joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cc3c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403dbc
xor eax, eax
push ebp
push 0x41cda6
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x41cc82
inc eax
jne 0x41ccb0
push 0x41cdc0
push dword [esi + 0xc]
push 0x41cddc
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.00409c94
push dword [ebp - 0x18]
lea eax, [esi + 4]
mov edx, 4
call fcn.00403c8c
xor ebx, ebx
jmp 0x41cd88
push 4
lea eax, [esi + 0x4c]
push eax
push 0x1005
push 0xffff
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_setsockopt
inc eax
je 0x41cce8
push 4
lea eax, [esi + 0x4c]
push eax
push 0x1006
push 0xffff
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x41cd09
lea eax, [esi + 4]
mov edx, 0x41cde8
call fcn.00403984
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [esi + 8], 0xffffffff
xor ebx, ebx
jmp 0x41cd88
cmp dword [esi + 0x58], 0
je 0x41cd36
mov eax, dword [esi + 0x58]
call fcn.00403dcc
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
mov ax, word [esi + 0x5c]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
jmp 0x41cd57
mov eax, dword [ebp - 4]
call fcn.00403dcc
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
push edi
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_connect
inc eax
jne 0x41cd88
lea eax, [esi + 4]
mov edx, 0x41ce08
call fcn.00403984
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [esi + 8], 0xffffffff
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cdad
lea eax, [ebp - 0x18]
call fcn.00403930
lea eax, [ebp - 4]
call fcn.00403930
ret
Function at 0x423714
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, eax
lea esi, [esp + 4]
mov eax, ebx
call fcn.00403930
push esp
push 0x20019
push 0
push 0x4237fc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x42378e
xor eax, eax
mov dword [esi], eax
lea eax, [esp + 8]
mov byte [eax], 0
inc dword [esi]
inc eax
cmp dword [esi], 0x100
jne 0x42374c
mov dword [esi], 0xff
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0x423824
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x42378e
mov eax, ebx
lea edx, [esp + 8]
mov ecx, pe_nt_image_headers32
call fcn.00403ba0
jmp 0x4237f1
push esp
push 0x20019
push 0
push 0x4237fc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4237f1
xor eax, eax
mov dword [esi], eax
lea eax, [esp + 8]
mov byte [eax], 0
inc dword [esi]
inc eax
cmp dword [esi], 0x100
jne 0x4237b1
mov dword [esi], 0xff
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0x423824
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4237f1
mov eax, ebx
lea edx, [esp + 8]
mov ecx, pe_nt_image_headers32
call fcn.00403ba0
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x401000
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
lea ecx, [esp]
push ecx
push 0x401030
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 4]
add esp, 8
ret
Function at 0x4025c0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x414398
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push str.LocalIBM_Rapid_Restore_Ultra_PE_User_Interface
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4207b4], eax
call esi
cmp eax, 0xb7
je 0x402653
mov eax, dword [0x4207b4]
test eax, eax
jne 0x402653
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push 0x4207b8
call fcn.00413dc4
push ecx
mov dword [esp + 0x1c], 0
mov ecx, esp
mov dword [esp + 0x10], esp
push str.CreateMutex
call fcn.00413dc4
push 0
mov dword [esp + 0x20], 0xffffffff
call fcn.00406a10
add esp, 0xc
call esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret
mov ecx, dword [esp + 0xc]
xor eax, eax
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret

Function at 0x4029b0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x414406
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x878
push ebp
mov ebp, dword [esp + 0x88c]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_swprintf]
push edi
push ebp
lea eax, [esp + 0x270]
push str._s.
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x26c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x402b34
mov edi, dword [esp + 0x898]
lea eax, [esp + 0x48]
push 0x41c170
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x402b11
lea ecx, [esp + 0x48]
push 0x41c168
push ecx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x402b11
test byte [esp + 0x1c], 0x10
je 0x402b11
lea edx, [esp + 0x48]
lea eax, [esp + 0x474]
push edx
push ebp
push str._s_sApplication_DataMicrosoftProtect
push eax
call esi
add esp, 0x10
mov edx, edi
lea ecx, [esp + 0x48]
and edx, 0xffff
push ecx
push edx
lea eax, [esp + 0x684]
push str._c:Documents_and_Settings_sApplication_DataMicrosoftProtect
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x67c]
lea edx, [esp + 0x474]
push ecx
push edx
push str.__s____s___E__H__R__C__Y__O__K__Q__I
push 0x4207a4
call sub.MFC42u.DLL_CString::Format
add esp, 0x10
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4207b8
call fcn.00413dc4
push 0x20
push 0x40
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4207a4
mov dword [esp + 0x8a8], 0
call sub.MFC42u.DLL_CString::CString_2
push ecx
mov byte [esp + 0x8a8], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.xcopy.exe
call fcn.00413dc4
mov dword [esp + 0x8a8], 0xffffffff
call fcn.0040eb10
add esp, 0x1c
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402a15
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x884]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebp
add esp, 0x884
ret
Function at 0x407450
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41479b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], edi
lea eax, [esp + 0xc]
mov dword [esp + 0x228], edi
push eax
push 0x20019
push edi
push str.SOFTWAREIBMIBM_Rapid_Restore_Ultra
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x4074f8
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
push edi
push str.InstallPath
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40750f
mov ebx, dword [esp + 0x230]
push 0x4207b8
mov ecx, ebx
call fcn.00413dc4
cmp esi, edi
je 0x4074f4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x407567
mov esi, dword [esp + 0x230]
push 0x4207b8
mov ecx, esi
call fcn.00413dc4
mov eax, esi
jmp 0x407567
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x407523
push esi
call ebp
xor esi, esi
mov dword [esp + 0x14], esi
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
lea ecx, [esp + 0x1c]
push ecx
call ebx
add esp, 4
cmp word [esp + eax*2 + 0x1a], 0x5c
jne 0x40754a
lea edx, [esp + 0x1c]
push edx
call ebx
add esp, 4
mov word [esp + eax*2 + 0x1a], di
mov ebx, dword [esp + 0x234]
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
call fcn.00413dc4
cmp esi, edi
je 0x407564
push esi
call ebp
mov eax, ebx
pop ebp
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x220
ret
Function at 0x4080b0
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
push 0xffffffffffffffff
push 0x414918
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, dword [esp + 0x48]
push ebx
push ebp
push esi
push edi
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [sym.imp.MSVCRT.dll_wcscpy]
lea ecx, [esp + 0x20]
mov ebx, eax
push 0x41c5ec
push ecx
mov edi, 2
shr ebx, 2
call esi
lea edx, [esp + 0x3c]
push str.._:
push edx
call esi
add esp, 0x10
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_1
test ebx, ebx
mov dword [esp + 0x4c], 0
je 0x408271
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
test bl, 1
je 0x408266
lea eax, [edi + 0x41]
mov word [esp + 0x20], ax
mov word [esp + 0x3c], ax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x408266
push 0
push 0x80
push eax
push 0
push eax
lea ecx, [esp + 0x48]
push 0x20000
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x408225
lea edx, [esp + 0x14]
push 0
push edx
lea eax, [esp + 0x30]
push 0xc
push eax
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4081bb
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
jne 0x40821c
mov eax, dword [esp + 0x58]
mov edx, 1
mov ecx, edi
push esi
shl edx, cl
or dword [eax], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408266
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
je 0x40821c
mov edx, dword [esp + 0x54]
lea eax, [esp + 0x34]
lea ecx, [esp + 0x20]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push str.listPartitionsOnDrive_d__s__s
push eax
call sub.MFC42u.DLL_CString::Format
add esp, 0x10
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call sub.MFC42u.DLL_CString::CString_2
push ecx
mov byte [esp + 0x54], 1
mov ecx, esp
mov dword [esp + 0x24], esp
push str.IOCTL_STORAGE_GET_DEVICE_NUMBER
call fcn.00413dc4
push 0
mov byte [esp + 0x58], 0
call fcn.00406a10
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408266
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
je 0x408266
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.listPartitionsOnDrive
call fcn.00413dc4
push ecx
mov byte [esp + 0x54], 2
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x41c354
call fcn.00413dc4
push 0
mov byte [esp + 0x58], 0
call fcn.00406a10
add esp, 0xc
shr ebx, 1
inc edi
test ebx, ebx
jne 0x408126
lea ecx, [esp + 0x10]
mov dword [esp + 0x4c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x40
ret
Function at 0x4085a0
Capabilities:
Get disk information via ioctl

Disassembly:
push 0xffffffffffffffff
push 0x414978
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
lea eax, [esp + 0x14]
push str.._:
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x40]
add esp, 8
mov cx, word [esp + 0x34]
lea edx, [esp + 0x14]
push 0
push 0x80
push 3
push 0
push 3
push 0x20000
push edx
mov word [esp + 0x38], cx
mov dword [edi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4086ab
lea eax, [esp + 0x34]
push 0
push eax
lea ecx, [esp + 0x10]
push 0xc
push ecx
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x408655
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10]
mov dword [edi], edx
push esi
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x28
ret
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x4207b8
call fcn.00413dc4
push ecx
mov dword [esp + 0x34], 0
mov ecx, esp
mov dword [esp + 0x44], esp
push str.getPartitionAssignment
call fcn.00413dc4
push 0
mov dword [esp + 0x38], 0xffffffff
call fcn.00406a10
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x28
ret
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.getPartitionAssignment
call fcn.00413dc4
push ecx
mov dword [esp + 0x34], 1
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x41c354
call fcn.00413dc4
push 0
mov dword [esp + 0x38], 0xffffffff
call fcn.00406a10
add esp, 0xc
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x41c198
call fcn.00413dc4
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
mov dword [esp + 0x3c], 2
call fcn.00413dc4
mov dword [esp + 0x38], 0xffffffff
call fcn.00406ff0
mov ecx, dword [esp + 0x30]
add esp, 0xc
xor eax, eax
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x409b60
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x414bad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x234
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x38]
or ebp, 0xffffffff
push 0x104
push eax
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x18]
call fcn.00413dc4
xor edi, edi
push str.minint
lea ecx, [esp + 0x18]
mov dword [esp + 0x250], edi
call sub.MFC42u.DLL_CString::Find_2
cmp eax, ebp
jg 0x409be8
push str.I386
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::Find_2
cmp eax, ebp
jg 0x409be8
push str.i386
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::Find_2
cmp eax, ebp
jle 0x409bed
mov byte [esp + 0x13], 1
call fcn.004082a0
test eax, eax
jbe 0x409dac
mov esi, dword [esp + 0x254]
push edi
call fcn.00409a10
add esp, 4
cmp eax, 0x400
jbe 0x409d51
mov al, byte [esp + 0x13]
xor bl, bl
test al, al
je 0x409c32
push edi
call fcn.0040a2b0
add esp, 4
test eax, eax
je 0x409d1d
jmp 0x409c6e
push 0
lea ecx, [esp + 0x30]
call fcn.004118c0
push edi
lea ecx, [esp + 0x30]
mov byte [esp + 0x250], 1
call fcn.00412350
test eax, eax
je 0x409c55
mov bl, 1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24c], 0
call fcn.00411970
test bl, bl
je 0x409d1d
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.00413dc4
lea edx, [esp + 0x28]
mov byte [esp + 0x254], 2
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Signature
call fcn.00413dc4
push ecx
mov byte [esp + 0x260], 3
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SecondDisk
call fcn.00413dc4
mov byte [esp + 0x260], 0
call fcn.0040d140
mov eax, dword [esp + 0x34]
add esp, 0x14
cmp eax, ebp
je 0x409da8
push edi
call fcn.00407fb0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, ecx
jne 0x409da8
mov al, byte [esp + 0x25c]
test al, al
je 0x409d98
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x41c198
call fcn.00413dc4
push ecx
mov byte [esp + 0x258], 4
mov ecx, esp
mov dword [esp + 0x28], esp
push str.___Signature_mismatch.
jmp 0x409d83
mov al, byte [esp + 0x25c]
test al, al
je 0x409d98
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x41c198
call fcn.00413dc4
push ecx
mov byte [esp + 0x258], 5
mov ecx, esp
mov dword [esp + 0x28], esp
push str.___Disk_is_not_local
jmp 0x409d83
mov al, byte [esp + 0x25c]
test al, al
je 0x409d98
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x41c198
call fcn.00413dc4
push ecx
mov byte [esp + 0x258], 6
mov ecx, esp
mov dword [esp + 0x28], esp
push str.___Disk___1GB
call fcn.00413dc4
mov byte [esp + 0x258], 0
call fcn.00406ff0
add esp, 0xc
inc edi
call fcn.004082a0
cmp edi, eax
jb 0x409c01
jmp 0x409dac
mov dword [esp + 0x24], edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x24c], ebp
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x244]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x240
ret
Function at 0x40a0e0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x414c36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebx
push esi
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_1
mov eax, dword [esp + 0x230]
mov ebx, dword [esp + 0x234]
mov esi, dword [esp + 0x22c]
mov dword [esp + 0x220], 0
mov dword [eax], 0
mov dword [ebx], 0
test esi, esi
jne 0x40a163
lea ecx, [esp + 0xc]
mov dword [esp + 0x220], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
mov dword fs:[0], ecx
add esp, 0x21c
ret
push edi
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [esp + 0x22c]
lea edx, [esp + 0xc]
push ecx
push str..PHYSICALDRIVE_d
push edx
mov byte [esp + 0x230], 1
call sub.MFC42u.DLL_CString::Format
mov eax, dword [esp + 0x18]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0x20000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40a24e
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push ebp
lea edx, [esp + 0x18]
push 0
push edx
push eax
push edi
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x28]
push 0x200
push edx
push edi
call ebp
lea eax, [esp + 0x20]
test eax, eax
je 0x40a246
mov ecx, dword [esp + 0x2d]
mov eax, dword [esp + 0x50]
and ecx, 0xff
cmp ax, 0xffff
mov dword [ebx], ecx
je 0x40a246
cmp ax, word [esp + 0x2e]
jae 0x40a246
xor esi, esi
test ax, ax
jbe 0x40a236
lea edx, [esp + 0x1c]
push 0
push edx
lea eax, [esp + 0x28]
push 0x200
push eax
push edi
call ebp
mov ecx, dword [esp + 0x50]
inc esi
and ecx, 0xffff
cmp esi, ecx
jl 0x40a213
mov eax, dword [esp + 0x238]
mov edx, dword [esp + 0x208]
mov dword [eax], edx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x224], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x224], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x40a3a0
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x414c68
push eax
mov dword fs:[0], esp
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov word [ebp], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea ecx, [esp + 0x20]
mov ebx, eax
mov esi, 0x1a
call sub.MFC42u.DLL_CString::CString_1
test ebx, ebx
mov dword [esp + 0x18], 0
je 0x40a432
mov edi, dword [sym.imp.MSVCRT.dll__wfopen]
mov eax, 1
mov ecx, esi
shl eax, cl
test ebx, eax
je 0x40a41e
lea ecx, [esi + 0x41]
lea edx, [esp + 0x20]
push ecx
push str._c:_rrutemp.txt
push edx
call sub.MFC42u.DLL_CString::Format
mov eax, dword [esp + 0x2c]
push 0x41c7dc
push eax
call edi
add esp, 0x14
test eax, eax
jne 0x40a421
dec esi
jmp 0x40a3eb
add esi, 0x41
push eax
mov word [ebp], si
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x40a960
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x416388
push 1
push 0
push 0x416458
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x40a9e1
push esi
push str.rootcimv2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x4208c8
push 0
push 0
mov esi, eax
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40a9cd
call fcn.0040a910
push esi
mov dword [0x41eb04], 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop esi
pop ecx
ret
push esi
mov dword [0x41eb04], 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop esi
pop ecx
ret
mov dword [0x41eb04], 2
pop ecx
ret
Function at 0x40ae20
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x414d3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x408
push ebx
push esi
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.Entering_GetCurrentHashedPwd
call fcn.00413dc4
call fcn.0040c2c0
add esp, 4
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_1
mov ecx, 0x20
xor eax, eax
mov edi, 0x4207d0
mov esi, dword [sym.imp.MSVCRT.dll_getenv]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x10
xor eax, eax
mov edi, 0x420854
push str.IBMSHARE
rep stosd dword es:[edi], eax
mov dword [esp + 0x420], 0
call esi
add esp, 4
test eax, eax
je 0x40affe
push str.IBMSHARE
call esi
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ibmpwhp.pyc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00413e78
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
push 0x41ebe4
push ecx
call sub.MFC42u.DLL_operator_2
call fcn.0040c2c0
lea eax, [esp + 0x18]
push 0x41ebe0
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40affe
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 0x20
push 1
push 0x4207d0
call edi
add esp, 0x10
cmp eax, 0x20
jge 0x40af6d
mov ecx, 0x20
xor eax, eax
mov edi, 0x4207d0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
jmp 0x40af9d
test eax, eax
je 0x40af8e
mov bl, 0xa
cmp byte [0x420854], bl
je 0x40af8e
push esi
push 1
push 1
push 0x420854
call edi
add esp, 0x10
test eax, eax
jne 0x40af73
push esi
push 0x3f
push 1
push 0x420854
call edi
add esp, 0x10
push 0x4207d0
lea ecx, [esp + 0x10]
call fcn.00413e78
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
push str.HashPwd_
push ecx
call sub.MFC42u.DLL_operator_2
call fcn.0040c2c0
add esp, 4
lea ecx, [esp + 0xc]
push 0x420854
call fcn.00413e78
push ecx
lea ecx, [esp + 0x10]
mov eax, esp
mov dword [esp + 0x14], esp
push ecx
push str.Hint_
push eax
call sub.MFC42u.DLL_operator_2
call fcn.0040c2c0
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
lea ecx, [esp + 0xc]
mov dword [esp + 0x41c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x414]
pop edi
pop esi
mov eax, 0x4207d0
mov dword fs:[0], ecx
pop ebx
add esp, 0x414
ret