joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b43
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x403b7b
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
jne 0x403b6e
xor al, al
jmp 0x403b9f
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
lea eax, [ebp - 4]
push eax
push 0x10000
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
push 0
call fcn.0042a9fc
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
setne al
pop esi
leave
ret 0xc

Function at 0x403ca3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
test ecx, ecx
je 0x403d0c
test edx, edx
je 0x403d0c
cmp dword [ebp + 8], 0
je 0x403d0c
cmp dword [ebp + 0x10], 0
je 0x403d0c
cmp dword [ebp + 0x14], 0
je 0x403d0c
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20106
push ebx
push edx
push ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403d07
push esi
push dword [ebp + 0x14]
xor esi, esi
push dword [ebp + 0x10]
inc esi
push esi
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
movzx ebx, bl
cmove ebx, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
leave
ret
xor al, al
leave
ret

Function at 0x403dd1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x403e43
cmp dword [ebp + 0x10], 4
jb 0x403e43
xor ebx, ebx
mov dword [esi], ebx
test ecx, ecx
je 0x403e43
test edx, edx
je 0x403e43
cmp dword [ebp + 8], ebx
je 0x403e43
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
mov eax, dword [ebp + 0x14]
or eax, 0x20019
mov dword [ebp - 4], ebx
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403e3f
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
cmove ebx, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x403e45
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x404baf
Capabilities:
Decrypt data via sspi

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xfac]
test ecx, ecx
je 0x404da7
mov edi, dword [esi + 0xfb0]
test edi, edi
je 0x404da7
mov eax, dword [esi + 0xfb8]
xorps xmm0, xmm0
sub edi, eax
movlpd qword [esp + 0x34], xmm0
xor ebx, ebx
movlpd qword [esp + 0x40], xmm0
inc ebx
mov dword [esp + 0x20], edi
lea ebp, [eax + ecx]
mov dword [esp + 0x24], ebx
xor eax, eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], eax
lea eax, [esi + 0xf84]
push eax
mov dword [esp + 0x1c], 4
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esi + 0xf9c]
push eax
call dword [sym.imp.Secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x404d6f
cmp eax, 0x90317
jne 0x404ca4
cmp dword [esi + 8], 0xffffffff
mov eax, dword [esi + 0xfb8]
mov dword [esi + 0xfb0], eax
je 0x404ce2
push str.tls___socket_closed_in_decrypt_message
lea ecx, [esi + 0x228]
mov edx, 0xff
call fcn.00403e49
push 2
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 8], 0xffffffff
jmp 0x404ce2
cmp eax, 0x80090308
jne 0x404cc2
push str.tls___invalid_token_in_decrypt_message
lea ecx, [esi + 0x228]
mov edx, 0xff
call fcn.00403e49
jmp 0x404ce0
test eax, eax
je 0x404cf4
push eax
push str.tls___decrypt_message_failed___d_status
lea eax, [esi + 0x228]
push 0xff
push eax
call fcn.00403c67
add esp, 0x10
xor bl, bl
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
jmp 0x404da9
push 4
lea edi, [esp + 0x24]
pop ebp
cmp dword [edi + 4], ebx
jne 0x404d22
push dword [edi]
mov eax, dword [esi + 0xfac]
push dword [edi + 8]
add eax, dword [esi + 0xfb8]
push eax
call fcn.0041c780
mov eax, dword [edi]
add esp, 0xc
add dword [esi + 0xfb8], eax
add edi, 0xc
sub ebp, 1
jne 0x404cfb
push 5
pop eax
cmp dword [esp + 0x24], eax
jne 0x404d3d
lea edi, [esp + 0x20]
lea eax, [esp + 0x28]
jmp 0x404d6b
cmp dword [esp + 0x30], eax
jne 0x404d4d
lea edi, [esp + 0x2c]
lea eax, [esp + 0x34]
jmp 0x404d6b
cmp dword [esp + 0x3c], eax
jne 0x404d5d
lea edi, [esp + 0x38]
lea eax, [esp + 0x40]
jmp 0x404d6b
cmp dword [esp + 0x48], eax
jne 0x404da3
lea edi, [esp + 0x44]
lea eax, [esp + 0x4c]
mov ebp, dword [eax]
mov edi, dword [edi]
test edi, edi
je 0x404d8a
mov eax, dword [esi + 0xfac]
add eax, dword [esi + 0xfb8]
push edi
push ebp
push eax
call fcn.0041c780
add esp, 0xc
mov ecx, dword [esi + 0xfb8]
lea eax, [esi + 0xf84]
add ecx, edi
mov dword [esi + 0xfb0], ecx
jmp 0x404ce6
xor edi, edi
jmp 0x404d8a
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x405067
Capabilities:
Encrypt data via sspi

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x50]
mov esi, ecx
test edi, edi
je 0x405144
mov ecx, dword [esi + 0xfc4]
mov edx, dword [esi + 0xfc0]
lea eax, [edx + ecx]
cmp dword [esp + 0x54], eax
jb 0x405144
mov ebp, dword [esp + 0x58]
lea eax, [edx + edi]
mov dword [esp + 0x30], eax
xor ebx, ebx
mov eax, dword [esp + 0x54]
sub eax, edx
mov dword [esp + 0x40], ebx
sub eax, ecx
mov dword [ebp], ebx
mov dword [esp + 0x28], eax
mov eax, edi
sub eax, ecx
mov dword [esp + 0x48], ebx
add eax, dword [esp + 0x54]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x10], ebx
lea ebx, [esi + 0xf84]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 7
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 6
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esi + 0xf9c]
push eax
call dword [sym.imp.Secur32.dll_EncryptMessage]
test eax, eax
je 0x405150
push str.tls___encrypt_message_failed
lea ecx, [esi + 0x228]
mov edx, 0xff
call fcn.00403e49
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0xc
mov eax, dword [esp + 0x1c]
cmp eax, dword [esi + 0xfc0]
jae 0x40518b
push dword [esp + 0x28]
add eax, edi
push dword [esp + 0x34]
push eax
call fcn.0041c780
push dword [esp + 0x40]
mov eax, dword [esp + 0x38]
add eax, dword [esp + 0x2c]
push dword [esp + 0x4c]
add eax, edi
push eax
call fcn.0041c780
mov eax, dword [esp + 0x34]
add esp, 0x18
mov ecx, dword [esp + 0x34]
add ecx, dword [esp + 0x28]
add ecx, eax
push ebx
mov dword [ebp], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x405146
Function at 0x405c82
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x120
xor eax, eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x228]
mov word [edi], ax
cmp byte [esi + 0x435], al
je 0x405ca8
xor al, al
jmp 0x405e67
call fcn.00403b0b
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push 1
push ebx
push ebx
movzx eax, word [ebp]
push 6
push 1
push eax
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x405ce4
push str.socket_create_failed
mov edx, 0xff
mov ecx, edi
call fcn.00403e49
jmp 0x405ca1
lea eax, [esi + 0x440]
cmp dword [eax], ebx
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
jbe 0x405d06
push 4
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call ebx
lea eax, [esi + 0x444]
cmp dword [eax], 0
jbe 0x405d23
push 4
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call ebx
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100000
push eax
push 0x1002
push 0xffff
push dword [esi + 8]
mov dword [esp + 0x2c], 0x40000
call ebx
push 4
lea eax, [esp + 0x1c]
push eax
push 0x1001
push 0xffff
push dword [esi + 8]
call ebx
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push 8
push 0xffff
push dword [esi + 8]
call ebx
mov eax, dword [esi]
xor ebx, ebx
inc ebx
mov ecx, esi
push ebx
call dword [eax + 0x1c]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
mov ebx, dword [sym.imp.WS2_32.dll_ioctlsocket]
push eax
push 0x8004667e
push dword [esi + 8]
call ebx
xor eax, eax
cmp word [ebp], 0x17
push eax
push eax
push eax
push eax
push 0x10
pop eax
push 0x1c
pop ecx
cmove eax, ecx
push eax
push ebp
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
jne 0x405e51
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x405e19
mov ecx, dword [esi + 8]
xor edx, edx
mov eax, dword [esp + 0x138]
mov dword [esp + 0x2c], ecx
mov ecx, 0x3e8
div ecx
xor ecx, ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], eax
imul eax, edx, 0x3e8
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push ecx
lea eax, [esp + 0x30]
push eax
push ecx
push ecx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x405e51
mov ecx, esi
call fcn.00403b0b
push str.connect_failed
mov edx, 0xff
mov ecx, edi
call fcn.00403e49
lea eax, [esi + 0x28]
push eax
push str._s_direct_connect_failed
push str.Socket
push 0x4b9590
call fcn.004456b9
add esp, 0x10
jmp 0x405ca1
and dword [esp + 0x10], 0
lea ecx, [esp + 0x10]
push ecx
push 0x8004667e
push dword [esi + 8]
call ebx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret 0xc
Function at 0x4074b0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x444c
call fcn.0041be30
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x240]
mov esi, edx
call fcn.00403638
push 8
pop ecx
xor eax, eax
lea edi, [esp + 0x20]
push 0x4000
rep stosd dword es:[edi], eax
xor ebx, ebx
lea eax, [esp + 0x45c]
push ebx
push eax
call fcn.0041cd00
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [esp + 0x10], ebx
mov dword [esi + 8], ebx
test eax, eax
je 0x407502
xor ecx, ecx
mov word [eax], cx
push 0x43
lea eax, [esp + 0x244]
push str.._c:
push eax
call fcn.004011fb
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push dword [esp + 0x25c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
cmp edi, 0xffffffff
je 0x407568
push ebx
lea eax, [esp + 0x14]
push eax
push 0x20
lea eax, [esp + 0x2c]
push eax
push ebx
push ebx
push 0x560000
push edi
call ebp
push edi
test eax, eax
jne 0x407562
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4076cf
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x28]
lea eax, [esp + 0x244]
push str..PHYSICALDRIVE_u
push eax
call fcn.004011fb
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push dword [esp + 0x25c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4076b7
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x20], ebx
push eax
push 0x4000
lea eax, [esp + 0x464]
mov dword [esp + 0x20], ebx
push eax
push 0xc
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], ebx
push eax
push 0x2d1400
push edi
call ebp
test eax, eax
je 0x4076b0
cmp dword [esp + 0x10], 0x28
jb 0x4076b0
mov ebp, 0x100
lea eax, [esp + 0x140]
push ebp
push ebx
push eax
call fcn.0041cd00
push ebp
lea eax, [esp + 0x50]
push ebx
push eax
call fcn.0041cd00
mov eax, dword [esp + 0x47c]
add esp, 0x18
test eax, eax
je 0x407630
lea ecx, [esp + 0x458]
push 0xff
add eax, ecx
push eax
lea eax, [esp + 0x148]
push ebp
push eax
call fcn.00428e13
add esp, 0x10
mov eax, dword [esp + 0x468]
test eax, eax
je 0x407658
lea ecx, [esp + 0x458]
push 0xff
add eax, ecx
push eax
lea eax, [esp + 0x48]
push ebp
push eax
call fcn.00428e13
add esp, 0x10
mov ebp, 0x46fcec
cmp byte [esp + 0x140], bl
je 0x40769b
cmp byte [esp + 0x40], bl
je 0x407689
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x144]
push eax
push str._S__S
push esi
call fcn.004011fb
add esp, 0x10
jmp 0x4076b0
lea eax, [esp + 0x140]
push eax
push ebp
push esi
call fcn.004011fb
add esp, 0xc
cmp byte [esp + 0x40], bl
je 0x4076b0
lea eax, [esp + 0x40]
push eax
push ebp
push esi
call fcn.004011fb
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
cmp dword [esi + 8], eax
jb 0x4076cb
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4076cb
cmp word [ecx], bx
jne 0x4076cd
mov al, bl
mov bl, al
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x444c
ret
Function at 0x407958
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push esi
push edi
push str.Windows
mov edi, edx
mov esi, ecx
call fcn.0040349c
push 0x118
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0041cd00
add esp, 0xc
mov dword [ebp - 0x124], 0x11c
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4079aa
xor al, al
jmp 0x407ba9
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x120]
test edi, edi
je 0x4079c1
imul eax, edx, 0x64
add eax, ecx
mov dword [edi], eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x4079d0
mov eax, dword [ebp - 0x118]
mov dword [edi], eax
xor ebx, ebx
inc ebx
cmp edx, 6
jne 0x407a20
sub ecx, 0
je 0x407a14
sub ecx, ebx
je 0x407a08
sub ecx, ebx
je 0x4079fc
sub ecx, ebx
jne 0x407a8c
mov eax, str.Windows_8.1
mov ecx, str.Windows_Server_2012_R2
jmp 0x407a7e
mov eax, str.Windows_8
mov ecx, str.Windows_Server_2012
jmp 0x407a7e
mov eax, str.Windows_7
mov ecx, str.Windows_Server_2008_R2
jmp 0x407a7e
mov eax, str.Windows_Vista
mov ecx, str.Windows_Server_2008
jmp 0x407a7e
cmp edx, 0xa
jne 0x407a6f
cmp byte [ebp - 0xa], bl
jne 0x407a43
cmp dword [ebp - 0x118], 0x55f0
mov eax, str.Windows_10
mov ecx, str.Windows_11
cmovae eax, ecx
jmp 0x407a84
cmp dword [ebp - 0x118], 0x4f7c
jb 0x407a56
mov eax, str.Windows_Server_2022
jmp 0x407a84
cmp dword [ebp - 0x118], 0x3839
mov eax, str.Windows_Server_2019
mov ecx, str.Windows_Server_2016
cmovbe eax, ecx
jmp 0x407a84
cmp edx, 0xb
jne 0x407a8c
mov eax, str.Windows_11
mov ecx, str.Windows_Server_2022
cmp byte [ebp - 0xa], bl
cmovne eax, ecx
push eax
mov ecx, esi
call fcn.0040349c
and dword [ebp - 0x22c], 0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x230], eax
xor eax, eax
cmp word [ebp - 0x110], ax
mov word [ebp - 0x224], ax
movzx eax, word [ebp - 0x118]
mov dword [ebp - 0x228], 0x80
mov dword [ebp - 0x234], 0x46fc48
push eax
jne 0x407ae3
lea eax, [ebp - 0x234]
push 0x46fc4c
push eax
call fcn.004011fb
add esp, 0xc
jmp 0x407afe
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x234]
push str.__s_build__d
push eax
call fcn.004011fb
add esp, 0x10
mov edx, dword [esi + 4]
test edx, edx
je 0x407b45
mov ecx, dword [ebp - 0x22c]
test ecx, ecx
je 0x407b45
mov edi, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, dword [esi + 0xc]
jae 0x407b45
lea eax, [ecx + ecx]
push eax
push dword [ebp - 0x230]
lea eax, [edx + edi*2]
push eax
call fcn.0041c780
mov eax, dword [ebp - 0x22c]
add esp, 0xc
add dword [esi + 8], eax
xor edx, edx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x234]
call fcn.0040791d
test al, al
je 0x407ba7
push str._on
mov ecx, esi
call fcn.00403846
mov edx, dword [esi + 4]
test edx, edx
je 0x407ba7
mov ecx, dword [ebp - 0x22c]
test ecx, ecx
je 0x407ba7
mov edi, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, dword [esi + 0xc]
jae 0x407ba7
lea eax, [ecx + ecx]
push eax
push dword [ebp - 0x230]
lea eax, [edx + edi*2]
push eax
call fcn.0041c780
mov ecx, dword [ebp - 0x22c]
add esp, 0xc
add dword [esi + 8], ecx
mov edx, dword [esi + 8]
mov ecx, dword [esi + 4]
xor esi, esi
mov word [ecx + edx*2], si
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407f6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00403638
push dword [esp + 0x14]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x407f9a
xor al, al
jmp 0x407fc4
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x407fb8
push dword [esp + 0x14]
push ecx
call fcn.0041eb0c
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
jmp 0x407fbd
and dword [esp + 0x10], 0
mov edx, esi
call fcn.00407bae
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4081ca
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x4014
call fcn.0041be30
push ebx
push ebp
push esi
push edi
mov edi, edx
xor ebp, ebp
mov eax, dword [edi + 4]
mov dword [edi + 8], ebp
test eax, eax
je 0x4081eb
xor edx, edx
mov word [eax], dx
push ebp
push ebp
push 3
push ebp
push 3
push ebp
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40826f
mov ebx, 0x4000
mov dword [esp + 0x10], ebp
push ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x20], ebp
push ebp
push eax
call fcn.0041cd00
add esp, 0xc
mov dword [esp + 0x14], ebp
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ebp
push ebp
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x408268
mov eax, dword [esp + 0x10]
cmp eax, 0x28
jb 0x408268
lea edx, [esp + 0x20]
lea ecx, [esp + 0x20]
add edx, eax
add ecx, dword [esp + 0x38]
push edi
call fcn.0040839b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4014
ret

Function at 0x4089e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00403638
push dword [esp + 0x14]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x408a16
xor al, al
jmp 0x408a40
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x408a34
push dword [esp + 0x14]
push ecx
call fcn.0041eb0c
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
jmp 0x408a39
and dword [esp + 0x10], 0
mov edx, esi
call fcn.0040862a
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408a45
Capabilities:
Generate random numbers via winapi

Disassembly:
push ecx
push ecx
push ebp
push esi
mov esi, ecx
mov ebp, edx
test esi, esi
je 0x408b1e
push ebx
push edi
push 0
call fcn.0042a838
pop ecx
push 2
mov edi, eax
mov ebx, edx
push 8
lea eax, [esp + 0x18]
add edi, 0xab5b7200
push eax
push 0
adc ebx, 0xffffffff
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
je 0x408a93
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
jmp 0x408a97
mov ecx, dword [esp + 0x10]
and ecx, 0x1ffffff
xor eax, eax
or ecx, ebx
or eax, edi
or ecx, 0x44000000
push ecx
push eax
push str._I64u
push 0xffffffffffffffff
push ebp
push esi
call fcn.00401ea4
add esp, 0x18
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
call fcn.00403d9d
mov edi, str.SOFTWAREMetaQuotes_Software
test al, al
jne 0x408adc
push ecx
mov edx, edi
mov ecx, ebx
call fcn.00403d45
pop ecx
push ecx
push esi
push ecx
mov ebp, 0x46d090
mov edx, edi
push ebp
mov ecx, ebx
call fcn.00403d10
add esp, 0x10
mov ebx, closesocket
mov ecx, ebx
call fcn.00403d9d
test al, al
jne 0x408b0c
push ecx
mov edx, edi
mov ecx, ebx
call fcn.00403d45
pop ecx
push ecx
push esi
push ecx
push ebp
mov edx, edi
mov ecx, ebx
call fcn.00403d10
add esp, 0x10
pop edi
pop ebx
pop esi
pop ebp
pop ecx
pop ecx
ret

Function at 0x408b72
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
xor eax, eax
push esi
mov dword [ebp - 4], eax
mov esi, 0x100
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x214]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x408be4
push 3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.0042942a
add esp, 0x10
xor eax, eax
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x214]
push esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x40e55f
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x20
or dword [esp + 0x14], 0xffffffff
push ebx
push ebp
push esi
push edi
push ecx
push 3
mov ebx, ecx
mov dword [esp + 0x28], 0x4679a8
push 3
push closesocket
push dword [esp + 0x44]
and dword [ebx + 8], 0
lea ecx, [esp + 0x34]
and dword [ebx + 0xc], 0
mov dword [esp + 0x3c], ebx
call fcn.00401442
mov esi, dword [esp + 0x24]
test al, al
je 0x40e6ed
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
cmp esi, 0xffffffff
je 0x40e5cc
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40e5cc
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
jmp 0x40e5dd
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov ecx, edi
mov eax, ebp
add ecx, 2
adc eax, 0
push eax
push ecx
mov ecx, ebx
call fcn.00403a50
test al, al
je 0x40e6de
cmp esi, 0xffffffff
je 0x40e6a4
mov eax, dword [ebx]
test eax, eax
je 0x40e6a4
test ebp, ebp
jne 0x40e618
cmp edi, 1
jb 0x40e6a4
xorps xmm0, xmm0
mov ebx, eax
movlpd qword [esp + 0x20], xmm0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], edx
mov dword [esp + 0x34], ecx
and dword [esp + 0x18], 0
mov eax, edi
sub eax, ecx
mov dword [esp + 0x20], eax
mov eax, ebp
sbb eax, edx
test eax, eax
jb 0x40e65b
ja 0x40e654
cmp dword [esp + 0x20], 0xfffffff
jbe 0x40e65b
mov eax, 0xfffffff
jmp 0x40e65f
mov eax, edi
sub eax, ecx
push 0
lea edx, [esp + 0x1c]
push edx
push eax
lea eax, [ecx + ebx]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x14]
test eax, eax
je 0x40e69e
cmp dword [esp + 0x18], 0
je 0x40e69e
add ecx, dword [esp + 0x18]
mov dword [esp + 0x34], ecx
adc edx, 0
mov dword [esp + 0x14], edx
cmp edx, ebp
jb 0x40e633
ja 0x40e69e
cmp ecx, edi
jb 0x40e633
mov ebx, dword [esp + 0x28]
jmp 0x40e6b5
xorps xmm0, xmm0
movlpd qword [esp + 0x28], xmm0
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
cmp ecx, edi
jne 0x40e6de
cmp edx, ebp
jne 0x40e6de
cmp esi, 0xffffffff
je 0x40e6cc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov ecx, ebx
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], ebp
call fcn.00403a04
xor ebx, ebx
inc ebx
jmp 0x40e6ef
cmp esi, 0xffffffff
je 0x40e6ed
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
xor bl, bl
cmp esi, 0xffffffff
je 0x40e6fb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x20
ret 0xc
Function at 0x40ea2b
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x660
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x24], 0x10
jbe 0x40eaff
push 0x250
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0041cd00
add esp, 0xc
lea ecx, [esp + 0x258]
call fcn.004049dc
push dword [esi + 0x20]
mov eax, ecx
push str._s.
push eax
call fcn.004011fb
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0x260]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40eaf4
test byte [esp + 8], 0x10
jne 0x40ead4
lea eax, [esp + 0x34]
push eax
push dword [esi + 0x20]
lea eax, [esp + 0x260]
push 0x470fa8
push eax
call fcn.004011fb
add esp, 0x10
mov ecx, esi
push dword [esp + 0x25c]
call fcn.0040e707
test al, al
je 0x40ead4
push dword [esp + 0x25c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [esi + 0xce79], 0
jne 0x40eaed
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40ea91
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esi + 0x95d8]
mov eax, dword [ecx]
call dword [eax + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret