joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412979
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
mov eax, 0x2088
call fcn.00415a90
mov eax, dword [ebp + 0x78]
mov ecx, dword [ebp + 0x7c]
mov al, byte [eax]
mov cl, byte [ecx]
cmp al, cl
jne 0x41299d
xor eax, eax
jmp 0x412acc
cmp al, 0x43
je 0x412ac9
cmp al, 0x63
je 0x412ac9
cmp cl, 0x43
je 0x412ac9
cmp cl, 0x63
je 0x412ac9
and dword [ebp + 0x68], 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x74]
call fcn.00412913
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x64], eax
jne 0x412ac4
push ebx
push esi
push edi
push 0x1fff
push eax
mov byte [ebp - 0x201c], al
lea eax, [ebp - 0x201b]
push eax
call sub.msvcrt.dll_memset
mov ebx, str.DosDevicesX:
mov esi, ebx
lea edi, [ebp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x31
lea eax, [ebp + 0x33]
push 0
push eax
movsb byte es:[edi], byte [esi]
call sub.msvcrt.dll_memset
mov esi, ebx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x31
lea eax, [ebp - 0xd]
push 0
push eax
movsb byte es:[edi], byte [esi]
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x7c]
mov al, byte [eax]
mov byte [ebp + 0x30], al
mov eax, dword [ebp + 0x78]
mov al, byte [eax]
mov byte [ebp - 0x10], al
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x201c]
push eax
lea eax, [ebp + 0x24]
push eax
push dword [ebp + 0x68]
mov esi, 0x2000
mov dword [ebp + 0x7c], esi
call fcn.00410fdb
add esp, 0x34
test eax, eax
je 0x412ab4
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x201c]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x68]
mov dword [ebp + 0x7c], esi
call fcn.00410fdb
add esp, 0x10
test eax, eax
jne 0x412ab8
push dword [ebp + 0x7c]
lea eax, [ebp - 0x201c]
push eax
push 3
push 0
lea eax, [ebp + 0x24]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x412ab8
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp + 0x64], eax
jmp 0x412ab8
or dword [ebp + 0x64], 0xffffffff
push dword [ebp + 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov eax, dword [ebp + 0x64]
jmp 0x412acc
or eax, 0xffffffff
add ebp, 0x6c
leave
ret
Function at 0x414f64
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 8]
xor eax, eax
inc eax
shl eax, cl
mov ecx, dword [ebp - 0x18]
test ecx, eax
je 0x415122
mov al, byte [ebp - 8]
mov esi, str..X:
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add al, 0x41
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x10], 0x5c3a58
mov byte [ebp - 1], al
mov byte [ebp - 0x20], al
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 4
je 0x415122
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x415122
xor eax, eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
push 0xc
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push 0x2d1080
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x415119
cmp dword [ebp - 0x30], 7
jne 0x415119
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x443]
push ebx
push eax
mov byte [ebp - 0x444], bl
call sub.msvcrt.dll_memset
xor eax, eax
mov byte [ebp - 0x44], bl
lea edi, [ebp - 0x43]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xa
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x2c]
call sub.msvcrt.dll__itoa
push esi
lea eax, [ebp - 0x44]
push eax
push str.SYSTEMCurrentControlSetServicesDiskEnum
push reloc.WS2_32.dll_bind
lea esi, [ebp - 0x444]
call fcn.00411088
push 7
mov eax, esi
push str.USBSTOR
push eax
call sub.msvcrt.dll__strnicmp
add esp, 0x34
test eax, eax
jne 0x415119
mov edi, dword [ebp + 8]
cmp dword [edi + 0x138], ebx
mov dword [ebp - 0xc], ebx
jle 0x415119
mov eax, dword [ebp - 0xc]
lea ecx, [edi + 0x12c]
call fcn.004034e8
push 0x3ff
mov esi, eax
lea eax, [ebp - 0x843]
push ebx
push eax
mov byte [ebp - 0x844], bl
call sub.msvcrt.dll_memset
lea eax, [esi + 0x419]
add esp, 0xc
cmp byte [eax], bl
je 0x41510b
lea ecx, [esi + 0x499]
push ecx
push eax
lea eax, [ebp - 0x844]
push str.USBSTOR_s_s
push eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x844]
push eax
call sub.msvcrt.dll__stricmp
add esp, 0x18
test eax, eax
jne 0x41510b
mov cl, byte [ebp - 1]
mov eax, esi
call fcn.0041323d
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edi + 0x138]
jl 0x415099
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1a
jb 0x414f7e
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4157da
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x4164e0
call fcn.004159c8
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x415817
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415817
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x41582f
cmp eax, 0x20b
je 0x41581c
mov dword [ebp - 0x1c], ebx
jmp 0x415843
cmp dword [ecx + 0x84], 0xe
jbe 0x415817
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x41583d
cmp dword [ecx + 0x74], 0xe
jbe 0x415817
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x41b52c], 0xffffffff
or dword [0x41b530], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x41a6ac]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x41a6a8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x41b528], eax
call fcn.004159c4
cmp dword [section..data], ebx
jne 0x41589e
push fcn.004159c4
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.004159b2
push 0x4164b8
push 0x4164b4
call sub.msvcrt.dll__initterm
mov eax, dword [0x41a6a4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x41a6a0]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x4164b0
push 0x41647c
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x415934
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x415908
cmp al, 0x22
jne 0x4158fa
cmp byte [esi], 0x22
jne 0x415911
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x41591b
cmp al, 0x20
jbe 0x41590d
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x41593f
movzx eax, word [ebp - 0x48]
jmp 0x415942
cmp byte [esi], 0x20
jbe 0x415911
inc esi
mov dword [ebp - 0x34], esi
jmp 0x415934
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x41595f
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x415994
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00415a01
ret
Function at 0x40100e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t__]
push str.TencentQQFlashDllFlash.ocx
mov ecx, edi
call dword [0x4080c4]
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
mov ecx, edi
call esi
push eax
lea eax, [ebp - 0x210]
push str.OSRoot:
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_FS::CombineQNC_wchar_t_const___wchar_t_const__]
add esp, 0xc
lea ecx, [ebp - 0x210]
call esi
push eax
call dword [sym.imp.Common.dll_int___cdecl_FS::IsFileExist_wchar_t_const__]
pop ecx
test eax, eax
je 0x4010c1
xor esi, esi
inc esi
lea ecx, [ebp - 0x210]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004073f8
leave
ret
push 0x408b88
mov ecx, edi
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
xor esi, esi
jmp 0x4010a6
Function at 0x403e6b
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
lea ecx, [ebp - 0x214]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x403f94
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x403fd4
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
lea ecx, [ebp - 0x210]
call edi
cmp dword [ebp + 0xc], ebx
jne 0x403efe
push 0x409628
lea ecx, [ebp - 0x210]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
lea ecx, [ebp - 0x21c]
call edi
mov ebx, dword [sym.imp.Common.dll_public:_void___cdecl_CTXStringW::Format_wchar_t_const__]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push str._s_regsvr32.exe
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x218]
call edi
mov edi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::GetString_void_const]
lea ecx, [ebp - 0x214]
call edi
push eax
lea ecx, [ebp - 0x210]
call edi
push eax
lea eax, [ebp - 0x218]
push str._s__s___s_
push eax
call ebx
mov edi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
add esp, 0x10
push 5
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x218]
call edi
push eax
lea ecx, [ebp - 0x21c]
call edi
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x218]
call esi
lea ecx, [ebp - 0x21c]
call esi
lea ecx, [ebp - 0x210]
call esi
jmp 0x403fd4
lea ecx, [ebp - 0x214]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.Common.dll_struct_HINSTANCE______cdecl_Util::Sys::SafeLoadLibrary_wchar_t_const__]
mov edi, eax
pop ecx
cmp edi, 0x20
jb 0x403fd4
cmp dword [ebp + 0xc], ebx
je 0x403fbb
push str.DllRegisterServer
jmp 0x403fc0
push str.DllUnregisterServer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x403fcd
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x214]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004073f8
leave
ret
Function at 0x404350
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
push edi
push 1
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
mov dword [ebp - 4], ebx
call esi
cmp dword [ebp - 4], ebx
je 0x40441f
push dword [ebp - 4]
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
pop ecx
cmp edi, ebx
je 0x40441f
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.MSVCR100.dll_memset]
add esp, 0xc
push 1
lea eax, [ebp - 4]
push eax
push edi
call esi
test eax, eax
je 0x4043cd
cmp dword [0x40c460], 2
jne 0x4043c4
push str.GetIpForwardTable_fail_n
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
pop ecx
pop ecx
push edi
call dword [sym.imp.MSVCR100.dll_free]
jmp 0x40443e
mov dword [ebp - 8], ebx
cmp dword [edi], ebx
jbe 0x404413
lea esi, [edi + 4]
cmp dword [0x40c460], 2
jne 0x4043fd
push dword [esi + 4]
push dword [esi]
push str.MIB_IPFORWARDROW__lu__lu_n
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 0x10
cmp dword [esi], ebx
jne 0x404406
cmp dword [esi + 4], ebx
je 0x4043c4
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add esi, 0x38
cmp eax, dword [edi]
jb 0x4043d7
push edi
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
xor eax, eax
jmp 0x404442
cmp dword [0x40c460], 2
jne 0x40443f
push str.size__0__malloc_fail_n
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
pop ecx
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404447
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x7fe
mov word [ebp - 0x804], ax
xor edi, edi
lea eax, [ebp - 0x802]
push edi
push eax
call sub.MSVCR100.dll_memset
push 0xffffffffffffffff
push str.SOFTWARETencent_bugReport_
mov esi, 0x400
lea eax, [ebp - 0x804]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_wcsncpy_s]
push 0x40c488
lea eax, [ebp - 0x804]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_wcscat_s]
add esp, 0x28
lea eax, [ebp - 0x810]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x804]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40452a
push 4
pop esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x80c]
push eax
push edi
push str.lcdbg
push dword [ebp - 0x810]
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x814], esi
mov dword [ebp - 0x80c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x80c], esi
je 0x404522
mov dword [ebp - 0x808], edi
mov eax, dword [ebp - 0x808]
jmp 0x40452c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004073f8
leave
ret
Function at 0x404b0b
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp byte [0x40c508], bl
jne 0x404bde
mov byte [0x40c508], 1
cmp eax, ebx
je 0x404bde
cmp word [eax], bx
je 0x404bde
push 0xffffffffffffffff
push eax
push 0x21
mov esi, 0x40c488
push esi
call dword [sym.imp.MSVCR100.dll_wcsncpy_s]
push 0x63
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call sub.MSVCR100.dll_memset
add esp, 0x1c
push ebx
push ebx
push 0x63
lea eax, [ebp - 0x68]
push eax
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
push eax
push 0x21
push 0x40c464
call dword [sym.imp.MSVCR100.dll_strncpy_s]
add esp, 0x10
cmp byte [0x40c464], bl
je 0x404bde
mov eax, dword [ebp + 0xc]
mov dword [0x40c4cc], eax
lea eax, [ebp - 0x6c]
push eax
push 4
push ebx
push 0x40453a
push ebx
push ebx
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x404bde
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x404be1
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004073f8
leave
ret

Function at 0x404d6d
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push esi
push str..PhysicalDrive0
mov dword [ebp - 0x418], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x414], eax
cmp eax, 0xffffffff
je 0x404e65
push ebx
push edi
mov edi, dword [sym.imp.MSVCR100.dll_memset]
push 0xc
lea eax, [ebp - 0x410]
push esi
push eax
call edi
mov ebx, 0x400
push ebx
lea eax, [ebp - 0x404]
push esi
push eax
mov dword [ebp - 0x410], esi
mov dword [ebp - 0x40c], esi
mov dword [ebp - 0x41c], esi
call edi
add esp, 0x18
push esi
lea eax, [ebp - 0x41c]
push eax
push ebx
lea eax, [ebp - 0x404]
push eax
push 0xc
lea eax, [ebp - 0x410]
push eax
push 0x2d1400
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
pop edi
pop ebx
test eax, eax
je 0x404e59
mov esi, dword [ebp - 0x3f4]
lea esi, [ebp + esi - 0x404]
movsx eax, byte [esi]
push eax
call dword [sym.imp.MSVCR100.dll_isalnum]
pop ecx
test eax, eax
je 0x404e59
push esi
call dword [sym.imp.MSVCR100.dll_strlen]
mov edx, dword [ebp - 0x418]
pop ecx
mov ecx, esi
call fcn.00405333
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x404e67
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004073f8
leave
ret 4
Function at 0x405935
Capabilities:
Hash data with md5

Disassembly:
push 0x5c
push 0
push esi
call dword [sym.imp.MSVCR100.dll_memset]
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
ret
Function at 0x4065e2
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
xor esi, esi
mov dword [ebp - 8], ebx
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push ebx
push 2
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov dword [ebp - 0x14], eax
cmp eax, 0x6f
jne 0x406645
cmp esi, ebx
je 0x406627
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [ebp - 0xc]
add eax, 0x120
push eax
call fcn.004073e6
mov esi, eax
pop ecx
cmp esi, ebx
je 0x406687
inc dword [ebp - 8]
cmp dword [ebp - 8], 5
jl 0x406604
cmp dword [ebp - 0x14], ebx
jne 0x40667b
cmp esi, ebx
je 0x406687
push edi
mov ecx, esi
call fcn.00406698
mov edi, eax
cmp edi, ebx
je 0x40666f
mov ecx, dword [ebp - 0x10]
call fcn.00406b3a
mov ecx, dword [ebp - 0x10]
call fcn.00406da8
xor edi, edi
inc edi
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, edi
jmp 0x406689
cmp esi, ebx
je 0x406687
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004073f8
leave
ret
Function at 0x414fc1
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ecx + 0x9c]
test edx, edx
je 0x457c02
mov ecx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x414fde
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push edi
push dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x457c11
push edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 8
push 6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x415019
push eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x415017

Function at 0x417450
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4a1318], 0
je 0x41747c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b590
leave
ret
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
push eax
push eax
push 0x801c
push eax
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
test eax, eax
jne 0x417470
lea eax, [ebp - 0x20c]
push eax
push 0x407ccc
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
je 0x458953
mov byte [0x4a1318], 1
jmp 0x41746e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x417470
movzx eax, ax
or eax, 0x80070000
jmp 0x417470