joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431d96
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x51bda9
call fcn.004f21c7
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x23c], esi
test byte [0x58758c], 1
push 7
mov dword [ebp - 0x240], edi
pop ebx
jne 0x431de7
or dword [0x58758c], 1
xor eax, eax
push 0x529159
mov dword [0x587588], ebx
mov dword [0x587584], esi
mov word [0x587574], ax
call fcn.004e9f4f
pop ecx
cmp byte [0x586ca9], 1
jne 0x431e03
push 0x587570
mov esi, edi
call fcn.004250eb
mov eax, edi
jmp 0x431ec0
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call fcn.004e7380
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x587570
test eax, eax
je 0x431eab
xor eax, eax
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], esi
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x23c]
push eax
mov dword [ebp - 4], esi
push dword [ebp - 0x21c]
call fcn.0040dcc8
pop ecx
pop ecx
test al, al
je 0x431e99
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call fcn.0040df58
pop ecx
pop ecx
test al, al
je 0x431e99
push 0xffffffffffffffff
push esi
push edi
lea eax, [ebp - 0x238]
call fcn.00404bcd
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea esi, [ebp - 0x238]
call fcn.00404e82
mov esi, dword [ebp - 0x240]
push edi
mov byte [0x586ca9], 1
call fcn.004250eb
mov eax, esi
call fcn.004f224a
ret

Function at 0x43206d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x515288
call fcn.004f215e
and dword [ebp - 0x18], 0
xor eax, eax
mov esi, str.software360TotalSecurity
mov byte [0x586cb0], 1
mov byte [ebp - 0xd], 0
cmp eax, esi
je 0x4320fd
mov ebx, str.FullCheck
cmp eax, ebx
je 0x4320fd
mov edi, str.ShowOptions
cmp eax, edi
je 0x4320fd
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push ebx
push esi
push str._s_s
lea eax, [ebp - 0x14]
call fcn.00429c50
mov esi, dword [ebp - 0x14]
and dword [ebp - 0x20], 0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push esi
push SysReAllocString
mov dword [ebp - 0x1c], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [esi - 0x10]
call fcn.0040557a
mov eax, dword [ebp - 0x18]
shr eax, 3
test al, 1
je 0x432138
mov eax, 0x585d80
call fcn.00443792
test al, al
jne 0x432138
push str.zh_CN
push dword [0x5864c0]
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x432138
call fcn.0040a287
test al, al
je 0x432138
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov byte [0x586cb1], al
call fcn.004f2236
ret
Function at 0x43448b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x514ae1
call fcn.004f215e
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x43451a
xor edi, edi
cmp dword [ebp + 8], edi
je 0x43451a
cmp dword [ebp + 0xc], edi
je 0x43451a
cmp dword [ebp + 0x14], edi
je 0x43451a
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push esi
push str._s_s
mov dword [ebp - 4], edi
call fcn.00429c50
add esp, 0xc
push 4
pop esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x10]
push edi
push dword [ebp + 0x14]
mov bl, 1
mov dword [ebp - 0x18], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x43450c
cmp dword [ebp - 0x14], esi
je 0x43450e
xor bl, bl
lea eax, [edi - 0x10]
call fcn.0040557a
mov al, bl
jmp 0x43451c
xor al, al
call fcn.004f2236
ret

Function at 0x434522
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x5149e8
call fcn.004f215e
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x4345a6
cmp dword [ebp + 8], eax
je 0x4345a6
cmp dword [ebp + 0xc], eax
je 0x4345a6
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
and dword [ebp - 4], 0
push esi
push str._s_s
lea eax, [ebp - 0x10]
call fcn.00429c50
mov esi, dword [ebp - 0x10]
and dword [ebp - 0x14], 0
add esp, 0xc
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push dword [ebp + 0x10]
mov bl, 1
push eax
push dword [ebp + 0xc]
push esi
push dword [ebp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x434598
cmp dword [ebp - 0x14], 3
je 0x43459a
xor bl, bl
lea eax, [esi - 0x10]
call fcn.0040557a
mov al, bl
jmp 0x4345a8
xor al, al
call fcn.004f2236
ret

Function at 0x4345ae
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x514abe
call fcn.004f215e
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x434640
cmp dword [ebp + 8], eax
je 0x434640
cmp dword [ebp + 0xc], eax
je 0x434640
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
and dword [ebp - 4], 0
push esi
push str._s_s
lea eax, [ebp - 0x14]
call fcn.00429c50
mov esi, dword [ebp - 0x14]
and dword [ebp - 0x10], 0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov bl, 1
push esi
push dword [ebp + 0x14]
mov dword [ebp - 0x18], 8
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x434632
cmp dword [ebp - 0x10], 0xb
je 0x434634
cmp dword [ebp - 0x10], 4
je 0x434634
xor bl, bl
lea eax, [esi - 0x10]
call fcn.0040557a
mov al, bl
jmp 0x434642
xor al, al
call fcn.004f2236
ret
Function at 0x434648
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x5149c5
call fcn.004f215e
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x4346ef
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4346ef
cmp dword [ebp + 0xc], edi
je 0x4346ef
cmp dword [ebp + 0x14], edi
je 0x4346ef
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push str._s_s
mov dword [ebp - 4], edi
call fcn.00429c50
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x14]
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4346c3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x14]
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push dword [ebp + 0xc]
push esi
push dword [ebp + 0x14]
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [esi - 0x10]
inc bl
call fcn.0040557a
mov al, bl
jmp 0x4346f1
xor al, al
call fcn.004f2236
ret

Function at 0x43479e
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x5149c5
call fcn.004f215e
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x43483c
xor edi, edi
cmp dword [ebp + 8], edi
je 0x43483c
cmp dword [ebp + 0xc], edi
je 0x43483c
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push str._s_s
mov dword [ebp - 4], edi
call fcn.00429c50
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x18]
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x434810
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x14]
push 8
lea eax, [ebp + 0x10]
push eax
push 0xb
push dword [ebp + 0xc]
push esi
push dword [ebp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [esi - 0x10]
inc bl
call fcn.0040557a
mov al, bl
jmp 0x43483e
xor al, al
call fcn.004f2236
ret

Function at 0x434844
Capabilities:
Delete registry value

Disassembly:
push 4
mov eax, 0x518cc0
call fcn.004f215e
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x4348b4
cmp dword [ebp + 8], eax
je 0x4348b4
cmp dword [ebp + 0xc], eax
je 0x4348b4
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
and dword [ebp - 4], 0
push esi
push str._s_s
lea eax, [ebp - 0x10]
call fcn.00429c50
mov esi, dword [ebp - 0x10]
add esp, 0xc
push dword [ebp + 0xc]
mov bl, 1
push esi
push dword [ebp + 0x10]
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
test eax, eax
je 0x4348a8
xor bl, bl
lea eax, [esi - 0x10]
call fcn.0040557a
mov al, bl
jmp 0x4348b6
xor al, al
call fcn.004f2236
ret
Function at 0x435ca6
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor esi, esi
cmp edi, esi
je 0x435e24
cmp dword [ebp + 8], esi
je 0x435e24
mov edx, dword [ebp + 0xc]
cmp edx, esi
je 0x435e24
cmp dword [ebp + 0x10], esi
je 0x435e24
cmp dword [ebp + 8], 2
jbe 0x435d78
mov dword [ebp - 8], 4
mov al, byte [edi]
sub dword [ebp + 8], 3
mov bl, al
shr bl, 2
inc edi
mov cl, byte [edi]
mov byte [ebp - 4], bl
mov bl, cl
and al, 3
inc edi
mov dl, byte [edi]
shr bl, 4
shl al, 4
add al, bl
and cl, 0xf
mov bl, dl
shl cl, 2
shr bl, 6
add cl, bl
mov byte [ebp - 2], cl
mov ecx, dword [ebp - 8]
and dl, 0x3f
inc edi
mov byte [ebp - 1], dl
cmp ecx, dword [ebp + 0x10]
ja 0x435dd7
movzx edx, byte [ebp - 4]
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, dword [ebp + 0xc]
mov byte [esi + ebx], dl
inc esi
movzx eax, al
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx], al
movzx eax, byte [ebp - 2]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
inc esi
mov byte [esi + ebx], al
movzx eax, byte [ebp - 1]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
inc esi
inc ecx
mov byte [esi + ebx], al
inc esi
inc ecx
cmp dword [ebp + 8], 2
mov dword [ebp - 8], ecx
ja 0x435ce8
mov edx, ebx
xor ecx, ecx
cmp dword [ebp + 8], ecx
je 0x435e17
xor al, al
mov byte [ebp - 2], cl
mov byte [ebp - 3], al
mov byte [ebp - 4], cl
cmp dword [ebp + 8], ecx
jbe 0x435da9
push dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
call fcn.004ea300
mov al, byte [ebp - 3]
mov cl, byte [ebp - 4]
add esp, 0xc
mov dl, cl
mov bl, al
and cl, 3
shr bl, 4
shl cl, 4
add cl, bl
mov bl, byte [ebp - 2]
and al, 0xf
shl al, 2
shr bl, 6
lea edi, [esi + 4]
shr dl, 2
add al, bl
cmp edi, dword [ebp + 0x10]
jbe 0x435ddc
mov eax, 0xffffffff
jmp 0x435e26
or eax, 0xffffffff
jmp 0x435e26
movzx edx, dl
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, dword [ebp + 0xc]
mov byte [esi + edx], bl
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [esi + edx], cl
inc esi
cmp dword [ebp + 8], 1
jne 0x435e05
mov byte [esi + edx], 0x3d
jmp 0x435e11
movzx eax, al
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
inc esi
mov byte [esi + edx], 0x3d
inc esi
cmp esi, dword [ebp + 0x10]
jae 0x435dd0
mov byte [esi + edx], 0
mov eax, esi
jmp 0x435e26
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x435e2b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x515288
call fcn.004f215e
and dword [ebp - 0x1c], 0
xor eax, eax
mov esi, str.software360TotalSecurity
mov byte [ebp - 0xd], 1
cmp eax, esi
je 0x435ec2
mov ebx, str.DriverUpdater
cmp eax, ebx
je 0x435ec2
mov edi, str.NewDrvNotify
cmp eax, edi
je 0x435ec2
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push ebx
push esi
push str._s_s
lea eax, [ebp - 0x14]
call fcn.00429c50
and dword [ebp - 0x18], 0
add esp, 0xc
push 4
pop esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
mov edi, dword [ebp - 0x14]
push edi
push SysReAllocString
mov bl, 1
mov dword [ebp - 0x20], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x435eb6
cmp dword [ebp - 0x18], esi
je 0x435eb8
xor bl, bl
lea eax, [edi - 0x10]
call fcn.0040557a
jmp 0x435ec4
xor bl, bl
cmp bl, 1
jne 0x435ed1
cmp dword [ebp - 0x1c], 0
setne byte [ebp - 0xd]
mov al, byte [ebp - 0xd]
call fcn.004f2236
ret
Function at 0x4384c0
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x51e6ec
call fcn.004f215e
xor edi, edi
cmp dword [ebp + 8], edi
je 0x438662
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x438662
call fcn.00438736
mov dword [ebp - 0x1c], eax
call fcn.00438716
push 0x26200a
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
push dword [ebp + 8]
call fcn.0046e035
mov ebx, eax
add esp, 0x10
mov dword [ebp - 0x10], ebx
cmp ebx, edi
je 0x438662
cmp dword [ebp - 0x1c], edi
mov dword [ebp + 8], edi
jl 0x4385d2
xor edi, edi
cmp dword [ebp - 0x18], edi
jl 0x4385c3
mov esi, dword [ebp + 0xc]
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp + 8]
call fcn.004386e6
mov ebx, dword [ebp - 0x14]
shr ebx, 0x18
cmp bl, 0xff
jne 0x438552
and dword [ebp - 0x14], 0
mov esi, dword [ebp - 0x10]
jmp 0x4385aa
test bl, bl
je 0x4385b6
mov esi, dword [ebp - 0x10]
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp + 8]
call fcn.004386e6
mov edx, dword [ebp - 0x14]
movzx ebx, bl
mov eax, edx
mov ecx, 0xff
shr eax, 0x18
sub ecx, ebx
cmp ecx, eax
jge 0x438582
mov al, cl
movzx eax, al
mov ecx, edx
shr ecx, 0x10
movzx ecx, cl
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
or ecx, eax
movzx eax, dl
shl ecx, 8
or ecx, eax
mov dword [ebp - 0x14], ecx
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
call fcn.004386c4
inc edi
cmp edi, dword [ebp - 0x18]
jle 0x43852a
mov ebx, dword [ebp - 0x10]
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x1c]
jle 0x43851f
xor edi, edi
lea esi, [ebp + 8]
mov dword [ebp - 0x14], edi
call fcn.004388ab
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x438644
push ebx
lea edi, [ebp - 0x10]
call fcn.0046e358
pop ecx
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x438638
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
push str.disable_resize
call fcn.0042256f
push ecx
mov byte [ebp - 4], 2
mov edi, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.0042256f
mov byte [ebp - 4], 3
mov edx, dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0043866a
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.0040557a
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
test eax, eax
je 0x43865d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
jmp 0x438664
xor eax, eax
call fcn.004f2236
ret
Function at 0x43a4bb
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x48
mov eax, 0x51b225
call fcn.004f21c7
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x44], ebx
cmp eax, ebx
jne 0x43a4e4
mov esi, edi
call fcn.00404ec9
jmp 0x43a5e8
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], cx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x4c], eax
cmp eax, 0xffffffff
je 0x43a5d2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
je 0x43a5c6
push 0x582e91
push esi
call fcn.004eb416
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 0x50], edi
cmp edi, ebx
je 0x43a5c6
push esi
push ebx
push edi
call fcn.004e7380
add esp, 0xc
push ebx
lea eax, [ebp - 0x48]
push eax
push esi
push edi
push dword [ebp - 0x4c]
mov dword [ebp - 0x48], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43a5bd
cmp dword [ebp - 0x48], esi
jne 0x43a5bd
push 0x10
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.004e7380
mov ecx, dword [ebp - 0x50]
add esp, 0xc
push esi
lea edi, [ebp - 0x40]
call fcn.004b8d00
pop ecx
test eax, eax
je 0x43a5bd
lea eax, [ebp - 0x44]
push eax
mov eax, edi
push eax
call fcn.004315ab
mov byte [ebp - 4], 1
mov esi, dword [eax]
push esi
call fcn.004e73fa
pop ecx
push esi
lea esi, [ebp - 0x30]
call fcn.00404dce
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
call fcn.0040557a
push dword [ebp - 0x50]
call fcn.004e85e3
pop ecx
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x54]
lea eax, [ebp - 0x30]
push eax
mov esi, edi
call fcn.004250eb
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.00404e82
mov eax, edi
call fcn.004f224a
ret
Function at 0x43a9f2
Capabilities:
Get disk information
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
push ebx
and al, 0xdf
push esi
xor esi, esi
mov bl, al
inc esi
sub al, 0x41
push edi
mov dword [ebp - 0x1c], esi
cmp al, 0x19
ja 0x43aae9
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x5c3a58
push eax
mov byte [ebp - 0x24], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x43aae9
push 3
pop ecx
cmp eax, ecx
je 0x43aa57
jbe 0x43aa50
cmp eax, 5
jbe 0x43aae9
cmp eax, 6
je 0x43aa57
mov eax, esi
jmp 0x43aaeb
mov esi, str..X:
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 8], bl
xor ebx, ebx
push ebx
push ebx
push ecx
push ebx
push ecx
push SysReAllocString
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
jne 0x43aa89
xor eax, eax
inc eax
jmp 0x43aaeb
mov edi, 0x227
push edi
call fcn.004e6ab6
pop ecx
push ebx
mov esi, eax
mov dword [esi + 4], edi
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push dword [esi + 4]
lea eax, [ebp - 0x18]
push esi
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x43aad4
mov eax, dword [esi + 0x1c]
cmp eax, 7
je 0x43aad1
cmp eax, 4
jne 0x43aad4
mov dword [ebp - 0x1c], ebx
push esi
call fcn.004e85e3
pop ecx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
jmp 0x43aaeb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e736b
leave
ret

Function at 0x43aafa
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
and al, 0xdf
mov cl, al
sub cl, 0x41
cmp cl, 0x19
ja 0x43ab5b
mov dword [ebp - 8], 0x5c3a58
mov byte [ebp - 8], al
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
dec eax
je 0x43ab56
dec eax
dec eax
je 0x43ab52
dec eax
je 0x43ab4e
dec eax
je 0x43ab4a
push dword [ebp + 8]
call fcn.0043a9f2
neg eax
sbb eax, eax
pop ecx
inc eax
jmp 0x43ab5d
push 5
jmp 0x43ab58
push 4
jmp 0x43ab58
push 3
jmp 0x43ab58
push 2
pop eax
jmp 0x43ab5e
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e736b
leave
ret
Function at 0x43ae0e
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.0043ad64
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x43ae3a
xor ebx, ebx
cmp esi, ebx
jne 0x43ae4a
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004e736b
leave
ret
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push 0x1a
mov dword [ebp - 0x50], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x43ae71
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x43ae3c
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
push esi
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x4c], 1
sete bl
jmp 0x43ae66
Function at 0x43b5ed
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
je 0x43b6fa
xor ecx, ecx
cmp cx, word [eax]
je 0x43b6fa
cmp dword [ebp + 8], esi
je 0x43b6fa
push esi
push 0x80
push 4
push esi
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43b6fa
push esi
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
cmp eax, esi
sete cl
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ecx
cmp eax, 0x10
jb 0x43b694
push 0x30
add eax, 0xfffffff0
xor edx, edx
pop ecx
div ecx
test edx, edx
jne 0x43b698
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x24], 0x54534355
jne 0x43b698
cmp dword [ebp - 0x20], 1
je 0x43b6b0
jmp 0x43b698
cmp eax, esi
jbe 0x43b6b0
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], esi
je 0x43b701
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push ebx
mov dword [ebp - 0x24], 0x54534355
mov dword [ebp - 0x20], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 8]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43b6f2
cmp dword [ebp - 8], 0x10
je 0x43b70c
lea eax, [ebp - 0x14]
call fcn.0043b588
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 2
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 8]
push eax
push 0x30
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43b6f2
cmp dword [ebp - 8], 0x30
jne 0x43b6f2
lea eax, [ebp - 0x14]
call fcn.0043b588
xor eax, eax
inc eax
jmp 0x43b6fc

Function at 0x43c2aa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 0x10