joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4137a4
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4137ac
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4139b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x416350]
mov edx, dword [0x416348]
mov eax, 0x80000000
call fcn.00411ba8
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0040f77c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.0040352c
mov eax, dword [ebp - 0x18]
call fcn.00406e3c
cmp al, 1
jne 0x413853
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.00413074
push 0
mov ecx, dword [0x416354]
mov edx, dword [0x416348]
mov eax, 0x80000000
call fcn.00411ad8
push 0
mov ecx, dword [0x416350]
mov edx, dword [0x416348]
mov eax, 0x80000000
call fcn.00411ad8
push 0
mov ecx, dword [0x41634c]
mov edx, dword [0x416348]
mov eax, 0x80000000
call fcn.00411ad8
mov dl, 1
mov eax, dword [0x40b6fc]
call fcn.00402af4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
call fcn.00411aa0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 8]
call fcn.00406edc
lea eax, [ebp - 0x24]
call fcn.00411aa0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xc]
call fcn.00406f38
mov eax, dword [ebp - 8]
call fcn.004036f0
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x4138ac
lea eax, [ebp - 0x10]
mov ecx, 0x4139d0
mov edx, dword [ebp - 8]
call fcn.0040373c
jmp 0x4138b7
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040352c
mov edx, 0x4139dc
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, 0x4139f0
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x413a00
push dword [ebp - 0xc]
push 0x413a10
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004037b0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x413a20
push dword [ebp - 0xc]
push 0x413a34
push 0x413a40
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.004037b0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, 0x413a54
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
push ebp
push 0x413985
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov ecx, 0x413a74
mov edx, dword [ebp - 0x10]
call fcn.0040373c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
push 0x413a80
mov eax, dword [ebp - 0x14]
call fcn.004038b4
push eax
push 0x413a84
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41398f
mov eax, dword [ebp - 4]
call fcn.00402b24
xor eax, eax
call fcn.004033f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4139c0
lea eax, [ebp - 0x2c]
mov edx, 0xa
call fcn.004034b8
ret
Function at 0x414860
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x414982
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004025a8
mov dword [ebp - 4], eax
call sub.user32.dll_GetForegroundWindow
push 0xc8
mov edx, dword [ebp - 4]
push edx
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040364c
mov edx, dword [ebp - 8]
mov eax, dword [0x416364]
call fcn.00403980
test eax, eax
jle 0x41495f
mov eax, dword [0x416554]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x41495f
xor eax, eax
push ebp
push 0x414955
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x416554]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x41494b
inc ebx
xor esi, esi
lea ecx, [ebp - 0xc]
mov eax, dword [0x416554]
mov eax, dword [eax]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00403980
test eax, eax
jle 0x414947
mov edx, dword [0x416548]
mov edx, dword [edx]
mov eax, dword [ebp - 0xc]
call fcn.00403980
test eax, eax
jg 0x41494b
mov eax, dword [0x416548]
push dword [eax]
push dword [ebp - 0xc]
push 0x414998
mov eax, dword [0x416548]
mov edx, 3
call fcn.004037b0
jmp 0x41494b
inc esi
dec ebx
jne 0x4148f3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41495f
mov eax, dword [ebp - 4]
call fcn.004025c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414989
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004034b8
ret
Function at 0x414b10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x414d0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004025a8
mov dword [ebp - 4], eax
mov eax, 0xc8
call fcn.004025a8
mov ebx, eax
mov byte [ebp - 0xd], 1
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
mov eax, dword [ebp - 4]
push eax
push esi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040364c
mov eax, dword [ebp - 0x14]
mov edx, 0x414d24
call fcn.00403800
je 0x414b81
mov byte [ebp - 0xd], 0
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.0040364c
mov eax, dword [ebp - 0x18]
mov edx, 0x414d34
call fcn.00403800
je 0x414baa
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
jne 0x414bcb
cmp dword [edi + 0x4c], 0
je 0x414cd7
mov eax, edi
call fcn.00414aa4
xor eax, eax
mov dword [edi + 0x4c], eax
jmp 0x414cd7
mov dword [edi + 0x4c], esi
push 0
push 0x414d40
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x414c14
push ebx
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.0040364c
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 0x414d54
call fcn.0040373c
lea eax, [edi + 0x44]
mov edx, dword [ebp - 8]
call fcn.004034e8
push 0
push 0x414d5c
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x414cd7
mov eax, dword [0x416440]
mov eax, dword [eax]
mov edx, 0x414d6c
call fcn.00403800
jne 0x414c75
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.0040364c
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 0x414d78
call fcn.0040373c
lea eax, [edi + 0x48]
mov edx, dword [ebp - 8]
call fcn.004034e8
jmp 0x414cd7
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_PostMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.0040364c
cmp dword [ebp - 0xc], 0
je 0x414cd7
lea eax, [edi + 0x30]
mov edx, dword [ebp - 0xc]
call fcn.004034e8
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, 0x414d78
call fcn.0040373c
lea eax, [edi + 0x48]
mov edx, dword [ebp - 8]
call fcn.004034e8
mov eax, dword [ebp - 4]
call fcn.004025c0
mov eax, ebx
call fcn.004025c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414d15
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004034b8
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004034b8
ret
Function at 0x415044
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x415229
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004025a8
mov dword [ebp - 8], eax
mov eax, 0xc8
call fcn.004025a8
mov dword [ebp - 4], eax
mov bl, 1
call sub.user32.dll_GetForegroundWindow
mov edi, eax
push 0xc8
mov eax, dword [ebp - 8]
push eax
push edi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040364c
mov eax, dword [ebp - 0x10]
mov edx, 0x415240
call fcn.00403800
je 0x4150af
xor ebx, ebx
push 0xc8
mov eax, dword [ebp - 4]
push eax
push edi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040364c
mov eax, dword [ebp - 0x14]
mov edx, 0x415250
call fcn.00403800
je 0x4150da
xor ebx, ebx
test bl, bl
jne 0x4150f9
cmp dword [esi + 0x3c], 0
je 0x4151fe
mov eax, esi
call fcn.00414fb8
xor eax, eax
mov dword [esi + 0x3c], eax
jmp 0x4151fe
mov dword [esi + 0x3c], edi
xor edx, edx
push ebp
push 0x4151f4
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x41525c
push 0
push edi
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4151ea
mov eax, dword [ebp - 4]
push eax
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040364c
lea eax, [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov edx, 0x41526c
call fcn.0040373c
push 0
push 0x41525c
push ebx
push edi
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4151ea
mov eax, dword [ebp - 4]
push eax
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040364c
lea eax, [esi + 0x38]
mov ecx, dword [ebp - 0xc]
mov edx, 0x415280
call fcn.0040373c
push 0
push 0x41525c
push ebx
push edi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4151ea
mov edx, dword [ebp - 4]
push edx
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040364c
lea eax, [esi + 0x34]
mov edx, 0x415294
call fcn.004034e8
mov edx, dword [ebp - 0xc]
mov eax, 0x4152a8
call fcn.00403980
test eax, eax
jg 0x4151ea
lea eax, [esi + 0x34]
mov edx, dword [ebp - 0xc]
call fcn.004036f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4151fe
mov eax, dword [ebp - 8]
call fcn.004025c0
mov eax, dword [ebp - 4]
call fcn.004025c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415230
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004034b8
ret
Function at 0x41552c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004038a4
xor eax, eax
push ebp
push 0x4156a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40ecd4]
call fcn.00402af4
mov ebx, eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040352c
lea eax, [ebp - 0x14c]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040ed28
mov eax, dword [ebp - 0x14c]
mov edx, 0x4156bc
call fcn.00403800
je 0x4155d6
push dword [ebp - 4]
push 0x4156bc
push 0x4156c8
lea eax, [ebp - 4]
mov edx, 3
call fcn.004037b0
lea eax, [ebp - 8]
mov ecx, 0x4156bc
mov edx, dword [ebp - 4]
call fcn.0040373c
jmp 0x4155e3
lea eax, [ebp - 4]
mov edx, 0x4156c8
call fcn.004036f8
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41567b
mov eax, dword [ebp - 0x148]
add eax, 0xfffffff0
sub eax, 8
jb 0x415615
add eax, 0xffffffe8
sub eax, 8
jae 0x415664
lea eax, [ebp - 0x11c]
cmp eax, 0x2e
je 0x415664
lea eax, [ebp - 0x11c]
cmp eax, 0x4156cc
je 0x415664
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004036c4
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 8]
call fcn.0040373c
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.KERNEL32.DLL_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x4155ff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4156ad
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.004034b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004034b8
ret
Function at 0x405124
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x4224e0], 0x44
push eax
xor eax, eax
push 0x4224e0
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40515f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4051e9
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00405498
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x40521d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423f68], eax
jmp 0x4053b1
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x40523b
test eax, eax
je 0x40535c
test byte [ebp + 0xc], 2
je 0x40535c
mov esi, 0x4214e0
push edi
push esi
call fcn.004058c4
test ebx, ebx
je 0x405258
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x40525e
push edi
call fcn.004053fe
cmp byte [edi], 0
jne 0x40526c
cmp byte [0x4214e0], 0x5c
jne 0x405277
push 0x40900c
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x405352
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.004053e2
cmp byte [eax], 0
je 0x4052bd
cmp byte [ebp - 0x18], 0
je 0x4052bd
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4052d3
mov al, byte [esi + 1]
test al, al
je 0x405331
cmp al, 0x2e
jne 0x4052d3
cmp byte [esi + 2], 0
je 0x405331
push esi
push ebx
call fcn.004058c4
test byte [ebp - 0x148], 0x10
je 0x4052f8
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405331
push dword [ebp + 0xc]
push edi
call fcn.004051e9
jmp 0x405331
push edi
call fcn.0040557c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405329
test byte [ebp + 0xc], 4
je 0x405321
push edi
push 0xfffffffffffffff1
call fcn.00404c62
push 0
push edi
call fcn.00405612
jmp 0x405331
inc dword [0x423f68]
jmp 0x405331
push edi
push 0xfffffffffffffff2
call fcn.00404c62
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40529b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x40535c
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4053b1
cmp dword [ebp - 8], esi
jne 0x405371
inc dword [0x423f68]
jmp 0x4053b1
push edi
call fcn.00405bbb
test eax, eax
je 0x4053b1
push edi
call fcn.004053b7
push edi
call fcn.0040557c
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4053a9
test byte [ebp + 0xc], 4
je 0x405369
push edi
push 0xfffffffffffffff1
call fcn.00404c62
push esi
push edi
call fcn.00405612
jmp 0x4053b1
push edi
push 0xffffffffffffffe5
call fcn.00404c62
pop edi
pop esi
leave
ret 8
Function at 0x405612
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405be2
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405636
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x40576f
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x422668], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422668
je 0x40567a
push 1
push 0
push esi
call fcn.0040559b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405775
cmp eax, edi
jg 0x405775
mov esi, 0x4220e0
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405775
cmp eax, edi
jg 0x405775
push esi
push ebp
push str._s_s_r_n
push 0x421ce0
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x423ef0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.004058e6
push 4
push 0xc0000000
push esi
call fcn.0040559b
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x40576f
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405768
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405768
cmp edi, dword [esp + 0x18]
jne 0x405768
push str._Rename__r_n
push esi
call fcn.00405510
test eax, eax
jne 0x40577c
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.004058c4
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x421ce0
push eax
call fcn.0040555c
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x423f70]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409390
push eax
call fcn.00405510
test eax, eax
je 0x405733
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x4057a3
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405798
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405735
Function at 0x402091
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov word [ebp - 3], 0x5c3a
add cl, 0x41
mov byte [ebp - 1], 0
push eax
mov byte [ebp - 4], cl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
sub eax, 1
je 0x4020e0
sub eax, 1
je 0x4020db
sub eax, 1
je 0x4020d7
sub eax, 1
je 0x4020d3
sub eax, 1
je 0x4020cf
xor eax, eax
leave
ret
push 6
jmp 0x4020dd
push 4
jmp 0x4020dd
push 3
jmp 0x4020dd
push 2
pop eax
leave
ret
xor eax, eax
inc eax
leave
ret
Function at 0x403212
Capabilities:
Get disk size
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, edx
mov word [ebp - 3], 0x5c3a
mov ebx, ecx
mov al, byte [edi]
mov byte [ebp - 4], al
xor eax, eax
push eax
push eax
mov byte [ebp - 1], al
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [ebp - 0xc]
mov ecx, 0x3d08fc00
cmp eax, ecx
jbe 0x403254
mov eax, ecx
cmp eax, dword [0x406960]
jge 0x403261
push 7
pop eax
jmp 0x4032b5
push esi
mov esi, dword [ebp + 8]
mov ecx, edi
mov edx, esi
call fcn.00403339
test eax, eax
jne 0x403276
push 4
jmp 0x4032b3
push esi
mov edx, edi
mov ecx, ebx
call fcn.0040357a
movzx ebx, ax
push 0xd
pop eax
cmp bx, ax
je 0x403299
mov edx, esi
mov ecx, edi
call fcn.004032bb
mov ax, bx
jmp 0x4032b4
push 3
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 3
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov byte [esi], 0x5c
push 0xd
pop eax
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x4032bb
Capabilities:
Delete directory
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov esi, ecx
mov dword [ebp - 4], 0x5c3a20
call fcn.00403a3c
mov al, byte [esi]
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
call dword [sym.imp.msvcrt.dll__chdir]
pop ecx
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor ebx, ebx
mov edi, ebx
push esi
call dword [sym.imp.msvcrt.dll__rmdir]
pop ecx
test eax, eax
je 0x40330b
inc edi
cmp edi, 0x4b0
jl 0x4032f6
mov edi, dword [ebp - 8]
push 0x80
push esi
mov byte [edi], bl
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.msvcrt.dll__rmdir]
pop ecx
test eax, eax
je 0x403331
inc ebx
cmp ebx, 0x4b0
jl 0x40331c
mov byte [edi], 0x5c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403339
Capabilities:
Create directory
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x406028]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
xor ebx, ebx
push edi
mov edx, 0xa0
mov edi, ecx
call fcn.00402125
mov dword [ebp - 0xac], eax
lea ecx, [edi + eax]
mov dword [ebp - 0xa8], ecx
movsx ecx, byte [edi]
sub ecx, 0x40
push ecx
call dword [sym.imp.msvcrt.dll__chdrive]
push edi
mov byte [esi], bl
call dword [sym.imp.msvcrt.dll__mkdir]
push ebx
push edi
mov byte [esi], 0x5c
call dword [sym.imp.msvcrt.dll__access]
mov esi, dword [ebp - 0xa8]
add esp, 0x10
jmp 0x40341f
push edi
call dword [sym.imp.msvcrt.dll__chdir]
pop ecx
test eax, eax
jne 0x4033f7
push edi
push 0x401244
lea eax, [ebp - 0xa4]
push 0xa0
push eax
call fcn.0040162e
add esp, 0x10
test eax, eax
js 0x40347c
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.msvcrt.dll__mktemp]
pop ecx
test eax, eax
je 0x4033f7
lea eax, [ebp - 0xa4]
push 0x401250
push eax
call dword [sym.imp.msvcrt.dll_fopen]
pop ecx
pop ecx
test eax, eax
jne 0x403440
inc ebx
cmp ebx, 9
jg 0x403468
push 0xa
mov eax, 0xa0
sub eax, dword [ebp - 0xac]
push eax
push esi
push ebx
call dword [sym.imp.msvcrt.dll__itoa_s]
push 0
push edi
call dword [sym.imp.msvcrt.dll__access]
add esp, 0x18
test eax, eax
je 0x40339f
push edi
call dword [sym.imp.msvcrt.dll__mkdir]
pop ecx
test eax, eax
jne 0x403468
push edi
call dword [sym.imp.msvcrt.dll__chdir]
xor eax, eax
pop ecx
inc eax
jmp 0x40346d
push eax
call dword [sym.imp.msvcrt.dll_fclose]
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.msvcrt.dll_remove]
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x40345f
mov byte [esi], 0
xor eax, eax
test ecx, ecx
sete al
jmp 0x40346d
mov byte [esi], 0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404bf0
leave
ret
call fcn.00402159
int3
Function at 0x403a3c
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, dword [0x406028]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push esi
push edi
push 1
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push dword [0x4063f0]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
push dword [0x4063f0]
mov esi, eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov edi, eax
test edi, edi
je 0x403bc3
jmp 0x403b54
mov edx, esi
mov ecx, edi
call fcn.00402125
mov ecx, dword [esp + 0xc]
mov edx, 0xa0
mov esi, eax
call fcn.00402125
inc eax
mov ecx, 0xa0
add eax, esi
cmp eax, ecx
jae 0x403bc3
push edi
push dword [esp + 0x10]
lea eax, [esp + 0xa8]
push 0x401144
push ecx
push eax
call fcn.0040162e
add esp, 0x14
test eax, eax
js 0x403bd8
push 0x4000
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x403b4d
xor esi, esi
lea eax, [esp + 0xa0]
push 0x80
push eax
call dword [sym.imp.msvcrt.dll__chmod]
pop ecx
pop ecx
test eax, eax
je 0x403b2a
call fcn.0040424e
inc esi
cmp esi, 0x4b0
jl 0x403b03
xor esi, esi
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.msvcrt.dll_remove]
pop ecx
test eax, eax
je 0x403b4d
call fcn.0040424e
inc esi
cmp esi, 0x4b0
jl 0x403b2c
mov esi, dword [esp + 0x10]
inc ebx
add edi, ebx
mov edx, esi
mov ecx, edi
call fcn.00402125
mov ebx, eax
test ebx, ebx
jne 0x403a98
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push dword [esp + 0xc]
lea eax, [esp + 0xa4]
push 0x401260
push 0xa0
push eax
call fcn.0040162e
add esp, 0x10
test eax, eax
js 0x403bd8
lea eax, [esp + 0xa0]
push 0x80
push eax
call dword [sym.imp.msvcrt.dll__chmod]
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.msvcrt.dll_remove]
add esp, 0xc
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404bf0
mov esp, ebp
pop ebp
ret
call fcn.00402159
int3