joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404ac5
Capabilities:
Decrypt data via sspi

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xb9c]
test ecx, ecx
je 0x404cbd
mov edi, dword [esi + 0xba0]
test edi, edi
je 0x404cbd
mov eax, dword [esi + 0xba8]
xorps xmm0, xmm0
sub edi, eax
movlpd qword [esp + 0x34], xmm0
xor ebx, ebx
movlpd qword [esp + 0x40], xmm0
inc ebx
mov dword [esp + 0x20], edi
lea ebp, [eax + ecx]
mov dword [esp + 0x24], ebx
xor eax, eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], eax
lea eax, [esi + 0xb74]
push eax
mov dword [esp + 0x1c], 4
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esi + 0xb8c]
push eax
call dword [sym.imp.Secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x404c85
cmp eax, 0x90317
jne 0x404bba
cmp dword [esi + 8], 0xffffffff
mov eax, dword [esi + 0xba8]
mov dword [esi + 0xba0], eax
je 0x404bf8
push str.tls___socket_closed_in_decrypt_message
lea ecx, [esi + 0x228]
mov edx, 0xff
call fcn.00403dea
push 2
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 8], 0xffffffff
jmp 0x404bf8
cmp eax, 0x80090308
jne 0x404bd8
push str.tls___invalid_token_in_decrypt_message
lea ecx, [esi + 0x228]
mov edx, 0xff
call fcn.00403dea
jmp 0x404bf6
test eax, eax
je 0x404c0a
push eax
push str.tls___decrypt_message_failed___d_status
lea eax, [esi + 0x228]
push 0xff
push eax
call fcn.00403c23
add esp, 0x10
xor bl, bl
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
jmp 0x404cbf
push 4
lea edi, [esp + 0x24]
pop ebp
cmp dword [edi + 4], ebx
jne 0x404c38
push dword [edi]
mov eax, dword [esi + 0xb9c]
push dword [edi + 8]
add eax, dword [esi + 0xba8]
push eax
call fcn.0041c430
mov eax, dword [edi]
add esp, 0xc
add dword [esi + 0xba8], eax
add edi, 0xc
sub ebp, 1
jne 0x404c11
push 5
pop eax
cmp dword [esp + 0x24], eax
jne 0x404c53
lea edi, [esp + 0x20]
lea eax, [esp + 0x28]
jmp 0x404c81
cmp dword [esp + 0x30], eax
jne 0x404c63
lea edi, [esp + 0x2c]
lea eax, [esp + 0x34]
jmp 0x404c81
cmp dword [esp + 0x3c], eax
jne 0x404c73
lea edi, [esp + 0x38]
lea eax, [esp + 0x40]
jmp 0x404c81
cmp dword [esp + 0x48], eax
jne 0x404cb9
lea edi, [esp + 0x44]
lea eax, [esp + 0x4c]
mov ebp, dword [eax]
mov edi, dword [edi]
test edi, edi
je 0x404ca0
mov eax, dword [esi + 0xb9c]
add eax, dword [esi + 0xba8]
push edi
push ebp
push eax
call fcn.0041c430
add esp, 0xc
mov ecx, dword [esi + 0xba8]
lea eax, [esi + 0xb74]
add ecx, edi
mov dword [esi + 0xba0], ecx
jmp 0x404bfc
xor edi, edi
jmp 0x404ca0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x404f7d
Capabilities:
Encrypt data via sspi

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x50]
mov esi, ecx
test edi, edi
je 0x40505a
mov ecx, dword [esi + 0xbb4]
mov edx, dword [esi + 0xbb0]
lea eax, [edx + ecx]
cmp dword [esp + 0x54], eax
jb 0x40505a
mov ebp, dword [esp + 0x58]
lea eax, [edx + edi]
mov dword [esp + 0x30], eax
xor ebx, ebx
mov eax, dword [esp + 0x54]
sub eax, edx
mov dword [esp + 0x40], ebx
sub eax, ecx
mov dword [ebp], ebx
mov dword [esp + 0x28], eax
mov eax, edi
sub eax, ecx
mov dword [esp + 0x48], ebx
add eax, dword [esp + 0x54]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x10], ebx
lea ebx, [esi + 0xb74]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 7
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 6
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esi + 0xb8c]
push eax
call dword [sym.imp.Secur32.dll_EncryptMessage]
test eax, eax
je 0x405066
push str.tls___encrypt_message_failed
lea ecx, [esi + 0x228]
mov edx, 0xff
call fcn.00403dea
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0xc
mov eax, dword [esp + 0x1c]
cmp eax, dword [esi + 0xbb0]
jae 0x4050a1
push dword [esp + 0x28]
add eax, edi
push dword [esp + 0x34]
push eax
call fcn.0041c430
push dword [esp + 0x40]
mov eax, dword [esp + 0x38]
add eax, dword [esp + 0x2c]
push dword [esp + 0x4c]
add eax, edi
push eax
call fcn.0041c430
mov eax, dword [esp + 0x34]
add esp, 0x18
mov ecx, dword [esp + 0x34]
add ecx, dword [esp + 0x28]
add ecx, eax
push ebx
mov dword [ebp], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x40505c
Function at 0x4051ef
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
push ebp
push esi
push edi
cmp dword [ebx + 8], 0xffffffff
je 0x405322
mov edi, dword [esp + 0x24]
test edi, edi
je 0x405322
mov esi, dword [esp + 0x2c]
xor eax, eax
test esi, esi
je 0x40521a
mov dword [esi], eax
push 0x1d4c0
mov dword [esp + 0x18], eax
mov ebp, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], edi
call fcn.00406323
jmp 0x4052ec
mov ecx, ebx
call fcn.0040609e
test eax, eax
jne 0x405260
mov ecx, ebx
call fcn.00406119
test al, al
jne 0x40532e
push 1
jmp 0x4052e6
xor eax, eax
push eax
push eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push 1
lea eax, [esp + 0x2c]
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x4052ca
cmp dword [esp + 0x24], 1
jne 0x4052ca
push 0x1d4c0
mov ecx, ebx
xor ebp, ebp
call fcn.00406323
mov eax, dword [esp + 0x1c]
mov cl, byte [eax]
cmp cl, 0xd
je 0x4052ec
cmp cl, 0xa
je 0x405345
mov ecx, dword [esp + 0x28]
cmp ecx, 1
jbe 0x4052ec
add eax, dword [esp + 0x24]
sub ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], ecx
jmp 0x4052ec
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0x2c], eax
cmp eax, 0x2733
jne 0x4052f9
inc ebp
cmp ebp, 0x7d0
je 0x4052f9
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebx + 0x435], 0
je 0x40523f
push str.raw___read_string_failed
lea ecx, [ebx + 0x228]
mov edx, 0xff
call fcn.00403dea
test esi, esi
je 0x405318
mov eax, dword [esp + 0x2c]
mov dword [esi], eax
mov ecx, ebx
mov byte [edi], 0
call fcn.00403acf
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
push str.raw___read_string_timeout
lea ecx, [ebx + 0x228]
mov edx, 0xff
call fcn.00403dea
jmp 0x405322
mov byte [eax], 0
mov esi, dword [ebx + 0x438]
mov edi, dword [ebx + 0x43c]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov dword [ebx + 0x440], eax
mov al, 1
adc edx, edi
mov dword [ebx + 0x444], edx
jmp 0x405324
Function at 0x40609e
Capabilities:
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
mov esi, ecx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp dword [esi + 8], 0xffffffff
je 0x406112
lea ecx, [ebp - 4]
push ecx
push 0x4004667f
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x4060d8
mov ecx, esi
call fcn.00403acf
mov eax, edi
jmp 0x406115
mov eax, dword [ebp - 4]
test eax, eax
jne 0x406115
mov eax, dword [esi + 8]
xor ecx, ecx
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xc]
push eax
push ecx
push ecx
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], edi
push eax
push ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x3e8
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x4060d4
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x40614f
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
xor edx, edx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
mov ebx, ecx
test edi, edi
je 0x406164
mov dword [edi], edx
mov eax, dword [esp + 0x30]
mov dword [eax], edx
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4062c8
cmp dword [ebx + 8], 0xffffffff
je 0x4062c8
push dword [esp + 0x38]
mov dword [esp + 0x18], edx
mov ebp, edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
call fcn.00406323
mov esi, dword [esp + 0x2c]
jmp 0x406285
cmp byte [ebx + 0x435], 0
jne 0x4062f9
mov ecx, ebx
call fcn.0040609e
mov ecx, eax
test ecx, ecx
jne 0x4061d4
mov ecx, ebx
call fcn.00406119
test al, al
jne 0x4062b3
push 1
jmp 0x40627f
mov edx, 0x400000
mov eax, esi
cmp esi, edx
cmova eax, edx
cmp eax, ecx
cmova eax, ecx
mov dword [esp + 0x18], eax
xor eax, eax
push eax
push eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x40]
push eax
push 1
lea eax, [esp + 0x2c]
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x40625d
cmp dword [esp + 0x34], eax
je 0x40625d
push dword [esp + 0x38]
xor ecx, ecx
mov dword [esp + 0x2c], ecx
mov ecx, ebx
call fcn.00406323
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
sub esi, eax
add dword [esp + 0x1c], eax
add dword [ecx], eax
cmp byte [esp + 0x3c], 0
je 0x406285
mov ecx, dword [ebx + 0x428]
test ecx, ecx
je 0x406285
push eax
push dword [ebx + 0x430]
push dword [ebx + 0x42c]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x406285
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x4062d4
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x28], eax
cmp eax, 0x7d0
je 0x4062f5
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x4061a4
mov esi, dword [ebx + 0x438]
mov edi, dword [ebx + 0x43c]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov dword [ebx + 0x440], eax
mov al, 1
adc edx, edi
mov dword [ebx + 0x444], edx
jmp 0x4062ca
push str.raw___read_timeout
lea ecx, [ebx + 0x228]
mov edx, 0xff
call fcn.00403dea
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x18
mov eax, dword [ebx + 8]
push dword [esp + 0x18]
lea eax, [ebx + 0x228]
push ebp
push str.raw___receive_failed___u_error___u_bytes_requested
push 0xff
push eax
call fcn.00403c23
add esp, 0x14
test esi, esi
je 0x40628d
push esi
push ebp
push str.raw___read_failed___u_error___zu_bytes_needed
lea eax, [ebx + 0x228]
push 0xff
push eax
call fcn.00403c23
add esp, 0x14
test edi, edi
je 0x40631a
mov dword [edi], ebp
mov ecx, ebx
call fcn.00403acf
jmp 0x4062c8
Function at 0x40635c
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebx, ecx
push edi
xor edi, edi
test esi, esi
je 0x406371
mov dword [esi], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4064a8
cmp dword [ebx + 8], 0xffffffff
je 0x4064a8
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
test ebp, ebp
je 0x406453
cmp byte [ebx + 0x435], 0
jne 0x406479
mov esi, dword [ebx + 0x438]
mov dword [esp + 0x28], edi
mov edi, dword [ebx + 0x43c]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov esi, 0x200000
mov dword [ebx + 0x440], eax
mov eax, ebp
adc edx, edi
cmp ebp, esi
mov dword [ebx + 0x444], edx
cmova eax, esi
xor edi, edi
push edi
push edi
push edi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x34]
push eax
push 1
lea eax, [esp + 0x2c]
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x406435
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov dword [esp + 0x24], edi
cmp edi, 0x2733
jne 0x40644f
mov esi, dword [esp + 0x14]
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x7d0
je 0x40644b
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x406443
mov eax, dword [esp + 0x28]
sub ebp, eax
add dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
test ebp, ebp
jne 0x4063a3
mov edi, dword [esp + 0x24]
test ebp, ebp
jne 0x40647d
mov esi, dword [ebx + 0x438]
mov edi, dword [ebx + 0x43c]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov dword [ebx + 0x440], eax
mov al, 1
adc edx, edi
mov dword [ebx + 0x444], edx
jmp 0x4064aa
mov edi, dword [esp + 0x24]
push ebp
push str.raw___send_failed___zu_bytes_needed
lea eax, [ebx + 0x228]
push 0xff
push eax
call fcn.00403c23
mov esi, dword [esp + 0x3c]
add esp, 0x10
test esi, esi
je 0x4064a1
mov dword [esi], edi
mov ecx, ebx
call fcn.00403acf
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x40727b
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x444c
call fcn.0041bae0
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x240]
mov esi, edx
call fcn.00403625
push 8
pop ecx
xor eax, eax
lea edi, [esp + 0x20]
push 0x4000
rep stosd dword es:[edi], eax
xor ebx, ebx
lea eax, [esp + 0x45c]
push ebx
push eax
call fcn.0041c9b0
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [esp + 0x10], ebx
mov dword [esi + 8], ebx
test eax, eax
je 0x4072cd
xor ecx, ecx
mov word [eax], cx
push 0x43
lea eax, [esp + 0x244]
push str.._c:
push eax
call fcn.004011fb
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push dword [esp + 0x25c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
cmp edi, 0xffffffff
je 0x407333
push ebx
lea eax, [esp + 0x14]
push eax
push 0x20
lea eax, [esp + 0x2c]
push eax
push ebx
push ebx
push 0x560000
push edi
call ebp
push edi
test eax, eax
jne 0x40732d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40749a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x28]
lea eax, [esp + 0x244]
push str..PHYSICALDRIVE_u
push eax
call fcn.004011fb
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push dword [esp + 0x25c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x407482
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x20], ebx
push eax
push 0x4000
lea eax, [esp + 0x464]
mov dword [esp + 0x20], ebx
push eax
push 0xc
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], ebx
push eax
push 0x2d1400
push edi
call ebp
test eax, eax
je 0x40747b
cmp dword [esp + 0x10], 0x28
jb 0x40747b
mov ebp, 0x100
lea eax, [esp + 0x140]
push ebp
push ebx
push eax
call fcn.0041c9b0
push ebp
lea eax, [esp + 0x50]
push ebx
push eax
call fcn.0041c9b0
mov eax, dword [esp + 0x47c]
add esp, 0x18
test eax, eax
je 0x4073fb
lea ecx, [esp + 0x458]
push 0xff
add eax, ecx
push eax
lea eax, [esp + 0x148]
push ebp
push eax
call fcn.00428ac3
add esp, 0x10
mov eax, dword [esp + 0x468]
test eax, eax
je 0x407423
lea ecx, [esp + 0x458]
push 0xff
add eax, ecx
push eax
lea eax, [esp + 0x48]
push ebp
push eax
call fcn.00428ac3
add esp, 0x10
mov ebp, 0x46fca4
cmp byte [esp + 0x140], bl
je 0x407466
cmp byte [esp + 0x40], bl
je 0x407454
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x144]
push eax
push str._S__S
push esi
call fcn.004011fb
add esp, 0x10
jmp 0x40747b
lea eax, [esp + 0x140]
push eax
push ebp
push esi
call fcn.004011fb
add esp, 0xc
cmp byte [esp + 0x40], bl
je 0x40747b
lea eax, [esp + 0x40]
push eax
push ebp
push esi
call fcn.004011fb
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
cmp dword [esi + 8], eax
jb 0x407496
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x407496
cmp word [ecx], bx
jne 0x407498
mov al, bl
mov bl, al
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x444c
ret
Function at 0x407d37
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00403625
push dword [esp + 0x14]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x407d65
xor al, al
jmp 0x407d8f
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x407d83
push dword [esp + 0x14]
push ecx
call fcn.0041e7bc
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
jmp 0x407d88
and dword [esp + 0x10], 0
mov edx, esi
call fcn.00407979
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407f95
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x4014
call fcn.0041bae0
push ebx
push ebp
push esi
push edi
mov edi, edx
xor ebp, ebp
mov eax, dword [edi + 4]
mov dword [edi + 8], ebp
test eax, eax
je 0x407fb6
xor edx, edx
mov word [eax], dx
push ebp
push ebp
push 3
push ebp
push 3
push ebp
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40803a
mov ebx, 0x4000
mov dword [esp + 0x10], ebp
push ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x20], ebp
push ebp
push eax
call fcn.0041c9b0
add esp, 0xc
mov dword [esp + 0x14], ebp
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ebp
push ebp
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x408033
mov eax, dword [esp + 0x10]
cmp eax, 0x28
jb 0x408033
lea edx, [esp + 0x20]
lea ecx, [esp + 0x20]
add edx, eax
add ecx, dword [esp + 0x38]
push edi
call fcn.00408166
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4014
ret

Function at 0x4087b3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00403625
push dword [esp + 0x14]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4087e1
xor al, al
jmp 0x40880b
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4087ff
push dword [esp + 0x14]
push ecx
call fcn.0041e7bc
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
jmp 0x408804
and dword [esp + 0x10], 0
mov edx, esi
call fcn.004083f5
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408810
Capabilities:
Generate random numbers via winapi

Disassembly:
push ecx
push ecx
push ebp
push esi
mov esi, ecx
mov ebp, edx
test esi, esi
je 0x4088e9
push ebx
push edi
push 0
call fcn.0042a4e8
pop ecx
push 2
mov edi, eax
mov ebx, edx
push 8
lea eax, [esp + 0x18]
add edi, 0xab5b7200
push eax
push 0
adc ebx, 0xffffffff
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
je 0x40885e
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
jmp 0x408862
mov ecx, dword [esp + 0x10]
and ecx, 0x1ffffff
xor eax, eax
or ecx, ebx
or eax, edi
or ecx, 0x44000000
push ecx
push eax
push str._I64u
push 0xffffffffffffffff
push ebp
push esi
call fcn.00401ea4
add esp, 0x18
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
call fcn.00403d3e
mov edi, str.SOFTWAREMetaQuotes_Software
test al, al
jne 0x4088a7
push ecx
mov edx, edi
mov ecx, ebx
call fcn.00403ce6
pop ecx
push ecx
push esi
push ecx
mov ebp, 0x46d090
mov edx, edi
push ebp
mov ecx, ebx
call fcn.00403c5f
add esp, 0x10
mov ebx, closesocket
mov ecx, ebx
call fcn.00403d3e
test al, al
jne 0x4088d7
push ecx
mov edx, edi
mov ecx, ebx
call fcn.00403ce6
pop ecx
push ecx
push esi
push ecx
push ebp
mov edx, edi
mov ecx, ebx
call fcn.00403c5f
add esp, 0x10
pop edi
pop ebx
pop esi
pop ebp
pop ecx
pop ecx
ret

Function at 0x40893d
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
xor eax, eax
push esi
mov dword [ebp - 4], eax
mov esi, 0x100
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x214]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4089af
push 3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.004290da
add esp, 0x10
xor eax, eax
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x214]
push esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x4092f9
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
push edi
test esi, esi
je 0x409320
xor edi, edi
cmp word [esi], di
je 0x409320
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409325
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x409345
xor al, al
pop edi
pop esi
ret
test al, 0x10
jne 0x409336
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x409320
jmp 0x409314
test al, 1
je 0x409345
xor eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 1
jmp 0x409322

Function at 0x40951b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
call fcn.004089b2
cmp eax, 0x258
jl 0x409580
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409580
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.EnableLUA
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x409585
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop ebx
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 4
jne 0x409598
cmp dword [ebp - 8], ebx
je 0x409598
mov bl, 1
mov al, bl
jmp 0x409582
Function at 0x40e31f
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x20
or dword [esp + 0x14], 0xffffffff
push ebx
push ebp
push esi
push edi
push ecx
push 3
mov ebx, ecx
mov dword [esp + 0x28], 0x4679a8
push 3
push closesocket
push dword [esp + 0x44]
and dword [ebx + 8], 0
lea ecx, [esp + 0x34]
and dword [ebx + 0xc], 0
mov dword [esp + 0x3c], ebx
call fcn.00401442
mov esi, dword [esp + 0x24]
test al, al
je 0x40e4ad
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
cmp esi, 0xffffffff
je 0x40e38c
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40e38c
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
jmp 0x40e39d
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov ecx, edi
mov eax, ebp
add ecx, 2
adc eax, 0
push eax
push ecx
mov ecx, ebx
call fcn.00403a14
test al, al
je 0x40e49e
cmp esi, 0xffffffff
je 0x40e464
mov eax, dword [ebx]
test eax, eax
je 0x40e464
test ebp, ebp
jne 0x40e3d8
cmp edi, 1
jb 0x40e464
xorps xmm0, xmm0
mov ebx, eax
movlpd qword [esp + 0x20], xmm0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], edx
mov dword [esp + 0x34], ecx
and dword [esp + 0x18], 0
mov eax, edi
sub eax, ecx
mov dword [esp + 0x20], eax
mov eax, ebp
sbb eax, edx
test eax, eax
jb 0x40e41b
ja 0x40e414
cmp dword [esp + 0x20], 0xfffffff
jbe 0x40e41b
mov eax, 0xfffffff
jmp 0x40e41f
mov eax, edi
sub eax, ecx
push 0
lea edx, [esp + 0x1c]
push edx
push eax
lea eax, [ecx + ebx]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x14]
test eax, eax
je 0x40e45e
cmp dword [esp + 0x18], 0
je 0x40e45e
add ecx, dword [esp + 0x18]
mov dword [esp + 0x34], ecx
adc edx, 0
mov dword [esp + 0x14], edx
cmp edx, ebp
jb 0x40e3f3
ja 0x40e45e
cmp ecx, edi
jb 0x40e3f3
mov ebx, dword [esp + 0x28]
jmp 0x40e475
xorps xmm0, xmm0
movlpd qword [esp + 0x28], xmm0
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
cmp ecx, edi
jne 0x40e49e
cmp edx, ebp
jne 0x40e49e
cmp esi, 0xffffffff
je 0x40e48c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov ecx, ebx
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], ebp
call fcn.004039c8
xor ebx, ebx
inc ebx
jmp 0x40e4af
cmp esi, 0xffffffff
je 0x40e4ad
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
xor bl, bl
cmp esi, 0xffffffff
je 0x40e4bb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x20
ret 0xc