joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b011
Capabilities:
Capture screenshot
Terminate process

Disassembly:
sub esp, 0x68
mov eax, dword [0x6ccd44]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
mov eax, ecx
xor ebp, ebp
push edi
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], eax
push ecx
push eax
call dword [sym.imp.USER32.dll_GetIconInfo]
lea eax, [esp + 0x1c]
push eax
push 0x18
push dword [esp + 0x48]
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp eax, 0x18
jne 0x40b17b
push ebp
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x40b17b
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x44], ebp
jne 0x40b07a
cdq
sub eax, edx
sar eax, 1
push eax
push dword [esp + 0x24]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
test ebx, ebx
je 0x40b15c
test esi, esi
je 0x40b167
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x2c
mov dword [esp + 0x1c], eax
xor ebp, ebp
lea eax, [esp + 0x4c]
push ebp
push eax
call fcn.005b5fd0
mov eax, dword [esp + 0x30]
add esp, 0xc
mov dword [esp + 0x48], 0x28
mov dword [esp + 0x58], ebp
cmp dword [esp + 0x44], ebp
jne 0x40b0d1
cdq
sub eax, edx
sar eax, 1
push 3
push ebp
push ebp
push eax
push dword [esp + 0x30]
push dword [esp + 0x28]
push ebp
push ebp
push ebx
call dword [sym.imp.USER32.dll_DrawIconEx]
push ebp
lea eax, [esp + 0x4c]
push eax
push ebp
push ebp
push ebp
push esi
push edi
call dword [sym.imp.GDI32.dll_GetDIBits]
push dword [esp + 0x5c]
call fcn.005eae30
mov ebp, eax
mov dword [esp + 0x18], ebp
pop ecx
test ebp, ebp
je 0x40b190
and dword [esp + 0x58], 0
cmp dword [esp + 0x44], 0
mov eax, dword [esp + 0x24]
jne 0x40b125
cdq
sub eax, edx
sar eax, 1
push 0
lea ecx, [esp + 0x4c]
push ecx
push ebp
push eax
push 0
push esi
push edi
call dword [sym.imp.GDI32.dll_GetDIBits]
mov edx, dword [esp + 0x5c]
mov ecx, ebp
push 0
call fcn.0047fb7d
push dword [esp + 0x14]
mov ebp, eax
call fcn.005eae10
pop ecx
push dword [esp + 0x18]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
test esi, esi
je 0x40b167
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [sym.imp.USER32.dll_ReleaseDC]
test ebx, ebx
je 0x40b176
push ebx
push 0
call esi
push edi
push 0
call esi
mov ecx, dword [esp + 0x74]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005b35b0
add esp, 0x68
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0xfe
mov edx, 0x6d1f60
push eax
push edi
xor ecx, ecx
lea esi, [edi - 0x5a]
push esi
call fcn.00488a50
push esi
push str...meshcoreKVMWindowsinput.c
push 0x6d1fa0
call fcn.00401109
add esp, 0x18
push edi
call fcn.005c3000
int3
Function at 0x40b50f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
mov ebx, dword [0x72a1d0]
xor eax, eax
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
xor ebp, ebp
push edi
mov dword [esp + 0x14], ebp
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
push ecx
push 0x7f00
push ebp
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call esi
mov ecx, eax
call fcn.0040b011
push 0x7f8a
push ebp
mov dword [0x75018c], eax
call esi
mov ecx, eax
call fcn.0040b011
push 0x7f03
push ebp
mov dword [0x750174], eax
call esi
mov ecx, eax
call fcn.0040b011
push 0x7f89
push ebp
mov dword [0x75017c], eax
call esi
mov ecx, eax
call fcn.0040b011
push 0x7f8b
push ebp
mov dword [0x7501d0], eax
call esi
mov ecx, eax
call fcn.0040b011
push 0x7f01
push ebp
mov dword [0x750168], eax
call esi
mov ecx, eax
call fcn.0040b011
push 0x7f88
push ebp
mov dword [0x750180], eax
call esi
mov ecx, eax
call fcn.0040b011
push 0x7f86
push ebp
mov dword [0x750188], eax
call esi
mov ecx, eax
call fcn.0040b011
push 0x7f83
push ebp
mov dword [0x750190], eax
call esi
mov ecx, eax
call fcn.0040b011
push 0x7f85
push ebp
mov dword [0x750178], eax
call esi
mov ecx, eax
call fcn.0040b011
push 0x7f82
push ebp
mov dword [0x750170], eax
call esi
mov ecx, eax
call fcn.0040b011
mov dword [0x7501d4], eax
push 0x7f84
push ebp
call esi
mov ecx, eax
call fcn.0040b011
push 0x7f04
push ebp
mov dword [0x75016c], eax
call esi
mov ecx, eax
call fcn.0040b011
push 0x7f02
push ebp
mov dword [0x750184], eax
call esi
mov ecx, eax
call fcn.0040b011
mov dword [0x750194], eax
lea eax, [esp + 0x18]
pop ecx
push eax
mov dword [esp + 0x18], 0x14
call dword [sym.imp.USER32.dll_GetCursorInfo]
push ecx
mov ecx, dword [esp + 0x20]
call fcn.0040b011
pop ecx
mov ecx, eax
call fcn.0040af68
push ebp
push ebp
push 0x15
mov dword [0x6d2084], eax
call fcn.005eae30
pop ecx
push 5
pop edx
mov ecx, eax
call fcn.004811d1
mov esi, dword [sym.imp.WS2_32.dll_htons]
mov edi, eax
pop ecx
pop ecx
push 0x58
call esi
push 5
mov word [edi], ax
call esi
mov dl, byte [0x6d2084]
mov ecx, ebx
mov byte [edi + 4], dl
mov edx, edi
push ebp
mov word [edi + 2], ax
call fcn.0048733f
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebp
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebp
push ebp
push ebp
push 0x40b404
push ebp
push ebp
mov dword [0x72a1b8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [0x72a1c8], eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b75a
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, edx
mov bl, cl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40b7cf
push edi
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor edi, edi
movzx eax, bl
inc edi
mov word [ebp - 0x18], ax
mov dword [ebp - 0x1c], edi
cmp esi, edi
jne 0x40b792
mov dword [ebp - 0x14], 2
jmp 0x40b7a4
push 3
pop eax
cmp esi, eax
je 0x40b7a1
xor eax, eax
cmp esi, 4
cmove eax, edi
mov dword [ebp - 0x14], eax
and dword [ebp - 0x10], 0
push 0
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [ebp - 0x16], ax
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push edi
call dword [sym.imp.USER32.dll_SendInput]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40bb21
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_bind
mov dword [ebp - 8], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bb71
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.SoftwareSASGeneration
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x40c8b5
Capabilities:
Create thread

Disassembly:
cmp dword [0x72a558], 0
push ebx
push ebp
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x40c90d
cmp esi, 2
jl 0x40c8f8
movzx eax, word [edi]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
cmp ax, 0xa
jne 0x40c8f8
xor eax, eax
push eax
push eax
push eax
push 0x40bb75
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40c8f8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, dword [0x72a558]
mov edx, edi
push esi
call fcn.0048a411
pop ecx
pop ecx
mov eax, esi
jmp 0x40c931
xor ebx, ebx
mov ebp, 0x4017e5
jmp 0x40c91f
add ebx, eax
mov edx, esi
sub edx, ebx
lea ecx, [ebx + edi]
push dword [esp + 0x18]
push ebp
call fcn.0040c18e
pop ecx
pop ecx
test eax, eax
jne 0x40c916
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40c958
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [0x6ccd44]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [0x72a208]
push ebx
mov ebx, ecx
push ebp
mov ebp, edx
push esi
push edi
test eax, eax
je 0x40c9ac
xor esi, esi
cmp dword [0x72a224], esi
jle 0x40c99b
push 1
push dword [eax + esi*4]
call fcn.005e7dd0
mov eax, dword [0x72a208]
inc esi
pop ecx
pop ecx
cmp esi, dword [0x72a224]
jl 0x40c981
push 1
push eax
call fcn.005e7dd0
and dword [0x72a208], 0
pop ecx
pop ecx
mov ecx, dword [0x6d23d8]
mov edi, 0x3ff
mov eax, dword [0x72a218]
imul eax, ecx
mov dword [0x6d23dc], ecx
cdq
and edx, edi
lea esi, [edx + eax]
mov eax, dword [0x72a1f8]
imul eax, ecx
sar esi, 0xa
mov dword [0x72a1ec], esi
cdq
and edx, edi
lea ecx, [edx + eax]
mov eax, esi
cdq
idiv dword [0x72a21c]
sar ecx, 0xa
mov edi, eax
mov dword [0x72a230], ecx
mov esi, edx
mov dword [0x72a22c], edi
mov eax, ecx
cdq
idiv dword [0x72a1fc]
mov dword [0x72a224], eax
test esi, esi
je 0x40ca17
inc edi
mov dword [0x72a22c], edi
test edx, edx
je 0x40ca21
inc eax
mov dword [0x72a224], eax
mov esi, dword [sym.imp.WS2_32.dll_htons]
push 7
call esi
push 8
mov word [esp + 0x14], ax
call esi
mov word [esp + 0x12], ax
movzx eax, word [0x72a1ec]
push eax
call esi
mov word [esp + 0x14], ax
movzx eax, word [0x72a230]
push eax
call esi
push ebp
mov word [esp + 0x1a], ax
lea eax, [esp + 0x14]
push 8
push eax
call ebx
mov eax, dword [0x72a224]
mov edi, 0x2c3
push edi
push 0x6d220c
shl eax, 2
push 1
push eax
call fcn.005e7f10
mov ecx, eax
add esp, 0x1c
mov dword [0x72a208], ecx
test ecx, ecx
je 0x40cb36
mov edx, dword [0x72a224]
xor esi, esi
test edx, edx
jle 0x40cafc
add edi, 2
mov eax, dword [0x72a22c]
push edi
push 0x6d2290
shl eax, 3
push 1
push eax
call fcn.005e7f10
mov ecx, dword [0x72a208]
add esp, 0x10
mov dword [ecx + esi*4], eax
test eax, eax
je 0x40cb0f
mov edx, dword [0x72a224]
inc esi
cmp esi, edx
jl 0x40ca9e
test edx, edx
jle 0x40cafc
mov edi, dword [0x72a22c]
xor esi, esi
test edi, edi
jle 0x40caf4
mov eax, dword [ecx]
mov dword [eax + esi*8], 0xff
mov eax, dword [ecx]
mov byte [eax + esi*8 + 4], 0
inc esi
cmp esi, edi
jl 0x40cadf
add ecx, 4
sub edx, 1
jne 0x40cad9
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005b35b0
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x6d22b0
push esi
push edi
xor ecx, ecx
call fcn.00488a50
push edi
push str...meshcoreKVMWindowskvm.c
push 0x6d22f0
jmp 0x40cb5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x6d222c
push esi
push edi
xor ecx, ecx
call fcn.00488a50
push edi
push 0x6d224c
push 0x6d226c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x40cb6a
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x753c
call fcn.005b3d10
mov eax, dword [0x6ccd44]
xor eax, esp
mov dword [esp + 0x7538], eax
push ebx
mov ebx, dword [ecx]
push ebp
mov ebp, dword [ecx + 4]
push esi
xor esi, esi
and dword [esp + 0xc], esi
push edi
xor edi, edi
cmp dword [0x6d23c8], esi
jne 0x40cc19
push 0
lea eax, [esp + 0x14]
push eax
mov eax, 0x7530
sub eax, esi
push eax
lea eax, [esp + 0x24]
add eax, esi
push eax
push dword [0x6d23d0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40cc0f
cmp dword [esp + 0x10], 0
je 0x40cc0f
cmp dword [0x6d23c8], 0
jne 0x40cc0f
add esi, dword [esp + 0x10]
mov dword [esp + 0x14], esi
jmp 0x40cbdd
add edi, eax
push ebp
mov edx, esi
lea ecx, [esp + 0x1c]
push ebx
sub edx, edi
add ecx, edi
call fcn.0040c18e
pop ecx
pop ecx
test eax, eax
jne 0x40cbdb
xor eax, eax
cmp edi, esi
cmove esi, eax
cmp edi, dword [esp + 0x14]
cmovne eax, edi
cmp dword [0x6d23c8], 0
mov edi, eax
je 0x40cb9b
jmp 0x40cc19
mov dword [0x6d23c8], 1
mov ecx, dword [esp + 0x7548]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005b35b0
add esp, 0x753c
ret
Function at 0x40d64c
Capabilities:
Create thread

Disassembly:
test edx, edx
je 0x40d692
cmp dword [0x72a1e8], 1
jne 0x40d665
cmp dword [0x6d23c8], 0
jne 0x40d665
xor eax, eax
ret
push dword [esp + 8]
mov eax, dword [esp + 0x10]
and dword [0x72a1e4], 0
push 0x4017e5
push ecx
mov dword [0x6d23e0], 5
mov dword [0x6d23cc], eax
call fcn.0040d48d
add esp, 0xc
ret
push esi
push edi
xor esi, esi
xor edx, edx
push esi
push esi
push 0xc
pop ecx
call fcn.004814a9
pop ecx
xor edi, edi
inc edi
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [eax], 0x4017e5
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov dword [0x72a210], edi
cmp dword [0x72a1e8], edi
jne 0x40d6da
cmp dword [0x6d23c8], esi
jne 0x40d6da
push edi
push eax
call fcn.005e7dd0
pop ecx
pop ecx
xor eax, eax
jmp 0x40d6f8
push esi
push esi
push eax
push fcn.0040d2e6
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [0x72a220], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
Function at 0x40ee00
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, 0x1d9
mov ebx, 0x10000
push edi
push 0x6d2518
push 1
push ebx
mov esi, ecx
call fcn.005e7f10
add esp, 0x10
mov dword [esi], eax
test eax, eax
je 0x40eea3
push ebp
push str._netif_:_
push ebx
push eax
call fcn.0040117f
mov ecx, dword [esi]
mov edi, eax
mov edx, ebx
add ecx, edi
sub edx, edi
call fcn.0040e902
mov ecx, dword [esi]
mov ebp, eax
add edi, ebp
push 0x6d2590
sub ebx, edi
add ecx, edi
push ebx
push ecx
call fcn.0040117f
add esp, 0x18
add edi, eax
js 0x40ee8e
test ebp, ebp
je 0x40ee8e
mov eax, dword [esi]
mov ebx, 0x1e5
push ebx
push 0x6d2594
push 1
mov byte [edi + eax], 0
lea eax, [edi + 1]
push eax
push dword [esi]
call fcn.005e80c0
add esp, 0x14
mov dword [esi], eax
test eax, eax
je 0x40eed6
mov eax, edi
jmp 0x40ee9e
push 1
push dword [esi]
call fcn.005e7dd0
and dword [esi], 0
xor eax, eax
pop ecx
pop ecx
pop ebp
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x6d2530
push esi
push edi
xor ecx, ecx
call fcn.00488a50
push edi
push 0x6d2548
push 0x6d2560
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x6d25ac
push esi
push ebx
xor ecx, ecx
call fcn.00488a50
push ebx
push str...meshcoremeshinfo.c
push 0x6d25dc
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x40ef0a
Capabilities:
Create thread
Shutdown system

Disassembly:
sub esp, 0x1c
mov eax, dword [0x6ccd44]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
jne 0x40ef2b
xor eax, eax
jmp 0x40f077
cmp edi, 6
jne 0x40ef46
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
push 2
call esi
push 4
call esi
xor eax, eax
inc eax
jmp 0x40f077
cmp edi, 7
jne 0x40ef5c
xor ebx, ebx
inc ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov eax, ebx
jmp 0x40f077
cmp edi, 8
jne 0x40ef6b
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x40ef3e
cmp edi, 9
jne 0x40ef93
xor esi, esi
push esi
push esi
push esi
push 0x40bb75
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40ef3e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40ef3e
cmp edi, 5
jg 0x40ef24
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40ef24
lea eax, [esp + 0x18]
xor esi, esi
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 2
push eax
push esi
push dword [esp + 0x24]
xor ebx, ebx
inc ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40f002
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40ef24
sub edi, 1
je 0x40f03a
sub edi, 1
je 0x40f02c
sub edi, 1
je 0x40f029
sub edi, 1
je 0x40f025
sub edi, 1
jne 0x40f06b
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
jmp 0x40f04e
push ebp
push ebx
jmp 0x40f01d
push ebx
jmp 0x40f02d
push esi
push ebx
push 0x1e
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
jmp 0x40f04e
push closesocket
test ebp, ebp
je 0x40f047
push 4
jmp 0x40f048
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x40f06b
push esi
push esi
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], esi
push eax
push esi
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, ebx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005b35b0
add esp, 0x1c
ret
Function at 0x40f09f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
mov esi, edx
push eax
push 0x6b4c20
push reloc.WS2_32.dll_bind
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40f0f4
mov ecx, esi
push ebx
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40f0c9
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push esi
push 1
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4461e1
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
and dword [esp + 4], 0
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x2c]
mov ebp, dword [eax + 0x88]
mov edx, dword [eax + 0x8c]
add ebp, 0x7f4a7c15
mov ecx, ebp
adc edx, 0x9e3779b9
mov eax, edx
mov dword [esp + 0x18], edx
shrd ecx, eax, 0x1e
push 0xbf58476d
shr eax, 0x1e
xor ecx, ebp
push 0x1ce4e5b9
xor eax, edx
push eax
push ecx
call fcn.005b4920
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1b
push 0x94d049bb
shr ecx, 0x1b
xor esi, eax
push 0x133111eb
xor ecx, edx
push ecx
push esi
call fcn.005b4920
mov edi, edx
mov esi, eax
shrd esi, edi, 0x1f
shr edi, 0x1f
xor esi, eax
mov eax, dword [ebx + 0x2c]
xor edi, edx
mov edx, dword [esp + 0x14]
mov ecx, edx
and ecx, 1
inc edx
mov dword [esp + 0x14], edx
cmp edx, 0x40
mov edx, dword [esp + 0x18]
mov dword [eax + ecx*8 + 0x88], esi
mov dword [eax + ecx*8 + 0x8c], edi
jb 0x4461fe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x45291f
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x6ccd44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x41c]
mov esi, ecx
push eax
push 0x400
lea eax, [ebp - 0x408]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
test eax, eax
je 0x452a9b
cmp byte [ebp - 0x408], 0
je 0x452a9b
mov ecx, esi
call fcn.0041ad21
lea edx, [ebp - 0x408]
mov ecx, esi
call fcn.0041a93d
push 0x6d9e34
push 0xfffffffffffffffe
pop ebx
mov edx, ebx
mov ecx, esi
call fcn.00417cb7
pop ecx
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x452a15
mov edx, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x410]
call fcn.005b4830
movaps xmm1, xmm0
mov ecx, esi
call fcn.0041a7b7
push 0x6d9e3c
mov edx, ebx
mov ecx, esi
call fcn.00417cb7
mov edx, dword [ebp - 0x414]
pop ecx
mov ecx, dword [ebp - 0x418]
call fcn.005b4830
movaps xmm1, xmm0
mov ecx, esi
call fcn.0041a7b7
push str.free
mov edx, ebx
mov ecx, esi
call fcn.00417cb7
pop ecx
dec edi
sub edi, 1
je 0x452a54
sub edi, 1
je 0x452a4d
sub edi, 1
je 0x452a46
sub edi, 1
je 0x452a3f
mov ecx, esi
sub edi, 1
je 0x452a38
mov edx, 0x6d9e78
jmp 0x452a5b
mov edx, str.RAMDISK
jmp 0x452a5b
mov edx, str.CDROM
jmp 0x452a59
mov edx, str.REMOTE
jmp 0x452a59
mov edx, str.FIXED
jmp 0x452a59
mov edx, str.REMOVABLE
mov ecx, esi
call fcn.0041a93d
push 0x6d9e80
mov edx, ebx
mov ecx, esi
call fcn.00417cb7
pop ecx
push 6
push 0x18075380
push 0
mov edx, 0x4528fe
mov ecx, esi
call fcn.0041afeb
add esp, 0xc
mov edx, ebx
mov ecx, esi
push 0x6d9e88
call fcn.00417cb7
xor eax, eax
pop ecx
inc eax
jmp 0x452a9d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b35b0
mov esp, ebp
pop ebp
ret
Function at 0x4739ed
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, ecx
or edx, 0xffffffff
push edi
mov dword [esp + 0x1c], ebx
call fcn.00417298
mov dword [esp + 0x18], eax
or edx, 0xffffffff
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.00418df8
pop ecx
mov ecx, ebx
call fcn.0041ab48
push 0x718074
or edx, 0xffffffff
mov ecx, ebx
call fcn.00458236
pop ecx
mov ecx, ebx
mov edi, eax
call fcn.0041b762
mov esi, dword [esp + 0x14]
xor edx, edx
test edi, edi
je 0x473a9a
xor ebx, ebx
lea ecx, [esi + 5]
push ebx
push ebx
call fcn.004814a9
mov ebp, eax
mov edx, esi
push esi
push dword [esp + 0x24]
lea ecx, [ebp + 4]
mov dword [ebp], edi
call section..text
add esp, 0x10
mov byte [esi + ebp + 4], bl
mov ecx, dword [edi]
call fcn.004813e2
test eax, eax
je 0x473a81
mov ecx, dword [edi]
cmp dword [ecx - 0xc], ebx
jbe 0x473a7f
lea ebx, [ecx + 0x10]
add ebx, dword [ecx - 0x10]
mov ebx, dword [ebx]
mov edx, dword [ebx]
mov ecx, dword [edi + 0xc]
push ebp
push 1
push 0x477e13
push dword [edi]
call fcn.00457f94
add esp, 0x10
jmp 0x473ae8
xor ebp, ebp
lea edi, [esi + 4]
push ebp
push ebp
mov ecx, edi
call fcn.004814a9
mov ebx, eax
mov edx, esi
push esi
push dword [esp + 0x24]
lea ecx, [ebx + 4]
mov dword [ebx], edi
call section..text
add esp, 0x10
lea eax, [esp + 0x20]
push ebp
push eax
push edi
push ebx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
call fcn.0041b762
push 1
push ebx
call fcn.005e7dd0
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x475d69
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
xor edi, edi
push edi
push edi
push 0xa26
push 0x71cd10
push 1
push 0x40
call fcn.005e7f10
add esp, 0x10
mov ecx, eax
push 0x30
pop edx
call fcn.004811d1
pop ecx
pop ecx
mov esi, eax
call fcn.0047fbb9
push 4
push esi
call fcn.004baa80
pop ecx
pop ecx
cmp dword [esi], edi
je 0x475d99
call fcn.0047fc91
xor ecx, ecx
call fcn.0048708c
push 0x47574e
push esi
push 0x475718
mov edx, 0x47568a
mov dword [esi + 0x1c], eax
mov ecx, 0x47561c
mov dword [esi + 0x18], edi
call fcn.00417613
add esp, 0xc
test eax, eax
je 0x475dde
pop edi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0xa38
push edi
push esi
mov edx, 0x71cd40
xor ecx, ecx
call fcn.00488a50
add esp, 0xc
push esi
push 0x71cd70
push 0x71cda0
call fcn.00401109
add esp, 0xc
push edi
call fcn.005c3000
int3
Function at 0x47cb05
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, dword [esp + 0x24]
mov ecx, 0x1258
call fcn.004815ba
mov ecx, str.ILibAsyncSocket
mov esi, eax
call fcn.00480fb6
mov dword [esi + 0x18], eax
mov dword [esi + 0x30], 0x40
mov dword [esi + 0x20], 0x47cae8
mov dword [esi + 0x24], fcn.0047d29f
mov dword [esi + 0x28], fcn.0047ec80
mov dword [esi + 0x10], ebx
test edi, edi
je 0x47cb72
mov ebp, 0x1ca
push ebp
push 0x71ee58
push 1
push edi
call fcn.005e7f10
add esp, 0x10
mov dword [esi + 0x1f8], eax
test eax, eax
jne 0x47cb81
jmp 0x47cbf2
mov edi, 0xffff
mov dword [esi + 0x1f8], 0x740000
mov eax, dword [esp + 0x14]
mov ecx, ebx
or dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x1bc], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x1c0], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x1c4], eax
mov eax, dword [esp + 0x20]
mov dword [esi], 0x47e14c
mov dword [esi + 4], 0x47e3e6
mov dword [esi + 8], 0x47ca13
mov dword [esi + 0x1c8], eax
mov dword [esi + 0x200], edi
mov dword [esi + 0x1fc], edi
call fcn.00481a26
mov dword [esi + 0x1d8], eax
mov edx, esi
mov dword [esi + 0x20c], 0
call fcn.004819aa
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x71ee78
push esi
push ebp
xor ecx, ecx
call fcn.00488a50
push ebp
push 0x71ee98
push 0x71eeb8
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3