joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100326d9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10036610
cmp edx, dword [eax]
je 0x100326fb
add eax, 8
inc ecx
cmp eax, 0x100366a0
jl 0x100326ec
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10036610]
jne 0x10032829
mov eax, dword [0x10036de0]
cmp eax, 1
je 0x10032803
test eax, eax
jne 0x1003272c
cmp dword [0x10036554], 1
je 0x10032803
cmp edx, 0xfc
je 0x10032829
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10032763
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.100308e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10030440
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x100327a6
lea eax, [ebp - 0x1a4]
push eax
call fcn.10030440
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x10035494
push edi
call fcn.10033e50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.100308e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.100308f0
lea eax, [ebp - 0xa0]
push 0x10035474
push eax
call fcn.100308f0
push dword [esi + 0x10036614]
lea eax, [ebp - 0xa0]
push eax
call fcn.100308f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.10033db8
add esp, 0x2c
pop edi
jmp 0x10032829
lea eax, [ebp + 8]
lea esi, [esi + 0x10036614]
push 0
push eax
push dword [esi]
call fcn.10030440
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403bf2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
mov eax, dword [0x4ba080]
xor eax, esp
mov dword [esp + 0x410], eax
cmp dword [ebp + 0x1c], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], edx
jne 0x403d7e
xor edi, edi
inc edi
cmp dword [ebp + 0xc], 0x110
push 2
pop edx
jne 0x403c99
push ecx
push ecx
mov dword [esi + 0x98], edi
call fcn.00403de0
mov dword [ebx], eax
cmp dword [esi + 0x98], 0
jne 0x403cbe
mov edx, dword [ebp + 0xc]
mov ecx, dword [esp + 0x10]
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00402fee
add esp, 0xc
test eax, eax
jne 0x403cbe
cmp dword [ebp + 0xc], 0x111
mov eax, dword [esi + 0x50]
mov dword [esp + 0x14], eax
jne 0x403d27
cmp di, word [ebp + 0x10]
jne 0x403d51
push edi
push dword [esi + 4]
mov dword [esi + 0x50], edi
call dword [sym.imp.USER32.dll_EndDialog]
and dword [ebx], 0
jmp 0x403d4b
cmp dword [ebp + 0xc], 0x111
jne 0x403c4c
mov eax, dword [ebp + 0x10]
movzx eax, ax
mov ecx, eax
cmp dx, ax
jne 0x403cc5
push edx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
xor edi, edi
inc edi
mov dword [ebx], edi
mov eax, edi
jmp 0x403d80
cmp di, cx
jne 0x403d0d
push 0x400
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0044dac0
add esp, 0xc
lea eax, [esp + 0x18]
push 0x200
push eax
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x80]
call fcn.0040245c
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x403cbc
push 0x4d
pop eax
cmp ax, cx
jne 0x403c4c
sub esp, 0x10
mov ecx, esi
call fcn.00404233
mov dword [ebx], eax
jmp 0x403cbe
cmp dword [ebp + 0xc], 0x10
jne 0x403d34
push 2
jmp 0x403c85
cmp dword [ebp + 0xc], 0x110
jne 0x403d51
push ecx
push ecx
mov ecx, esi
mov dword [esi + 0x50], edi
call fcn.00402ee1
mov dword [ebx], eax
cmp dword [esi + 0x50], 0
jne 0x403d6b
mov edx, dword [ebp + 0xc]
mov ecx, dword [esp + 0x10]
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00402fee
add esp, 0xc
test eax, eax
je 0x403d77
mov eax, dword [esp + 0x14]
mov dword [esi + 0x50], eax
jmp 0x403cbe
mov eax, dword [esp + 0x14]
mov dword [esi + 0x50], eax
xor eax, eax
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044b95e
mov esp, ebp
pop ebp
ret 0x18

Function at 0x40832d
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x48ccb0
call fcn.0044c7ee
mov esi, ecx
push 4
xor ebx, ebx
call fcn.0044b99d
mov edx, dword [ebp + 8]
mov dword [ebp + 8], eax
mov dword [eax], edx
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
push edi
push ebx
push eax
push 0x408a12
push ebx
push ebx
call fcn.0045e844
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x408374
mov eax, esi
call fcn.0044c7bc
ret 4
push 6
mov dword [edi], ebx
call fcn.0044a727
int3
Function at 0x409341
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
xor ebx, ebx
test ecx, ecx
je 0x409364
cmp word [ecx], bx
je 0x409364
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409364
push 1
test al, 0x10
movzx ebx, bl
pop ecx
cmove ebx, ecx
mov al, bl
pop ebx
ret

Function at 0x409421
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4ba080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
push 0xa
pop ecx
push dword [ebp + 8]
lea edi, [ebp - 0x2c]
mov esi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push 0x4a98a8
push eax
call fcn.0040750b
add esp, 0xc
lea eax, [ebp - 0x2c]
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4094cf
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4094cf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4094cf
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x4094cf
lea eax, [esi + 1]
cmp eax, dword [ebx + 0x10]
ja 0x4094af
mov dword [ebx + 0x10], eax
mov edx, ebx
cmp dword [ebx + 0x14], 0xf
jbe 0x4094a8
mov edx, dword [ebx]
xor ecx, ecx
mov byte [edx + eax], cl
jmp 0x4094bb
sub eax, dword [ebx + 0x10]
push ecx
push eax
mov ecx, ebx
call fcn.00409c63
push ecx
mov ecx, ebx
call fcn.0040745f
push esi
push edi
call fcn.00402389
xor ecx, ecx
inc ecx
jmp 0x4094d1
xor ecx, ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044b95e
leave
ret

Function at 0x4094e2
Capabilities:
Get file version info

Disassembly:
push 0x18
mov eax, 0x48ce6b
call fcn.0044c857
mov esi, edx
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
push eax
mov dword [ebp - 0x1c], eax
call fcn.0044bc23
pop ecx
mov edi, eax
xor eax, eax
push edi
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push eax
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x409566
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4a9790
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x409566
mov ax, word [ecx + 0xa]
mov word [esi], ax
mov ax, word [ecx + 8]
mov word [esi + 2], ax
mov ax, word [ecx + 0xe]
mov word [esi + 4], ax
mov ax, word [ecx + 0xc]
mov word [esi + 6], ax
xor esi, esi
inc esi
test edi, edi
je 0x40957f
push edi
call fcn.0044bc1e
pop ecx
jmp 0x40957f
mov eax, esi
call fcn.0044c7bc
ret
Function at 0x40958c
Capabilities:
Get common file path

Disassembly:
push 0x854
mov eax, 0x48cea3
call fcn.0044c821
mov ebx, ecx
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.0044dac0
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x840]
call fcn.00401cc1
and dword [ebp - 4], 0
lea edi, [ebp - 0x828]
xor eax, eax
stosd dword es:[edi], eax
push 7
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
pop edi
mov ecx, edi
mov word [ebp - 0x828], ax
mov dword [ebp - 0x814], ecx
mov byte [ebp - 4], 1
and dword [ebp - 0x818], 0
lea eax, [ebp - 0x828]
cmp ecx, edi
lea edx, [ebp - 0x828]
push 0xa
cmova eax, dword [ebp - 0x828]
xor ecx, ecx
mov word [eax], cx
pop ecx
call fcn.0040afb7
lea eax, [ebp - 0x828]
push eax
lea edx, [ebp - 0x840]
lea ecx, [ebp - 0x858]
call fcn.00409f84
pop ecx
cmp dword [eax + 0x14], edi
jbe 0x409648
mov eax, dword [eax]
push 0
push eax
call fcn.0045e20f
pop ecx
pop ecx
lea ecx, [ebp - 0x858]
mov esi, eax
call fcn.004015bc
test esi, esi
jne 0x40966b
mov ecx, dword [ebp - 0x814]
jmp 0x4095ff
lea eax, [ebp - 0x828]
push eax
lea edx, [ebp - 0x840]
lea ecx, [ebp - 0x858]
call fcn.00409f84
pop ecx
push eax
mov ecx, ebx
call fcn.00401c8a
lea ecx, [ebp - 0x858]
call fcn.004015bc
cmp dword [ebx + 0x14], edi
jbe 0x40969e
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x814]
cmp eax, edi
jbe 0x4096f2
mov ecx, dword [ebp - 0x828]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x85c], eax
mov dword [ebp - 0x860], ecx
cmp eax, 0x1000
jb 0x4096e9
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp - 0x860]
push eax
call fcn.0040156c
mov eax, dword [ebp - 0x85c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x860]
push eax
push ecx
call fcn.0044b96c
pop ecx
pop ecx
and dword [ebp - 0x818], 0
lea ecx, [ebp - 0x840]
xor eax, eax
mov dword [ebp - 0x814], edi
mov word [ebp - 0x828], ax
call fcn.004015bc
mov eax, ebx
call fcn.0044c7d0
ret
Function at 0x40971b
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push 0x844
mov eax, 0x48cf11
call fcn.0044c821
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [ebp - 0x84c], ebx
mov dword [ebp - 0x844], ebx
call fcn.00406189
mov edx, str.JaqKKLKJSDKTn9NPjHsGku6Tny6RJL6TSDpRjHcSkm6NJLrSoarRj1IJXuMOcLbSSL_RrabSkuMRau6T
lea ecx, [ebp - 0x840]
call fcn.0040d1b9
mov edx, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x828]
call fcn.0040aea3
cmp dword [eax + 0x14], 7
jbe 0x409768
mov eax, dword [eax]
lea ecx, [ebp - 0x844]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x828]
call fcn.004015bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x840]
call fcn.00402431
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.0044dac0
add esp, 0xc
mov dword [ebp - 0x848], 0x400
cmp dword [ebp - 0x844], 0
je 0x409872
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x850]
push eax
push ebx
push str.TEMP
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409866
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.0040245c
push ebx
push dword [0x4e4bac]
mov ecx, esi
call fcn.0040822c
mov edi, eax
cmp edi, 0xffffffff
je 0x409866
push 0x400
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x409866
push dword [0x4e4bac]
call fcn.00461ce4
pop ecx
lea edx, [ebp - 0x810]
mov ecx, eax
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0x84c]
jne 0x409842
sub edx, ebx
lea eax, [ebp - 0x810]
sar edx, 1
push edx
push eax
push ecx
push edi
mov ecx, esi
call fcn.00409cbd
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0044c7d0
ret
Function at 0x4099a8
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x870
mov eax, 0x48cfa6
call fcn.0044c821
mov esi, ecx
mov dword [ebp - 0x874], esi
push 0x800
xor ebx, ebx
mov dword [ebp - 0x874], esi
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.0044dac0
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x858]
call fcn.00401cc1
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x858]
mov eax, dword [ebp - 0x848]
push 7
pop ebx
cmp dword [ebp - 0x844], ebx
cmova ecx, dword [ebp - 0x858]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x409a37
push 0x4a9790
lea ecx, [ebp - 0x858]
call fcn.00402078
xor eax, eax
lea edi, [ebp - 0x840]
stosd dword es:[edi], eax
mov ecx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x82c], ecx
mov word [ebp - 0x840], ax
lea edi, [ebp - 0x828]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x814], ebx
mov word [ebp - 0x828], ax
mov byte [ebp - 4], 2
xor edi, edi
cmp ecx, ebx
mov dword [ebp - 0x830], edi
lea eax, [ebp - 0x840]
cmova eax, dword [ebp - 0x840]
lea edx, [ebp - 0x840]
xor ecx, ecx
push 8
mov word [eax], cx
lea eax, [ebp - 0x828]
cmp dword [ebp - 0x814], ebx
mov dword [ebp - 0x818], edi
cmova eax, dword [ebp - 0x828]
mov word [eax], cx
pop ecx
call fcn.0040afb7
push eax
lea edx, [ebp - 0x858]
lea ecx, [ebp - 0x870]
call fcn.00409f84
pop ecx
push eax
lea ecx, [ebp - 0x828]
call fcn.00401c8a
lea ecx, [ebp - 0x870]
call fcn.004015bc
cmp dword [ebp - 0x814], ebx
lea ecx, [ebp - 0x828]
cmova ecx, dword [ebp - 0x828]
call fcn.00409368
test al, al
je 0x409b08
mov ecx, dword [ebp - 0x82c]
jmp 0x409a73
cmp dword [ebp - 0x814], ebx
lea eax, [ebp - 0x828]
cmova eax, dword [ebp - 0x828]
push eax
call fcn.00460bb0
pop ecx
lea eax, [ebp - 0x828]
mov ecx, esi
push eax
call fcn.00401f87
mov eax, dword [ebp - 0x814]
cmp eax, ebx
jbe 0x409b84
mov ecx, dword [ebp - 0x828]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x874], ecx
cmp eax, 0x1000
jb 0x409b7b
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0x874]
push eax
call fcn.0040156c
mov eax, dword [ebp - 0x878]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x874]
push eax
push ecx
call fcn.0044b96c
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x818], edi
mov word [ebp - 0x828], ax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x814], ebx
cmp eax, ebx
jbe 0x409bed
mov ecx, dword [ebp - 0x840]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x874], eax
mov dword [ebp - 0x878], ecx
cmp eax, 0x1000
jb 0x409be4
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x878]
push eax
call fcn.0040156c
mov eax, dword [ebp - 0x874]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x878]
push eax
push ecx
call fcn.0044b96c
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x830], edi
lea ecx, [ebp - 0x858]
mov dword [ebp - 0x82c], ebx
mov word [ebp - 0x840], ax
call fcn.004015bc
mov eax, esi
call fcn.0044c7d0
ret
Function at 0x40af20
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
xor bl, bl
push 0xb1
mov ecx, esi
call fcn.0040b5a0
jmp 0x40afa5
call fcn.00458e5b
push 0x24
cdq
pop ecx
idiv ecx
cmp edx, 9
ja 0x40af4e
add dl, 0x30
jmp 0x40af51
add dl, 0x57
mov byte [ebp - 4], dl
lea eax, [edx - 0x30]
test edi, edi
jne 0x40af63
cmp al, 9
jbe 0x40afa5
test edi, edi
je 0x40af73
cmp dword [esi + 0x14], 0xf
mov ecx, esi
jbe 0x40af6d
mov ecx, dword [esi]
cmp byte [edi + ecx - 1], dl
je 0x40afa5
test bl, bl
jne 0x40af99
cmp al, 9
ja 0x40af7f
inc bl
jmp 0x40af99
cmp dword [esi + 0x10], 0xb0
jne 0x40af99
call fcn.00458e5b
push 0xa
cdq
pop ecx
idiv ecx
add dl, 0x30
mov byte [ebp - 4], dl
push dword [ebp - 4]
mov ecx, esi
push 1
call fcn.0040b601
mov edi, dword [esi + 0x10]
cmp edi, 0xb1
jb 0x40af39
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40cde1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov dword [ebp - 4], eax
add eax, 4
cmp dword [eax + 0x14], 7
jbe 0x40cdf5
mov eax, dword [eax]
push esi
push 0x4a97e8
push eax
call fcn.00458973
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40ce74
push ebx
push edi
mov ecx, esi
call fcn.004093d7
mov ebx, eax
push ebx
call fcn.0044bc23
push ebx
mov edi, eax
push 0
push edi
call fcn.0044dac0
push esi
push 1
push ebx
push edi
call fcn.0045f37b
push esi
call fcn.00458db1
mov ecx, dword [ebp - 4]
add esp, 0x24
cmp dword [ecx + 0x2c], 0
je 0x40ce5c
add ecx, 0x1c
cmp dword [ecx + 0x14], 0xf
jbe 0x40ce4c
mov ecx, dword [ecx]
mov esi, dword [ebp + 8]
mov edx, edi
push esi
push ebx
call fcn.0040d64f
pop ecx
pop ecx
jmp 0x40ce68
mov esi, dword [ebp + 8]
mov ecx, esi
push ebx
push edi
call fcn.00402389
push edi
call fcn.0044bc1e
mov eax, dword [esi + 0x10]
pop ecx
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x40e145
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0x44
mov eax, 0x48d875
call fcn.0044c821
mov edi, ecx
xor ebx, ebx
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x48], ebx
lea eax, [ebp - 0x48]
mov dword [ebp - 4], ebx
push eax
push 0x4978a4
push 1
push ebx
push 0x4978b4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40e22d
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x44]
mov edx, str.nyrRpmqOeqbTn0
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x4c], eax
call fcn.0040d1b9
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.0040aea3
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 7
jbe 0x40e1bd
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.00407579
mov byte [ebp - 4], 4
mov eax, dword [eax]
test eax, eax
je 0x40e1d4
mov eax, dword [eax]
jmp 0x40e1d6
mov eax, ebx
push edi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push esi
call dword [ebp - 0x4c]
lea ecx, [ebp - 0x50]
mov esi, eax
call fcn.00405f74
lea ecx, [ebp - 0x2c]
call fcn.004015bc
lea ecx, [ebp - 0x44]
call fcn.00402431
test esi, esi
js 0x40e22d
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [edi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
mov eax, dword [edi + 4]
test eax, eax
je 0x40e228
mov dword [edi + 4], ebx
mov byte [ebp - 4], 7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
sete bl
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x40e241
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov al, bl
call fcn.0044c7d0
ret
Function at 0x411ac2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48df77
mov eax, dword fs:[0]
push eax
mov eax, 0x1040
call fcn.0044ccd0
mov eax, dword [0x4ba080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0041171b
mov ebx, 0x800
mov esi, eax
push ebx
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.0044dac0
xor eax, eax
push ebx
push eax
mov dword [ebp - 0x1044], eax
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x810]
push eax
call fcn.0044dac0
add esp, 0x18
lea ecx, [ebp - 0x1040]
mov edx, str.3eoB
call fcn.0040d1b9
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1028]
mov edx, eax
call fcn.0040aea3
lea ecx, [ebp - 0x1040]
call fcn.00402431
cmp dword [ebp - 0x1014], 7
lea ecx, [ebp - 0x810]
mov edx, 0x400
lea eax, [ebp - 0x1028]
cmova eax, dword [ebp - 0x1028]
push edx
push ecx
lea ecx, [ebp - 0x1048]
push ecx
lea ecx, [ebp - 0x104c]
push ecx
lea ecx, [ebp - 0x1044]
push ecx
push edx
lea ecx, [ebp - 0x1010]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1044]
mov edx, esi
push edi
call fcn.00411a22
pop ecx
lea ecx, [ebp - 0x1028]
call fcn.004015bc
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044b95e
leave
ret

Function at 0x411bdd
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dfbc
mov eax, dword fs:[0]
push eax
mov eax, 0x1054
call fcn.0044ccd0
mov eax, dword [0x4ba080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0041171b
mov edi, 0x800
mov esi, eax
push edi
lea eax, [ebp - 0x1020]
push 0
push eax
call fcn.0044dac0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x1054], eax
mov dword [ebp - 0x105c], eax
mov dword [ebp - 0x1058], eax
push edi
push eax
lea eax, [ebp - 0x820]
push eax
call fcn.0044dac0
add esp, 0xc
lea ecx, [ebp - 0x1050]
mov edx, str.3eoB
call fcn.0040d1b9
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1038]
mov edx, eax
call fcn.0040aea3
lea ecx, [ebp - 0x1050]
mov byte [ebp - 4], 2
call fcn.00402431
cmp dword [ebp - 0x1024], 7
lea ecx, [ebp - 0x820]
mov edx, 0x400
lea eax, [ebp - 0x1038]
cmova eax, dword [ebp - 0x1038]
push edx
push ecx
lea ecx, [ebp - 0x1058]
push ecx
lea ecx, [ebp - 0x105c]
push ecx
lea ecx, [ebp - 0x1054]
push ecx
push edx
lea ecx, [ebp - 0x1020]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1054]
lea edi, [ebp - 0x1c]
xor eax, eax
mov edx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00411a22
pop ecx
push ebx
push 0xc
pop edx
lea ecx, [ebp - 0x1c]
call fcn.0040d9b3
pop ecx
lea ecx, [ebp - 0x1038]
call fcn.004015bc
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044b95e
leave
ret
Function at 0x42005b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0xc], esi
mov ebx, dword [esi + 0x2c]
lea ecx, [esi + 0x38]
mov dword [ebp - 0x18], ebx
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x3c]
add eax, 0xfffffefa
sub edi, dword [esi + 0x74]
add eax, ebx
sub edi, dword [esi + 0x6c]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edi
cmp dword [esi + 0x6c], eax
jb 0x42011f
mov ecx, dword [ecx]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.0044d540
mov ecx, dword [esi + 0x4c]
add esp, 0xc
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
sub dword [esi + 0x5c], ebx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
mov edi, dword [ebp - 8]
movzx ecx, bx
mov dword [ebp - 4], ecx
lea esi, [esi - 2]
movzx eax, word [esi]
mov edx, eax
sub eax, ecx
xor ecx, ecx
movzx eax, ax
cmp edx, ebx
cmovae ecx, eax
mov word [esi], cx
mov ecx, dword [ebp - 4]
sub edi, 1
jne 0x4200c2
mov esi, dword [ebp - 0xc]
mov edi, ebx
movzx ecx, bx
mov dword [ebp - 8], ecx
mov eax, dword [esi + 0x40]
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
movzx eax, word [esi]
mov edx, eax
sub eax, ecx
xor ecx, ecx
movzx eax, ax
cmp edx, ebx
cmovae ecx, eax
mov word [esi], cx
mov ecx, dword [ebp - 8]
sub edi, 1
jne 0x4200f2
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
add edi, ebx
lea ecx, [esi + 0x38]
mov dword [ebp - 8], ecx
mov ebx, dword [esi]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx + 4]
test eax, eax
je 0x4201ef
mov ebx, dword [esi + 0x74]
mov edx, dword [esi + 0x6c]
add ebx, edx
add ebx, dword [ecx]
cmp eax, edi
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
cmovbe edi, eax
test edi, edi
jne 0x42014c
xor edi, edi
jmp 0x4201ab
sub eax, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x42016d
mov edx, dword [ebx]
mov ecx, dword [ebx + 0x30]
push edi
call fcn.00420a9f
pop ecx
mov ecx, dword [ebp - 8]
jmp 0x42018c
mov dword [ebp - 4], ecx
cmp eax, 2
jne 0x420192
mov edx, dword [ebx]
test edx, edx
jne 0x42017f
xor eax, eax
jmp 0x420189
mov ecx, dword [ebx + 0x30]
push edi
call fcn.0041dc26
pop ecx
lea ecx, [esi + 0x38]
mov dword [ebp - 4], ecx
mov dword [ebx + 0x30], eax
push edi
push dword [ebx]
push dword [ebp - 0x14]
call fcn.0044d540
add dword [ebx], edi
add esp, 0xc
add dword [ebx + 8], edi
mov edx, dword [esi + 0x6c]
mov ecx, dword [ebp - 4]
add edi, dword [esi + 0x74]
mov dword [esi + 0x74], edi
cmp edi, 3
jb 0x4201d4
mov eax, dword [ecx]
mov ecx, dword [esi + 0x58]
movzx edx, byte [eax + edx]
mov dword [esi + 0x48], edx
shl edx, cl
mov ecx, dword [esi + 0x6c]
movzx eax, byte [eax + ecx + 1]
xor edx, eax
and edx, dword [esi + 0x54]
mov dword [esi + 0x48], edx
cmp edi, 0x106
jae 0x4201ef
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x4201ef
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
jmp 0x420072
pop edi
pop esi
pop ebx
leave
ret