword [0x5b32f4], ecx
mov ecx, dword [eax + 0x58a370]
mov dword [0x5d6c60], edx
mov dword [0x5c6c40], ecx
movzx dx, byte [eax + 0x58a374]
mov eax, dword [esp + 0x1c]
or word [eax], dx
mov dword [0x5b6c24], ebx
mov dword [0x5d6c68], ebx
call fcn.004b2e90
add esp, 8
cmp eax, ebx
mov dword [0x5b3300], eax
pop edi
jne 0x4b40d8
mov dword [0x5b3300], ebx
pop esi
mov dword [0x5b32fc], 1
pop ebx
ret
mov esi, 0x106
mov dword [0x5b32fc], ebx
cmp eax, esi
jae 0x4b40fc
cmp dword [0x5b32fc], ebx
jne 0x4b40fc
call fcn.004b4230
cmp dword [0x5b3300], esi
jb 0x4b40e7
xor ecx, ecx
xor eax, eax
xor edx, edx
and ecx, 0x3ff
mov dl, byte [eax + 0x5c6c60]
and edx, 0x7fff
shl ecx, 5
xor ecx, edx
inc eax
cmp eax, 2
jb 0x4b4100
pop esi
mov dword [0x5b32f8], ecx
pop ebx
ret
Function at 0x4b5c79
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x53dc52
call fcn.004eec88
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x10], ebx
cmp dword [esi], ebx
jne 0x4b5d41
push 8
call fcn.00509cd1
mov edi, eax
pop ecx
mov dword [ebp + 8], edi
cmp edi, ebx
mov dword [ebp - 4], ebx
je 0x4b5cb8
mov ecx, edi
call fcn.005277fd
mov ecx, edi
jmp 0x4b5cba
xor ecx, ecx
or dword [ebp - 4], 0xffffffff
push ebx
push str.HexinSSLCnt.SocksProxy
mov dword [esi], ecx
call fcn.005278a9
test eax, eax
jne 0x4b5d41
push 0xffffffffffffffff
push 4
push 0x14d
call fcn.005184ab
cmp eax, 6
jne 0x4b5d27
lea ecx, [ebp - 0x18]
call fcn.00421b78
push 1
lea ecx, [ebp - 0x18]
pop edi
push 0x166
mov dword [ebp - 4], edi
call fcn.00421c2a
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
neg eax
sbb eax, eax
push edi
and eax, ecx
push ebx
push ebx
mov eax, dword [eax]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00421ba6
mov edi, dword [esi]
or dword [ebp - 0x10], 0xffffffff
cmp edi, ebx
je 0x4b5d3f
mov ecx, edi
call fcn.005278fc
push edi
call fcn.00509cfa
pop ecx
mov dword [esi], ebx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4b8c22
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b8ca2
add esp, 0xc
mov dword [ebp + 8], eax
test eax, eax
jne 0x4b8c3f
pop ebp
ret
push esi
lea ecx, [ebp + 0xc]
push edi
push ecx
lea ecx, [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
push ecx
push 0
push dword [ebp + 0x14]
push eax
call esi
mov edi, eax
test edi, edi
jne 0x4b8c8e
cmp dword [ebp + 0x10], 1
jne 0x4b8c8b
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x10]
push dword [ebp + 0x18]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call esi
mov edi, eax
test edi, edi
jne 0x4b8c8e
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
and byte [eax + ecx], 0
jmp 0x4b8c8e
or edi, 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
pop ebp
ret

Function at 0x4b8d0a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b8ca2
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4b8d62
lea eax, [ebp + 0x10]
push edi
push eax
lea eax, [ebp + 0xc]
push dword [ebp + 0x18]
mov dword [ebp + 0x10], 4
push eax
push 0
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x4b8d50
cmp dword [ebp + 0xc], 4
je 0x4b8d53
or edi, 0xffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
pop ebx
pop ebp
ret
Function at 0x4b9036
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov esi, ecx
push str.RasAPI32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
mov dword [esi + 0x90], eax
je 0x4b915d
push 0x28
push 0
push 0x5b33f8
call fcn.004eed90
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
add esp, 0xc
push str.RasEnumEntriesA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5b33f8], eax
je 0x4b9156
push str.RasGetEntryDialParamsA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5b33fc], eax
je 0x4b9156
push str.RasSetEntryDialParamsA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5b3400], eax
je 0x4b9156
push str.RasDialA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5b3404], eax
je 0x4b9156
push str.RasHangUpA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5b3408], eax
je 0x4b9156
push str.RasGetErrorStringA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5b340c], eax
je 0x4b9156
push str.RasEnumConnectionsA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5b3410], eax
je 0x4b9156
push str.RasGetConnectStatusA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5b3414], eax
je 0x4b9156
push str.RasGetEntryPropertiesA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5b3418], eax
je 0x4b9156
push str.RasSetEntryPropertiesA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5b341c], eax
jne 0x4b9161
mov ecx, esi
call fcn.004b9019
xor eax, eax
jmp 0x4b9164
push 1
pop eax
pop edi
pop esi
ret
Function at 0x4bd9f9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x53e66f
call fcn.004eec88
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [0x5927d4]
lea ecx, [esi + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ecx], edx
mov edx, dword [0x5927d4]
mov dword [esi + 0x10], edx
mov edx, dword [0x5927d4]
mov dword [esi + 0x18], edx
mov edx, dword [0x5927d4]
mov dword [esi + 0x1c], edx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov edx, dword [0x5927d4]
mov dword [esi + 0x68], edx
mov edx, dword [0x5927d4]
mov dword [esi + 0x6c], edx
mov edx, dword [0x5927d4]
mov dword [esi + 0x7c], edx
mov edx, dword [ebp + 0x14]
or dword [esi + 0x14], 0xffffffff
mov dword [esi + 8], edx
mov edx, dword [ebp + 8]
mov dword [esi + 0x20], edx
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x24], edx
mov edx, dword [ebp + 0x10]
push 0x59758c
mov byte [ebp - 4], 9
mov dword [esi], method.CCommandLineInfo.virtual_0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], edx
mov dword [esi + 0x58], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 4], eax
call fcn.0050a119
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x4c3c8c
Capabilities:
Create thread

Disassembly:
mov eax, 0x53f1cc
call fcn.004eec88
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push 0x10
call fcn.00509cd1
test eax, eax
pop ecx
je 0x4c3cbd
mov ecx, dword [0x5927d4]
mov esi, eax
mov dword [eax], ecx
mov ecx, dword [0x5927d4]
mov dword [eax + 4], ecx
jmp 0x4c3cbf
xor esi, esi
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push dword [ebp + 0xc]
call fcn.00509d05
lea eax, [ebp + 0xc]
push eax
call fcn.004c2f25
pop ecx
pop ecx
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 4]
call fcn.0050a0c9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00509f90
mov eax, dword [ebp + 0x10]
add ebx, 0x44
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
push ebx
mov ecx, esi
mov dword [esi + 8], eax
call fcn.0050a0c9
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x4c3d39
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x4c3d29
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc

Function at 0x4c45ed
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x186], edi
je 0x4c4602
xor eax, eax
jmp 0x4c462f
cmp dword [esi + 0x60], edi
jne 0x4c45fe
mov eax, dword [ebp + 8]
mov dword [esi + 0x186], eax
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x4c4635
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [esi + 0x64], eax
mov eax, ecx
pop edi
pop esi
pop ebp
ret 4

Function at 0x4c6a53
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x53f763
call fcn.004eec88
push ecx
mov eax, dword [0x5927d4]
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], eax
xor edi, edi
lea ecx, [esi + 0x34]
push edi
push edi
push edi
mov dword [ebp - 4], edi
call fcn.004e7461
mov ecx, dword [ebp - 0xc]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi + 4], edi
mov dword [esi], 0x551ddc
mov dword [esi + 0x18], 0x2710
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret