joyce8/EMBER2024-capa huggingface dataset:
Function at 0x93e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x93e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x93e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93e06a
add dl, dl
jne 0x93e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93e0dc
xor eax, eax
add dl, dl
jne 0x93e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93e17d
add dl, dl
jne 0x93e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x93e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x93e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x93e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x93e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x93e075
mov eax, 1
add dl, dl
jne 0x93e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x93e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x93e0e1
sub eax, ebx
mov ebx, 1
jne 0x93e128
mov ecx, 1
add dl, dl
jne 0x93e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x93e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x93e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x93e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x93e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x93e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x93e136
cmp eax, 0x7d00
jae 0x93e16d
cmp eax, 0x500
jb 0x93e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x93e075
cmp eax, 0x7f
ja 0x93e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x93e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x93e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x93e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10011023
Capabilities:
Terminate process

Disassembly:
jmp 0x1001cb00
jmp fcn.1001cb30
cmp ecx, dword [0x10021054]
jne 0x1001cb0a
repz ret
jmp 0x100110b9

Function at 0x100139e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100139ef
pop dword [ebp - 0x40]
mov eax, 0x100139ef
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x3910600
add dword [ebp - 0x50], 0x4ac13f4b
mov dword [ebp - 0x4c], 0x2a8ac78a
sub dword [ebp - 0x4c], 0xf8577b45
mov dword [ebp - 0x48], 0x998f0e59
add dword [ebp - 0x48], 0xb2bd35d5
mov dword [ebp - 0x44], 0xaa82cf3f
add dword [ebp - 0x44], 0x557d30c1
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf93c6706
sub dword [ebp - 0x50], 0x84c9fdb0
mov dword [ebp - 0x4c], 0x323670f5
sub dword [ebp - 0x4c], 0xf0ca0f80
mov dword [ebp - 0x48], 0x36e2e072
sub dword [ebp - 0x48], 0xd3737406
mov dword [ebp - 0x44], 0x2013160d
add dword [ebp - 0x44], 0xdfece9f3
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x51b727b0
add eax, 0xbe4afa40
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x35178
push 0
call eax
mov ecx, 0xa5c5c6f4
add ecx, 0x5a3a787d
mov ebx, eax
mov edi, 0x10024a00
add edi, dword [ebp - 0x40]
mov edx, 0x342e5b2a
add dword [ebp - 0x2c], 0xb00019ad
mov esi, dword [edi]
sub dword [ebp - 0x24], 0x75bb0d08
sub esi, edx
xor dword [ebp - 0x1c], 0x8211a23c
mov dword [ebx], esi
xor dword [ebp - 0x30], 0x47075e49
add ebx, 4
add edi, 0x39e36327
sub edi, 0x39e36323
loop 0x10013afb
add eax, 0xf097
mov ebx, eax
add eax, 5
mov ecx, 0x31fcb280
sub ecx, 0x21fcb280
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401d4a
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [0x418714], 0
mov eax, dword [0x418714]
mov ebx, 0xffffffff
push ebx
call dword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov dword [0x418ebf], eax
mov dword [0x418174], 0
mov eax, dword [0x418174]
lea edx, [edx + 0x418977]
add dword [0x4195a1], edx
sub edx, eax
shr edx, 1
add edx, eax
mov ecx, edx
add ecx, 0x94e
add dword [0x418b51], ecx
ror ecx, 2
shr ecx, 1
sub ecx, eax
add dword [0x418e06], ecx
call fcn.00402f28
mov dword [0x41818c], eax
push 0x2547545c
pop edi
push edi
mov esi, 0x1eeae871
mov eax, esi
push eax
mov eax, 0x535b7a47
mov esi, eax
push esi
mov edi, 0x174cf46c
mov ebp, edi
push ebp
push 0x418ab134
pop ebx
push ebx
push 0x21ff1beb
pop eax
push eax
push 0x67cf697b
pop edx
push edx
mov edx, 0x47777e77
push edx
mov esi, 0
mov edi, esi
push edi
push 0x30a185
pop ebx
add ebx, 0x103f1b
push dword [ebx]
pop dword [0x41855f]
mov ebx, dword [0x41855f]
call ebx
mov dword [0x418f49], eax
or eax, eax
je 0x401e19
sub ebp, edi
ret

Function at 0xac1058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ac11a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xac107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xac106a
add dl, dl
jne 0xac1089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xac10dc
xor eax, eax
add dl, dl
jne 0xac1096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xac117d
add dl, dl
jne 0xac10a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xac10b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xac10bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xac10c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xac10d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xac1075
mov eax, 1
add dl, dl
jne 0xac10ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xac10f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xac10e1
sub eax, ebx
mov ebx, 1
jne 0xac1128
mov ecx, 1
add dl, dl
jne 0xac110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xac1119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xac1105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xac1075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xac113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xac114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xac1136
cmp eax, 0x7d00
jae 0xac116d
cmp eax, 0x500
jb 0xac1168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xac1075
cmp eax, 0x7f
ja 0xac1170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xac1075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xac119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xac1075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x40de38
nop
mov ecx, 0x49f16ca2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x398144d0
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401150
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push edi
mov edi, str.SeLoadDriverPrivilege
call fcn.004011f0
mov edi, str.SeDebugPrivilege
call fcn.004011f0
mov edi, str.SeBackupPrivilege
call fcn.004011f0
mov edi, str.SeRestorePrivilege
call fcn.004011f0
mov edi, str.SeSecurityPrivilege
call fcn.004011f0
mov edi, str.SeSystemEnvironmentPrivilege
call fcn.004011f0
mov edi, str.SeManageVolumePrivilege
call fcn.004011f0
mov edi, str.SeAssignPrimaryTokenPrivilege
call fcn.004011f0
mov edi, str.SeIncreaseQuotaPrivilege
call fcn.004011f0
mov edi, str.SeTakeOwnershipPrivilege
call fcn.004011f0
mov edi, str.SeShutdownPrivilege
call fcn.004011f0
mov edi, str.SeProfileSingleProcessPrivilege
call fcn.004011f0
mov edi, str.SeImpersonatePrivilege
call fcn.004011f0
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x402bb0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x14
mov eax, dword [0x630160]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push edi
xor edi, edi
push 0x1000
push edi
push 0x655d08
mov ebx, ecx
mov dword [esp + 0x14], edi
call fcn.00422f70
add esp, 0xc
xor eax, eax
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc]
push eax
push 0x1000
push 0x655d08
push 0xc
lea ecx, [esp + 0x20]
push ecx
push 0x2d1400
push esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x402c34
push 0x655d08
lea edx, [esp + 0x10]
push edx
push esi
mov eax, 0x2d1400
call fcn.00403220
test eax, eax
lea eax, [edi + 1]
jne 0x402c36
mov eax, edi
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
xor ecx, esp
call fcn.00418878
add esp, 0x14
ret
Function at 0x403820
Capabilities:
Get disk size

Disassembly:
sub esp, 0x10c
mov eax, dword [0x630160]
xor eax, esp
mov dword [esp + 0x104], eax
xor eax, eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor ebx, ebx
push ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
lea eax, [esp + 0x10]
push eax
push 0x18
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push 0x70000
mov dword [esi], ebx
push edi
mov dword [esi + 4], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x50], ebx
call ebp
push ebx
test eax, eax
je 0x403913
mov eax, dword [esp + 0x30]
mul dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push ecx
push edx
push eax
call fcn.0041f0d0
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
push edx
push eax
call fcn.0041f0d0
mov dword [esi], eax
jmp 0x4039bc
lea edx, [esp + 0x10]
push edx
push 0x28
lea eax, [esp + 0xec]
push eax
push ebx
push ebx
push 0x700a0
push edi
call ebp
test eax, eax
je 0x403940
mov ecx, dword [esp + 0xf8]
mov edx, dword [esp + 0xfc]
jmp 0x4039ba
push ebx
lea eax, [esp + 0x10]
push eax
push 8
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push 0x7405c
push edi
call ebp
test eax, eax
je 0x40396a
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], eax
jmp 0x4039bf
push ebx
lea ecx, [esp + 0x10]
push ecx
push 0x20
lea edx, [esp + 0x3c]
push edx
push ebx
push ebx
push 0x74004
push edi
call ebp
test eax, eax
je 0x403994
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esi], eax
mov dword [esi + 4], ecx
jmp 0x4039bf
push ebx
lea edx, [esp + 0x10]
push edx
push 0x90
lea eax, [esp + 0x5c]
push eax
push ebx
push ebx
push 0x70048
push edi
call ebp
test eax, eax
je 0x4039bf
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov ecx, dword [esp + 0x10c]
pop ebp
pop ebx
xor ecx, esp
mov eax, esi
call fcn.00418878
add esp, 0x10c
ret
Function at 0x4039e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
xor edi, edi
test byte [0x657cc0], 1
mov ebx, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
jne 0x403a2b
or dword [0x657cc0], 1
push str.ZwReadFile
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x657cbc], eax
push 0x200
call fcn.0041884e
push 0x200
mov esi, eax
push edi
push esi
call fcn.00422f70
add esp, 0x10
push edi
lea eax, [esp + 0x14]
push eax
push 0x200
push esi
lea ecx, [esp + 0x28]
push ecx
push edi
push edi
push edi
push ebx
call dword [0x657cbc]
test eax, eax
jl 0x403b2c
cmp ebp, edi
je 0x403a76
mov edx, dword [esi + 0x1b8]
mov dword [ebp], edx
cmp dword [esp + 0x2c], edi
je 0x403b2c
cmp byte [esi + 0x1c2], 0xee
jne 0x403b2c
push edi
lea eax, [esp + 0x14]
push eax
push 0x200
push esi
lea ecx, [esp + 0x28]
push ecx
push edi
push edi
push edi
push ebx
mov dword [esp + 0x34], 0x200
mov dword [esp + 0x38], edi
call dword [0x657cbc]
test eax, eax
jl 0x403b2c
cmp dword [esi], 0x20494645
jne 0x403b2c
cmp dword [esi + 4], 0x54524150
jne 0x403b2c
cmp dword [esi + 8], 0x10000
jne 0x403b2c
mov edx, 0x5c
cmp dword [esi + 0xc], edx
jne 0x403b2c
mov ebx, dword [esi + 0x10]
mov dword [esi + 0x10], edi
mov ecx, esi
or eax, 0xffffffff
jmp 0x403af0
movzx ebp, byte [ecx]
xor ebp, eax
and ebp, 0xff
shr eax, 8
xor eax, dword [ebp*4 + 0x6243f0]
inc ecx
sub edx, 1
jne 0x403af0
not eax
cmp eax, ebx
jne 0x403b2c
mov edx, dword [esi + 0x38]
mov eax, dword [esp + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x3c]
mov dword [eax + 4], ecx
mov edx, dword [esi + 0x40]
mov dword [eax + 8], edx
mov ecx, dword [esi + 0x44]
mov dword [eax + 0xc], ecx
cmp esi, edi
je 0x403b39
push esi
call fcn.0041960a
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x403c80
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push edi
push 0
push 0
call ebx
xor ecx, ecx
mov edi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041884e
add esp, 4
push eax
push edi
mov dword [esp + 0x18], eax
call ebx
mov edi, dword [esp + 0x10]
cmp word [edi], 0
je 0x403e82
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x403e57
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403ce0
sub eax, edx
sar eax, 1
add eax, eax
push eax
mov eax, dword [esi + 0x7238]
add eax, 0x985
lea ecx, [eax + eax*2]
lea edx, [esi + ecx*4]
push edi
push edx
call fcn.00422ff0
add esp, 0xc
mov ebx, edi
call fcn.004043c0
mov ecx, dword [esi + 0x7238]
mov dword [esi + ecx*4 + 0x7374], eax
mov ecx, edi
call fcn.00404280
mov edx, dword [esi + 0x7238]
shl edx, 4
lea ecx, [edx + esi + 0x73dc]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, edi
call fcn.00403ea0
mov ecx, eax
lea edx, [ecx + 2]
lea ebx, [ebx]
mov bx, word [ecx]
add ecx, 2
test bx, bx
jne 0x403d60
sub ecx, edx
mov edx, dword [esi + 0x7238]
sar ecx, 1
add ecx, ecx
push ecx
push eax
shl edx, 7
lea eax, [edx + esi + 0x757c]
push eax
call fcn.00422ff0
add esp, 0xc
push 0x48
push 0
push 0x656e40
call fcn.00422f70
mov eax, dword [esi + 0x7238]
add eax, 0x985
lea ecx, [eax + eax*2]
movzx edx, word [esi + ecx*4]
add esp, 0xc
push edx
mov ebx, 0x656e40
call fcn.00403b50
test eax, eax
je 0x403e51
mov edx, dword [0x656e40]
mov eax, edx
xor ebx, ebx
imul eax, eax, 0x680
lea ecx, [eax + esi + 0x8f8]
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
lea ecx, [eax + 2]
mov dword [esp + 0x14], ecx
jmp 0x403df0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403df0
sub eax, dword [esp + 0x14]
sar eax, 1
je 0x403e10
add dword [esp + 0xc], 0x40
inc ebx
cmp ebx, 0x1a
jl 0x403ddd
jmp 0x403e51
mov eax, 0x656e44
lea ecx, [eax + 2]
mov dword [esp + 0x14], ecx
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403e20
sub eax, dword [esp + 0x14]
imul edx, edx, 0x1a
sar eax, 1
add eax, eax
add edx, ebx
push eax
shl edx, 6
lea ecx, [edx + esi + 0x8f8]
push 0x656e44
push ecx
call fcn.00422ff0
add esp, 0xc
inc dword [esi + 0x7238]
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403e60
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 + 2], cx
lea edi, [edi + eax*2 + 2]
jne 0x403cc8
mov edi, dword [esp + 0x10]
push edi
call fcn.0041960a
add esp, 4
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4043c0
Capabilities:
Get disk information

Disassembly:
sub esp, 0xb0
mov eax, dword [0x630160]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebp
push esi
push edi
xor eax, eax
xor ebp, ebp
push 0x7e
lea ecx, [esp + 0x36]
push ebp
push ecx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov word [esp + 0x3c], ax
call fcn.00422f70
add esp, 0xc
test byte [0x657dd4], 1
jne 0x404434
or dword [0x657dd4], 1
push str.ZwQueryVolumeInformationFile
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x657dd0], eax
movzx edx, word [ebx]
push edx
lea eax, [esp + 0x34]
push str.._c:
push eax
mov edx, 0x80
call fcn.00401fe0
add esp, 0xc
push ebp
push 0x80
push 3
push ebp
push 3
push accept
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40449b
push 1
push 0x18
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push esi
call dword [0x657dd0]
mov edi, eax
test edi, edi
jl 0x404490
mov ebp, dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jge 0x4044bb
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x4044bd
mov eax, ebp
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00418878
add esp, 0xb0
ret

Function at 0x408640
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x84
mov eax, dword [0x630160]
xor eax, esp
mov dword [esp + 0x80], eax
push esi
push edi
push 5
mov esi, ecx
call fcn.00472a30
mov eax, dword [esi + 4]
push str.Hardwares
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
call fcn.00408380
xor ecx, ecx
push 0x7e
push ecx
lea edx, [esp + 0x12]
push edx
mov word [esp + 0x14], cx
call fcn.00422f70
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
push 0x655638
push 0x20
lea eax, [esp + 0x10]
push eax
push 0
push 0x62505c
push 0x625060
call edi
test eax, eax
je 0x4086c0
mov ecx, dword [esi + 0x768]
mov edx, dword [ecx]
mov edx, dword [edx + 0x3c]
lea eax, [esp + 8]
push eax
call edx
push 0x655638
push 0x20
lea eax, [esp + 0x10]
push eax
push 0
push 0x625084
push 0x625060
call edi
test eax, eax
je 0x4086f0
mov ecx, dword [esi + 0x76c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x3c]
lea eax, [esp + 8]
push eax
call edx
push 0x655638
push 0x20
lea eax, [esp + 0x10]
push eax
push 0
push 0x625088
push 0x625060
call edi
test eax, eax
jne 0x408762
mov ecx, dword [esi + 4]
push 4
push 0x62509c
push 0x6250a8
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x408748
push eax
mov ecx, esi
call fcn.00472c3d
pop edi
pop esi
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00418878
add esp, 0x84
ret
push 0x655638
push 0x6255a0
push 0x625088
push 0x625060
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [esp + 0x88]
pop edi
pop esi
xor ecx, esp
call fcn.00418878
add esp, 0x84
ret
Function at 0x4090c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5c55ed
mov eax, dword fs:[0]
push eax
sub esp, 0x7f8
mov eax, dword [0x630160]
xor eax, esp
mov dword [esp + 0x7f0], eax
push esi
mov eax, dword [0x630160]
xor eax, esp
push eax
lea eax, [esp + 0x800]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [esp + 0x10]
push eax
mov esi, ecx
call fcn.004149f0
push 0
push accept
push accept
push accept
push accept
push 0x100
push 0x96c80000
mov dword [esp + 0x824], 0
mov ecx, dword [esi + 4]
push 0
push ecx
lea ecx, [esp + 0x30]
call fcn.00472d7e
lea ecx, [esp + 0xc]
call fcn.004728f3
lea ecx, [esp + 0xc]
call fcn.0047281a
lea edx, [esp + 0xc]
push edx
mov esi, eax
mov dword [esp + 0x80c], 0xffffffff
call fcn.004091a0
mov eax, esi
mov ecx, dword [esp + 0x800]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.00418878
mov esp, ebp
pop ebp
ret 4
Function at 0x413480
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea ecx, [esp + 8]
push ecx
or eax, 1
push eax
push 4
push edx
xor esi, esi
push reloc.WS2_32.dll_bind
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413536
mov eax, dword [esp + 8]
test eax, eax
je 0x413545
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 8]
push ecx
push esi
push 0x651368
push esi
push ebx
push eax
call edi
cmp eax, 2
je 0x413535
test eax, eax
jne 0x413535
mov eax, dword [esp + 8]
test eax, eax
jbe 0x413535
add eax, 4
push eax
mov dword [esp + 0xc], eax
call fcn.0041884e
mov esi, eax
add esp, 4
test esi, esi
je 0x413535
mov edx, dword [esp + 8]
push edx
push 0
push esi
call fcn.00422f70
mov ecx, dword [esp + 0x18]
add esp, 0xc
lea eax, [esp + 8]
push eax
push esi
push 0x651368
push 0
push ebx
push ecx
call edi
test eax, eax
jne 0x41352a
cmp dword [esp + 8], eax
ja 0x413535
push esi
call fcn.0041960a
add esp, 4
xor esi, esi
pop edi
mov eax, dword [esp + 8]
test eax, eax
je 0x413545
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x413550
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
push 1
push 4
push ecx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41359d
mov eax, dword [esp + 4]
test eax, eax
je 0x4135ac
lea edx, [esp]
push edx
push 0
push 0x65136c
push 0
push str.NameServer
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 4]
test eax, eax
je 0x4135ac
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 8
ret

Function at 0x4135c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea ecx, [esp + 4]
push ecx
or eax, 1
push eax
push 4
push edx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41361b
mov eax, dword [esp + 4]
test eax, eax
je 0x41362a
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 4]
push edx
push 0x651370
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 4]
test eax, eax
je 0x41362a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 0xc
ret