joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4918a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1a5b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5203c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x49194c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x49194c
call fcn.0047ead0
mov edi, eax
jmp 0x491a6b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x49196f
call fcn.0047ead0
jmp 0x491a5e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x49198d
call fcn.0047ead0
jmp 0x491a5e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x4919ae
mov edi, 0x8007000e
jmp 0x491a60
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x491aa4
jb 0x4919cc
cmp eax, 0xffffffff
ja 0x491aa4
cmp eax, 0x400
jbe 0x4919e1
push eax
lea ecx, [ebp - 0x418]
call fcn.00490bf0
jmp 0x491a07
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x491a07
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x491a1e
mov edi, 0x8007000e
jmp 0x491a60
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x491a3e
call fcn.0047ead0
jmp 0x491a5e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00491700
mov edi, eax
test esi, esi
je 0x491a6b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x491a84
lea ecx, [ebp - 0x418]
call fcn.00490e90
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00476460
int3
Function at 0x493c10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5203c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x493c44
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x493c44
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x493d3c
push edi
mov edi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x493c63
cmp dx, 0x5c
jne 0x493c65
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x493c57
cmp edi, ebx
je 0x493cb3
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call fcn.004ad230
add esp, 0xc
cmp edi, 0x208
jae 0x493d4c
xor eax, eax
mov word [ebp + edi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.00493c10
add esp, 8
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x493ce0
lea ecx, [ebp - 0x20c]
sub ecx, esi
jmp 0x493cd0
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x493cd0
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x493ce2
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
jmp 0x493d00
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x493d00
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x493d3c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
call fcn.004a946a
int3
Function at 0x4945e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 8], ebx
cmp dword [ebx], 0
jne 0x49478c
cmp dword [ebx + 4], 0xffffffff
jne 0x49478c
push edi
lea edi, [ebx + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x494617
sub ecx, edx
sar ecx, 1
movzx eax, word [ebx + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x494653
cmp eax, 0x2f
je 0x494653
add edi, 0xfffffffe
jmp 0x494640
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x494640
mov eax, dword [0x4f98a0]
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
push esi
cmp edi, 1
jne 0x49467e
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x494699
pop esi
pop edi
mov eax, 0x2000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 2
je 0x494696
cmp edi, 3
je 0x494696
pop esi
pop edi
mov eax, 0x10000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 8]
xor ebx, ebx
xor al, al
mov byte [ebp - 1], al
mov byte [ebp + 0x13], bl
cmp edi, 1
je 0x4946df
cmp edi, 2
jne 0x4946fb
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4946d9
pop esi
pop edi
mov eax, 0x200
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov byte [ebp + 0x13], 1
jmp 0x4946e5
mov ebx, esi
mov byte [ebp + 0x13], 0
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne al
mov byte [ebp - 1], al
push 0x20
call fcn.004a8c07
add esp, 4
mov esi, eax
cmp edi, 1
je 0x494736
cmp edi, 2
je 0x494736
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov word [esi], 0x100
mov byte [esi + 0x10], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0xc], 0
jmp 0x494767
mov al, byte [ebp + 0x13]
mov byte [esi + 0x10], al
mov al, byte [ebp - 1]
mov byte [esi], 1
mov byte [esi + 1], al
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
test al, al
je 0x494767
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0xc], eax
push esi
call fcn.00497ab0
mov ecx, dword [ebp - 8]
add esp, 4
mov dword [ecx], eax
neg eax
pop esi
sbb eax, eax
and eax, 0xfffffe00
pop edi
add eax, 0x200
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x1000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4974a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x4974de
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4974d2
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x4974ef
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.004ad230
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x497510
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x49751e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x4975dd
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4ea730]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4ea730]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4ea730]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4ea730]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4ea730]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4ea730]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4ea730]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4ea730]
sub edi, 1
jne 0x497536
pop edi
test esi, esi
je 0x4975fb
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4ea730]
sub esi, 1
jne 0x4975e1
not eax
pop esi
pop ebp
ret
Function at 0x4978e0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x497a99
cmp dword [edi + 0x18], 0
je 0x497a99
cmp dword [edi + 0x7c], 0
je 0x49790b
push edi
call fcn.00497600
add esp, 4
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push edi
call fcn.00497f50
add esp, 0x10
test eax, eax
je 0x49792e
mov eax, 0xffffff99
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.004b778c
mov esi, eax
add esp, 4
test esi, esi
je 0x497971
push 0x4000
call fcn.004b778c
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x49797c
push esi
call fcn.004b7771
add esp, 4
pop esi
mov eax, 0xffffff98
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x54], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x40], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x4979d8
lea eax, [esi + 4]
mov dword [esi + 0x24], 0
push eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00495a80
add esp, 4
test eax, eax
jne 0x4979d8
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov cl, byte [edi + 0x30]
mov dword [esi + 0x58], eax
and cl, 1
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x30]
shr eax, 3
mov byte [esi + 0x6c], cl
test al, 1
je 0x4979fc
mov al, byte [edi + 0x39]
jmp 0x4979ff
mov al, byte [edi + 0x3f]
mov edx, dword [ebp + 0xc]
mov byte [esi + 0x80], al
movzx eax, cl
neg eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
sbb eax, eax
mov dword [esi + 0x78], 0x34567890
and eax, 0xc
mov dword [esi + 0x7c], eax
test edx, edx
je 0x497a7b
mov edi, edi
mov al, byte [edx]
test al, al
je 0x497a7b
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ea730]
movzx eax, cl
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
mov dword [esi + 0x70], ecx
mov ecx, dword [esi + 0x78]
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ea730]
mov dword [esi + 0x78], ecx
add edx, 1
jne 0x497a30
mov eax, dword [ebp - 8]
add eax, 0x1e
mov dword [edi + 0x7c], esi
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xffffff9a
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4a4880
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4a48cf
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a48cf
cmp esi, dword [ebp + 0x10]
je 0x4a48ca
push 0x4f9904
push 1
push edi
push edi
call fcn.004a3f13
jmp 0x4a48dd
xor eax, eax
inc eax
jmp 0x4a48e2
mov eax, 0x4f9904
push eax
push eax
push edi
push edi
call fcn.004a3f60
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4a5acf
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4a5af9
mov eax, 0x4f9904
push eax
push eax
push 0
push 0
call fcn.004a3f60
add esp, 0x10
xor eax, eax
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret

Function at 0x4a683b
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x4a6d7c
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x4a703b
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x4e27d6
call fcn.004a9972
mov esi, ecx
mov dword [ebp - 0xa0], esi
xor ebx, ebx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
push 0x41
lea eax, [ebp - 0x98]
push eax
call fcn.004a780c
add esp, 0x14
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x98]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x9c], edi
test edi, edi
je 0x4a7187
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4a70b4
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.004a766b
test eax, eax
je 0x4a70e9
mov dword [esi], eax
mov eax, dword [esi]
inc dword [eax + 0x5bc]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x4a7187
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a7187
push 0x5c0
call fcn.004a7346
pop ecx
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4a710c
push edi
mov ecx, eax
call fcn.004a71c8
jmp 0x4a710e
mov eax, ebx
mov byte [ebp - 4], bl
mov dword [esi], eax
test eax, eax
je 0x4a718f
xor ebx, ebx
inc ebx
mov dword [ebp - 0xb0], ebx
push eax
call fcn.004a77ab
pop ecx
test eax, eax
jne 0x4a70c2
mov dword [ebp - 0xa8], 3
push 0x51b934
lea eax, [ebp - 0xa8]
jmp 0x4a71a4
mov eax, esi
call fcn.004a98c4
ret
mov dword [ebp - 0xa4], 1
push 0x51b934
lea eax, [ebp - 0xa4]
push eax
call fcn.004ad98c
int3
Function at 0x4a71c8
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x4e2809
call fcn.004a98d3
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi], 0
lea ecx, [esi + 8]
or dword [esi + 4], 0xffffffff
call fcn.004a700c
and dword [ebp - 4], 0
and dword [esi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4a7214
mov eax, dword [ebp + 8]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004a98a1
ret 4
push 0x51b934
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
call fcn.004ad98c
int3

Function at 0x4a73e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.004a7574
mov edi, eax
test edi, edi
je 0x4a746b
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x4a741b
mov esi, edi
jmp 0x4a7457
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x4a7450
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4a7443
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.004a750f
jmp 0x4a7457
push 0x4ed008
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4a7457
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.004a7574
mov edi, eax
test edi, edi
jne 0x4a7410
test esi, esi
jne 0x4a7480
mov ecx, dword [ebx]
add ecx, 8
call fcn.004a76fc
mov esi, eax
test esi, esi
je 0x4a7480
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4aa4c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x5203c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x4aa6c4
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4aa6c4
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.004ad7b0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2e4]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call esi
test eax, eax
jne 0x4aa699
xor edi, edi
mov dword [ebp - 0x2d8], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4aa688
lea eax, [ebp - 0x2e8]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2e4]
call esi
test eax, eax
jne 0x4aa652
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2e0], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x2e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4aa64a
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.004ad7b0
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004aa6e0
add esp, 0x18
test eax, eax
je 0x4aa64a
cmp byte [ebp - 0x68], 0
je 0x4aa60c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x4aa64a
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x4aa639
mov al, byte [esi + ecx]
test al, al
je 0x4aa639
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4aa620
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e8]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4aa560
push dword [ebp - 0x2e4]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x4aa6c4
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.0048ae10
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
Function at 0x4aa960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5203c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x5292f0]
mov byte [ebp - 0x20d], 0x40
push ebx
mov ebx, dword [ebp + 8]
test ecx, ecx
jne 0x4aaa4d
push 0x208
push ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.004ad7b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0xf5
ja 0x4aaa2e
push esi
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4aa9c6
mov eax, dword [0x4f98a0]
mov dword [edi], eax
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4aa9e2
mov ecx, 6
lea eax, [ebp - 0x20c]
mov esi, str.Netapi32.dll
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
test eax, eax
je 0x4aaa2e
push str.Netbios
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x5292f0]
test eax, eax
cmovne ecx, eax
mov dword [0x5292f0], ecx
jmp 0x4aaa34
mov ecx, dword [0x5292f0]
test ecx, ecx
jne 0x4aaa4d
mov al, byte [ebp - 0x20d]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
push ebx
call ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret

Function at 0x4ab160
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.004a8e60
mov eax, dword [0x5203c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x4ab2c2
cmp dword [ebp + 0xc], 0
je 0x4ab2c2
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.00485bf0
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4ab2a5
push 0x2710
lea eax, [ebp - 0x2bfc]
mov dword [ebp - 0x2c00], 0
push 0
push eax
mov dword [ebp - 0x2c04], 0
mov dword [ebp - 0x2c0c], 0
mov dword [ebp - 0x2c08], 0
call fcn.004ad7b0
add esp, 0xc
lea eax, [ebp - 0x2c00]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c0c]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4ab29a
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.004ad7b0
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.004ac210
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.0048ae10
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x4ab2af
inc esi
cmp esi, 0x10
jl 0x4ab1a0
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret