joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x41006c]
push eax
push ecx
push 0x40e438
push 0x40f6c0
call fcn.00404854
add esp, 0x10
call fcn.00401030
mov eax, dword [esp + 8]
test eax, eax
je 0x4012f7
call sub.WSOCK32.dll_WSACleanup
push 1
call fcn.0040496c
ret

Function at 0x401300
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x41008c]
test eax, eax
jne 0x401319
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x41008c], eax
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x401340
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, 0x200
call fcn.00401300
mov eax, dword [0x40e03c]
mov esi, dword [esp + 0x20]
push 0
dec eax
push 1
push 2
mov dword [esi], eax
mov word [esp + 0x18], 2
mov dword [esp + 0x1c], 0
call sub.WSOCK32.dll_socket
mov edi, eax
test edi, edi
jl 0x4013c5
mov cx, word [esi]
push ecx
call sub.WSOCK32.dll_htons
lea edx, [esp + 0xc]
push 0x10
push edx
push edi
mov word [esp + 0x1a], ax
call sub.WSOCK32.dll_bind
test eax, eax
je 0x4013d4
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2740
jne 0x4013bf
cmp dword [esi], 0x200
jne 0x4013b5
mov dword [esi], 0x400
mov ecx, dword [esi]
dec ebx
dec ecx
test ebx, ebx
mov dword [esi], ecx
jne 0x40137c
push edi
call sub.WSOCK32.dll_closesocket
call fcn.00401330
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret
mov eax, dword [esi]
mov dword [0x40e03c], eax
call fcn.00401330
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x4013f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x40e464
xor edi, edi
call fcn.00401000
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
add esp, 4
push edi
push ebp
push ebx
push eax
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
je 0x401470
mov eax, dword [0x41007c]
test eax, eax
je 0x401442
mov ecx, dword [0x41006c]
push esi
push ecx
push 0x40e44c
push 0x40f6c0
call fcn.00404854
add esp, 0x10
add edi, esi
test esi, esi
je 0x401477
cmp edi, ebp
jge 0x401477
mov al, byte [edi + ebx - 1]
test al, al
je 0x401477
mov ecx, dword [esp + 0x14]
mov edx, ebp
sub edx, edi
push 0
lea eax, [edi + ebx]
push edx
push eax
push ecx
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
jne 0x40141f
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
test edi, edi
jne 0x40147e
mov byte [ebx], 0
mov byte [edi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401490
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x1000
call fcn.00404b30
mov eax, dword [esp + 0x1004]
push ebp
push 0x40e4ac
push eax
call fcn.00404b0e
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4014cc
push eax
push 0x40e48c
call fcn.004012c0
add esp, 8
pop ebp
add esp, 0x1000
ret
mov al, byte [ebp + 0xc]
push esi
test al, 0x10
push edi
jne 0x40153f
push ebp
lea ecx, [esp + 0x10]
push 0x1000
push ecx
mov byte [esp + 0x18], 0
call fcn.00404a97
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
je 0x401517
push eax
mov eax, dword [esp + 0x1018]
lea edx, [esp + 0x10]
push esi
push edx
push eax
call sub.WSOCK32.dll_send
cmp eax, esi
jl 0x401530
test byte [ebp + 0xc], 0x10
je 0x4014d5
push ebp
call fcn.00404a41
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0x1000
ret
push 0
push 0x40e474
call fcn.004012c0
add esp, 8
push ebp
call fcn.00404a41
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0x1000
ret
Function at 0x401a30
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push 0x40e558
call fcn.00401000
add esp, 4
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x401a65
push 1
push 0x40e530
call fcn.004012c0
add esp, 8
mov ax, word [esp]
cmp al, 1
jne 0x401a76
xor ecx, ecx
mov cl, ah
cmp cl, al
je 0x401a85
push 1
push 0x40e530
call fcn.004012c0
add esp, 8
add esp, 0x190
ret

Function at 0x401a90
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
push edi
push eax
mov dword [esi], 0xffffffff
call fcn.00404f60
mov edi, eax
add esp, 4
test di, di
jne 0x401acd
push 0
push 0x40e6b4
call fcn.004012c0
add esp, 8
mov eax, 1
pop edi
pop esi
add esp, 0x10
ret
mov eax, dword [0x41007c]
test eax, eax
je 0x401af8
mov edx, dword [0x41006c]
mov ecx, edi
and ecx, 0xffff
push ecx
push edx
push 0x40e698
push 0x40f6c0
call fcn.00404854
add esp, 0x10
cmp di, 0x200
jb 0x401c62
cmp di, 0x3ff
ja 0x401c62
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
lea ecx, [esp + 8]
push eax
push ecx
push edx
mov dword [esp + 0x30], 0x10
call sub.WSOCK32.dll_getpeername
test eax, eax
je 0x401b45
push 0
push 0x40e670
call fcn.004012c0
mov eax, dword [esi]
add esp, 8
push eax
jmp 0x401c4c
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0x3ff
push ecx
call fcn.00401340
add esp, 4
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x401b7b
push 0
push 0x40e650
call fcn.004012c0
add esp, 8
mov eax, 1
pop edi
pop esi
add esp, 0x10
ret
mov eax, dword [0x41007c]
test eax, eax
je 0x401ba1
mov edx, dword [esp + 0x20]
mov eax, dword [0x41006c]
push edx
push eax
push 0x40e630
push 0x40f6c0
call fcn.00404854
add esp, 0x10
push 0x40e608
call fcn.00401000
mov ecx, dword [esi]
add esp, 4
push 4
push 0x40e038
push 8
push 0xffff
push ecx
call sub.WSOCK32.dll_setsockopt
test eax, eax
jge 0x401bd7
push 0
push 0x40e5ec
call fcn.004012c0
add esp, 8
push 4
mov word [0x410044], 0
mov word [0x410046], 0x3c
mov edx, dword [esi]
push 0x410044
push 0x80
push 0xffff
push edx
call sub.WSOCK32.dll_setsockopt
test eax, eax
jge 0x401c15
push 0
push 0x40e5d4
call fcn.004012c0
add esp, 8
push edi
mov word [esp + 0xc], 2
call sub.WSOCK32.dll_htons
mov ecx, dword [esi]
mov word [esp + 0xa], ax
lea eax, [esp + 8]
push 0x10
push eax
push ecx
call sub.WSOCK32.dll_connect
test eax, eax
je 0x401c57
push 0
push 0x40e5a8
call fcn.004012c0
mov edx, dword [esi]
add esp, 8
push edx
call sub.WSOCK32.dll_closesocket
mov dword [esi], 0xffffffff
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret
push 1
push 0x40e578
call fcn.004012c0
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret
Function at 0x402390
Capabilities:
Create thread

Disassembly:
sub esp, 8
push 0x402340
call sub.WSOCK32.dll_WSASetBlockingHook
push 0x40eb98
call fcn.00401000
mov eax, dword [0x410020]
add esp, 4
push 5
push eax
call sub.WSOCK32.dll_listen
test eax, eax
je 0x4023d6
mov ecx, dword [0x410020]
push ecx
call sub.WSOCK32.dll_closesocket
push 1
push 0x40eb68
call fcn.004012c0
add esp, 8
push ebx
push esi
push edi
push 0x40eb4c
call fcn.00401000
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 4
push 0x40eb34
call fcn.00401000
mov eax, dword [0x410020]
add esp, 4
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x10
push edx
push 0x410028
push eax
call sub.WSOCK32.dll_accept
mov edi, eax
mov eax, dword [0x40e030]
test eax, eax
je 0x4024bb
cmp edi, 0xffffffff
jne 0x40243b
push 0
push 0x40eb08
call fcn.004012c0
add esp, 8
jmp 0x4023ec
mov ecx, dword [0x41006c]
push 0x40eaf4
inc ecx
mov dword [0x41006c], ecx
call fcn.00401000
push 4
call fcn.00404f76
mov esi, eax
add esp, 8
test esi, esi
jne 0x402475
push eax
push 0x40eae4
call fcn.004012c0
add esp, 8
jmp 0x4023ec
push 0x40eac8
mov dword [esi], edi
call fcn.00401000
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push 0
push esi
push 0x402240
push 0
push 0
call ebx
test eax, eax
jne 0x4024af
push 1
push 0x40eaa8
call fcn.004012c0
add esp, 8
jmp 0x4023ec
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4023ec
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x402af0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x18]
push ebx
push 1
push edi
push ebp
mov byte [edi], bl
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
je 0x402b7d
mov eax, dword [0x41007c]
test eax, eax
je 0x402b57
test esi, esi
jne 0x402b39
mov eax, dword [0x41006c]
push esi
push eax
push 0x40ef98
push 0x40f6c0
call fcn.00404854
add esp, 0x10
jmp 0x402b57
movsx ecx, byte [edi]
mov edx, dword [0x41006c]
push ecx
push esi
push edx
push 0x40ef74
push 0x40f6c0
call fcn.00404854
add esp, 0x14
mov al, byte [edi]
mov ecx, dword [esp + 0x1c]
inc ebx
inc edi
cmp ebx, ecx
jg 0x402b93
cmp al, 0xa
je 0x402ba5
test al, al
je 0x402ba5
push 0
push 1
push edi
push ebp
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
jne 0x402b11
push 0
push 0x40e9b4
call fcn.004012c0
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x2738
call sub.WSOCK32.dll_WSASetLastError
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret
Function at 0x403780
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x40e464
xor edi, edi
call fcn.00401000
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
add esp, 4
push edi
push ebx
push ebp
push eax
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
je 0x4037f8
mov eax, dword [0x41007c]
test eax, eax
je 0x4037d2
mov ecx, dword [0x41006c]
push esi
push ecx
push 0x40f210
push 0x40f6c0
call fcn.00404854
add esp, 0x10
add edi, esi
test esi, esi
je 0x4037ff
cmp edi, ebx
jge 0x4037ff
mov ecx, dword [esp + 0x14]
mov edx, ebx
sub edx, edi
push 0
lea eax, [edi + ebp]
push edx
push eax
push ecx
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
jne 0x4037af
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
test edi, edi
jne 0x403807
mov byte [ebp], 0
mov byte [edi + ebp], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x404370
Capabilities:
Access the windows event log

Disassembly:
mov eax, dword [0x4102bc]
sub esp, 0x108
test eax, eax
push esi
jne 0x4043ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x40f52c
push 0
mov dword [0x4102b8], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
mov eax, dword [0x4102b8]
push eax
push 0x40f52c
lea ecx, [esp + 0x14]
push 0x40f548
push ecx
call fcn.00404e06
mov eax, dword [esp + 0x120]
add esp, 0x10
lea edx, [esp + 0xc]
mov dword [esp + 8], eax
test esi, esi
mov dword [esp + 4], edx
je 0x4043ef
lea ecx, [esp + 4]
push 0
push ecx
push 0
push 2
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
add esp, 0x108
ret

Function at 0x404400
Capabilities:
Access the windows event log

Disassembly:
push ecx
mov eax, dword [0x4102bc]
push esi
test eax, eax
jne 0x404447
push 0x40f52c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
mov eax, dword [esp + 0xc]
test esi, esi
mov dword [esp + 4], eax
je 0x404447
lea ecx, [esp + 4]
push 0
push ecx
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
pop ecx
ret

Function at 0x404450
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x200
lea eax, [esp]
push edi
push 0x200
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404497
push 0x100
push 0x410198
call fcn.00404740
push eax
push 0x40f5bc
push 0x40f5a0
call fcn.0040510b
add esp, 0x14
pop edi
add esp, 0x200
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x404538
push ebx
push esi
push 0
push 0
push 0x4102c0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
push 1
push 2
push 0x10
push 0xf01ff
push 0x40f5bc
push 0x40f52c
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x40450e
push 0x40f5bc
push 0x40f590
call fcn.0040510b
add esp, 8
push esi
call ebx
push edi
call ebx
pop esi
pop ebx
pop edi
add esp, 0x200
ret
push 0x100
push 0x410198
call fcn.00404740
push eax
push 0x40f574
call fcn.0040510b
add esp, 0x10
push edi
call ebx
pop esi
pop ebx
pop edi
add esp, 0x200
ret
push 0x100
push 0x410198
call fcn.00404740
push eax
push 0x40f558
call fcn.0040510b
add esp, 0x10
pop edi
add esp, 0x200
ret
Function at 0x404560
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x4046b0
push esi
push 0xf01ff
push 0x40f52c
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x404689
push 0x410298
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40462d
push ebx
push edi
push 0x40f5bc
push 0x40f640
call fcn.0040510b
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x410298
push esi
call ebx
test eax, eax
je 0x404608
cmp dword [0x41029c], 3
jne 0x404608
push 0x40efc4
call fcn.0040510b
add esp, 4
push 0x3e8
call edi
push 0x410298
push esi
call ebx
test eax, eax
jne 0x4045df
mov eax, dword [0x41029c]
pop edi
pop ebx
cmp eax, 1
push 0x40f5bc
jne 0x404620
push 0x40f630
jmp 0x404625
push 0x40f618
call fcn.0040510b
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x40465b
push 0x40f5bc
push 0x40f608
call fcn.0040510b
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
ret
push 0x100
push 0x410198
call fcn.00404740
push eax
push 0x40f5ec
call fcn.0040510b
add esp, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
ret
push 0x100
push 0x410198
call fcn.00404740
push eax
push 0x40f5d0
call fcn.0040510b
add esp, 0x10
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
ret
push 0x100
push 0x410198
call fcn.00404740
push eax
push 0x40f558
call fcn.0040510b
add esp, 0x10
pop ebp
ret

Function at 0x405c9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405cbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00408bbc
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x405cde
test byte [esp + 8], 2
je 0x405cde
mov dword [0x4102c8], 0xd
mov dword [0x4102cc], 5
jmp 0x405cb9
xor eax, eax
ret
Function at 0x409ca5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40fd58
cmp edx, dword [eax]
je 0x409cc7
add eax, 8
inc ecx
cmp eax, 0x40fde8
jl 0x409cb8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40fd58]
jne 0x409df5
mov eax, dword [0x410340]
cmp eax, 1
je 0x409dcf
test eax, eax
jne 0x409cf8
cmp dword [0x40f904], 1
je 0x409dcf
cmp edx, 0xfc
je 0x409df5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x409d2f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407390
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00407500
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x409d72
lea eax, [ebp - 0x1a4]
push eax
call fcn.00407500
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40d588
push edi
call fcn.00404f90
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407390
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004073a0
lea eax, [ebp - 0xa0]
push 0x40d568
push eax
call fcn.004073a0
push dword [esi + 0x40fd5c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004073a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040c0e5
add esp, 0x2c
pop edi
jmp 0x409df5
lea eax, [ebp + 8]
lea esi, [esi + 0x40fd5c]
push 0
push eax
push dword [esi]
call fcn.00407500
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100410f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x1001298
push 0x80000002
mov dword [ebp - 8], 0x78
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004171
push esi
lea eax, [ebp - 8]
push eax
mov esi, 0x101ef40
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1001288
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x3c
push esi
push 0x101efc0
call fcn.01004e25
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
call fcn.01004ac9
leave
ret

Function at 0x10041c2
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
je 0x100422e
cmp dword [ebp + 0xc], ebx
je 0x100422e
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x100422e
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push edi
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call sub.MPR.dll_WNetAddConnection2A
cmp eax, ebx
je 0x1004242
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, ebx
je 0x100422b
cmp byte [edi], bl
jne 0x100422b
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push ebx
push eax
call sub.MPR.dll_WNetAddConnection2A
cmp eax, ebx
je 0x100422b
call esi
pop esi
jmp 0x1004242
push 0x100131c
push 0x8f
call fcn.01004e8d
pop ecx
pop ecx
or eax, 0xffffffff
pop edi
pop ebx
leave
ret 0xc
Function at 0x100ca35
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
mov byte [ebp - 4], bl
lea edi, [ebp - 3]
stosw word es:[edi], ax
mov eax, dword [0x7ffe02d0]
shr eax, 8
not al
test al, 1
je 0x100cac8
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push 0x1002060
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ca9e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x100204c
push dword [ebp - 0xc]
mov dword [ebp - 8], 3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsx eax, byte [ebp - 4]
push eax
call fcn.01010a76
test eax, eax
pop ecx
jne 0x100cab1
mov byte [ebp - 4], 0x43
movsx eax, byte [ebp - 4]
push eax
mov dword [ebp - 0x18], 0x5c3a41
call fcn.010108e3
pop ecx
sub eax, 0x41
jmp 0x100cad2
push 2
mov dword [ebp - 0x18], 0x5c3a41
pop eax
cmp eax, 0x1a
mov dword [ebp - 8], eax
mov ebx, eax
jge 0x100cb09
mov al, bl
add al, 0x41
mov byte [ebp - 0x18], al
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
cmp esi, 4
jne 0x100cafe
push ebx
call fcn.0100c9a9
test eax, eax
jne 0x100cb13
cmp esi, 1
je 0x100cb13
inc ebx
cmp ebx, 0x1a
jl 0x100cadc
push 0xf
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebp + 8]
inc ebx
mov word [eax], bx
xor eax, eax
jmp 0x100cb0c

Function at 0x100cb1e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov al, byte [ebp + 8]
add al, 0x41
mov dword [ebp - 0xc], 0x5c3a41
mov byte [ebp - 0xc], al
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x100cb5d
movzx eax, word [ebp + 8]
push eax
mov esi, 0x2000
call fcn.0100c9a9
test eax, eax
je 0x100cb6d
mov esi, 0xa000
jmp 0x100cb6d
dec eax
neg eax
sbb eax, eax
mov ecx, 0x800
and eax, ecx
add eax, ecx
mov esi, eax
mov ax, si
pop esi
leave
ret 4
Function at 0x100f198
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x18
push 0x10022c8
call fcn.0101216c
mov edi, 0x94
mov eax, edi
call fcn.010105e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x101d778], ecx
mov eax, dword [esi + 4]
mov dword [0x101d784], eax
mov edx, dword [esi + 8]
mov dword [0x101d788], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x101d77c], esi
cmp ecx, 2
je 0x100f1f8
or esi, 0x8000
mov dword [0x101d77c], esi
shl eax, 8
add eax, edx
mov dword [0x101d780], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x100f231
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100f231
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100f249
cmp eax, 0x20b
je 0x100f236
mov dword [ebp - 0x1c], edi
jmp 0x100f25d
cmp dword [ecx + 0x84], 0xe
jbe 0x100f231
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x100f257
cmp dword [ecx + 0x74], 0xe
jbe 0x100f231
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push edi
call fcn.01012119
pop ecx
test eax, eax
jne 0x100f289
cmp dword [0x101d75c], 2
je 0x100f276
call fcn.01011996
push 0x1c
call fcn.010117cd
push 0xff
call fcn.0100fc6c
pop ecx
pop ecx
mov dword [ebp - 4], edi
call fcn.01011f54
test eax, eax
jge 0x100f29d
push 0x1b
call fcn.0100f173
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10203b8], eax
call fcn.01011e2e
mov dword [0x101d754], eax
call fcn.01011d8c
test eax, eax
jge 0x100f2c3
push 8
call fcn.0100f173
pop ecx
call fcn.01011b40
test eax, eax
jge 0x100f2d4
push 9
call fcn.0100f173
pop ecx
call fcn.0100fc9c
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x100f2e7
push eax
call fcn.0100f173
pop ecx
mov eax, dword [0x101d798]
mov dword [0x101d79c], eax
push eax
push dword [0x101d790]
push dword [0x101d78c]
call fcn.010040a0
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x1c], edi
jne 0x100f316
push esi
call fcn.0100fdab
call fcn.0100fdcd
jmp 0x100f348
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.010121a5
ret