joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410260
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov ebx, 0x499714
lea eax, [ebp - 4]
push eax
push ecx
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
mov eax, ebx
mov edx, esi
call fcn.00405c48
mov eax, ebx
call fcn.00405bdc
inc eax
push eax
push ebx
push 1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x104]
mov edx, esi
call fcn.00405c48
push 0x4103f8
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
push 0x410400
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
cmp byte [ebp + 8], 0
jne 0x410313
mov eax, dword [0x48d560]
call fcn.00412904
jmp 0x41032a
mov edx, 0x49227c
mov eax, ebx
call fcn.00405c48
push 0x41040c
push ebx
call sub.kernel32.dll_lstrcatA
mov eax, ebx
call fcn.00405bdc
inc eax
push eax
push ebx
push 1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 4]
push eax
push esi
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
mov eax, ebx
mov edx, edi
call fcn.00405c48
mov eax, ebx
call fcn.00405bdc
inc eax
push eax
push ebx
push 1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
lea eax, [ebp - 0x104]
mov edx, esi
call fcn.00405c48
push 0x410414
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
mov eax, dword [0x48d560]
call fcn.00412904
mov eax, ebx
call fcn.00405bdc
mov byte [ebx + eax - 5], 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_lstrcatA
mov eax, ebx
call fcn.00405bdc
inc eax
push eax
push ebx
push 1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410bf0
Capabilities:
Get disk size

Disassembly:
add esp, 0xffffffec
cmp byte [0x494848], 0
jne 0x410c52
mov eax, 0x410c60
call fcn.00412904
mov edx, eax
lea eax, [esp + 0x10]
mov cx, 3
call fcn.00405c70
mov dword [esp + 8], 1
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x20]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
cmp dword [esp + 8], 0
jne 0x410c4b
mov byte [0x494848], 1
jmp 0x410c52
mov byte [0x494848], 2
cmp byte [0x494848], 1
sete al
add esp, 0x14
ret

Function at 0x410c64
Capabilities:
Set registry value

Disassembly:
push ebx
push ecx
cmp byte [0x4947d2], 0
jne 0x410da5
mov al, byte [0x49481e]
mov byte [0x493632], al
cmp dword [0x499710], 0
je 0x410ca0
mov eax, 0x491e7c
mov edx, dword [0x499710]
call fcn.00405c48
mov eax, dword [0x499710]
call fcn.00405eac
push esp
mov eax, dword [0x48d62c]
mov eax, dword [eax]
push eax
push 0x80000001
call sub.advapi32.dll_RegCreateKeyA
mov eax, 0x410da8
call fcn.00412904
mov eax, 0x499714
call fcn.0040fb68
mov eax, 0x499714
call fcn.0040f278
mov eax, 0x499714
call fcn.00405bdc
inc eax
push eax
push 0x499714
push 1
push 0
push 0x410dac
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
cmp byte [0x49481b], 0
je 0x410d3a
push 0x1e1c
push 0x491d7c
push 3
push 0
mov eax, dword [0x48bc68]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x410da5
mov ax, 0x119
call fcn.0040bc04
mov edx, eax
mov ax, 0x1a
call fcn.0040de10
jmp 0x410da5
push 0
mov eax, dword [0x4996b8]
push eax
call sub.kernel32.dll__lcreat
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x410d68
call fcn.00410bf0
test al, al
jne 0x410da5
mov edx, dword [0x4996b8]
mov ax, 3
call fcn.0040de10
jmp 0x410da5
push 0x20
push 0x48c1c4
push ebx
call sub.kernel32.dll__hwrite
push 0x1e1c
push 0x491d7c
push ebx
call sub.kernel32.dll__hwrite
cdq
cmp edx, 0
jne 0x410d9f
cmp eax, 0xffffffff
jne 0x410d9f
mov edx, dword [0x4996b8]
mov ax, 3
call fcn.0040de10
push ebx
call sub.kernel32.dll_CloseHandle_1
pop edx
pop ebx
ret
Function at 0x411278
Capabilities:
Create process on windows

Disassembly:
mov al, 4
call fcn.00411204
mov edx, 0x4112f8
mov eax, 0x499714
call fcn.00405c48
mov al, byte [0x493608]
sub al, 1
jb 0x4112a1
dec al
je 0x4112b2
dec al
je 0x4112c3
jmp 0x4112d4
push 0x41131c
push 0x499714
call sub.kernel32.dll_lstrcatA
jmp 0x4112e3
push 0x411324
push 0x499714
call sub.kernel32.dll_lstrcatA
jmp 0x4112e3
push 0x41132c
push 0x499714
call sub.kernel32.dll_lstrcatA
jmp 0x4112e3
push 0x411334
push 0x499714
call sub.kernel32.dll_lstrcatA
push 5
push 0
push 0
push 0x499714
push 0
push 0
call sub.shell32.dll_ShellExecuteA
ret

Function at 0x412cf4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x412d15
mov al, byte [esp]
jmp 0x412d17
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x412d1c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x412d55
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044d4
jmp 0x412d5e
mov eax, ebx
mov edx, esi
call fcn.00404464
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x412ed4
Capabilities:
Get file size

Disassembly:
add esp, 0xfffffff4
lea edx, [esp + 8]
push edx
push eax
call sub.kernel32.dll_GetFileSize_1
mov edx, dword [esp + 8]
call fcn.0040fdbc
fistp qword [esp]
wait
fild qword [esp]
add esp, 0xc
ret

Function at 0x412f30
Capabilities:
Get file size

Disassembly:
push ebx
add esp, 0xfffffff4
mov ecx, 0x8000000
xor edx, edx
call fcn.0040eba4
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x412f58
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
jmp 0x412f76
lea eax, [esp + 8]
push eax
push ebx
call sub.kernel32.dll_GetFileSize_1
mov edx, dword [esp + 8]
call fcn.0040fdbc
fistp qword [esp]
wait
push ebx
call sub.kernel32.dll_CloseHandle_1
fild qword [esp]
add esp, 0xc
pop ebx
ret
Function at 0x4140d8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffd30
mov ebx, eax
mov ebp, esp
push 0
push 0
push 0x418
mov eax, dword [0x49a1ac]
push eax
call sub.user32.dll_SendMessageA
test eax, eax
je 0x414325
mov edx, dword [0x4996c8]
mov eax, ebp
call fcn.00402ba4
mov eax, ebp
call fcn.00402934
call fcn.004025ec
test eax, eax
je 0x414133
mov edx, dword [0x4996c8]
mov ax, 3
call fcn.0040de10
jmp 0x414325
push 0xff
lea eax, [esp + 0x1d0]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
lea edx, [esp + 0x1cc]
mov eax, ebp
call fcn.00403250
call fcn.004032bc
mov eax, ebp
call fcn.004032bc
push 8
push ebx
call sub.user32.dll_GetWindowLongA
mov esi, eax
push 4
push ebx
call sub.user32.dll_GetWindowLongA
mov edi, eax
fild dword [esi + 0x400]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 8
xor eax, eax
call fcn.0040fe88
push eax
mov edx, dword [0x48d470]
mov edx, dword [edx + 8]
mov eax, ebp
call fcn.00403250
mov edx, 0x414338
call fcn.00404918
pop edx
call fcn.00403250
call fcn.004032bc
fild dword [esi + 0x404]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 8
xor eax, eax
call fcn.0040fe88
push eax
mov edx, dword [0x48d470]
mov edx, dword [edx + 0x14]
mov eax, ebp
call fcn.00403250
mov edx, 0x414344
call fcn.00404918
pop edx
call fcn.00403250
call fcn.004032bc
mov eax, ebp
call fcn.004032bc
mov edx, 0x414350
mov eax, ebp
call fcn.00404918
call fcn.004032bc
push 0x10
push ebx
call sub.user32.dll_GetWindowLongA
cmp eax, 0xff
jg 0x4142f1
mov ebx, eax
mov dword [esp + 0x2cc], ebx
fild dword [esp + 0x2cc]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 2
xor eax, eax
call fcn.0040fe88
mov edx, eax
mov eax, ebp
call fcn.00403250
mov dl, 9
call fcn.00403198
mov ecx, 3
mov edx, ebx
call fcn.004031d4
mov dl, 9
call fcn.00403198
call fcn.00402c54
cmp ebx, 0x20
jge 0x414274
mov dl, 0x2e
mov eax, ebp
call fcn.00403198
call fcn.00402c54
jmp 0x414282
mov edx, ebx
mov eax, ebp
call fcn.00403198
call fcn.00402c54
mov dl, 9
mov eax, ebp
call fcn.00403198
mov edx, dword [esi + ebx*4]
call fcn.00403214
call fcn.00402c54
test edi, edi
jle 0x4142dd
fild dword [esi + ebx*4]
mov dword [esp + 0x2cc], edi
fild dword [esp + 0x2cc]
fdivp st(1)
fmul dword [0x414364]
add esp, 0xfffffff4
fstp xword [esp]
wait
mov dl, 9
mov eax, ebp
call fcn.00403198
mov ecx, 2
xor edx, edx
call fcn.00403288
mov dl, 0x25
call fcn.00403198
call fcn.00402c54
mov eax, ebp
call fcn.004032bc
inc ebx
cmp ebx, 0x100
jne 0x414219
mov eax, ebp
call fcn.00402c60
call fcn.004025ec
test eax, eax
je 0x414312
mov edx, dword [0x4996c8]
mov ax, 5
call fcn.0040de10
jmp 0x414325
mov ax, 0x13a
call fcn.0040bc04
mov edx, 4
call fcn.00411d74
add esp, 0x2d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x414368
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov ebx, eax
push 0
push 0x46
push 0x499714
push 0x46
mov eax, dword [0x49a240]
push eax
call sub.user32.dll_GetMenuStringA
mov eax, 0x499714
mov dl, 0x2e
call fcn.00405cf8
test eax, eax
je 0x41439b
mov byte [eax], 0
mov eax, 0x499714
mov dl, 0x26
call fcn.00405cf8
test eax, eax
je 0x4143ae
mov byte [eax], 0x20
push 0x41447c
push 0x499714
call sub.kernel32.dll_lstrcatA
push 0xff
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
mov edx, esp
mov eax, 0x499940
call fcn.00405c48
mov eax, 0x499940
call fcn.0040cd5c
mov eax, 0x499940
call fcn.0040cd5c
push 0x499714
push 0x499940
call sub.kernel32.dll_lstrcatA
mov eax, 0x499940
mov edx, 2
call fcn.00411d74
test al, al
jne 0x414417
push ebx
call sub.user32.dll_BringWindowToTop
jmp 0x414472
push ebx
call sub.user32.dll_BringWindowToTop
push 0xffffffffffffffff
push 0
push ebx
call sub.user32.dll_InvalidateRect
call fcn.0040f494
mov eax, dword [0x49a4e4]
push eax
push 0x49a3b2
push 0x49a324
push 0x49a3a5
call sub.gdi32.dll_CreateDCA
mov esi, eax
test esi, esi
jne 0x414461
mov ax, 0x13d
call fcn.0040bc04
mov edx, 1
call fcn.00411d74
jmp 0x414472
mov ecx, esp
mov edx, esi
mov eax, ebx
call fcn.004137ac
push esi
call sub.gdi32.dll_DeleteDC
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x41552c
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
mov ebx, edx
cmp byte [0x4935fb], 0
je 0x415574
push eax
push 0x4154e4
push eax
call sub.user32.dll_EnumChildWindows
test bl, bl
je 0x415574
cmp dword [0x49475c], 0
jne 0x415574
mov eax, dword [0x49a1ac]
call fcn.00405aec
push eax
mov eax, dword [0x48e700]
push eax
mov eax, 0x4153d0
push eax
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [0x49475c], eax
pop ebx
ret
Function at 0x419d98
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, ecx
mov edi, edx
mov byte [esp], al
mov byte [esp + 1], 0
mov dword [esp + 4], 1
mov dword [esp + 8], 0xff
lea eax, [esp + 8]
push eax
mov eax, dword [0x48da44]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x419fa8
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x419f9a
xor ebx, ebx
mov bl, byte [esp]
add ebx, 0x40
mov byte [esp + 0xc], 0
mov eax, dword [0x48da44]
call fcn.00405bdc
mov edx, eax
dec edx
test edx, edx
jl 0x419e13
inc edx
mov eax, dword [0x48da44]
cmp bl, byte [eax]
jne 0x419e0f
mov byte [esp + 0xc], 1
jmp 0x419e13
inc eax
dec edx
jne 0x419e04
cmp byte [esp + 0xc], 0
je 0x419f9a
mov dword [esp + 8], 0xff
lea eax, [esp + 8]
push eax
mov eax, dword [0x48da44]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x419fc8
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x419f9a
push 0x419fd0
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x419e77
push 0x419fd8
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x419f9a
mov dword [esp + 8], 0x13
lea eax, [esp + 8]
push eax
mov eax, dword [0x48d7ec]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x419fe0
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x419f9a
xor eax, eax
call fcn.0040bcc0
mov byte [esi + 2], al
mov eax, dword [0x48d6d4]
cmp byte [eax], 0
jne 0x419f9a
mov dword [esp + 8], 0x13
lea eax, [esp + 8]
push eax
mov eax, dword [0x48d7ec]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x419fe8
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x419f9a
xor eax, eax
call fcn.0040bcc0
mov byte [esi + 1], al
mov eax, dword [0x48d6d4]
cmp byte [eax], 0
jne 0x419f9a
xor ebp, ebp
mov eax, ebp
mov byte [esi], al
mov edx, dword [0x48da44]
mov eax, dword [esi]
call fcn.00419a68
test al, al
je 0x419f75
mov dword [esp + 8], 0xff
lea eax, [esp + 8]
push eax
mov eax, dword [0x48d830]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x419ff8
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x419f75
mov eax, dword [0x48da44]
mov byte [eax + 8], 0
mov eax, dword [0x48d830]
mov byte [eax + 8], 0
mov eax, dword [0x48d830]
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x419f75
mov al, byte [esp]
mov byte [esi + 3], al
mov byte [esp + 1], 1
jmp 0x419f9a
inc ebp
cmp ebp, 8
jne 0x419f03
mov byte [esi], 0
mov edx, dword [0x48da44]
mov eax, dword [esi]
call fcn.00419a68
test al, al
je 0x419f9a
mov al, byte [esp]
mov byte [esi + 3], al
mov byte [esp + 1], 1
mov al, byte [esp + 1]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41a004
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffddc
mov dword [esp + 4], edx
mov byte [esp], al
lea edi, [esp + 0x11e]
mov ebp, dword [0x48d830]
mov byte [esp + 8], 0
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov edx, 0x48c294
lea eax, [esp + 0x18]
call fcn.00405c48
lea eax, [esp + 0xc]
push eax
push 8
push 0
lea eax, [esp + 0x24]
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41a164
xor esi, esi
jmp 0x41a132
mov edx, 0x48c294
lea eax, [esp + 0x18]
call fcn.00405c48
push 0x41a174
lea eax, [esp + 0x1c]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48da44]
push eax
lea eax, [esp + 0x1c]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x10]
push eax
push 8
push 0
lea eax, [esp + 0x24]
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41a131
xor ebx, ebx
jmp 0x41a112
lea edx, [esp + 0x18]
mov eax, edi
call fcn.00405c48
push 0x41a174
push edi
call sub.kernel32.dll_lstrcatA
push ebp
push edi
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x14]
push eax
push edi
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x41a111
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x14]
mov al, byte [esp]
call fcn.00419d98
test al, al
je 0x41a111
mov byte [esp + 8], 1
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x41a150
inc ebx
push 0x105
push ebp
push ebx
mov eax, dword [esp + 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x41a0bb
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
inc esi
push 0x105
mov eax, dword [0x48da44]
push eax
push esi
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x41a06e
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov al, byte [esp + 8]
add esp, 0x224
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41aa4c
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
xor eax, eax
test bl, bl
jge 0x41aa8e
movsx edx, bl
mov ecx, dword [0x48d494]
mov edx, dword [ecx + edx*4 + 0x98]
test edx, edx
je 0x41ab56
movsx eax, bl
mov ecx, dword [0x48d494]
mov eax, esi
call fcn.00405c48
mov al, 1
jmp 0x41ab56
cmp bl, 0x1a
jle 0x41aaa5
mov ecx, esi
xor edx, edx
mov eax, ebx
call fcn.0041ac5c
mov al, 1
jmp 0x41ab56
movsx edi, bl
mov eax, dword [0x48d1c8]
mov eax, dword [eax + edi*4 - 4]
test eax, eax
je 0x41aace
movsx edx, bl
mov ecx, dword [0x48d1c8]
call fcn.00405eac
mov eax, dword [0x48d1c8]
xor edx, edx
mov dword [eax + edi*4 - 4], edx
mov eax, edi
add eax, 0x40
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0
push 0xff
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0xff
push esi
lea eax, [esp + 0x1c]
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x41ab39
mov eax, esi
call fcn.00405bdc
test eax, eax
jle 0x41ab39
lea eax, [esi + 1]
push eax
call sub.user32.dll_CharLowerA
mov eax, esi
call fcn.00405e78
movsx edx, bl
mov ecx, dword [0x48d1c8]
mov dword [ecx + edx*4 - 4], eax
jmp 0x41ab40
mov byte [esi], 0
xor eax, eax
jmp 0x41ab56
movsx eax, bl
mov edx, dword [0x48d1c8]
mov edx, dword [edx + eax*4 - 4]
mov eax, esi
call fcn.00405c48
mov al, 1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x41ab60
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef4
mov esi, ecx
mov edi, edx
cmp al, 0x1a
jbe 0x41ab7f
mov byte [edi], 0xfd
mov byte [esi], 0
mov bl, 1
jmp 0x41ac48
and eax, 0xff
add eax, 0x40
mov edx, dword [0x48da44]
mov byte [edx], al
mov eax, dword [0x48da44]
mov byte [eax + 1], 0x3a
mov eax, dword [0x48da44]
mov byte [eax + 2], 0x5c
mov eax, dword [0x48da44]
mov byte [eax + 3], 0
push 0xff
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0xff
mov eax, dword [0x48d830]
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x41ac46
cmp byte [esp + 0xc], 0
je 0x41ac46
mov bl, 1
push 0x41ac58
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x41abfe
mov byte [edi], 2
jmp 0x41ac01
mov byte [edi], 0xfd
test byte [esp + 8], 0x10
je 0x41ac0b
mov byte [esi], 1
test byte [esp + 9], 0x80
je 0x41ac15
mov byte [esi], 2
mov esi, 0xfffffffe
mov ebp, dword [0x48db8c]
add ebp, 8
mov eax, dword [ebp]
push eax
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x41ac3b
mov eax, esi
mov byte [edi], al
jmp 0x41ac48
inc esi
add ebp, 4
cmp esi, 5
jne 0x41ac23
jmp 0x41ac48
xor ebx, ebx
mov eax, ebx
add esp, 0x10c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41b3a4
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
push ebx
push esi
xor ebx, ebx
push 0
mov eax, dword [0x48d838]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x41b3d1
mov edx, dword [0x48d838]
mov edx, dword [edx + 0xc]
mov ax, 9
call fcn.0040de10
jmp 0x41b44a
call sub.kernel32.dll_GetTickCount
mov esi, eax
push 0x14
call sub.kernel32.dll_Sleep
push 0
push 0x41b450
call sub.user32.dll_FindWindowA
mov edx, dword [0x48d884]
mov dword [edx], eax
mov eax, dword [0x48d884]
cmp dword [eax], 0
jne 0x41b40b
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 0x3e8
jbe 0x41b3d8
mov eax, dword [0x48d884]
cmp dword [eax], 0
jne 0x41b429
mov edx, dword [0x48d838]
mov edx, dword [edx + 0xc]
mov ax, 0xa
call fcn.0040de10
jmp 0x41b44a
mov eax, dword [0x48d2b0]
cmp byte [eax], 0
je 0x41b448
mov eax, dword [0x48d7f0]
mov eax, dword [eax]
push eax
mov eax, dword [0x48d884]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowTextA
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4245b8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
cmp byte [ebx + 0x83], 0
jne 0x4245d6
lea edi, [ebx + 0x20]
jmp 0x4245d8
xor edi, edi
cmp byte [ebx + 0x76], 3
jne 0x42461a
cmp dword [ebx + 0x78], 0
je 0x4245eb
mov eax, ebx
call fcn.00424a28
push edi
mov cl, byte [ebp + 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00429484
test al, al
sete byte [ebp - 5]
or dword [ebx + 0x1c], 0x20
mov eax, dword [ebx + 0x1c]
or eax, 0x20
push eax
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4246a1
mov byte [ebp - 5], 0
push esi
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x42463e
push edi
mov eax, dword [ebx + 8]
mov cl, byte [ebp + 8]
mov edx, esi
call fcn.00429484
test al, al
jne 0x4246a1
cmp byte [ebx + 0x80], 0
je 0x424677
call fcn.00422f34
test al, al
je 0x4246a1
mov ecx, dword [0x48da44]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00422954
test eax, eax
je 0x424671
mov edx, dword [0x48da44]
call fcn.0040de10
jmp 0x4246a1
mov byte [ebp - 5], 1
jmp 0x4246a1
push esi
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x42469d
mov eax, esi
call fcn.00412584
test al, al
jne 0x42469d
mov edx, esi
mov ax, 3
call fcn.0040de10
jmp 0x4246a1
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4246b0
Capabilities:
Delete file
Move file

Disassembly:
push ebx
push esi
add esp, 0xfffffdf8
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x40], 0
jne 0x42487e
mov al, byte [esi + 0x76]
cmp al, 3
je 0x4246d4
cmp al, 4
jne 0x4246e8
cmp dword [esi + 0x78], 0
je 0x4246e1
mov eax, esi
call fcn.00424a28
mov bl, 1
jmp 0x42487e
mov eax, dword [0x48d550]
movzx eax, word [eax + 0x1872]
mov edx, 0x32
call fcn.0040bb84
mov dword [esp + 0x204], eax
fild dword [esp + 0x204]
fild qword [esi + 0xc]
fdiv dword [0x42488c]
fdiv dword [0x42488c]
fcompp
fnstsw ax
sahf
jbe 0x4247a6
mov eax, dword [0x48d550]
cmp byte [eax + 0x18ed], 0
jne 0x4247a6
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.00412abc
mov edx, eax
mov eax, dword [0x48d830]
call fcn.00405c48
mov ax, 0x2b8
call fcn.0040bc04
mov edx, dword [0x48d830]
call fcn.0040f5a0
push 0x424890
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov ax, 0x124
call fcn.0040bc04
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48da44]
mov edx, 0x24
call fcn.00411d74
mov eax, dword [0x48d91c]
mov al, byte [eax]
mov edx, dword [0x48d550]
mov byte [edx + 0x18ed], al
mov eax, dword [0x48d7bc]
mov byte [eax], 1
mov ax, word [esi + 0x72]
call fcn.00412944
mov edx, eax
lea eax, [esp + 0x101]
call fcn.00405c48
cmp byte [esi + 0x80], 0
je 0x424824
lea edx, [esp + 0x101]
lea eax, [esp + 1]
call fcn.00405c48
push 0x424894
lea eax, [esp + 5]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 1]
push eax
lea eax, [esp + 0x105]
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x424824
call sub.kernel32.dll_GetLastError_1
call fcn.0040f5f0
mov eax, dword [0x48da44]
mov edx, 1
call fcn.00411d74
jmp 0x42487e
mov al, byte [esp]
xor al, 1
add al, 7
push eax
lea ecx, [esp + 0x105]
lea edx, [esp + 5]
mov eax, esi
call fcn.004245b8
test al, al
je 0x42485b
mov byte [esi + 0x76], 3
mov byte [esi + 0x80], 1
lea eax, [esp + 1]
push eax
call sub.kernel32.dll_DeleteFileA_1
mov bl, 1
jmp 0x424876
cmp byte [esi + 0x80], 0
je 0x424876
lea eax, [esp + 0x101]
push eax
lea eax, [esp + 5]
push eax
call sub.kernel32.dll_MoveFileA
mov eax, dword [0x48d7bc]
mov byte [eax], 0
mov eax, ebx
add esp, 0x208
pop esi
pop ebx
ret