joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456da0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x48000]
push edi
jmp 0x456dba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x456dc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x456db0
mov eax, 1
add ebx, ebx
jne 0x456dd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x456dc8
jne 0x456de4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x456dc8
xor ecx, ecx
sub eax, 3
jb 0x456df8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x456e6a
mov ebp, eax
add ebx, ebx
jne 0x456e03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x456e10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x456e34
inc ecx
add ebx, ebx
jne 0x456e20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x456e15
jne 0x456e31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x456e15
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x456e54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x456e45
jmp 0x456db6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x456e54
add edi, ecx
jmp 0x456db6
pop esi
mov edi, esi
mov ecx, 0x6f7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x456e72
cmp byte [edi], 7
jne 0x456e72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x456e77
lea edi, [esi + 0x42000]
mov eax, dword [edi]
or eax, eax
je 0x456ee6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x57970]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x57bb4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x456ea4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x57bb8]
or eax, eax
je 0x456ee0
mov dword [ebx], eax
add ebx, 4
jmp 0x456ec1
call dword [esi + 0x57bc8]
mov ebp, dword [esi + 0x57bbc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x456f1a
sub esp, 0xffffff80
jmp 0x4145c0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x648f2588
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7ff93b51
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430005
Capabilities:
Check for vm using instruction vpcext
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x2d8f13f0
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..pdata
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x3cba2acc
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ef
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x2070210
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.02070360
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x2070236
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2070222
add dl, dl
jne 0x2070241
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2070294
xor eax, eax
add dl, dl
jne 0x207024e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2070335
add dl, dl
jne 0x207025d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2070268
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2070273
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x207027e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x207028a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x207022d
mov eax, 1
add dl, dl
jne 0x20702a2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20702ad
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2070299
sub eax, ebx
mov ebx, 1
jne 0x20702e0
mov ecx, 1
add dl, dl
jne 0x20702c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x20702d1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x20702bd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x207022d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x20702f7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2070302
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x20702ee
cmp eax, 0x7d00
jae 0x2070325
cmp eax, 0x500
jb 0x2070320
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x207022d
cmp eax, 0x7f
ja 0x2070328
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x207022d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x2070356
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x207022d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push 0x407357
call sub.kernel32.dll_LoadLibraryA
push 0x407362
push eax
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x401058
mov dword [0x409765], eax
push 0xfffffffffffffffe
call dword [0x409765]
push eax
push 0
call sub.user32.dll_GetDC
mov ebx, eax
push 0x5a
push ebx
call sub.gdi32.dll_GetDeviceCaps
xchg ebx, eax
push eax
push 0
call sub.user32.dll_ReleaseDC
mov dword [0x4093d2], ebx
pop eax
push eax
call dword [0x409765]
jmp 0x4010ba
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x40737f
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x4010ba
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x4073a3
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
jne 0x4010b2
cmp dword [ebp - 0x10], 4
jne 0x4010b2
mov eax, dword [ebp - 8]
mov dword [0x4093d6], eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop ebx
leave
ret

Function at 0x40165f
Capabilities:
Create thread

Disassembly:
cmp dword [0x409ac8], 0
jne 0x4016db
push 0
call fcn.004055b5
or eax, eax
je 0x4016db
call fcn.00402b86
jne 0x401686
push 0x4097ab
call fcn.0040537a
jmp 0x4016db
push 0x4097bf
call fcn.0040537a
push 0x401cec
call fcn.00401baf
cmp dword [0x409ba0], 0
je 0x4016c2
cmp dword [0x409ba4], 0
jne 0x4016c2
push 0x4097b5
call fcn.0040537a
mov dword [0x409ba4], 0xffffffff
jmp 0x4016db
call fcn.00401d6b
push 0
push 0
push 0
push 0x40158d
push 0
push 0
call sub.kernel32.dll_CreateThread
ret

Function at 0x401b45
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_GetVolumePathNamesForVolumeNameA
or eax, eax
jne 0x401ba4
call sub.kernel32.dll_GetLastError
cmp eax, 0xea
jne 0x401ba4
cmp dword [ebp - 4], 0
jne 0x401b84
mov dword [ebp - 4], 0x1000
push dword [ebp - 4]
push 1
push dword [0x40e624]
call sub.kernel32.dll_HeapAlloc
mov esi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push ebx
call sub.kernel32.dll_GetVolumePathNamesForVolumeNameA
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4
Function at 0x401baf
Capabilities:
Enumerate disk volumes
Get disk information
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
mov dword [ebp - 0x50], 0
lea ebx, [ebp - 0x40]
push 0x40
push ebx
call sub.kernel32.dll_FindFirstVolumeA
mov esi, eax
push ebx
call fcn.00401b45
or eax, eax
je 0x401c1f
cmp ecx, 1
jbe 0x401c1f
push ecx
push eax
call fcn.00401b08
cmp al, 0x43
jae 0x401c1f
mov ah, 0x3a
mov dword [ebp - 0x54], eax
push 0x100
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_QueryDosDeviceA
or eax, eax
je 0x401c1f
mov edx, esi
mov ecx, 0xe
mov esi, 0x40745c
lea edi, [ebp - 0x154]
repe cmpsb byte [esi], byte es:[edi]
mov esi, edx
je 0x401c9a
push ebx
call sub.kernel32.dll_lstrlenA
mov byte [eax + ebx - 1], 0
push ebx
call fcn.004018da
cmp eax, 0xffffffff
je 0x401c9a
mov edi, eax
test dword [0x40e61c], 0xffffffff
je 0x401c7d
push 0
push 0x40e480
push 0xc
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x2d1080
push edi
call sub.kernel32.dll_DeviceIoControl
or eax, eax
je 0x401c94
cmp dword [0x40e480], 0xc
jne 0x401c94
cmp dword [ebp - 0x4c], 7
jne 0x401c94
mov eax, dword [ebp - 0x48]
cmp eax, dword [0x40e61c]
jne 0x401c94
inc dword [ebp - 0x50]
push dword [ebp - 0x50]
push ebx
push edi
call dword [ebp + 8]
or eax, eax
jne 0x401c94
push edi
call sub.kernel32.dll_CloseHandle
jmp 0x401cab
push edi
call sub.kernel32.dll_CloseHandle
push 0x40
push ebx
push esi
call sub.kernel32.dll_FindNextVolumeA
or eax, eax
jne 0x401bcf
push esi
call sub.kernel32.dll_FindVolumeClose
mov eax, dword [ebp - 0x50]
or eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x401d6b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [0x40e628], 0x8000000
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x40746a
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x401e00
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x4074a6
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
jne 0x401ddd
cmp dword [ebp - 0x10], 4
jne 0x401ddd
mov eax, dword [ebp - 8]
or dword [0x40e628], eax
or dword [ebp - 8], 4
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x4074a6
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret

Function at 0x401e02
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
test dword [0x40e628], 0x8000000
je 0x401e64
and dword [0x40e628], 0xf7ffffff
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x40746a
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x401e64
push 4
push 0x40e628
push 4
push 0
push 0x4074a6
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret
Function at 0x401fd0
Capabilities:
Hide graphical window

Disassembly:
mov dword [0x40e61c], 0
mov byte [0x40ec30], 0
push 0xffffffffffffffff
call fcn.004028e8
mov ebx, eax
cmp dword [0x40eff4], 2
je 0x4021f3
test dword [0x409ac8], 0xffffffff
je 0x4021f3
push pe_nt_image_headers32
call sub.kernel32.dll_Sleep
cmp dword [0x40eff4], 2
je 0x4021f3
test dword [0x409ac8], 0xffffffff
je 0x4021f3
push 0xffffffffffffffff
call fcn.004028e8
cmp eax, ebx
je 0x401fea
mov esi, ebx
xor esi, eax
test eax, esi
jne 0x402080
mov dword [0x40eff4], 0
push dword [0x40efe0]
call fcn.004039b4
push 5
push dword [0x40efdc]
call sub.user32.dll_ShowWindow
not esi
and ebx, esi
push 0x4097e0
call fcn.0040537a
mov dword [0x40e61c], 0
jmp fcn.00401fd0
bsf edi, esi
mov dword [0x40e61c], edi
push edi
call fcn.004028e8
or eax, eax
jne 0x40209a
or ebx, esi
jmp 0x401fea
lea edi, [eax + 4]
mov dword [0x409ba8], 0
test dword [0x40e61c], 0xffffffff
je 0x402150
push 0x4097fc
call fcn.0040537a
push 0x200
push edi
push 0x40e630
call sub.kernel32.dll_lstrcpynA
push 0x4073e9
push edi
call sub.shlwapi.dll_StrStrA
or eax, eax
je 0x4020ed
lea esi, [eax + 5]
mov ecx, 0x40e830
call fcn.004021f4
push 0x4073ef
push edi
call sub.shlwapi.dll_StrStrA
or eax, eax
je 0x402109
lea esi, [eax + 6]
mov ecx, 0x40e930
call fcn.004021f4
push 0x4073f6
push edi
call sub.shlwapi.dll_StrStrA
or eax, eax
je 0x402125
lea esi, [eax + 5]
mov ecx, 0x40ea30
call fcn.004021f4
mov ecx, 0x40eb30
call fcn.004021f4
lea eax, [edi - 4]
push eax
push 1
push dword [0x40e624]
call sub.kernel32.dll_HeapFree
push dword [0x40e61c]
call fcn.00401886
cmp eax, 0xffffffff
jne 0x40215f
push 0x4097ee
call fcn.0040537a
jmp 0x4021f3
call fcn.00401966
or eax, eax
jne 0x402177
push 0x40980b
call fcn.0040537a
jmp 0x401fda
push 0x40efa4
push 0x40ec70
call fcn.00401ac9
call fcn.00401f6f
test dword [0x409ba8], 0xffffffff
jne 0x402041
call fcn.004054c5
push 0x40985f
push 0
push 1
push 0x409819
push 0x40efc8
call fcn.0040501d
push 0
push dword [0x40efdc]
call sub.user32.dll_ShowWindow
push 5
push dword [0x40efe0]
call sub.user32.dll_ShowWindow
push 1
push dword [0x40efe0]
call sub.user32.dll_EnableWindow
call fcn.0040388f
mov dword [0x40eff4], 1
jmp 0x401fda
ret

Function at 0x40237f
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov ebx, dword [0x4093d6]
cmp ebx, 0x60
je 0x402419
mov eax, 0x600000
xor edx, edx
div ebx
shl edx, 1
sub edx, ebx
cmc
adc eax, 0
mov ebx, eax
mov edi, dword [ebp + 8]
push edi
call sub.kernel32.dll_GlobalSize
mov ecx, eax
mov al, 0x5c
repne scasb al, byte es:[edi]
jne 0x402419
cmp dword [edi], 0x6c6c6563
jne 0x4023b1
cmp byte [edi + 4], 0x78
jne 0x4023b1
add edi, 5
sub ecx, 5
xor eax, eax
movzx edx, byte [edi]
sub dl, 0x30
jb 0x4023e3
cmp dl, 9
ja 0x4023e3
imul eax, eax, 0xa
add eax, edx
inc edi
dec ecx
jmp 0x4023cd
mul ebx
shr eax, 0x10
push ecx
mov ecx, 0xa
xor edx, edx
div ecx
add dl, 0x30
mov byte [edi - 1], dl
xor edx, edx
div ecx
add dl, 0x30
mov byte [edi - 2], dl
xor edx, edx
div ecx
add dl, 0x30
mov byte [edi - 3], dl
xor edx, edx
div ecx
add dl, 0x30
mov byte [edi - 4], dl
pop ecx
jmp 0x4023b1
pop edi
pop ebx
leave
ret 4
Function at 0x4028e8
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
xor esi, esi
mov dword [ebp - 0x24], 0
push 0x12
push 0
push 0
push 0x4074d6
call sub.setupapi.dll_SetupDiGetClassDevsA
cmp eax, 0xffffffff
je 0x402a6b
mov ebx, eax
push 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
call sub.kernel32.dll_RtlFillMemory
mov dword [ebp - 0x1c], 0x1c
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
push 0x4074d6
push 0
push ebx
call sub.setupapi.dll_SetupDiEnumDeviceInterfaces
or eax, eax
je 0x402a6b
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.setupapi.dll_SetupDiGetDeviceInterfaceDetailA
push dword [ebp - 0x20]
push 1
push dword [0x40e624]
call sub.kernel32.dll_HeapAlloc
mov esi, eax
mov dword [esi], 5
push 0
push 0
push dword [ebp - 0x20]
push esi
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.setupapi.dll_SetupDiGetDeviceInterfaceDetailA
lea eax, [esi + 4]
mov dword [ebp - 0x5c], eax
push 0x4073ca
push dword [ebp - 0x5c]
call sub.shlwapi.dll_StrStrA
cmp eax, dword [ebp - 0x5c]
je 0x4029b5
push 0x4073db
push dword [ebp - 0x5c]
call sub.shlwapi.dll_StrStrA
cmp eax, dword [ebp - 0x5c]
jne 0x402a55
push 0
push 0x80
push 3
push 0x40e460
push 3
push 0x80000000
push dword [ebp - 0x5c]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x402a55
mov dword [ebp - 0x28], eax
push 0
push 0x40e480
push 0x21
lea eax, [ebp - 0x55]
push eax
push 0
push 0
push 0x700a0
push dword [ebp - 0x28]
call sub.kernel32.dll_DeviceIoControl
or eax, eax
je 0x402a4d
push 0
push 0x40e480
push 0xc
lea eax, [ebp - 0x34]
push eax
push 0
push 0
push 0x2d1080
push dword [ebp - 0x28]
call sub.kernel32.dll_DeviceIoControl
or eax, eax
je 0x402a4d
cmp dword [0x40e480], 0xc
jne 0x402a4d
cmp dword [ebp - 0x34], 7
jne 0x402a4d
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
cmp ecx, 0xffffffff
je 0x402a4a
cmp eax, ecx
jne 0x402a4d
mov edi, esi
push dword [ebp - 0x28]
call sub.kernel32.dll_CloseHandle
jmp 0x402a6b
bts edi, eax
push dword [ebp - 0x28]
call sub.kernel32.dll_CloseHandle
push esi
push 1
push dword [0x40e624]
call sub.kernel32.dll_HeapFree
inc dword [ebp - 0x24]
jmp 0x402919
or ebx, ebx
je 0x402a75
push ebx
call sub.setupapi.dll_SetupDiDestroyDeviceInfoList
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402c5d
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebx
push 4
push 0x3000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov ebx, eax
mov word [0x40efb4], 0
mov dword [0x40ef9c], 0
mov dword [0x40efa0], 0
jmp 0x402caa
inc word [0x40efb4]
add dword [0x40ef9c], 0x1000
adc dword [0x40efa0], 0
push 0
push 0x40efa0
push dword [0x40ef9c]
push dword [0x40e484]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x40e480
push 0x1000
push ebx
push dword [0x40e484]
call sub.kernel32.dll_ReadFile
or eax, eax
jne 0x402cf4
cmp word [0x40efb4], 0x20
jb 0x402c92
push 0x409829
call fcn.0040537a
jmp 0x402d5d
push 0
push 0x40efa0
push dword [0x40ef9c]
push dword [0x40e484]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x40e480
push 0x1000
push ebx
push dword [0x40e484]
call sub.kernel32.dll_WriteFile
or eax, eax
jne 0x402d5d
call sub.kernel32.dll_GetLastError
cmp eax, 0x45d
je 0x402d39
cmp eax, 0x13
jne 0x402d45
push 0x409842
call fcn.0040537a
jmp 0x402d5d
cmp word [0x40efb4], 0x20
jb 0x402c92
push 0x409835
call fcn.0040537a
xchg ebx, eax
push 0x8000
push 0
push eax
call sub.kernel32.dll_VirtualFree
or ebx, ebx
pop ebx
ret

Function at 0x402f93
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 1
push 0x8000
push dword [0x40eff0]
call sub.user32.dll_SendMessageA
push 0
push 0x40efa0
push dword [0x40ef9c]
push dword [0x40e484]
call sub.kernel32.dll_SetFilePointer
call fcn.00401538
push 0
push 0x40e480
push dword [0x40efc2]
push dword [ebp + 8]
push dword [0x40e484]
call sub.kernel32.dll_ReadFile
push eax
je 0x402ff6
push 0x409bac
push 0x409bb4
call fcn.00401543
jmp 0x40300f
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x403005
cmp eax, 0x37
jne 0x40300f
mov dword [0x40eff4], 0
push 0
push 3
push 0x8000
push dword [0x40eff0]
call sub.user32.dll_SendMessageA
pop eax
leave
ret 4

Function at 0x403028
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 2
push 0x8000
push dword [0x40eff0]
call sub.user32.dll_SendMessageA
push 0
push 0x40efa0
push dword [0x40ef9c]
push dword [0x40e484]
call sub.kernel32.dll_SetFilePointer
call fcn.00401538
push 0
push 0x40e480
push dword [0x40efc2]
push dword [ebp + 8]
push dword [0x40e484]
call sub.kernel32.dll_WriteFile
push eax
je 0x40308b
push 0x409bb0
push 0x40bfb4
call fcn.00401543
jmp 0x4030a4
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x40309a
cmp eax, 0x37
jne 0x4030a4
mov dword [0x40eff4], 0
push 0
push 3
push 0x8000
push dword [0x40eff0]
call sub.user32.dll_SendMessageA
pop eax
leave
ret 4
Function at 0x4033f1
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
mov dword [ebp - 0x194], 0
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
or eax, eax
jne 0x403466
cmp word [ebp - 0x190], 0x101
jne 0x403466
push 0x4074e6
call sub.wsock32.dll_gethostbyname
or eax, eax
je 0x403466
movzx ebx, word [eax + 8]
movzx ecx, word [eax + 0xa]
cmp ebx, 2
jne 0x403466
cmp ecx, 4
jne 0x403466
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
or eax, eax
je 0x403466
mov eax, dword [eax]
cmp al, 0xef
jne 0x403466
xor al, al
bswap eax
cmp eax, 1
jbe 0x403466
mov dword [ebp - 0x194], 0xffffffff
call sub.wsock32.dll_WSACleanup
mov eax, dword [ebp - 0x194]
leave
ret

Function at 0x403793
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x409ab8], eax
push 0
push 0
push 1
call sub.kernel32.dll_HeapCreate
mov dword [0x40e624], eax
call fcn.004017ae
push 7
call sub.kernel32.dll_SetErrorMode
call fcn.00405252
push 0
push 0
call sub.combase.dll_CoInitializeEx
call 0x403793
jb 0x40376f
call fcn.004037db
jb 0x40376f
call fcn.00403b74
jb 0x40376f
call fcn.00403fc1
jb 0x40376f
push dword [0x409b0c]
call fcn.0040352c
call fcn.004014bc
call fcn.0040241f
call fcn.0040489d
call fcn.0040388f
call fcn.00403473
or eax, eax
je 0x4036c7
call fcn.00405208
push 1
call fcn.004055b5
jmp 0x403704
cmp dword [0x409b98], 0
je 0x4036ec
call fcn.00405208
push 1
call fcn.004055b5
or eax, eax
je 0x403704
push 0x409851
call fcn.0040537a
jmp 0x403704
push 1
push dword [0x409a94]
call sub.user32.dll_ShowWindow
push dword [0x409a94]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
push 0x409a9c
call sub.user32.dll_GetMessageA
or eax, eax
je 0x40376f
cmp dword [0x409ac8], 0
je 0x403739
push 0x409a9c
push dword [0x409acc]
push dword [0x409ac8]
call sub.user32.dll_TranslateAcceleratorA
jmp 0x40374f
push 0x409a9c
push dword [0x409abc]
push dword [0x409a94]
call sub.user32.dll_TranslateAcceleratorA
or eax, eax
jne 0x403704
push 0x409a9c
call sub.user32.dll_TranslateMessage
push 0x409a9c
call sub.user32.dll_DispatchMessageA
push cs
call fcn.0040220b
jmp 0x403704
call fcn.0040388f
push 4
push 0
push dword [0x409b88]
call sub.winmm.dll_PlaySoundA
call fcn.0040490a
push dword [0x409aa4]
call sub.kernel32.dll_ExitProcess
push ebx
push 0
push 0x409292
call sub.user32.dll_FindWindowA
or eax, eax
je 0x4037d9
mov ebx, eax
push 0
push 0x4092a6
call sub.user32.dll_FindWindowA
or eax, eax
je 0x4037b8
mov ebx, eax
push 1
push ebx
call sub.user32.dll_ShowWindow
push 3
push 0
push 0
push 0
push 0
push 0
push ebx
call sub.user32.dll_SetWindowPos
push ebx
call sub.user32.dll_SetForegroundWindow
stc
pop ebx
ret