joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473a80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x473a8b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x473b8e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4df2e8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4df2e8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4df2e8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4df2e8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4df2e8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4df2e8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4df2e8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4df2e8]
xor eax, edx
inc ecx
dec edi
jne 0x473aa6
pop edi
test esi, esi
je 0x473bb0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4df2e8]
xor eax, edx
inc ecx
dec esi
jne 0x473b92
pop esi
pop ebx
not eax
ret
Function at 0x47a670
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x4fbea4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x47a683
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x47a6c4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x4fbf4c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x47a6f6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x47a6fa
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x47a6eb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x47a718
mov bl, byte [esp + ecx + 0x4c]
jmp 0x47a71c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x47a70d
xor ecx, ecx
mov eax, 0x4fbeb4
xor ebx, ebx
mov bl, byte [ecx + 0x4fbf5c]
cmp byte [esp + ebx + 0x14], 0
je 0x47a747
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x4fbf74]
cmp byte [esp + ebx + 0x14], 0
je 0x47a75e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x47a72e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x47a6b7
lea edx, [esp + 0x84]
push edx
call fcn.0047a7a0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x49420d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x494245
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004922c4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049229c
jmp 0x494251
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x495904
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x495946
call fcn.0049b6bb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x495946
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49593d
xor eax, eax
jmp 0x49594e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00495954
pop edi
pop esi
pop ebx
ret 4

Function at 0x49bbeb
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49bc19
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49bc37
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049bb51
jmp 0x49bc37
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49bc37
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049bb51
test edi, edi
mov eax, edi
jne 0x49bc21
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x41cee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x41cf02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41cf09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cef8
mov eax, 1
add ebx, ebx
jne 0x41cf1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41cf10
jne 0x41cf2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf10
xor ecx, ecx
sub eax, 3
jb 0x41cf40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cfb2
mov ebp, eax
add ebx, ebx
jne 0x41cf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cf58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cf7c
inc ecx
add ebx, ebx
jne 0x41cf68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cf5d
jne 0x41cf79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cf9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cf8d
jmp 0x41cefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cf9c
add edi, ecx
jmp 0x41cefe
pop esi
mov edi, esi
mov ecx, 0x157
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cfba
cmp byte [edi], 0
jne 0x41cfba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41cfbf
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41d02e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d100]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cfec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d104]
or eax, eax
je 0x41d028
mov dword [ebx], eax
add ebx, 4
jmp 0x41d009
call dword [esi + 0x1d108]
popal
jmp 0x403ab4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x404ee0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1064
call fcn.00433890
mov eax, dword [0x446004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x447aa8], 0
push esi
mov esi, ecx
jne 0x404f38
push 0x104
push 0x447aa8
push 0x43ad10
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp byte [0x447aa8], 0
jne 0x404f38
push str.C:Windows
push 0x104
push 0x447aa8
call fcn.00401010
add esp, 0xc
push 0x447aa8
push str._s_system32WindowsPowerShell_v1.0powershell.exe
push 0
call fcn.004143d0
add esp, 0xc
test eax, eax
jne 0x404f6e
push str.powershell.exe_not_exist
call fcn.00414230
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ee2e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1060]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [ebp - 0x1034], 1
xor eax, eax
push esi
push str.C:Windows_system32WindowsPowerShell_v1.0powershell.exe__Command____s__
mov word [ebp - 0x1030], ax
lea eax, [ebp - 0x1008]
push 0x1000
push eax
call fcn.00401010
lea eax, [ebp - 0x1008]
push eax
push str.CreateProcess___s_
call fcn.00414230
add esp, 0x18
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1060]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1008]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push str.Wair_process_...
call fcn.00414230
add esp, 4
push 0xffffffffffffffff
push dword [ebp - 0x1018]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.Process_finished...
call fcn.00414230
mov eax, dword [ebp - 0x1018]
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x405025
push eax
call esi
mov dword [ebp - 0x1018], 0xffffffff
mov eax, dword [ebp - 0x1014]
cmp eax, 0xffffffff
je 0x405033
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.0041ee2e
mov esp, ebp
pop ebp
ret

Function at 0x407ca0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x4473f0], 0
push esi
push edi
mov edi, edx
jne 0x407d30
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, esi
push 0
shld eax, ecx, 9
push edx
shl ecx, 9
push eax
push ecx
push dword [0x4496e8]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea eax, [ebp - 8]
push eax
push 0x200
push edi
push dword [0x4496e8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 0x200
mov dword [ebp - 0xc], eax
je 0x407d1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 8]
push 0x200
push dword [ebp - 0xc]
push str.ReadFile_error_bRet:_u_WriteSize:_u_dwSize:_u_ErrCode:_u
call fcn.00414230
add esp, 0x14
or esi, dword [ebp + 0xc]
jne 0x407d30
mov ecx, 0x80
mov esi, 0x4489d8
rep movsd dword es:[edi], dword [esi]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
or eax, ebx
mov dword [ebp - 8], edx
jne 0x407d7a
mov ecx, 0x80
mov esi, edx
mov edi, 0x4489d8
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x10]
cmp esi, 1
je 0x407eb7
xor ebx, ebx
lea edi, [eax + 1]
dec esi
jmp 0x407d7d
mov esi, dword [ebp + 0x10]
cmp dword [0x4473f0], 0
je 0x407e3d
mov eax, dword [0x4468b0]
lea ecx, [eax + eax*2]
mov eax, dword [0x4473e4]
lea edx, [eax + ecx*8]
mov ecx, dword [0x4468b0]
test ecx, ecx
js 0x407de5
cmp dword [edx + 0xc], 0
mov eax, dword [edx + 8]
ja 0x407db1
test eax, eax
je 0x407de5
add eax, dword [edx]
mov ecx, dword [edx + 4]
adc ecx, dword [edx + 0xc]
mov dword [ebp + 0xc], ecx
mov ecx, dword [0x4468b0]
cmp edi, eax
jne 0x407de5
cmp ebx, dword [ebp + 0xc]
jne 0x407de5
mov eax, esi
xor ecx, ecx
add dword [edx + 8], eax
mov eax, dword [0x4473ec]
adc ecx, dword [edx + 0xc]
mov dword [edx + 0xc], ecx
mov ecx, dword [0x4473e8]
jmp 0x407e0d
mov eax, dword [0x4473ec]
inc ecx
mov dword [0x4468b0], ecx
mov ecx, dword [0x4473e8]
mov dword [edx + 0x18], edi
mov dword [edx + 0x1c], ebx
mov dword [edx + 0x28], ecx
mov dword [edx + 0x2c], eax
mov dword [edx + 0x20], esi
mov dword [edx + 0x24], 0
push dword [0x4473f0]
shl esi, 9
add ecx, esi
push esi
push 1
push dword [ebp - 8]
adc eax, 0
mov dword [0x4473e8], ecx
mov dword [0x4473ec], eax
call fcn.00423aa7
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
shld ebx, edi, 9
lea eax, [ebp - 0x14]
push eax
push ebx
shl edi, 9
push edi
push dword [0x4496e8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea eax, [ebp + 0xc]
shl esi, 9
push eax
push esi
push dword [ebp - 8]
push dword [0x4496e8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
je 0x407e82
cmp dword [ebp + 0xc], esi
je 0x407eb7
mov ecx, dword [0x4473f4]
inc ecx
mov dword [0x4473e0], 1
mov dword [0x4473f4], ecx
cmp ecx, 0xa
jg 0x407eb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0xc]
push esi
push edi
push str.WriteFile_error_bRet:_u_WriteSize:_u_dwSize:_u_ErrCode:_u
call fcn.00414230
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c000
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x446004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x419
push ecx
mov dword [ebp - 0x54], edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
push 0
push 0
push 0x146
push ebx
call edi
mov esi, eax
sub esi, 1
js 0x40c050
nop dword [eax]
push 0
push esi
push 0x144
push ebx
call edi
sub esi, 1
jns 0x40c040
xor edi, edi
xor esi, esi
mov dword [ebp - 0x50], edi
test esi, esi
jne 0x40c077
lea ecx, [esi + 0x35]
call fcn.0040be70
push eax
push esi
push 0x143
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
inc edi
mov dword [ebp - 0x50], edi
jmp 0x40c0ed
mov edi, dword [esi*4 + 0x43ac90]
mov eax, edi
cdq
and edx, 0xfffff
lea ecx, [edx + eax]
mov eax, edi
cdq
and edx, 0x3ff
sar ecx, 0x14
add eax, edx
sar eax, 0xa
cmp edi, 0x100000
cmovge eax, ecx
mov ecx, str._d_KB
push eax
mov eax, str._d_MB
cmovl eax, ecx
push eax
lea eax, [ebp - 0x4c]
push 0x40
push eax
call fcn.00401010
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
push 0
push 0x143
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [ebp - 0x50]
inc edi
cmp dword [ebp - 0x54], 0
mov dword [ebp - 0x50], edi
jne 0x40c0ed
cmp dword [esi*4 + 0x43ac90], 0x10000
je 0x40c0f7
inc esi
cmp esi, 0x10
jb 0x40c057
mov eax, dword [ebp + 8]
cmp eax, edi
jge 0x40c102
test eax, eax
jns 0x40c112
push eax
push str.Change_invalid_default_index__d_to_0
call fcn.00414230
add esp, 8
xor eax, eax
push 0
push eax
push 0x14e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ee2e
mov esp, ebp
pop ebp
ret

Function at 0x40cb80
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edx
push edi
push edi
mov dword [ebp - 0xc], ecx
call ebx
mov dword [ebp - 8], eax
lea esi, [eax + 1]
push esi
call fcn.004237fe
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
test esi, esi
jne 0x40cbbd
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 8]
call ebx
mov eax, esi
cmp byte [eax], 0
je 0x40cc18
mov ebx, dword [ebp + 8]
nop dword [eax]
cmp edi, ebx
jge 0x40cc00
movsx ecx, byte [esi]
xor edx, edx
call fcn.0040cf20
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jne 0x40cc00
movsx eax, byte [esi]
push ecx
push eax
push str._C:_is_belong_to_phydrive_d
call fcn.00414230
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov al, byte [esi]
mov byte [edi + ecx], al
inc edi
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cc05
sub eax, edx
inc esi
add esi, eax
cmp byte [esi], cl
jne 0x40cbd0
mov eax, dword [ebp - 4]
push eax
call fcn.004235fd
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
push edi
push 0
mov edi, ecx
lea ecx, [ebp - 8]
shld eax, edx, 9
push ecx
shl edx, 9
push eax
push edx
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0x4000
call fcn.004237fe
add esp, 4
mov esi, eax
lea eax, [ebp + 0xc]
push 0
push eax
push 0x4000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call fcn.004235fd
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0xc]
push edi
push str.Try_write_part2_bRet:_u_dwSize:_u_code:_u
call fcn.00414230
add esp, 0x10
test edi, edi
je 0x40e299
cmp dword [ebp + 0xc], 0x4000
jne 0x40e299
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41439b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x420
mov eax, dword [0x446004]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x1e]
push eax
movzx eax, word [esp + 0x20]
push eax
movzx eax, word [esp + 0x22]
push eax
movzx eax, word [esp + 0x24]
push eax
movzx eax, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push eax
push str.__4d__02d__02d__02d:_02d:_02d._03d_
lea eax, [esp + 0x40]
push 0x400
push eax
call fcn.00401010
add esp, 0x28
mov edi, eax
lea eax, [ebp + 0xc]
mov ecx, 0x3ff
sub ecx, edi
push eax
push 0
push dword [ebp + 8]
lea eax, [esp + 0x2c]
push ecx
push ecx
add eax, edi
push eax
call fcn.00401000
push dword [eax + 4]
push dword [eax]
call fcn.00423534
or ecx, 0xffffffff
add esp, 0x20
test eax, eax
cmovs eax, ecx
add edi, eax
cmp dword [0x448eec], 0
je 0x414358
push 0x408
call fcn.004237fe
mov esi, eax
add esp, 4
test esi, esi
je 0x4143b3
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esi + 4]
push ecx
call fcn.00420a10
mov eax, dword [0x448ee8]
add esp, 0xc
mov dword [esi + 0x404], 0
mov dword [esi], edi
mov dword [0x448ee8], esi
test eax, eax
je 0x41433e
mov dword [eax + 0x404], esi
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.0041ee2e
mov esp, ebp
pop ebp
ret
mov dword [0x448ee4], esi
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.0041ee2e
mov esp, ebp
pop ebp
ret
cmp dword [0x447410], 0
mov ecx, str.log.txt
mov eax, str.cli_log.txt
cmove eax, ecx
push 0x441b14
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0042465c
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0x4143b3
push eax
push edi
lea eax, [esp + 0x28]
push 1
push eax
call fcn.00423aa7
push dword [esp + 0x1c]
push 1
push 1
push 0x441b2c
call fcn.00423aa7
push dword [esp + 0x2c]
call fcn.00424521
add esp, 0x24
mov ecx, dword [esp + 0x424]
pop edi
pop esi
xor ecx, esp
call fcn.0041ee2e
mov esp, ebp
pop ebp
ret

Function at 0x4143d0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x446004]
xor eax, esp
mov dword [esp + 0x10c], eax
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [esp + 0xc]
push 0x104
push 0x104
push eax
call fcn.00401000
push dword [eax + 4]
push dword [eax]
call fcn.00423534
add esp, 0x20
lea eax, [esp]
push 0
push 0
push 3
push 0
push 1
push 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x41444d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0x10
cmp dword [ebp + 8], 0
je 0x414461
test eax, eax
jne 0x414465
xor eax, eax
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0041ee2e
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x41444d
mov ecx, dword [esp + 0x10c]
mov eax, 1
xor ecx, esp
call fcn.0041ee2e
mov esp, ebp
pop ebp
ret
Function at 0x414480
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], 0
push 0x43f664
lea eax, [ebp - 4]
mov edi, edx
push esi
push eax
call fcn.0042465c
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
jne 0x4144c5
push esi
push str.Failed_to_open_file__s
call fcn.00414230
add esp, 8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 2
push 0
push eax
call fcn.0042512f
add esp, 0xc
push dword [ebp - 4]
call fcn.00424d33
mov esi, eax
add esp, 4
lea ecx, [esi + edi]
push ecx
call fcn.004237fe
mov edi, eax
add esp, 4
test edi, edi
jne 0x414505
push dword [ebp - 4]
call fcn.00424521
add esp, 4
lea eax, [edi + 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push dword [ebp - 4]
call fcn.0042512f
add esp, 0xc
push dword [ebp - 4]
push esi
push 1
push edi
call fcn.00425466
push dword [ebp - 4]
call fcn.00424521
mov eax, dword [ebp + 8]
add esp, 0x14
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414a70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x446004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x442220]
movq xmm0, qword [str.SOFTWARE_]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x104
mov word [ebp - 8], ax
lea eax, [ebp - 0x114]
push 0
push eax
movq qword [ebp - 0x10], xmm0
call fcn.00420360
add esp, 0xc
mov dword [ebp - 0x120], 0xffffffff
xor edi, edi
mov dword [ebp - 0x124], 4
mov dword [ebp - 0x11c], edi
mov esi, 0x30
mov dword [ebp - 0x118], edi
mov dword [ebx], edi
nop
cmp byte [esi + str.SoftwareMicrosoftWindows_NTCurrentVersionUBR], 0x5c
je 0x414b1e
sub esi, 1
jne 0x414ae0
lea eax, [ebp - 0x11c]
push eax
push 0x2001d
push esi
push str.SOFTWARE
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x414bee
mov dword [ebp - 0x11c], edi
jmp 0x414c42
push 9
lea eax, [ebp - 0x10]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionUBR
call fcn.0042514a
add esp, 0xc
test eax, eax
je 0x414b85
lea eax, [esi + 0xa]
cmp eax, 0x104
jae 0x414b8d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.004235a3
push str.SoftwareMicrosoftWindows_NTCurrentVersionUBR
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00423618
lea eax, [esi + 9]
add esp, 0x18
cmp eax, 0x104
jae 0x414c66
mov byte [ebp + eax - 0x114], 0
jmp 0x414bc1
cmp esi, 0x104
jb 0x414ba0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ee2e
mov esp, ebp
pop ebp
ret
push str.SoftwareMicrosoftWindows_NTCurrentVersionUBR
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.004235a3
add esp, 0xc
mov byte [ebp + esi - 0x114], 0
lea eax, [ebp - 0x118]
inc esi
push eax
push 0x20019
push 0
lea eax, [ebp - 0x114]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x414bee
mov dword [ebp - 0x118], edi
jmp 0x414c31
lea eax, [ebp - 0x124]
push eax
push ebx
lea eax, [ebp - 0x120]
push eax
push 0
lea eax, [esi + str.SoftwareMicrosoftWindows_NTCurrentVersionUBR]
push eax
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x414c2c
test eax, eax
jne 0x414c31
cmp dword [ebp - 0x120], 4
jne 0x414c31
cmp dword [ebp - 0x124], edi
jbe 0x414c31
mov edi, 1
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x414c42
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x118]
test ecx, ecx
je 0x414c53
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ee2e
mov esp, ebp
pop ebp
ret
call fcn.0041ef5e
int3