joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4068c0
Capabilities:
Read .ini file

Disassembly:
push ecx
test esi, esi
je 0x40691f
test edi, edi
je 0x40691f
xor eax, eax
cmp eax, str.Global
je 0x40691f
mov eax, 0x43b5ac
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4068e0
sub eax, edx
je 0x40691f
mov eax, 0x43b4a8
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4068f5
sub eax, edx
je 0x40691f
mov ecx, dword [esp + 8]
push 0x43b4a8
push ecx
push edi
push 0
push esi
push str.Global
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop ecx
ret 4
or eax, 0xffffffff
pop ecx
ret 4
Function at 0x406ce0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Check mutex on windows
Print debug messages

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.Receive_Message_Nemservice_failed_
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
push 0x12e
push 1
push str.SendMessageToAgent_wParam____d___lParam__d_
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 0xc
cmp dword [0x43b458], 0
je 0x406d23
push str.Ending_session__stop_sending_message_to_agent.
jmp 0x406ea1
cmp dword [0x43af7c], 2
jne 0x406d36
push str.Client_Manager_is_exiting__it_does_not_send__TIMEOUT__message_to_agent.
jmp 0x406ea1
mov eax, dword [0x43ac0c]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x406d87
mov ecx, dword [0x43ac0c]
push 0x12e
push 1
push 0x1080
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov edx, dword [0x43ac0c]
push 0x12e
push 1
push 0x1080
push edx
push str.PostMessage_to_agent_hwnd0x_08x_msg_d_service_d_parm_d
call fcn.00403400
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ebp, eax
xor edi, edi
call ebx
sub eax, ebp
cmp eax, 0x2710
jae 0x406eae
push str.hAgentWnd_is_invalid_refresh_inter_process_info
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x43b7f8]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0040f190
mov ecx, dword [0x43b7f8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [0x43ac0c]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
mov ecx, 0x43b48c
jne 0x406e6e
push str.Post_message_to_agent_failed
call fcn.0040a090
add esp, 4
push str.GlobalSVNIEAgentControl
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x406e27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x406e27
push str.Ocx_or_plugin_do_not_exist_
call fcn.00403400
add esp, 4
cmp edi, 2
je 0x406e9c
push 0x1f4
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
push 0x12e
push 1
mov esi, eax
mov eax, dword [0x43ac0c]
push 0x1080
push eax
push str.PostMessage_to_agent_hwnd0x_08x_msg_d_service_d_parm_d
call fcn.00403400
sub esi, ebp
add esp, 0x14
cmp esi, 0x2710
jb 0x406da2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.IsWindow__TRUE__message_has_sent.
call fcn.0040a090
mov ecx, dword [0x43ac0c]
add esp, 4
push 0x12e
push 1
push 0x1080
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.Ocx_or_plugin_do_not_exist_stop_try_to_post_message_to_agent.
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x406ef0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Check mutex on windows
Print debug messages

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.Receive_Message_Nemservice_Socket_Closed_
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
push 0x12e
push 1
push str.SendMessageToAgent_wParam____d___lParam__d_
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 0xc
cmp dword [0x43b458], 0
je 0x406f33
push str.Ending_session__stop_sending_message_to_agent.
jmp 0x4070b1
cmp dword [0x43af7c], 2
jne 0x406f46
push str.Client_Manager_is_exiting__it_does_not_send__TIMEOUT__message_to_agent.
jmp 0x4070b1
mov eax, dword [0x43ac0c]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x406f97
mov ecx, dword [0x43ac0c]
push 0x12e
push 1
push 0x1080
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov edx, dword [0x43ac0c]
push 0x12e
push 1
push 0x1080
push edx
push str.PostMessage_to_agent_hwnd0x_08x_msg_d_service_d_parm_d
call fcn.00403400
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ebp, eax
xor edi, edi
call ebx
sub eax, ebp
cmp eax, 0x2710
jae 0x4070be
push str.hAgentWnd_is_invalid_refresh_inter_process_info
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x43b7f8]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0040f190
mov ecx, dword [0x43b7f8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [0x43ac0c]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
mov ecx, 0x43b48c
jne 0x40707e
push str.Post_message_to_agent_failed
call fcn.0040a090
add esp, 4
push str.GlobalSVNIEAgentControl
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x407037
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x407037
push str.Ocx_or_plugin_do_not_exist_
call fcn.00403400
add esp, 4
cmp edi, 2
je 0x4070ac
push 0x1f4
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
push 0x12e
push 1
mov esi, eax
mov eax, dword [0x43ac0c]
push 0x1080
push eax
push str.PostMessage_to_agent_hwnd0x_08x_msg_d_service_d_parm_d
call fcn.00403400
sub esi, ebp
add esp, 0x14
cmp esi, 0x2710
jb 0x406fb2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.IsWindow__TRUE__message_has_sent.
call fcn.0040a090
mov ecx, dword [0x43ac0c]
add esp, 4
push 0x12e
push 1
push 0x1080
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.Ocx_or_plugin_do_not_exist_stop_try_to_post_message_to_agent.
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x407bf0
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push edi
xor eax, eax
push 0xf003f
push str.ServicesActive
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x407c37
mov eax, 4
pop edi
add esp, 0x1c
ret
push ebx
push ebp
push esi
push 0xf01ff
push str.NemService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x407c55
xor ebp, ebp
jmp 0x407c7b
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x407c76
xor ecx, ecx
cmp dword [esp + 0x14], 1
setne cl
add ecx, 1
mov ebp, ecx
jmp 0x407c7b
mov ebp, 4
test esi, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x407c88
push esi
call ebx
push edi
call ebx
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x1c
ret
Function at 0x407f60
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push 0xff
lea ecx, [esp + 0x25]
push ebx
push ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x2c], bl
call fcn.00420f50
push 0xff
lea edx, [esp + 0x131]
push ebx
push edx
mov byte [esp + 0x138], bl
call fcn.00420f50
add esp, 0x18
cmp esi, ebx
jne 0x407fd5
xor eax, eax
jmp 0x40810f
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407fce
mov eax, dword [esp + 0x10]
push ebp
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x3c]
push edx
push ebx
mov ebp, 0x100
push eax
mov dword [esp + 0x34], ebp
call edi
cmp eax, 0x103
mov esi, 1
je 0x408108
jmp 0x408030
cmp eax, ebx
jne 0x4080e2
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x34]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4080b8
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x12c]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [esp + 0x2c], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4080a9
cmp dword [esp + 0x1c], 1
jne 0x4080a9
mov edx, dword [esp + 0x24]
push edx
lea eax, [esp + 0x12c]
push eax
call fcn.0041c7f9
add esp, 8
test eax, eax
je 0x4080e6
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x4080ae
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
mov edx, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3c]
push ecx
push esi
push edx
mov dword [esp + 0x34], ebp
call edi
add esi, 1
cmp eax, 0x103
jne 0x408030
jmp 0x408108
xor eax, eax
jmp 0x40810d
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x14], ebx
call esi
mov edx, dword [esp + 0x20]
mov dword [edx], 1
mov eax, 1
pop edi
pop ebp
mov ecx, dword [esp + 0x220]
pop esi
pop ebx
xor ecx, esp
call fcn.0041aec3
add esp, 0x21c
ret 4
Function at 0x408130
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push edi
xor edi, edi
push 0x100
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x20], edi
call fcn.0041ae22
mov ebx, eax
add esp, 4
cmp ebx, edi
mov dword [esp + 0x18], ebx
je 0x408339
push esi
push 0x100
call fcn.0041ae22
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x40818c
push ebx
call fcn.0041b96e
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x18]
push eax
push 0xf003f
push edi
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4081c3
push ebx
call fcn.0041b96e
push esi
call fcn.0041b96e
add esp, 8
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x18]
push ebp
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x28]
push ecx
push esi
push edi
push edx
mov dword [esp + 0x38], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, 1
je 0x40831d
cmp eax, edi
jne 0x40831d
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push eax
push 0x20019
push edi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4082f1
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x20019
push edi
push str.Connection
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4082e6
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push edi
push str.PnpInstanceID
push edx
mov dword [esp + 0x30], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4082db
cmp dword [esp + 0x24], 1
jne 0x4082db
mov eax, dword [esp + 0x20]
push str.ROOTNET
push eax
call fcn.0041c810
add esp, 8
test eax, eax
jne 0x40829d
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], edi
push edx
jmp 0x4082eb
lea eax, [esp + 0x28]
push eax
mov ecx, esi
mov dword [esp + 0x2c], edi
call fcn.00407f60
test eax, eax
je 0x40828b
cmp dword [esp + 0x28], edi
jne 0x40828b
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
mov dword [esp + 0x18], edi
call ebx
mov eax, dword [esp + 0x1c]
push esi
push eax
mov dword [esp + 0x18], edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
jmp 0x4082f1
mov eax, dword [esp + 0x14]
push eax
call ebx
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x10]
push ecx
call ebx
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x1c]
push edi
push edi
push edi
push edi
lea edx, [esp + 0x28]
push edx
push esi
push ebp
push eax
mov dword [esp + 0x38], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
add ebp, 1
cmp eax, 0x103
jne 0x4081f8
mov ecx, dword [esp + 0x1c]
push ecx
call ebx
mov edx, dword [esp + 0x20]
push edx
call fcn.0041b96e
push esi
call fcn.0041b96e
add esp, 8
pop ebp
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret
Function at 0x408350
Capabilities:
Create process on windows
Print debug messages
Query service configuration

Disassembly:
sub esp, 8
push edi
xor eax, eax
xor edi, edi
cmp eax, str.NemService
mov dword [esp + 4], 0
jne 0x40836c
pop edi
add esp, 8
ret
push ebp
push 0xf003f
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x40838c
xor edi, edi
jmp 0x408481
push esi
push 1
push str.NemService
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4083a8
xor edi, edi
jmp 0x408475
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4083cd
xor edi, edi
jmp 0x408474
mov edx, dword [esp + 0x10]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esp + 0x14], eax
je 0x408467
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
push esi
call ebx
test eax, eax
je 0x408463
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call ebx
push ebp
xor esi, esi
call ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
xor ebp, ebp
push ebp
push ebp
push str._unregserver
push ecx
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x408463
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, edi
call fcn.00407bf0
test eax, eax
je 0x408448
push 0x1f4
call ebx
add edi, 1
cmp edi, 0xa
jl 0x408430
cmp edi, 0xa
jne 0x408458
push str.Nemservces_state_is_not_in_SERVICE_STOPPED_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x14]
mov edi, 1
jmp 0x408469
mov eax, dword [esp + 0x14]
xor edi, edi
test eax, eax
je 0x408474
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
test esi, esi
je 0x408480
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
test ebp, ebp
je 0x40848c
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebp
mov eax, edi
pop edi
add esp, 8
ret
Function at 0x408800
Capabilities:
Delete registry key

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x40889c
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push 0xf003f
push eax
push edi
push edx
call esi
test eax, eax
je 0x40885f
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 4]
push edi
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
test eax, eax
jne 0x408895
mov eax, dword [esp + 4]
push eax
call esi
mov eax, 1
pop esi
add esp, 8
ret
mov ecx, dword [esp + 4]
push ecx
call esi
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x408fc0
Capabilities:
Check mutex on windows

Disassembly:
push ecx
push esi
push str.GlobalSVNOperateDriveMutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [0x43ada8], eax
jne 0x408ffa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_mutex_while_install_driver._May_be_out_of_memory.__errorcode___d_
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 8
xor eax, eax
pop esi
pop ecx
ret 0xc
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00408a60
mov edx, dword [0x43ada8]
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x43ada8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov dword [0x43ada8], 0
pop esi
pop ecx
ret 0xc
Function at 0x409580
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push ebx
push ebp
xor ebp, ebp
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], ebp
jne 0x4095a9
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
push edi
push 0x100
call fcn.0041ae22
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x4095c6
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
push esi
push 0x100
call fcn.0041ae22
mov esi, eax
add esp, 4
cmp esi, ebp
jne 0x4095ed
push edi
call fcn.0041b96e
add esp, 4
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebp
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x409625
push edi
call fcn.0041b96e
push esi
call fcn.0041b96e
add esp, 8
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
call ebx
test eax, eax
je 0x40966e
push edi
call fcn.0041b96e
push esi
call fcn.0041b96e
mov ecx, dword [esp + 0x18]
add esp, 8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.Connection
push ecx
call ebx
test eax, eax
je 0x4096c2
push edi
call fcn.0041b96e
push esi
call fcn.0041b96e
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
push edx
call esi
mov eax, dword [esp + 0x1c]
push eax
mov dword [esp + 0x14], ebp
call esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push ebp
push str.MediaSubType
mov edi, 1
push edx
mov dword [esp + 0x30], edi
call esi
mov eax, dword [esp + 0x14]
push 0xc
push str.SVN_Adapter
push edi
push ebp
push str.Name
push eax
call esi
mov ecx, dword [esp + 0x14]
push 0xe
push str.ROOTNET0000
push edi
push ebp
push str.PnpInstanceID
push ecx
call esi
mov eax, dword [esp + 0x14]
push 4
lea edx, [esp + 0x1c]
push edx
push 4
push ebp
push str.ShowIcon
push eax
mov dword [esp + 0x30], edi
call esi
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x40b050
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
cmp eax, ecx
push esi
je 0x40b0c5
cmp edi, ecx
je 0x40b0c5
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0040a7d0
lea esi, [esp + 8]
mov ecx, edi
call fcn.0040a890
mov eax, 1
pop esi
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0041aec3
add esp, 0x68
ret 8
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0041aec3
add esp, 0x68
ret 8
Function at 0x40c190
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
cmp eax, 2
push esi
push edi
jne 0x40c1a1
push str.EVENT_EXIT_PFM_INSTALL_LOCAL_DNS_SERVER_THREAD
jmp 0x40c1ab
cmp eax, 4
jne 0x40c1bd
push str.EVENT_EXIT_WLM_INSTALL_LOCAL_DNS_SERVER_THREAD
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
test esi, esi
jne 0x40c1c7
push str.Failed_to_create_event_g_hEventInstallLocalDNS
jmp 0x40c259
lea eax, [esp + 8]
push eax
push 0
push 0x40c090
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], esi
call fcn.0041d401
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40c24d
push str.Before_wait_install_dns_server_thread_exit...
push 0
mov ecx, 0x43b48c
call fcn.0040a450
add esp, 8
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.after_wait_install_dns_server_thread_exit.
push 0
mov ecx, 0x43b48c
call fcn.0040a450
add esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
cmp dword [0x4390dc], 0
jne 0x40c242
push str.FAILED_TO_RESTART_DNS_CACHE
jmp 0x40c259
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.failed_to_create_thread:_MakeSureLocalDNSServerInstall
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret