joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push esi
push edi
mov dword [ebp - 0x10], eax
cmp dword [eax + 4], 0xffffffff
je 0x4044d2
cmp dword [ebp + 8], 0
je 0x4044d2
cmp dword [ebp + 0x10], 0
ja 0x40445d
cmp dword [ebp + 0xc], 1
jb 0x4044d2
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
and dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub ecx, esi
sbb eax, edi
test eax, eax
jb 0x404490
ja 0x404487
cmp ecx, 0xfffffff
jbe 0x404490
mov eax, 0xfffffff
mov ecx, esi
jmp 0x404497
mov eax, dword [ebp + 0xc]
mov ecx, esi
sub eax, ecx
push 0
lea edx, [ebp - 8]
push edx
push eax
mov eax, dword [ebp + 8]
add eax, ecx
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4044cc
cmp dword [ebp - 8], 0
je 0x4044cc
add esi, dword [ebp - 8]
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x40446b
ja 0x4044cc
cmp esi, dword [ebp + 0xc]
jb 0x40446b
mov eax, esi
mov edx, edi
jmp 0x4044d6
xor eax, eax
xor edx, edx
pop edi
pop esi
leave
ret 0xc

Function at 0x404607
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
mov ebp, ecx
and dword [esp + 0x10], esi
mov ebx, edx
push edi
xor edi, edi
test ebp, ebp
je 0x404737
mov edx, dword [esp + 0x20]
test edx, edx
je 0x404737
mov eax, dword [esp + 0x24]
cmp eax, 9
jb 0x404737
mov byte [edx], 0
test ebx, ebx
je 0x40472e
add eax, 0xfffffff8
mov dword [esp + 0x18], eax
cmp esi, eax
jae 0x40472e
mov ch, byte [edi + ebp]
inc edi
cmp edi, ebx
jb 0x40466f
xor al, al
mov dword [esp + 0x14], 2
xor cl, cl
mov byte [esp + 0x11], cl
jmp 0x40468d
mov al, byte [edi + ebp]
inc edi
mov byte [esp + 0x11], al
mov cl, al
cmp edi, ebx
jae 0x404683
mov al, byte [edi + ebp]
inc edi
jmp 0x40468d
xor al, al
mov dword [esp + 0x14], 1
mov byte [esp + 0x12], al
and cl, 0xf
shr al, 6
shl cl, 2
or cl, al
movzx eax, ch
shr eax, 2
and ch, 3
shl ch, 4
mov byte [esp + 0x13], cl
movzx ecx, ch
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
movzx eax, byte [esp + 0x11]
shr eax, 4
or ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx + 1], al
add esi, 2
mov eax, dword [esp + 0x14]
sub eax, 0
je 0x4046ff
sub eax, 1
je 0x4046ea
sub eax, 1
jne 0x404722
mov word [esi + edx], 0x3d3d
jmp 0x40471f
movzx eax, byte [esp + 0x13]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
mov byte [esi + edx + 1], 0x3d
jmp 0x40471f
movzx eax, byte [esp + 0x13]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
movzx eax, byte [esp + 0x12]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx + 1], al
add esi, 2
mov eax, dword [esp + 0x18]
cmp edi, ebx
jb 0x40464d
mov byte [esi + edx], 0
lea eax, [esi + 1]
jmp 0x404739
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x405604
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
push ebp
push esi
push edi
cmp dword [ebx + 8], 0xffffffff
je 0x405778
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x405778
mov ebp, dword [esp + 0x34]
xor ecx, ecx
test ebp, ebp
je 0x405630
mov dword [ebp], ecx
mov esi, dword [ebx + 0x448]
mov edi, dword [ebx + 0x44c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov dword [ebx + 0x450], eax
adc edx, edi
mov dword [ebx + 0x454], edx
jmp 0x40573d
mov ecx, ebx
call fcn.00405cc3
test eax, eax
jne 0x405690
mov ecx, ebx
call fcn.00405d3e
test al, al
jne 0x405784
push 1
jmp 0x405737
xor eax, eax
push eax
push eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x40]
push eax
push 1
lea eax, [esp + 0x34]
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x405714
cmp dword [esp + 0x34], 1
jne 0x405714
mov esi, dword [ebx + 0x448]
xor ecx, ecx
mov edi, dword [ebx + 0x44c]
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov dword [ebx + 0x450], eax
mov eax, dword [esp + 0x24]
adc edx, edi
mov dword [ebx + 0x454], edx
mov cl, byte [eax]
cmp cl, 0xd
je 0x40573d
cmp cl, 0xa
je 0x40579b
mov ecx, dword [esp + 0x30]
cmp ecx, 1
jbe 0x40573d
add eax, dword [esp + 0x34]
sub ecx, dword [esp + 0x34]
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], ecx
jmp 0x40573d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0x18], eax
cmp eax, 0x2733
jne 0x40574a
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x7d0
je 0x40574a
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebx + 0x435], 0
je 0x40566f
push str.raw___read_string_failed
lea ecx, [ebx + 0x228]
mov edx, 0xff
call fcn.00403d44
test ebp, ebp
je 0x40576a
mov eax, dword [esp + 0x18]
mov dword [ebp], eax
mov eax, dword [esp + 0x2c]
mov ecx, ebx
mov byte [eax], 0
call fcn.0040394f
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
push str.raw___read_string_timeout
lea ecx, [ebx + 0x228]
mov edx, 0xff
call fcn.00403d44
jmp 0x405778
mov byte [eax], 0
mov esi, dword [ebx + 0x448]
mov edi, dword [ebx + 0x44c]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov dword [ebx + 0x450], eax
mov al, 1
adc edx, edi
mov dword [ebx + 0x454], edx
jmp 0x40577a
Function at 0x405b6b
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebx, ecx
push edi
xor edi, edi
test esi, esi
je 0x405b80
mov dword [esi], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x405cb7
cmp dword [ebx + 8], 0xffffffff
je 0x405cb7
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
test ebp, ebp
je 0x405c62
cmp byte [ebx + 0x435], 0
jne 0x405c88
mov esi, dword [ebx + 0x448]
mov dword [esp + 0x28], edi
mov edi, dword [ebx + 0x44c]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov esi, 0x200000
mov dword [ebx + 0x450], eax
mov eax, ebp
adc edx, edi
cmp ebp, esi
mov dword [ebx + 0x454], edx
cmova eax, esi
xor edi, edi
push edi
push edi
push edi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x34]
push eax
push 1
lea eax, [esp + 0x2c]
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x405c44
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov dword [esp + 0x24], edi
cmp edi, 0x2733
jne 0x405c5e
mov esi, dword [esp + 0x14]
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x7d0
je 0x405c5a
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x405c52
mov eax, dword [esp + 0x28]
sub ebp, eax
add dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
test ebp, ebp
jne 0x405bb2
mov edi, dword [esp + 0x24]
test ebp, ebp
jne 0x405c8c
mov esi, dword [ebx + 0x448]
mov edi, dword [ebx + 0x44c]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov dword [ebx + 0x450], eax
mov al, 1
adc edx, edi
mov dword [ebx + 0x454], edx
jmp 0x405cb9
mov edi, dword [esp + 0x24]
push ebp
push str.raw___send_failed___zu_bytes_needed
lea eax, [ebx + 0x228]
push 0xff
push eax
call fcn.00403ad2
mov esi, dword [esp + 0x3c]
add esp, 0x10
test esi, esi
je 0x405cb0
mov dword [esi], edi
mov ecx, ebx
call fcn.0040394f
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc

Function at 0x405cc3
Capabilities:
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
mov esi, ecx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp dword [esi + 8], 0xffffffff
je 0x405d37
lea ecx, [ebp - 4]
push ecx
push 0x4004667f
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x405cfd
mov ecx, esi
call fcn.0040394f
mov eax, edi
jmp 0x405d3a
mov eax, dword [ebp - 4]
test eax, eax
jne 0x405d3a
mov eax, dword [esi + 8]
xor ecx, ecx
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xc]
push eax
push ecx
push ecx
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], edi
push eax
push ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x3e8
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x405cf9
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x405d74
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
xor edx, edx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
mov ebx, ecx
test edi, edi
je 0x405d89
mov dword [edi], edx
mov eax, dword [esp + 0x30]
mov dword [eax], edx
mov eax, dword [esp + 0x28]
test eax, eax
je 0x405eed
cmp dword [ebx + 8], 0xffffffff
je 0x405eed
push dword [esp + 0x38]
mov dword [esp + 0x18], edx
mov ebp, edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
call fcn.00406647
mov esi, dword [esp + 0x2c]
jmp 0x405eaa
cmp byte [ebx + 0x435], 0
jne 0x405f1e
mov ecx, ebx
call fcn.00405cc3
mov ecx, eax
test ecx, ecx
jne 0x405df9
mov ecx, ebx
call fcn.00405d3e
test al, al
jne 0x405ed8
push 1
jmp 0x405ea4
mov edx, 0x400000
mov eax, esi
cmp esi, edx
cmova eax, edx
cmp eax, ecx
cmova eax, ecx
mov dword [esp + 0x18], eax
xor eax, eax
push eax
push eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x40]
push eax
push 1
lea eax, [esp + 0x2c]
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x405e82
cmp dword [esp + 0x34], eax
je 0x405e82
push dword [esp + 0x38]
xor ecx, ecx
mov dword [esp + 0x2c], ecx
mov ecx, ebx
call fcn.00406647
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
sub esi, eax
add dword [esp + 0x1c], eax
add dword [ecx], eax
cmp byte [esp + 0x3c], 0
je 0x405eaa
mov ecx, dword [ebx + 0x428]
test ecx, ecx
je 0x405eaa
push eax
push dword [ebx + 0x430]
push dword [ebx + 0x42c]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x405eaa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x405ef9
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x28], eax
cmp eax, 0x7d0
je 0x405f1a
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x405dc9
mov esi, dword [ebx + 0x448]
mov edi, dword [ebx + 0x44c]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov dword [ebx + 0x450], eax
mov al, 1
adc edx, edi
mov dword [ebx + 0x454], edx
jmp 0x405eef
push str.raw___read_timeout
lea ecx, [ebx + 0x228]
mov edx, 0xff
call fcn.00403d44
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x18
mov eax, dword [ebx + 8]
push dword [esp + 0x18]
lea eax, [ebx + 0x228]
push ebp
push str.raw___receive_failed___u_error___u_bytes_requested
push 0xff
push eax
call fcn.00403ad2
add esp, 0x14
test esi, esi
je 0x405eb2
push esi
push ebp
push str.raw___read_failed___u_error___zu_bytes_needed
lea eax, [ebx + 0x228]
push 0xff
push eax
call fcn.00403ad2
add esp, 0x14
test edi, edi
je 0x405f3f
mov dword [edi], ebp
mov ecx, ebx
call fcn.0040394f
jmp 0x405eed
Function at 0x406452
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x118
xor eax, eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x228]
mov word [edi], ax
cmp byte [esi + 0x435], al
je 0x406478
xor al, al
jmp 0x40663a
call fcn.0040394f
mov ebp, dword [esp + 0x12c]
xor ebx, ebx
push 1
push ebx
push ebx
movzx eax, word [ebp]
push 6
push 1
push eax
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x4064b4
push str.socket_create_failed
mov edx, 0xff
mov ecx, edi
call fcn.00403d44
jmp 0x406471
lea eax, [esi + 0x440]
cmp dword [eax], ebx
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
jbe 0x4064d6
push 4
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call ebx
lea eax, [esi + 0x444]
cmp dword [eax], 0
jbe 0x4064f3
push 4
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call ebx
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 1
push eax
push 8
push 0xffff
push dword [esi + 8]
call ebx
mov eax, dword [esi]
xor ebx, ebx
inc ebx
mov ecx, esi
push ebx
call dword [eax + 0x1c]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
mov ebx, dword [sym.imp.WS2_32.dll_ioctlsocket]
push eax
push 0x8004667e
push dword [esi + 8]
call ebx
call fcn.00406380
mov dword [esi + 0x470], eax
xor eax, eax
push eax
push eax
push eax
push eax
push 0x10
pop eax
push 0x1c
pop ecx
mov dword [esi + 0x474], edx
cmp word [ebp], 0x17
cmove eax, ecx
push eax
push ebp
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
jne 0x406605
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4065bf
mov ecx, dword [esi + 8]
xor edx, edx
mov eax, dword [esp + 0x130]
mov dword [esp + 0x24], ecx
mov ecx, 0x3e8
div ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x18], eax
imul eax, edx, 0x3e8
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
lea eax, [esp + 0x28]
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x406605
mov ecx, esi
call fcn.0040394f
and dword [esi + 0x470], 0
mov edx, 0xff
and dword [esi + 0x474], 0
mov ecx, edi
push str.connect_failed
call fcn.00403d44
lea eax, [esi + 0x28]
push eax
push str._s_direct_connect_failed
push str.Socket
push 0x55ad50
call fcn.0044a8a9
add esp, 0x10
jmp 0x406471
push dword [esi + 0x474]
push dword [esi + 0x470]
call fcn.004063a7
and dword [esp + 0x18], 0
pop ecx
pop ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x470], eax
push ecx
push 0x8004667e
push dword [esi + 8]
mov dword [esi + 0x474], edx
call ebx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0xc
Function at 0x406cf7
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x444c
call fcn.0041c820
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x240]
mov esi, edx
call fcn.0040337a
push 8
pop ecx
xor eax, eax
lea edi, [esp + 0x20]
push 0x4000
rep stosd dword es:[edi], eax
xor ebx, ebx
lea eax, [esp + 0x45c]
push ebx
push eax
call fcn.0041d6f0
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [esp + 0x10], ebx
mov dword [esi + 8], ebx
test eax, eax
je 0x406d49
xor ecx, ecx
mov word [eax], cx
push 0x43
lea eax, [esp + 0x244]
push 0x50c270
push eax
call fcn.0040371e
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push dword [esp + 0x25c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
cmp edi, 0xffffffff
je 0x406daf
push ebx
lea eax, [esp + 0x14]
push eax
push 0x20
lea eax, [esp + 0x2c]
push eax
push ebx
push ebx
push 0x560000
push edi
call ebp
push edi
test eax, eax
jne 0x406da9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406f16
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x28]
lea eax, [esp + 0x244]
push str..PHYSICALDRIVE_u
push eax
call fcn.0040371e
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push dword [esp + 0x25c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x406efe
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x20], ebx
push eax
push 0x4000
lea eax, [esp + 0x464]
mov dword [esp + 0x20], ebx
push eax
push 0xc
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], ebx
push eax
push 0x2d1400
push edi
call ebp
test eax, eax
je 0x406ef7
cmp dword [esp + 0x10], 0x28
jb 0x406ef7
mov ebp, 0x100
lea eax, [esp + 0x140]
push ebp
push ebx
push eax
call fcn.0041d6f0
push ebp
lea eax, [esp + 0x50]
push ebx
push eax
call fcn.0041d6f0
mov eax, dword [esp + 0x47c]
add esp, 0x18
test eax, eax
je 0x406e77
lea ecx, [esp + 0x458]
push 0xff
add eax, ecx
push eax
lea eax, [esp + 0x148]
push ebp
push eax
call fcn.00429f73
add esp, 0x10
mov eax, dword [esp + 0x468]
test eax, eax
je 0x406e9f
lea ecx, [esp + 0x458]
push 0xff
add eax, ecx
push eax
lea eax, [esp + 0x48]
push ebp
push eax
call fcn.00429f73
add esp, 0x10
mov ebp, 0x50c16c
cmp byte [esp + 0x140], bl
je 0x406ee2
cmp byte [esp + 0x40], bl
je 0x406ed0
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x144]
push eax
push str._S__S
push esi
call fcn.0040371e
add esp, 0x10
jmp 0x406ef7
lea eax, [esp + 0x140]
push eax
push ebp
push esi
call fcn.0040371e
add esp, 0xc
cmp byte [esp + 0x40], bl
je 0x406ef7
lea eax, [esp + 0x40]
push eax
push ebp
push esi
call fcn.0040371e
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
cmp dword [esi + 8], eax
jb 0x406f12
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x406f12
cmp word [ecx], bx
jne 0x406f14
mov al, bl
mov bl, al
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x444c
ret
Function at 0x4077b3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0040337a
push dword [esp + 0x14]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4077e1
xor al, al
jmp 0x40780b
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4077ff
push dword [esp + 0x14]
push ecx
call fcn.0042a711
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
jmp 0x407804
and dword [esp + 0x10], 0
mov edx, esi
call fcn.004073f5
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407a11
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x4014
call fcn.0041c820
push ebx
push ebp
push esi
push edi
mov edi, edx
xor ebp, ebp
mov eax, dword [edi + 4]
mov dword [edi + 8], ebp
test eax, eax
je 0x407a32
xor edx, edx
mov word [eax], dx
push ebp
push ebp
push 3
push ebp
push 3
push ebp
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407ab6
mov ebx, 0x4000
mov dword [esp + 0x10], ebp
push ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x20], ebp
push ebp
push eax
call fcn.0041d6f0
add esp, 0xc
mov dword [esp + 0x14], ebp
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ebp
push ebp
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x407aaf
mov eax, dword [esp + 0x10]
cmp eax, 0x28
jb 0x407aaf
lea edx, [esp + 0x20]
lea ecx, [esp + 0x20]
add edx, eax
add ecx, dword [esp + 0x38]
push edi
call fcn.00407be2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4014
ret

Function at 0x40822f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0040337a
push dword [esp + 0x14]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x40825d
xor al, al
jmp 0x408287
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x40827b
push dword [esp + 0x14]
push ecx
call fcn.0042a711
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
jmp 0x408280
and dword [esp + 0x10], 0
mov edx, esi
call fcn.00407e71
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40840a
Capabilities:
Generate random numbers via winapi

Disassembly:
push ecx
push ecx
push ebp
push esi
mov esi, ecx
mov ebp, edx
test esi, esi
je 0x4084e3
push ebx
push edi
push 0
call fcn.0042bcc4
pop ecx
push 2
mov edi, eax
mov ebx, edx
push 8
lea eax, [esp + 0x18]
add edi, 0xab5b7200
push eax
push 0
adc ebx, 0xffffffff
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
je 0x408458
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
jmp 0x40845c
mov ecx, dword [esp + 0x10]
and ecx, 0x1ffffff
xor eax, eax
or ecx, ebx
or eax, edi
or ecx, 0x44000000
push ecx
push eax
push 0x50a164
push 0xffffffffffffffff
push ebp
push esi
call fcn.00401bd1
add esp, 0x18
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
call fcn.00403c98
mov edi, 0x5098d4
test al, al
jne 0x4084a1
push ecx
mov edx, edi
mov ecx, ebx
call fcn.00403c40
pop ecx
push ecx
push esi
push ecx
mov ebp, 0x509910
mov edx, edi
push ebp
mov ecx, ebx
call fcn.00403c0b
add esp, 0x10
mov ebx, closesocket
mov ecx, ebx
call fcn.00403c98
test al, al
jne 0x4084d1
push ecx
mov edx, edi
mov ecx, ebx
call fcn.00403c40
pop ecx
push ecx
push esi
push ecx
push ebp
mov edx, edi
mov ecx, ebx
call fcn.00403c0b
add esp, 0x10
pop edi
pop ebx
pop esi
pop ebp
pop ecx
pop ecx
ret

Function at 0x408537
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
xor eax, eax
push esi
mov dword [ebp - 4], eax
mov esi, 0x100
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x214]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4085a9
push 3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.0042a5e4
add esp, 0x10
xor eax, eax
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x214]
push esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x408ef3
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x408f1d
xor edi, edi
cmp word [esi], di
je 0x408f1d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x408f24
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408f36
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
test bl, 0x10
jne 0x408f3b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x408f1d
jmp 0x408f11
push 0x10
pop eax
jmp 0x408f20
test bl, 1
je 0x408f4b
xor ebx, 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, ebx
jmp 0x408f20

Function at 0x409121
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
call fcn.004085ac
cmp eax, 0x258
jl 0x409186
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409186
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.EnableLUA
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x40918b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop ebx
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 4
jne 0x40919e
cmp dword [ebp - 8], ebx
je 0x40919e
mov bl, 1
mov al, bl
jmp 0x409188