joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432c30
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49788b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4e3ec8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0xc0], 0
jne 0x432d27
mov eax, dword [esi + 0xe4]
push 0
push 0
push 0x184
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push str.C:WindowsSystem32Driversetchosts
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], 0
call fcn.00479050
add esp, 4
push str.hosts.txt
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc100.dll_Ordinal_1483]
push 0
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x14]
push edx
call fcn.00479050
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov ecx, esi
call fcn.00432520
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4e46c0
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov ecx, esi
call fcn.00432770
mov ecx, esi
call fcn.004324d0
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4335e0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4e3ec8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x3ff
lea eax, [ebp - 0x403]
mov dword [ebp - 0x408], 0
push 0
push eax
mov dword [ebp - 0x408], 0x400
mov byte [ebp - 0x404], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 0x404]
push edx
push 0
call sub.urlmon.dll_ObtainUserAgentString
lea eax, [ebp - 0x404]
push eax
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0048e770
mov esp, ebp
pop ebp
ret
Function at 0x433780
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e179
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4e3ec8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x48]
call dword [sym.imp.mfc100.dll_Ordinal_5207]
test eax, eax
je 0x43380c
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
push eax
push ecx
lea edx, [ebp - 0x10]
push str._s:_d
push edx
mov dword [ebp - 4], 0
call dword [sym.imp.mfc100.dll_Ordinal_4283]
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 3
lea ecx, [esi + 0x38]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
lea ecx, [ebp - 0x10]
mov edi, eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
jmp 0x433826
push 0
push 0
push 0
push 0
lea ecx, [esi + 0x38]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
lea ecx, [esi + 0x50]
call dword [sym.imp.mfc100.dll_Ordinal_5207]
test eax, eax
je 0x433850
lea ecx, [esi + 0x50]
call dword [sym.imp.mfc100.dll_Ordinal_5207]
push eax
lea ecx, [esi + 0x50]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x2b
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
add esi, 0x54
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_5207]
test eax, eax
je 0x43387a
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_5207]
push eax
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x2c
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4356c0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x4e3ec8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x3c
xor ebx, ebx
lea eax, [ebp - 0x6c]
push ebx
push eax
call sub.MSVCR100.dll_memset
add edi, 0x20
add esp, 0xc
mov ecx, edi
call dword [sym.imp.mfc100.dll_Ordinal_5207]
lea ecx, [ebp - 0xd]
push ecx
lea esi, [eax + 8]
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.00435140
lea edx, [ebp - 0xd]
push edx
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call fcn.00435140
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x6c]
push edx
mov dword [ebp - 0x40], ecx
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x6c], 0x3c
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x3c], esi
call dword [sym.imp.mfc100.dll_Ordinal_5207]
push eax
mov ecx, edi
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
push edi
call dword [sym.imp.mfc100.dll_Ordinal_1316]
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp + 0xc]
push esi
call dword [sym.imp.mfc100.dll_Ordinal_1316]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
cmp esi, ebx
je 0x4357a7
push esi
call sub.mfc100.dll_Ordinal_1296
add esp, 4
cmp edi, ebx
je 0x4357b4
push edi
call sub.mfc100.dll_Ordinal_1296
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4359d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xcc]
push edi
test eax, eax
je 0x4359ea
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xcc], 0
cmp dword [esi + 0x60], 4
jne 0x435a01
or dword [esi + 0x40], 0x800000
lea eax, [ebp - 4]
push eax
lea ecx, [esi + 0x10]
call fcn.00433560
mov ecx, dword [esi + 0x40]
mov ebx, dword [esi + 0xc4]
push 0
push ecx
push 0
push 0
push 0
lea ecx, [esi + 0x68]
mov edi, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
mov ecx, edi
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
lea ecx, [ebp - 4]
mov dword [esi + 0xc8], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0
push 0
push esi
push 0x4358c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [esi + 0xd0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497e22
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4e3ec8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
push ebx
lea ecx, [esi + 0x10]
mov dword [esi], vtable.FCHttpRequest.0
call fcn.004346f0
lea ecx, [esi + 0x64]
mov dword [ebp - 4], ebx
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x68]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x74]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x78]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x80], ebx
lea eax, [esi + 0x88]
push eax
mov dword [esi + 0x84], vtable.inner::FCAutoCSec.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x84], vtable.inner::CReceiveBuffer.0
mov dword [esi + 0xb4], 0xf
mov dword [esi + 0xb0], ebx
mov byte [esi + 0xa0], bl
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [esi + 8], ecx
push eax
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 9
mov dword [esi + 0xc], edx
call fcn.00435a70
lea ecx, [esi + 0x60]
push ecx
lea eax, [esi + 0x68]
push eax
lea eax, [esi + 0x64]
push eax
lea ecx, [esi + 0x10]
call fcn.004356c0
mov ecx, esi
call fcn.00433780
push ebx
push ebx
push esi
push 0x433690
push ebx
push ebx
mov dword [esi + 0xc0], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xcc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x44]
mov dword [esi + 0x5c], ebx
cmp eax, ebx
je 0x436970
mov edx, dword [esi + 8]
push ebx
push eax
mov eax, dword [esi + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x438f20
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov dword [esi], vtable.CHttpManager.0
cmp dword [esi + 0x6c], 0x10
jb 0x438f3b
mov eax, dword [esi + 0x58]
push eax
call sub.mfc100.dll_Ordinal_1296
add esp, 4
xor eax, eax
mov dword [esi + 0x6c], 0xf
mov dword [esi + 0x68], eax
lea ecx, [esi + 0x50]
mov byte [esi + 0x58], al
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [esi + 0x4c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [esi + 0x48]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [esi + 0x44]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [esi + 0x40]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, esi
pop esi
jmp fcn.00438b50
Function at 0x45b4f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d921
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x4e3ec8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xe0], 0
push 0x4ae26b
lea ecx, [ebp - 0xdc]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp + 0xc]
push ecx
mov byte [ebp - 4], 1
call fcn.0047a520
lea edx, [ebp - 0xdc]
push edx
mov dword [ebp - 0xe4], eax
lea eax, [ebp - 0xe0]
push 0x4b0cd8
push eax
call fcn.00401a70
add esp, 0x14
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc100.dll_Ordinal_1479]
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0xe4]
push ecx
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
mov edx, dword [ebp - 0xe4]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x45b5e6
mov edx, dword [ebp - 0xe4]
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0xd8]
push ecx
push 0
push edx
mov dword [ebp - 0xe0], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0xd8]
push eax
jmp 0x45b5f8
mov ecx, dword [ebp - 0xe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4ae26b
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0xdc]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e770
mov esp, ebp
pop ebp
ret 8
Function at 0x466500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f419
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4e3ec8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlTerminal_Server
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46660f
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0
push str.fDenyTSConnections
push ecx
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0x3ff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x4ae26b
lea ecx, [ebp - 0x10]
mov edi, eax
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov dword [ebp - 4], 0
test edi, edi
jne 0x4665db
cmp dword [ebp - 0x14], edi
jne 0x4665db
push str.Allowed
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x514
mov ecx, esi
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call sub.mfc100.dll_Ordinal_12868
push edi
push 0x407
mov ecx, esi
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call sub.mfc100.dll_Ordinal_3970
jmp 0x466606
push str.Not_Allowed
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x514
mov ecx, esi
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call sub.mfc100.dll_Ordinal_12868
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x466630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f419
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4e3ec8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x466740
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0
push str.UserAuthentication
push ecx
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0x3ff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x4ae26b
lea ecx, [ebp - 0x10]
mov edi, eax
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov dword [ebp - 4], 0
test edi, edi
jne 0x4666f7
cmp dword [ebp - 0x14], edi
jne 0x4666f7
push str.Less_Secure
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x4a9
mov ecx, esi
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call sub.mfc100.dll_Ordinal_12868
jmp 0x466737
push str.Secure
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x4a9
mov ecx, esi
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call sub.mfc100.dll_Ordinal_12868
push 0
push 0x408
mov ecx, esi
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call sub.mfc100.dll_Ordinal_3970
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x466760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f3eb
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4e3ec8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftTerminal_Server_Client
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4668a0
push str.AuthenticationLevelOverride
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0x3ff
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x20]
push eax
push 0
push str.AuthenticationLevelOverride
push ecx
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x4ae26b
lea ecx, [ebp - 0x10]
mov esi, eax
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 2
test esi, esi
jne 0x46685a
cmp dword [ebp - 0x14], esi
jne 0x46685a
push str.Not_Prompt
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x4b3
mov ecx, edi
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call sub.mfc100.dll_Ordinal_12868
push esi
push 0x444
mov ecx, edi
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call sub.mfc100.dll_Ordinal_3970
jmp 0x466885
push str.Prompt
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x4b3
mov ecx, edi
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call sub.mfc100.dll_Ordinal_12868
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4668c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f419
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4e3ec8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_NTTerminal_Services
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x466996
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0
push str.KeepAliveEnable
push ecx
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0x3ff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x4ae26b
lea ecx, [ebp - 0x10]
mov esi, eax
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov dword [ebp - 4], 0
test esi, esi
jne 0x466962
cmp dword [ebp - 0x14], 1
jne 0x466962
push str.Enabled
jmp 0x466967
push str.Disabled
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x4ae
mov ecx, edi
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call sub.mfc100.dll_Ordinal_12868
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4669c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f419
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4e3ec8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_NTTerminal_Services
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x466a95
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0
push str.fDisableAutoReconnect
push ecx
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0x3ff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x4ae26b
lea ecx, [ebp - 0x10]
mov esi, eax
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov dword [ebp - 4], 0
test esi, esi
jne 0x466a61
cmp dword [ebp - 0x14], esi
jne 0x466a61
push str.Enabled
jmp 0x466a66
push str.Disabled
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x4b0
mov ecx, edi
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call sub.mfc100.dll_Ordinal_12868
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4673f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f548
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4e3ec8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 8]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0xc]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x34]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x38]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x3c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x40]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x44]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x48]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x4c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x50]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x54]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0x4ae26b
mov ecx, esi
mov byte [ebp - 4], 0xc
call dword [sym.imp.mfc100.dll_Ordinal_1316]
or eax, 0xffffffff
push 0x4ae26b
lea ecx, [esi + 4]
mov dword [esi + 0x18], 0
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
call dword [sym.imp.mfc100.dll_Ordinal_1316]
xor ebx, ebx
push 0x4ae26b
lea ecx, [esi + 0x48]
mov dword [esi + 0x30], ebx
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push 0x4ae26b
lea ecx, [esi + 0x4c]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push 0x4ae26b
lea ecx, [esi + 0x50]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push 0x4ae26b
lea ecx, [esi + 0x14]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call dword [sym.imp.mfc100.dll_Ordinal_1316]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret