joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcf6250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd0a808
push 0xcfa288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xcf6329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xcf6329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00cf91d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xcf6329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xcf6329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xcf632c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00cf6351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xcf6d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xcf6d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xcf6d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xcf6d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xcf6d94
push eax
push esi
call fcn.00cf920b
add esp, 8
pop esi
ret 0x10

Function at 0xcf6da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcf6e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xcf6e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xd0f320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00cf8dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xcf6dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xcf6e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcf6ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xcf6eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xd0f320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00cf8dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xcf6eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xcf6e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xcf7000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xcf7131
push esi
call fcn.00cfa145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00ce9080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xcf7131
push 0
push ebp
call fcn.00ce93a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00ce9260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xcf708b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00ce92f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xcf7121
push 0xd0f918
push edi
call fcn.00cf83f0
push eax
push ebx
push esi
call fcn.00cf6f60
push 0xd0f8f8
push edi
call fcn.00cf83f0
push eax
push ebx
push esi
call fcn.00cf6f60
push 0xd0f8d8
push edi
call fcn.00cf83f0
push eax
push ebx
push esi
call fcn.00cf6f60
push 0xd0f8c0
push edi
call fcn.00cf83f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00cf6f60
push 0xd0f8a0
push edi
call fcn.00cf83f0
push eax
push ebx
push esi
call fcn.00cf6f60
push 0xd0f888
push edi
call fcn.00cf83f0
push eax
push ebx
push esi
call fcn.00cf6f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xcf81b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00cf8140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00cf8140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00cf8140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00cf8140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xcf8bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xcf8c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd0a87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xcf8c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xcf8c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4019c0
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x42c6a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x430], ecx
push 0x3ec
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp - 0x430]
add ecx, 4
call fcn.00402880
mov ecx, eax
call fcn.00409d40
push eax
lea ecx, [ebp - 4]
call fcn.004024f0
lea ecx, [ebp - 4]
call fcn.004023c0
mov ecx, dword [ebp - 0x430]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 0x430]
cmp dword [edx + 0x28], 0xffffffff
jne 0x401ad1
lea ecx, [ebp - 0xc]
call fcn.00410cc0
lea ecx, [ebp - 8]
call fcn.00410cc0
mov ecx, dword [ebp - 0x430]
add ecx, 0x24
call fcn.00409d40
mov dword [ebp - 0x434], eax
lea ecx, [ebp - 0xc]
call fcn.00409e40
push eax
push 0x79
mov eax, dword [ebp - 0x434]
push eax
mov ecx, dword [ebp - 0x434]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [ebp - 0x430]
add ecx, 0x24
call fcn.00409d40
mov dword [ebp - 0x438], eax
lea ecx, [ebp - 8]
call fcn.00409e40
push eax
push 0x7a
mov ecx, dword [ebp - 0x438]
push ecx
mov edx, dword [ebp - 0x438]
mov eax, dword [edx]
mov ecx, dword [eax + 0x14]
call ecx
push 0
lea ecx, [ebp - 0xc]
call fcn.00409d40
push eax
lea ecx, [ebp - 8]
call fcn.00409d40
push eax
mov ecx, dword [ebp - 0x430]
add ecx, 4
call fcn.004028b0
lea ecx, [ebp - 8]
call fcn.00401130
lea ecx, [ebp - 0xc]
call fcn.00401130
jmp 0x401c2a
push 0x3ff
mov ecx, dword [ebp - 0x430]
add ecx, 4
call fcn.00402860
mov edx, dword [ebp - 0x430]
mov dword [edx + 0x34], eax
push 0x3ff
lea eax, [ebp - 0x42c]
push eax
mov ecx, dword [ebp - 0x430]
add ecx, 4
call fcn.00402880
mov ecx, eax
call fcn.004027d0
test eax, eax
je 0x401c1b
xor ecx, ecx
mov word [ebp - 0x420], cx
push 0x206
push 0
lea edx, [ebp - 0x41e]
push edx
call fcn.00417120
add esp, 0xc
push 0x104
lea eax, [ebp - 0x420]
push eax
push 0x4254e4
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401b6c
push 0
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.00417120
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.004170a0
add esp, 0xc
push 0x42550c
lea ecx, [ebp - 0x218]
push ecx
call fcn.004027a0
add esp, 8
lea ecx, [ebp - 0x424]
call fcn.00402990
push 0x3ff
mov ecx, dword [ebp - 0x430]
add ecx, 4
call fcn.00402860
push eax
push 0x425530
lea edx, [ebp - 0x424]
push edx
call fcn.004029b0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x424]
call fcn.00409d40
push eax
push str.DiskReadOnly
push 0x425554
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x424]
call fcn.00403310
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x430]
call fcn.00414e40
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041710f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4040a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x7c], 0x80004004
jne 0x4040c7
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x7c], 0
mov eax, 0x80004004
jmp 0x4041b7
mov ecx, dword [ebp + 8]
add ecx, 0x50
call fcn.0040a5c0
test eax, eax
jne 0x404141
mov edx, dword [ebp + 8]
mov dword [edx + 0x7c], 0
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x78
call fcn.00409310
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x84], 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
mov ecx, dword [ebp + 8]
sub ecx, 0x28
push ecx
push 0x4041c0
push 0
push 0
call fcn.004178e9
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
mov ecx, dword [ebp + 0x14]
push 0
push 0x64
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ecx]
push eax
call fcn.00417a10
mov ecx, dword [ebp + 0x18]
mov esi, dword [ecx + 4]
push esi
mov ecx, dword [ecx]
push ecx
push edx
push eax
call fcn.004179a0
push eax
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x4c
call fcn.00415df0
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jb 0x4041b1
ja 0x40419d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
cmp eax, dword [edx]
jb 0x4041b1
push 0
push 1
push 0x111
mov ecx, dword [ebp + 8]
add ecx, 0x50
call fcn.0040a520
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x7c]
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4042a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0xb8], 0x80004004
jne 0x4042cd
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xb8], 0
mov eax, 0x80004004
jmp 0x4043bf
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jb 0x4042fc
ja 0x4042f5
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
cmp eax, dword [edx]
jb 0x4042fc
xor eax, eax
jmp 0x4043bf
mov ecx, dword [ebp + 8]
add ecx, 0x8c
call fcn.0040a5c0
test eax, eax
jne 0x40437f
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xb8], 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0xb4
call fcn.00409310
mov eax, dword [ebp + 8]
mov dword [eax + 0xc0], 2
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
mov eax, dword [ebp + 8]
sub eax, 0x28
push eax
push 0x4043d0
push 0
push 0
call fcn.004178e9
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
mov eax, dword [ebp + 0x14]
push 0
push 0x64
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.00417a10
mov ecx, dword [ebp + 0x10]
mov esi, dword [ecx + 4]
push esi
mov ecx, dword [ecx]
push ecx
push edx
push eax
call fcn.004179a0
push eax
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x88
call fcn.00415df0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb8]
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404850
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x42c6a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00417120
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0x4256ec
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00417120
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0x104
lea eax, [ebp - 0x418]
push eax
call fcn.004170a0
add esp, 0xc
push 0x425714
lea ecx, [ebp - 0x418]
push ecx
call fcn.004027a0
add esp, 8
lea edx, [ebp - 0x418]
push edx
push 0
push 0x425738
push 0x425760
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x404911
mov eax, 1
jmp 0x404913
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041710f
mov esp, ebp
pop ebp
ret
Function at 0x4059e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405ba4
cmp dword [ebp - 4], 1
jle 0x405ba4
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
lea ecx, [ebp - 0x10]
call fcn.0040a6f0
push 0x425968
lea ecx, [ebp - 0x10]
call fcn.0040a830
test eax, eax
je 0x405a49
push 0x425980
lea ecx, [ebp - 0x10]
call fcn.0040a830
test eax, eax
jne 0x405a75
cmp dword [ebp - 4], 3
jne 0x405a5e
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.004088b0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x10]
call fcn.00403310
jmp 0x405ba4
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0xc]
call fcn.0040a6f0
lea ecx, [ebp - 0xc]
call fcn.0040a790
sub eax, 1
push eax
lea ecx, [ebp - 0xc]
call fcn.0040a7b0
movzx edx, ax
cmp edx, 0x22
jne 0x405ab6
push 0x5c
lea ecx, [ebp - 0xc]
call fcn.0040a790
sub eax, 1
push eax
lea ecx, [ebp - 0xc]
call fcn.0040a7d0
cmp dword [ebp - 4], 2
jne 0x405ad1
push 0
push 0
lea ecx, [ebp - 0xc]
call fcn.00409d40
push eax
mov ecx, dword [ebp - 0x20]
call fcn.00407b00
cmp dword [ebp - 4], 2
jle 0x405b8a
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040a6f0
lea ecx, [ebp - 0x18]
call fcn.0040a790
sub eax, 1
push eax
lea ecx, [ebp - 0x18]
call fcn.0040a7b0
movzx edx, ax
cmp edx, 0x22
jne 0x405b1c
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.0040a790
sub eax, 1
push eax
lea ecx, [ebp - 0x18]
call fcn.0040a7d0
mov byte [ebp - 0x11], 0
cmp dword [ebp - 4], 3
jle 0x405b63
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0040a6f0
push 0x425998
lea ecx, [ebp - 0x1c]
call fcn.0040a830
test eax, eax
je 0x405b57
push 0x4259a4
lea ecx, [ebp - 0x1c]
call fcn.0040a830
test eax, eax
jne 0x405b5b
mov byte [ebp - 0x11], 1
lea ecx, [ebp - 0x1c]
call fcn.00403310
movzx edx, byte [ebp - 0x11]
push edx
lea ecx, [ebp - 0x18]
call fcn.00409d40
push eax
lea ecx, [ebp - 0xc]
call fcn.00409d40
push eax
mov ecx, dword [ebp - 0x20]
call fcn.00407b00
lea ecx, [ebp - 0x18]
call fcn.00403310
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0xc]
call fcn.00403310
lea ecx, [ebp - 0x10]
call fcn.00403310
mov esp, ebp
pop ebp
ret
Function at 0x405e80
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0xc], 0x80
je 0x405e9c
mov eax, 1
jmp 0x405f5b
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x48]
test ecx, ecx
jne 0x405eb0
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x4c], 0
je 0x405eba
mov eax, 1
jmp 0x405f5b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x202
je 0x405ed7
cmp dword [ebp - 0x18], 0x205
je 0x405f19
jmp 0x405f59
mov ecx, dword [ebp - 0x14]
call fcn.00406750
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 8
mov ecx, dword [ebp - 0x14]
add ecx, 0xec
call fcn.00409950
jmp 0x405f59
mov ecx, dword [ebp - 0x14]
call fcn.00406750
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xf0
call fcn.00409950
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x407b00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x68
call fcn.0040a800
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x6c
call fcn.0040a800
mov edx, dword [ebp - 4]
mov al, byte [ebp + 0x10]
mov byte [edx + 0x70], al
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x4075c0
push 0
push 0
call fcn.004178e9
add esp, 0x18
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408850
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 5
push 0
push 0
push str.http:__bbs.winmount.com_forumdisplay.php_fid24
push 0x425ae8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x408880
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 5
push 0
push 0
push str.http:__cn.winmount.com_sponsor1.html
push 0x425b44
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4088b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42c6a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040a6f0
lea ecx, [ebp - 0x14]
call fcn.0040a790
sub eax, 1
push eax
lea ecx, [ebp - 0x14]
call fcn.0040a7b0
movzx ecx, ax
cmp ecx, 0x22
jne 0x408901
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.0040a790
sub eax, 1
push eax
lea ecx, [ebp - 0x14]
call fcn.0040a7d0
mov edx, dword [0x425b50]
mov dword [ebp - 0x10], edx
mov eax, dword [0x425b54]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0x5a
jmp 0x408924
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x41
jl 0x40896e
mov dx, word [ebp - 0x18]
mov word [ebp - 0x10], dx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x40896c
push 0
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00409d40
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00407b00
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x14]
call fcn.00403310
mov eax, dword [ebp - 0x1c]
jmp 0x4089ea
jmp 0x40891b
lea ecx, [ebp - 4]
call fcn.00410cc0
mov ecx, dword [ebp - 0x24]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.00409e40
push eax
push 0x1b
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
call edx
push 0x425b58
lea ecx, [ebp - 4]
call fcn.00409610
lea ecx, [ebp - 0x14]
call fcn.00409d40
push eax
lea ecx, [ebp - 4]
call fcn.00409610
lea ecx, [ebp - 4]
call fcn.00409d40
push eax
push 0xe
push 0
mov ecx, dword [ebp - 0x24]
call fcn.00406350
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 4]
call fcn.00401130
lea ecx, [ebp - 0x14]
call fcn.00403310
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041710f
mov esp, ebp
pop ebp
ret 4
Function at 0x40b5f0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x42c6a0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00417120
add esp, 0xc
push 0x104
lea edx, [ebp - 0x420]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40b644
mov eax, 0x80004005
jmp 0x40b6f7
push str.WMDrive.sys
push 0x5c
lea eax, [ebp - 0x420]
push eax
call fcn.00409050
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumW]
test eax, eax
je 0x40b69b
mov eax, 0x80004005
jmp 0x40b6f7
mov ecx, dword [ebp - 0x218]
cmp ecx, dword [ebp - 0x214]
je 0x40b6b0
mov eax, 0x80004005
jmp 0x40b6f7
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.driversWMDrive.sys
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40b6f5
mov eax, 0x80004005
jmp 0x40b6f7
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041710f
mov esp, ebp
pop ebp
ret