joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4048d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x4c
push ebx
push esi
push edi
mov ecx, 0x12
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
push 0x410
rep stosd dword es:[edi], eax
push 0x40
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x40490c
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
add esp, 0x4c
ret
push 0x104
push edi
push 0
lea esi, [edi + 0x208]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40493c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x4c
ret
push esi
push 0
push edi
call fcn.0040ab60
cmp eax, 0x80092009
jne 0x40495c
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x4c
ret
push esi
push 1
push edi
call fcn.0040ab60
mov ebx, eax
test ebx, ebx
je 0x40497b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x4c
ret
mov eax, 0x20
mov ecx, 0x65
mov word [esp + 0x20], ax
mov word [esp + 0x16], ax
mov word [esp + 0x30], ax
mov word [esp + 0x28], ax
mov word [esp + 0x46], ax
lea eax, [esp + 0xc]
mov word [esp + 0x34], cx
mov word [esp + 0x2c], cx
mov ebx, 0x67
mov edx, 0x6f
mov ecx, 0x69
push eax
push esi
mov word [esp + 0x14], 0x43
mov word [esp + 0x1a], 0x6e
mov word [esp + 0x26], bx
mov word [esp + 0x2c], dx
mov word [esp + 0x18], dx
mov word [esp + 0x16], 0x68
mov word [esp + 0x36], cx
mov word [esp + 0x2a], 0x59
mov word [esp + 0x3a], 0x54
mov word [esp + 0x56], cx
mov word [esp + 0x24], 0x6e
mov word [esp + 0x3e], 0x63
mov word [esp + 0x1c], bx
mov word [esp + 0x40], 0x68
mov word [esp + 0x20], 0x51
mov word [esp + 0x54], 0x6d
mov word [esp + 0x42], 0x6e
mov word [esp + 0x5a], 0x65
mov word [esp + 0x2e], 0x75
mov word [esp + 0x50], 0x4c
mov word [esp + 0x44], dx
mov word [esp + 0x52], cx
mov word [esp + 0x5e], 0
mov word [esp + 0x46], 0x6c
mov word [esp + 0x22], cx
mov word [esp + 0x48], dx
mov word [esp + 0x58], 0x74
mov word [esp + 0x4a], bx
mov word [esp + 0x32], 0x42
mov word [esp + 0x5c], 0x64
mov word [esp + 0x4c], 0x79
call dword [sym.imp.MSVCRT.dll_wcscmp]
mov esi, eax
add esp, 8
neg esi
sbb esi, esi
push edi
and esi, 5
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x4c
ret
Function at 0x405020
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41dc40
push 0x40a43e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
cmp dword [0x4288e8], ecx
je 0x40506d
mov dword [0x42663c], ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
rdtsc
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], ecx
mov dword [0x42663c], ecx
mov eax, dword [0x4288fc]
cmp eax, ecx
je 0x405089
call eax
mov dword [0x42663c], 1
jmp 0x40509e
mov dword [ebp - 4], 0xffffffff
rdtsc
sub eax, dword [ebp - 0x20]
sbb edx, dword [ebp - 0x1c]
cmp edx, dword [0x4288f4]
jl 0x4050c9
jg 0x4050bf
cmp eax, dword [0x4288f0]
jb 0x4050c9
mov dword [0x42663c], 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405590
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x18
push ebx
push esi
lea eax, [esp + 8]
push edi
xor ebx, ebx
push eax
push ebx
push 8
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4055fc
call esi
cmp eax, 0x3f0
jne 0x4056d8
lea ecx, [esp + 0xc]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4055fc
pop edi
pop esi
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push edx
push ebx
push ebx
push 2
push eax
call edi
test eax, eax
je 0x40562e
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
call esi
cmp eax, 0x7a
je 0x405649
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x10]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebx
jne 0x405670
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
push esi
push 2
push ecx
call edi
test eax, eax
jne 0x4056a3
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x4056e1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, dword [esi]
xor edi, edi
cmp eax, ebx
push ebp
mov dword [esp + 0x1c], ebx
jbe 0x405719
mov ebp, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ebx, [esi + 4]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx]
push eax
push ecx
call ebp
test eax, eax
jne 0x405711
mov eax, dword [esi]
inc edi
add ebx, 8
cmp edi, eax
jb 0x4056f7
jmp 0x405719
mov dword [esp + 0x1c], 1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x4057c0
Capabilities:
Check os version
Create process on windows

Disassembly:
sub esp, 0x560
push edi
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4057f6
cmp dword [esp + 0x44], 6
jb 0x405901
mov dx, word [0x428280]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x156]
mov word [esp + 0x154], dx
mov word [esp + 0x35c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x35e]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x158]
push ecx
push 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x405901
lea edx, [esp + 0x154]
lea eax, [esp + 0x35c]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea ecx, [esp + 0x364]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 0x10
test eax, eax
je 0x405881
mov word [eax + 2], 0
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 4]
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
lea edx, [esp + 0x158]
lea eax, [esp + 0x360]
push ecx
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0x426228
mov dword [esp + 0x18], str.RunAs
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4058f3
push 1
call fcn.0040bd60
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0x1f4
call edi
push 0
call fcn.0040bd90
test eax, eax
je 0x4058f3
inc esi
cmp esi, 0x64
jl 0x4058db
pop esi
mov eax, 1
pop edi
add esp, 0x560
ret
xor eax, eax
pop edi
add esp, 0x560
ret
Function at 0x405910
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x5c
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
mov ecx, 0x15
xor eax, eax
lea edi, [esp + 0x1c]
push 0x80
mov dword [esp + 0x1c], ebp
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x7c]
push ebp
push 1
push connect
push eax
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40595c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x5c
ret 8
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
jne 0x405982
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x5c
ret 8
lea ecx, [esp + 0x14]
push ecx
call fcn.00409250
push 0x10
lea edx, [esp + 0x18]
push 0x41d8c8
push edx
call fcn.00409280
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x10]
push ebp
push eax
push 0x10000
push esi
push edi
mov dword [esp + 0x24], ebp
call ebx
test eax, eax
je 0x4059d0
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x4059ea
push eax
lea ecx, [esp + 0x18]
push esi
push ecx
call fcn.00409280
jmp 0x4059a3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x5c
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [esp + 0x74]
lea eax, [esp + 0x14]
push edx
push eax
call fcn.00409350
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x5c
ret 8
Function at 0x405d90
Capabilities:
Get common file path
Move file

Disassembly:
push 0xffffffffffffffff
push 0x41c35b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov ax, word [0x428280]
push esi
mov esi, ecx
push edi
mov word [esp + 0xc], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
stosw word es:[edi], ax
call fcn.00409fa0
mov eax, dword [0x42615c]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x405f57
lea ecx, [esp + 0xc]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x405e2b
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
add esp, 0x218
ret
push 0x104
lea edx, [esp + 0x10]
push str.Drivers
push edx
call dword [sym.imp.MSVCRT.dll_wcsncat]
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push 0x4268e4
push 0x426928
push eax
push str._s_s._s
push ecx
call sub.MFC42u.DLL_CString::Format_1
mov edx, dword [esp + 0x1c]
add esp, 0x14
push 0x426054
push edx
call fcn.004012b0
test eax, eax
je 0x405eb9
mov eax, dword [esp + 8]
push 0x83
push eax
mov ecx, esi
call fcn.00406700
test eax, eax
je 0x405eb9
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
add esp, 0x218
ret
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x405efb
cmp word [esp + eax*2 + 0xa], 0x5c
lea eax, [esp + eax*2 + 0xa]
jne 0x405ede
mov word [eax], 0
lea edx, [esp + 0xc]
push str.FGMiniAgent.fgdcf
push edx
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
lea eax, [esp + 0xc]
push eax
call fcn.0040d440
mov ecx, dword [esp + 8]
push ecx
call fcn.0040b790
test eax, eax
je 0x405f3e
push 0x6d
push eax
call fcn.00409dd0
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
add esp, 0x218
ret
mov ecx, esi
call fcn.00406460
test eax, eax
jne 0x405f57
mov edx, dword [esp + 8]
push 4
push eax
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x214]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret
Function at 0x406460
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
mov dword [esp], 0
push eax
push 0x4265e8
push connect
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4064dd
lea ecx, [esp]
push esi
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0x426528
push ecx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4064dd
mov ecx, dword [esp + 8]
mov eax, 1
cmp ecx, eax
je 0x4064df
xor eax, eax
add esp, 0x10
ret

Function at 0x406570
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0x20
mov ecx, 8
mov esi, 0x41d898
lea edi, [esp + 0x34]
push 0x41d898
push 0x41d888
push 2
rep movsd dword es:[edi], dword [esi]
call fcn.0040bf00
xor ebx, ebx
cmp eax, ebx
je 0x4065b4
push 0x6a
push eax
call fcn.00409dd0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
xor eax, eax
mov byte [esp + 0x1c], bl
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], al
call fcn.00415130
test eax, eax
je 0x406611
lea ecx, [esp + 0x1c]
push ebx
push ecx
call fcn.00415160
test eax, eax
je 0x406611
mov ecx, 8
mov esi, 0x41d898
lea edi, [esp + 0x30]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov dl, byte [esp + eax + 0x1c]
mov cl, byte [esp + eax + 0x30]
xor cl, dl
mov byte [esp + eax + 0x30], cl
inc eax
cmp eax, 0x14
jl 0x4065fd
lea eax, [esp + 0x30]
push 0x20
push eax
push 0x41d8b8
push 2
call fcn.0040bf00
cmp eax, ebx
je 0x40663a
push 0x6a
push eax
call fcn.00409dd0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
mov edi, dword [sym.imp.MSVCRT.dll_rand]
xor esi, esi
call edi
and eax, 0x800000ff
jns 0x406652
dec eax
or eax, 0xffffff00
inc eax
mov dl, byte [esp + esi + 0x30]
xor dl, al
mov byte [esp + esi + 0x30], dl
inc esi
cmp esi, 0x14
jl 0x406642
lea ecx, [esp + 0x30]
push 0x20
push ecx
push 0x41d8d8
push 0x103
call fcn.0040bf00
cmp eax, ebx
je 0x40668e
push 0x6a
push eax
call fcn.00409dd0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
xor esi, esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
call fcn.004143a0
test eax, eax
jne 0x4066c9
inc esi
cmp esi, 3
jl 0x40669c
mov ecx, ebp
call fcn.00406aa0
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x40
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
call fcn.0040ccc0
cmp eax, ebx
je 0x4066b5
push 0x6b
push eax
call fcn.00409dd0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
Function at 0x406df0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x4269a4]
mov ecx, dword [0x4269a8]
mov edx, dword [0x4269ac]
mov dword [esp + 0x10], eax
mov ax, word [0x4269b0]
push esi
push edi
mov dword [esp + 0x1c], ecx
mov word [esp + 0x24], ax
mov ecx, 0x7e
xor eax, eax
lea edi, [esp + 0x26]
mov esi, dword [sym.imp.MSVCRT.dll_wcslen]
mov dword [esp + 0x20], edx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
mov dword [esp + 8], 0xffffffff
push ecx
stosw word es:[edi], ax
call esi
mov edx, 0x104
add esp, 4
sub edx, eax
lea eax, [esp + 0x18]
push edx
push eax
call esi
mov edx, dword [esp + 0x22c]
add esp, 4
lea ecx, [esp + eax*2 + 0x1c]
push ecx
push edx
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
pop edi
pop esi
test eax, eax
jne 0x406ed1
lea edx, [esp + 8]
lea eax, [esp]
push edx
mov edx, dword [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0x428280
push edx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406ec6
cmp dword [esp], 0x10000
jb 0x406ec6
mov dword [esp], 0
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 0x218
ret 4
Function at 0x407460
Capabilities:
Connect network resource
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x41c3bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4
push ebx
push ebp
push esi
mov dword [esp + 0x1c], ecx
mov dx, word [0x428280]
push edi
xor esi, esi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], esi
mov word [esp + 0x44], dx
rep stosd dword es:[edi], eax
mov eax, dword [0x426ba4]
mov cx, word [0x426ba8]
mov dword [esp + 0x10], eax
mov word [esp + 0x14], cx
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x46]
xor ebp, ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x42615c]
mov dword [esp + 0x1c], esi
cmp eax, esi
je 0x4074df
mov eax, 0x57
jmp 0x40765c
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [sym.imp.MSVCRT.dll__wcsicmp]
mov ebx, eax
mov edx, 1
mov ecx, esi
shl edx, cl
lea eax, [esi + 0x41]
mov word [esp + 0x10], ax
test ebx, edx
je 0x40754a
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x44]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x28], 0x3f
call sub.MPR.dll_WNetGetConnectionW
test eax, eax
jne 0x40754e
lea eax, [esp + 0x44]
push 0x426c38
push eax
call edi
add esp, 8
test eax, eax
je 0x407559
lea ecx, [esp + 0x44]
push 0x426b68
push ecx
call edi
add esp, 8
test eax, eax
je 0x407559
jmp 0x40754e
mov ebp, dword [esp + 0x10]
inc esi
cmp esi, 0x1a
jl 0x4074ed
test bp, bp
jne 0x407560
xor eax, eax
jmp 0x40765c
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
lea edx, [esp + 0x10]
mov word [esp + 0x10], bp
mov dword [esp + 0x24], 2
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], 0x426b68
mov dword [esp + 0x3c], str.Ubeisoft_Virtual_Disk
mov dword [esp + 0x40], 0x426bc4
xor esi, esi
push 0x80
push 0
lea eax, [esp + 0x2c]
push 0
push eax
push 0
call sub.MPR.dll_WNetAddConnection3W
mov edi, eax
cmp edi, 0x55
jne 0x4075e1
lea ecx, [esp + 0x10]
push 1
push ecx
call sub.MPR.dll_WNetCancelConnectionW
push 0xc8
call ebx
inc esi
cmp esi, 0xa
jl 0x4075aa
jmp 0x40765a
test edi, edi
jne 0x40765a
lea ecx, [esp + 0x18]
call fcn.00409fa0
push 0x80
lea ecx, [esp + 0x1c]
mov dword [esp + 0xd0], edi
call sub.MFC42u.DLL_CString::LoadStringW
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edi
push edx
push 0x426b68
mov ecx, esi
call fcn.004080f0
mov ecx, dword [esp + 0x10]
mov eax, 1
and ecx, 0xffff
sub ecx, 0x41
shl eax, cl
mov ecx, esi
push eax
push 0x8000
call fcn.00407fe0
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004071b0
lea ecx, [esp + 0x18]
mov dword [esp + 0xcc], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, edi
mov ecx, dword [esp + 0xc4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xc0
ret
Function at 0x407cb0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [str.Z:.]
mov ecx, dword [0x426d9c]
mov edx, dword [0x426da0]
push esi
mov dword [esp + 0x10], eax
mov ax, word [0x426da4]
push edi
xor esi, esi
push 0x250
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov word [esp + 0x24], ax
mov word [esp + 0x26], si
call sub.MFC42u.DLL_operatornew
mov edi, eax
add esp, 4
cmp edi, esi
je 0x407df1
push ebx
push 0x800
call sub.MFC42u.DLL_operatornew
mov ebx, eax
add esp, 4
cmp ebx, esi
mov dword [esp + 0x10], ebx
je 0x407de7
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x30]
mov edx, 1
mov ecx, esi
shl edx, cl
test eax, edx
je 0x407dcf
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push ebx
lea ecx, [esi + 0x41]
push 1
push eax
mov word [esp + 0x2c], cx
mov dword [esp + 0x28], 0x800
call sub.MPR.dll_WNetGetUniversalNameW
test eax, eax
jne 0x407dcf
mov eax, dword [ebx]
test eax, eax
je 0x407dcf
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407d95
push edi
push esi
xor ebx, ebx
call ebp
test eax, eax
je 0x407d8a
cmp ebx, 3
jg 0x407d8a
push edi
push esi
inc ebx
call ebp
test eax, eax
jne 0x407d7c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0x14]
push edi
push str.FGVDiskRLocalC:.
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407dcb
push edi
push esi
xor ebx, ebx
call ebp
test eax, eax
je 0x407dc0
cmp ebx, 3
jg 0x407dc0
push edi
push esi
inc ebx
call ebp
test eax, eax
jne 0x407db2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc esi
cmp esi, 0x1a
mov dword [esp + 0x10], esi
jb 0x407d22
push ebx
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop ebp
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop ebx
pop edi
pop esi
add esp, 0x1c
ret 4
Function at 0x407e00
Capabilities:
Get disk information

Disassembly:
sub esp, 0x98
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x540]
cmp eax, 2
jge 0x407e27
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x98
ret
cmp eax, 0x19
jg 0x407fc6
push 0x426a30
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
test ebp, ebp
je 0x407fc6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x426cdc
push ebp
call edi
push 0x426dbc
push ebp
mov ebx, eax
call edi
push 0x426da8
push ebp
call edi
test ebx, ebx
je 0x407fbf
test eax, eax
je 0x407fbf
push 0
push 0
call ebx
mov eax, dword [0x426d04]
mov cx, word [0x426d08]
mov dword [esp + 0x10], eax
xor edx, edx
movzx ax, byte [esi + 0x540]
mov word [esp + 0x14], cx
mov dword [esp + 0x16], edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x1a], edx
add eax, 0x41
push ecx
push str.FGVDiskVDiskList99
mov ecx, esi
mov word [esp + 0x26], dx
mov word [esp + 0x18], ax
call fcn.00408290
lea edx, [esp + 0x10]
push 1
push edx
call sub.MPR.dll_WNetCancelConnectionW
mov ecx, dword [esi + 0x540]
mov eax, 1
shl eax, cl
mov ecx, esi
push eax
push 0x8004
call fcn.00407fe0
mov cx, word [0x428280]
xor eax, eax
mov word [esp + 0x28], cx
mov ecx, 0x1f
lea edi, [esp + 0x2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x24], eax
xor edi, edi
mov eax, 1
mov ecx, edi
shl eax, cl
mov ecx, dword [esp + 0x24]
lea edx, [edi + 0x41]
mov word [esp + 0x10], dx
test ecx, eax
je 0x407f5d
lea edx, [esp + 0x20]
lea eax, [esp + 0x28]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x2c], 0x3f
call sub.MPR.dll_WNetGetConnectionW
test eax, eax
jne 0x407f5d
lea edx, [esp + 0x28]
push 0x426b68
push edx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x407f65
inc edi
cmp edi, 0x1a
jl 0x407f0d
jmp 0x407f98
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push 0x426b68
call fcn.00408290
lea ecx, [esp + 0x10]
push 1
push ecx
call sub.MPR.dll_WNetCancelConnectionW
mov edx, 1
mov ecx, edi
shl edx, cl
mov ecx, esi
push edx
push 0x8004
call fcn.00407fe0
push 0
push 1
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x540], 0xffffffff
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x98
ret
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x98
ret