joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4435c8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x4435e4
cmp dword [esi + 4], 0
je 0x443611
test byte [ebx + 0x45], 1
jne 0x443603
mov eax, ebx
call fcn.004423ac
test eax, eax
jne 0x443603
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x443721
mov edx, esi
mov eax, ebx
call fcn.004430ec
jmp 0x443721
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44371a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004455d0
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00440310
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004435c8
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004455d0
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443721
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44bb6c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404008
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x44bb85
test al, 0x10
jne 0x44bb89
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x44be44
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
push eax
mov eax, dword [eax]
mov esi, edx
or ecx, ecx
je 0x44be68
mov edx, eax
shl edx, 8
mov bl, byte [esi]
shr eax, 0x18
xor al, bl
mov eax, dword [eax*4 + 0x4b8b58]
xor eax, edx
inc esi
dec ecx
jne 0x44be4f
mov ecx, eax
pop eax
mov dword [eax], ecx
pop ebx
pop esi
ret
Function at 0x44d33c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
mov eax, dword [ebx + 0x6c]
sub edi, eax
mov edx, dword [ebx + 0x64]
sub edi, edx
test edi, edi
jne 0x44d36c
mov ecx, dword [ebx + 0x64]
test ecx, ecx
jne 0x44d36c
mov eax, dword [ebx + 0x6c]
test eax, eax
jne 0x44d36c
mov edi, esi
jmp 0x44d400
cmp edi, 0xffffffff
jne 0x44d377
dec edi
jmp 0x44d400
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
mov edx, dword [ebx + 0x64]
cmp eax, edx
ja 0x44d400
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0044c414
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
mov ecx, dword [ebx + 0x3c]
add edx, ecx
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
mov ecx, dword [esp]
cmp esi, ecx
ja 0x44d3ca
mov cx, word [esp]
sub cx, si
jmp 0x44d3cc
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x44d3b1
mov eax, esi
mov edx, eax
add edx, edx
mov ecx, dword [ebx + 0x38]
add edx, ecx
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
mov ecx, dword [esp]
cmp esi, ecx
ja 0x44d3f6
mov cx, word [esp]
sub cx, si
jmp 0x44d3f8
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x44d3dd
add edi, esi
mov ebp, dword [ebx]
mov eax, dword [ebp + 4]
test eax, eax
je 0x44d468
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
add edx, ecx
mov eax, dword [ebx + 0x6c]
add edx, eax
mov ecx, edi
mov eax, ebp
call fcn.0044d0cc
add dword [ebx + 0x6c], eax
mov edx, dword [ebx + 0x6c]
cmp edx, 3
jb 0x44d451
mov ecx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x64]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
mov edx, dword [ebx + 0x4c]
and eax, edx
mov dword [ebx + 0x40], eax
mov eax, dword [ebx + 0x6c]
cmp eax, 0x106
jae 0x44d468
mov ecx, dword [ebx]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x44d346
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x452e48
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403ff8
mov eax, dword [ebp - 8]
call fcn.00403ff8
xor eax, eax
push ebp
push 0x453041
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00452e3c
test al, al
je 0x452eab
push dword [ebp - 4]
push 0x45305c
push dword [ebp - 8]
mov eax, ebx
mov edx, 3
call fcn.00403f04
jmp 0x453019
push 0xa
push 0x453060
mov eax, dword [0x4bd4dc]
push eax
call sub.kernel32.dll_FindResourceA
mov esi, eax
push esi
mov eax, dword [0x4bd4dc]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_LockResource
mov edi, eax
push esi
mov eax, dword [0x4bd4dc]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.00402784
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, edi
mov ecx, dword [ebp - 0x14]
call fcn.004028a8
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeResource
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 0x18]
mov edx, eax
add edx, 0xf8
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x34], edx
mov edx, dword [eax + 0x50]
cmp edx, dword [ebp + 0xc]
jae 0x452f43
mov ecx, dword [ebp + 0xc]
sub ecx, edx
mov edx, ecx
add dword [eax + 0x50], edx
movzx eax, word [eax + 6]
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 0x1c]
add dword [ecx + eax*8 - 0x20], edx
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00403c18
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebx]
call fcn.00403e44
mov ecx, eax
sub ecx, 4
mov eax, dword [ebx]
mov edx, 1
call fcn.0040404c
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, 0x453074
call fcn.00403e90
xor esi, esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebx]
call fcn.00404008
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
test edi, edi
jge 0x452fe2
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebx]
call fcn.00403e44
mov ecx, eax
sub ecx, 3
mov eax, dword [ebx]
mov edx, 1
call fcn.0040404c
push dword [ebp - 0x24]
push 0x453084
lea eax, [ebp - 0x28]
mov edx, esi
add dl, 0x30
call fcn.00403d6c
push dword [ebp - 0x28]
mov eax, ebx
mov edx, 3
call fcn.00403f04
inc esi
jmp 0x452ffe
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push edi
call sub.kernel32.dll_WriteFile_1
push edi
call sub.kernel32.dll_CloseHandle_1
jmp 0x453007
cmp esi, 0xa
jb 0x452f7a
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00403e4c
mov eax, dword [ebp - 0x18]
call fcn.0040279c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453048
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00403be8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403be8
ret
Function at 0x453174
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ff8
xor eax, eax
push ebp
push 0x453276
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402b84
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.00402b84
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404008
push eax
push 0
call sub.kernel32.dll_CreateProcessA
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
je 0x453260
mov eax, dword [ebp - 0x5c]
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x54]
mov dword [eax], edx
mov dword [edi], 0x10007
push edi
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetThreadContext
lea eax, [ebp - 8]
push eax
push 4
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadProcessMemory
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
jmp 0x453243
cmp dword [ebp - 0x68], 0x10000
je 0x453256
add edi, dword [ebp - 0x6c]
push 0x1c
lea eax, [ebp - 0x78]
push eax
push edi
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x453237
mov eax, dword [ebp + 0xc]
sub edi, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45327d
lea eax, [ebp - 4]
call fcn.00403bc4
ret
Function at 0x454bb4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402b84
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x4bce6c]
cmp byte [edx + 8], 0
je 0x454c18
mov edx, dword [0x4bce5c]
cmp dword [edx], 2
jne 0x454c18
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret

Function at 0x454c1c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x454cd4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00454bb4
test al, al
je 0x454cb6
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403cac
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x454cb6
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404008
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00404008
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403d7c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x454c6f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454cdb
lea eax, [ebp - 0x2c]
call fcn.00403bc4
lea eax, [ebp - 0xc]
call fcn.00403bc4
ret

Function at 0x454f08
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.004548f4
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404008
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x454f66
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4bcb18]
mov dl, 1
mov eax, dword [0x4547ec]
call fcn.0040b798
call fcn.004035f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x454f70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404008
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x454fc8
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4bce7c]
mov dl, 1
mov eax, dword [0x4547ec]
call fcn.0040b798
call fcn.004035f4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0045493c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x455b58
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
and ax, 0xffff
cmp ax, 0xffff
jne 0x455b87
mov eax, esi
call fcn.00404360
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x455b87
push 0x20
push edi
call sub.kernel32.dll_SetFileAttributesW
push ebx
mov ecx, esi
mov dl, 1
mov eax, dword [0x44bf68]
call fcn.0044c0d0
cmp dword [eax + 8], 0xffffffff
jne 0x455ba3
call fcn.00402e9c
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x457374
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov ebp, edx
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dl, 1
mov eax, dword [0x40ed14]
call fcn.00402e6c
mov esi, eax
push esi
push 0x45735c
call sub.user32.dll_EnumWindows
mov edi, dword [esi + 8]
dec edi
test edi, edi
jl 0x4573f4
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.00410778
cmp ebp, eax
je 0x4573f0
push 0x50
lea eax, [esp + 0xc]
push eax
mov edx, ebx
mov eax, esi
call fcn.00410778
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4573f0
lea eax, [esp + 8]
mov edx, dword [esp]
call fcn.00409610
test eax, eax
jne 0x4573f0
mov edx, ebx
mov eax, esi
call fcn.00410778
mov dword [esp + 4], eax
jmp 0x4573f4
inc ebx
dec edi
jne 0x4573aa
mov eax, esi
call fcn.00402e9c
mov eax, dword [esp + 4]
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x457688
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
xor edx, edx
mov dword [ebp - 0x88], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45770d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x21
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x83]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4576f4
lea eax, [ebp - 0x83]
call fcn.004094e4
mov byte [ebp - 0x84], al
lea eax, [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.00403de8
mov eax, dword [ebp - 0x88]
mov edx, ebx
call fcn.00408954
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457714
lea eax, [ebp - 0x88]
call fcn.00403bc4
ret
Function at 0x45771c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x457786
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x1e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x23]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x457770
lea eax, [ebp - 0x23]
call fcn.004094e4
mov byte [ebp - 0x24], al
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00403de8
mov eax, dword [ebp - 0x28]
mov edx, ebx
call fcn.00408954
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45778d
lea eax, [ebp - 0x28]
call fcn.00403bc4
ret

Function at 0x4578ec
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x457a02
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [esi]
mov eax, 0x457a18
call fcn.00404130
mov ebx, eax
test ebx, ebx
je 0x4579e1
cmp ebx, dword [ebp - 8]
je 0x4579e1
mov dword [ebp - 8], ebx
mov eax, esi
mov ecx, 1
mov edx, ebx
call fcn.0040408c
mov edx, dword [esi]
mov eax, 0x457a18
call fcn.00404130
mov edi, eax
test edi, edi
je 0x4579e1
lea eax, [ebp - 4]
push eax
mov ecx, edi
sub ecx, ebx
mov eax, dword [esi]
mov edx, ebx
call fcn.0040404c
mov ecx, edi
sub ecx, ebx
inc ecx
mov eax, esi
mov edx, ebx
call fcn.0040408c
cmp dword [ebp - 4], 0
je 0x457918
push 0x457a18
push dword [ebp - 4]
push 0x457a18
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403f04
push 0x104
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 4]
call fcn.00404014
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00403df4
mov eax, dword [ebp - 0x110]
mov edx, esi
mov ecx, ebx
call fcn.004040d4
jmp 0x457918
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457a09
lea eax, [ebp - 0x110]
call fcn.00403bc4
lea eax, [ebp - 4]
call fcn.00403bc4
ret

Function at 0x457bfc
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov edi, eax
mov esi, edx
mov ecx, ecx
shr ecx, 2
cld
lodsd eax, dword [esi]
xor dword [edi], eax
add edi, 4
loop 0x457c08
pop esi
pop edi
ret
Function at 0x457fec
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ff8
xor eax, eax
push ebp
push 0x458079
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00404014
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x458055
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0040666c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x458063
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458080
lea eax, [ebp - 4]
call fcn.00403bc4
ret

Function at 0x45808c
Capabilities:
Get disk information
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45818b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4581a4
lea eax, [ebp - 0x40]
mov edx, ebx
call fcn.00403d6c
push dword [ebp - 0x40]
push 0x4581b4
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403f04
push 0
push 0
push 3
push 0
push 0
push 0
lea eax, [ebp - 8]
call fcn.00404014
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x458166
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0xc
call fcn.00402b84
push 0
lea eax, [ebp - 4]
push eax
push 0x28
lea eax, [ebp - 0x3c]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2d1400
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x458160
cmp dword [ebp - 0x20], 7
jne 0x458160
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00403d6c
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 8]
mov ecx, 0x4581c0
call fcn.00403e90
lea eax, [ebp - 8]
call fcn.00404014
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
je 0x45815c
cmp eax, 2
jne 0x458160
mov bl, 1
jmp 0x458168
push esi
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458192
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00403be8
lea eax, [ebp - 8]
call fcn.00403bc4
ret
Function at 0x45a2fc
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test bl, bl
je 0x45a319
test byte [esi + 0x20], 0x10
je 0x45a319
mov eax, 0x45a388
call fcn.0044b97c
jmp 0x45a37a
cmp bl, byte [esi + 0x28]
je 0x45a37a
test bl, bl
je 0x45a352
test byte [esi + 0x20], 0x10
jne 0x45a377
mov cl, 1
mov dl, 1
mov eax, dword [0x45a070]
call fcn.004162f8
mov edi, eax
mov dword [esi + 0x48], edi
mov dword [edi + 0x30], esi
mov byte [edi + 0xe], 1
mov eax, edi
call fcn.00416434
mov eax, esi
call fcn.0045a3ac
jmp 0x45a377
test byte [esi + 0x20], 0x10
jne 0x45a377
mov eax, dword [esi + 0x24]
push eax
call sub.winmm.dll_timeKillEvent
push 0
mov eax, dword [esi + 0x48]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [esi + 0x48]
call fcn.00402e9c
mov byte [esi + 0x28], bl
pop edi
pop esi
pop ebx
ret

Function at 0x45ae88
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x45af11
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4bd908
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x45aefb
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040ae54
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x45af28
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x4bccf0]
mov dl, 1
mov eax, dword [0x45a744]
call fcn.0040b798
call fcn.004035f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45af18
lea eax, [ebp - 0x1c]
call fcn.00403bc4
ret

Function at 0x45b580
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0045b4a4
mov cl, 1
mov edx, esi
mov eax, esi
mov bx, 0xffff
call fcn.00403078
push 0x10
lea eax, [esi + 0x18]
push eax
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x45b5e4
call fcn.0045add0
mov byte [esi + 0x29], 0
test byte [esi + 0x28], 0x10
jne 0x45b5d6
cmp dword [esi + 4], 0xffffffff
setne al
mov byte [esi + 8], al
mov cl, 2
mov edx, esi
mov eax, esi
mov bx, 0xffff
call fcn.00403078
pop esi
pop ebx
ret

Function at 0x45b608
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0045b33c
xor eax, eax
push ebp
push 0x45b687
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403bc4
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x45b641
call fcn.00403694
jmp 0x45b68e
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x45b671
push dword [ebp - 0x14]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00403d7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b68e
mov eax, dword [ebp - 4]
call fcn.0045b348
ret
pop ebx
mov esp, ebp
pop ebp
ret