joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8c20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00407519
movzx eax, al
test eax, eax
je 0x4c8c3f
xor eax, eax
jmp 0x4c8c92
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00408055
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4c8c5e
xor eax, eax
jmp 0x4c8c92
mov ecx, dword [ebp - 4]
and ecx, 0x10
jne 0x4c8c7e
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00408055
push eax
call fcn.004c88b0
add esp, 4
jmp 0x4c8c92
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00408055
push eax
call fcn.004c77b0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x4ca680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0xffffffff
push 0
push 0
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4ca6c4
jmp 0x4ca6ff
mov dword [ebp - 0x10], 0
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4ca6f4
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0x10]
je 0x4ca6f8
jmp 0x4ca6ff
mov dword [ebp - 4], 1
cmp dword [ebp - 0xc], 0xffffffff
je 0x4ca70f
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cb600
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf1e6
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x507334]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x10], 0
mov word [ebp - 0x224], 0
push 0x206
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.00489f10
add esp, 0xc
lea eax, [ebp - 0x14]
call fcn.00409ac2
mov dword [ebp - 4], 0
push 1
push 0x23
lea ecx, [ebp - 0x224]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4cb723
push 0x104
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4cb6ab
jmp 0x4cb7aa
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040848a
lea edx, [ebp - 0x22c]
push edx
mov ecx, 1
lea eax, [ebp - 0x14]
call fcn.00408b77
mov dword [ebp - 0x280], eax
push 0x4e17f4
mov eax, dword [ebp - 0x280]
push eax
call fcn.00408c5f
add esp, 8
mov byte [ebp - 0x225], al
lea ecx, [ebp - 0x22c]
call fcn.004084c4
movzx ecx, byte [ebp - 0x225]
test ecx, ecx
je 0x4cb713
push 0x4e17f8
lea edx, [ebp - 0x14]
push edx
call fcn.00408995
push 0x4e17fc
lea eax, [ebp - 0x14]
push eax
call fcn.00408995
jmp 0x4cb78b
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.0040848a
lea eax, [ebp - 0x234]
push eax
mov ecx, 1
lea eax, [ebp - 0x14]
call fcn.00408b77
mov dword [ebp - 0x284], eax
push 0x4e1834
mov ecx, dword [ebp - 0x284]
push ecx
call fcn.00408c5f
add esp, 8
mov byte [ebp - 0x22d], al
lea ecx, [ebp - 0x234]
call fcn.004084c4
movzx edx, byte [ebp - 0x22d]
test edx, edx
je 0x4cb78b
push 0x4e1838
lea eax, [ebp - 0x14]
push eax
call fcn.00408995
push 0x4e183c
lea ecx, [ebp - 0x14]
push ecx
call fcn.00408995
lea eax, [ebp - 0x14]
call fcn.00408055
push eax
call fcn.004088b3
add esp, 4
lea eax, [ebp - 0x14]
mov esi, dword [ebp + 8]
call fcn.00408101
mov edx, dword [ebp - 0x238]
or edx, 1
mov dword [ebp - 0x238], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004084c4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0048f726
mov esp, ebp
pop ebp
ret
Function at 0x4cbc10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cef08
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x507334]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4e18d0
lea eax, [ebp - 0x20]
push eax
call fcn.0040826f
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x20019
call fcn.0040ae2d
cmp eax, 2
jne 0x4cbc7c
mov ecx, dword [ebp - 0x10]
or ecx, 0x100
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
call fcn.00408055
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4cbca9
cmp dword [ebp - 0x14], 0
jne 0x4cbcab
jmp 0x4cbd05
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x24]
push eax
push 0
push str.InstallDate
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4cbcec
cmp dword [ebp - 0x24], 4
je 0x4cbcee
jmp 0x4cbd05
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
mov dword [edx], eax
mov dword [ebp - 0x1c], 1
xor ecx, ecx
jne 0x4cbc66
cmp dword [ebp - 0x14], 0
je 0x4cbd1c
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004084c4
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4cc770
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ceac1
mov eax, dword fs:[0]
push eax
sub esp, 0x690
mov eax, dword [0x507334]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x228]
push edx
call fcn.0040826f
mov dword [ebp - 4], 0
lea eax, [ebp - 0x228]
call fcn.00409af9
cmp eax, 3
jl 0x4cc824
mov ecx, 3
lea edx, [ebp - 0x66c]
lea eax, [ebp - 0x228]
call fcn.00408bc7
mov dword [ebp - 0x698], eax
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x69c], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x69c]
lea edi, [ebp - 0x228]
call fcn.00407526
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x66c]
call fcn.004084c4
mov dword [ebp - 0x668], 0x104
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x444], 0x104
mov ecx, dword [ebp - 0x444]
push ecx
lea edx, [ebp - 0x664]
push edx
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x448]
push ecx
lea edx, [ebp - 0x44c]
push edx
mov eax, dword [ebp - 0x668]
push eax
lea ecx, [ebp - 0x43c]
push ecx
lea eax, [ebp - 0x228]
call fcn.00408055
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x4cc8cc
mov dword [ebp - 0x670], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.004084c4
mov eax, dword [ebp - 0x670]
jmp 0x4cc905
mov edx, dword [ebp - 0x44c]
push edx
push 0x4e0848
mov eax, dword [ebp + 8]
call fcn.00408eea
add esp, 8
mov dword [ebp - 0x674], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.004084c4
mov eax, dword [ebp - 0x674]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f726
mov esp, ebp
pop ebp
ret
Function at 0x4cde00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf9a1
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push esi
mov eax, dword [0x507334]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x20]
call fcn.004c8b40
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x4cde4c
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x4cde51
jmp 0x4cdf0c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4cde64
jmp 0x4cdf0c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.004c7340
test eax, eax
jne 0x4cde79
jmp 0x4cdf0c
lea eax, [ebp - 0x34]
call fcn.0044dc9f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x20]
call fcn.004c9570
test eax, eax
jne 0x4cdea3
mov byte [ebp - 4], 0
lea esi, [ebp - 0x34]
call fcn.0045272f
jmp 0x4cdf0c
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x3c], esp
lea edx, [ebp - 0x34]
push edx
call fcn.00483f40
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x38]
push eax
call fcn.004cdc60
add esp, 0x14
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x38]
call fcn.00409af9
push eax
lea eax, [ebp - 0x38]
call fcn.00408055
push eax
push 0x100
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048f23a
add esp, 0x10
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x38]
call fcn.004084c4
mov byte [ebp - 4], 0
lea esi, [ebp - 0x34]
call fcn.0045272f
xor edx, edx
jne 0x4cde3c
lea ecx, [ebp - 0x20]
call fcn.004c6930
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004c6b60
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x66403b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
sub esp, 0x3c
mov word [ebp - 0x1e], ax
test byte [0x66444720], 8
jne 0x66403b68
test si, si
je 0x66403ba3
movzx eax, si
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x1c], eax
lea esi, [esi]
movsx eax, byte [edi + esi]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlUpperChar]
movsx eax, al
sub esp, 4
add eax, esi
add esi, 1
xor ebx, eax
cmp esi, dword [ebp - 0x1c]
jne 0x66403b30
mov eax, ebx
xor edx, edx
div word [ebp - 0x1e]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
mov eax, edx
ret
movzx edx, cx
movzx eax, ax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._x___s___x_n
mov dword [esp + 8], str.ATOM_Hash
mov dword [esp + 4], 0x66444720
mov dword [esp], 3
call fcn.66403a70
test si, si
jne 0x66403b23
lea esp, [ebp - 0xc]
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret

Function at 0x66404a00
Capabilities:
Create thread

Disassembly:
mov eax, 1
xchg dword [0x66451018], eax
test eax, eax
je 0x66404a10
ret
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x66451024]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x664048b0
add eax, 0x400
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
leave
ret
Function at 0x66404a70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0x10ffff
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x3000
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
sub esp, 0x18
test eax, eax
jne 0x66404c04
mov eax, dword [ebp - 0x10]
cmp eax, 0x10000
jbe 0x66404bc0
test byte [0x66444740], 4
jne 0x66404bd8
mov ecx, eax
xor edx, edx
mov dword [0x66451028], ecx
mov dword [0x66451020], edx
mov dword [0x66451024], eax
mov dword [esp + 4], 0x664054d0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_AddVectoredExceptionHandler]
mov dword [0x6645101c], eax
mov eax, dword [0x66451024]
sub esp, 8
mov dword [esp + 0x10], 0x13
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10000
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.66408880
mov dword [esp + 0x10], 0x13
mov word [0x66451008], ax
mov eax, dword [0x66451024]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x100
mov dword [esp], 0
add eax, 0x400
mov dword [esp + 4], eax
call fcn.66408880
mov dword [esp + 0x10], 0x13
mov word [0x66451006], ax
mov eax, dword [0x66451028]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10000
mov dword [esp], 0
add eax, 0xf0000
mov dword [esp + 4], eax
call fcn.66408880
mov word [0x66451004], ax
mov eax, 1
leave
ret
xor ecx, ecx
mov edx, 0x10000
mov eax, 0xf0000
jmp 0x66404ae1
mov dword [esp + 0xc], str.First_megabyte_not_available_for_DOS_address_space._n
mov dword [esp + 8], str.DOSMEM_Init
mov dword [esp + 4], 0x66444740
mov dword [esp], 2
call fcn.66404960
mov eax, dword [ebp - 0x10]
jmp 0x66404add
test byte [0x66444740], 2
jne 0x66404c1a
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.Cannot_allocate_DOS_memory_n
mov dword [esp + 8], str.DOSMEM_Init
mov dword [esp + 4], 0x66444740
mov dword [esp], 1
call fcn.66404960
jmp 0x66404c0d
Function at 0x664056f0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov ebx, dword [0x6645100c]
test ebx, ebx
jne 0x664057ce
mov eax, dword [0x66451028]
test eax, eax
jne 0x664057da
lea eax, [ebp - 0xc]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x110000
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x664057da
mov esi, dword [0x66451028]
mov dword [esp + 8], 0x500
mov eax, dword [0x66451024]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.ucrtbase.dll_memcpy
movzx eax, word [0x66451008]
mov dword [esp + 4], 0
mov dword [0x66451024], esi
mov dword [esp], eax
call sym.krnl386.exe16_SetSelectorBase
movzx eax, word [0x66451006]
sub esp, 8
mov dword [esp + 4], 0x400
mov dword [esp], eax
call sym.krnl386.exe16_SetSelectorBase
mov edx, dword [0x66451028]
sub esp, 8
lea esi, [esi]
mov eax, ebx
shl eax, 8
or eax, 0x90cf00cd
mov dword [edx + ebx*4 + 0xf0000], eax
add ebx, 1
cmp ebx, 0x100
jne 0x664057a8
mov dword [0x6645100c], 1
lea esp, [ebp - 8]
mov eax, 1
pop ebx
pop esi
pop ebp
ret
test byte [0x66444740], 2
jne 0x664057f0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.Need_full_access_to_the_first_megabyte_for_DOS_mode_n
mov dword [esp + 8], str.DOSMEM_MapDosLayout
mov dword [esp + 4], 0x66444740
mov dword [esp], 1
call fcn.66404960
jmp 0x664057e3
Function at 0x66406db0
Capabilities:
Get common file path

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x11c]
push esi
push ebx
push ecx
sub esp, 0x138
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov dword [esp + 4], 0xfd
mov dword [esp], edi
mov dword [ebp - 0x12c], eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov esi, eax
sub esp, 8
add eax, 8
cmp ax, word [ebp - 0x12c]
jbe 0x66406e10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strcpy]
mov dword [esp], ebx
call sub.ucrtbase.dll_strlen
mov ecx, dword [0x66446ad4]
mov edx, dword [str.SYSTEM]
mov dword [ebx + eax + 4], ecx
mov dword [ebx + eax], edx
lea esp, [ebp - 0x10]
pop ecx
lea eax, [esi + 7]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
Function at 0x66408090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x20
mov eax, dword [eax + 0xb8]
mov dword [esp + 4], eax
movzx eax, word [ebx + 0xbc]
mov dword [esp], eax
call fcn.6642fb90
mov ecx, esi
mov byte [eax - 2], 0x9b
mov byte [eax - 1], cl
sub dword [ebx + 0xb8], 2
test byte [0x66444760], 8
jne 0x664080d8
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
movzx esi, cl
mov dword [esp + 0xc], str.Modified_code_in_FPU_int_call_to_0x9b_0x_x_n
mov dword [esp + 0x10], esi
mov dword [esp + 8], str.FPU_ModifyCode
mov dword [esp + 4], 0x66444760
mov dword [esp], 3
call fcn.66408000
add esp, 0x20
pop ebx
pop esi
pop ebp
ret

Function at 0x664085c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
shr ax, 3
movzx edx, dx
mov ebp, esp
push esi
movzx esi, ax
push ebx
add edx, esi
sub esp, 0x10
cmp edx, dword [0x66451524]
mov eax, dword [0x66451528]
jle 0x66408600
lea ebx, [edx + 0xff]
xor bl, bl
test eax, eax
je 0x66408610
cmp ebx, 0x2000
jg 0x66408650
mov eax, dword [0x66451528]
mov dword [0x66451524], ebx
shl esi, 4
add eax, esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 0x20000
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov dword [0x66451528], eax
test eax, eax
je 0x66408650
mov edx, dword [0x66444a20]
mov dword [edx], eax
jmp 0x664085ed
xor eax, eax
jmp 0x66408605

Function at 0x664089a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test ax, ax
jne 0x664089b8
mov eax, 1
pop ebp
ret
pop ebp
movzx eax, ax
jmp fcn.664086f0
Function at 0x664089d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 1
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
test bx, bx
jne 0x664089f0
add esp, 0x20
mov eax, ecx
pop ebx
pop esi
pop ebp
ret
mov esi, dword [0x66451524]
mov eax, ebx
shr ax, 3
movzx eax, ax
cmp eax, esi
jge 0x66408a78
mov edx, ebx
or edx, 7
test bl, 7
je 0x66408a50
shl eax, 4
add eax, dword [0x66451528]
xor ecx, ecx
cmp byte [eax + 0xf], 1
jne 0x664089e5
mov esi, dword [ebp + 0xc]
movzx edx, dx
mov dword [eax], esi
mov esi, dword [ebp + 0x10]
mov dword [eax + 4], esi
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], esi
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.66430140
add esp, 0x20
mov ecx, 1
pop ebx
mov eax, ecx
pop esi
pop ebp
ret
test byte [0x66444770], 4
jne 0x66408a90
lea edx, [ebx - 1]
mov eax, edx
shr ax, 3
movzx ebx, ax
xor ecx, ecx
cmp esi, ebx
jle 0x664089e5
movzx eax, ax
jmp 0x66408a0d
test byte [0x66444770], 4
jne 0x66408ac0
xor ebx, ebx
xor eax, eax
xor edx, edx
jmp 0x66408a65
mov dword [esp + 0xc], str.Program_attempted_invalid_selector_conversion_n
mov dword [esp + 8], str.GlobalHandleToSel16
mov dword [esp + 4], 0x66444770
mov dword [esp], 2
call fcn.66408660
mov esi, dword [0x66451524]
jmp 0x66408a59
movzx ebx, bx
mov dword [esp + 0xc], str.Invalid_handle_0x_04x_passed_to_GlobalHandleToSel__n
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov dword [esp + 8], str.GlobalHandleToSel16
mov dword [esp + 4], 0x66444770
mov dword [esp], 2
call fcn.66408660
mov esi, dword [0x66451524]
xor eax, eax
xor edx, edx
jmp 0x66408a65

Function at 0x66409130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov esi, dword [ebp + 8]
test byte [0x66444770], 8
jne 0x664091d8
mov eax, esi
shr ax, 3
movzx eax, ax
cmp eax, dword [0x66451524]
jge 0x66409190
shl eax, 4
add eax, dword [0x66451528]
xor ebx, ebx
mov edx, dword [eax]
test edx, edx
movzx edx, byte [eax + 0xc]
movzx eax, byte [eax + 0xe]
sete bl
shl ebx, 0xe
or ebx, edx
shl eax, 5
and ax, 0x100
or ebx, eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4
xor ebx, ebx
test byte [0x66444770], 4
je 0x66409184
movzx esi, si
mov dword [esp + 0xc], str.Invalid_handle_0x_04x_passed_to_GlobalFlags16__n
mov dword [esp + 0x10], esi
mov dword [esp + 8], str.GlobalFlags16
mov dword [esp + 4], 0x66444770
mov dword [esp], 2
call fcn.66408660
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4
movzx eax, si
mov dword [esp + 0xc], 0x66446f13
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.GlobalFlags16
mov dword [esp + 4], 0x66444770
mov dword [esp], 3
call fcn.66408660
jmp 0x6640914b
Function at 0x66409b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov ebx, dword [ebp + 8]
test bx, bx
je 0x66409ba0
mov eax, ebx
shr ax, 3
movzx eax, ax
cmp eax, dword [0x66451524]
jge 0x66409bb0
mov esi, ebx
or esi, 7
test bl, 7
je 0x66409bf0
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret 4
test byte [0x66444770], 4
je 0x66409ba0
movzx ebx, bx
mov dword [esp + 0xc], str.Invalid_handle_0x_04x_passed_to_GlobalHandleToSel__n
mov dword [esp + 0x10], ebx
mov dword [esp + 8], str.GlobalHandleToSel16
mov dword [esp + 4], 0x66444770
mov dword [esp], 2
call fcn.66408660
jmp 0x66409ba0
test byte [0x66444770], 4
jne 0x66409c10
lea esi, [ebx - 1]
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret 4
mov dword [esp + 0xc], str.Program_attempted_invalid_selector_conversion_n
mov dword [esp + 8], str.GlobalHandleToSel16
mov dword [esp + 4], 0x66444770
mov dword [esp], 2
call fcn.66408660
jmp 0x66409bf9
Function at 0x6640cd90
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, eax
push ebx
sub esp, 0x5c
mov dword [ebp - 0x1e], 0x3a0041
mov word [ebp - 0x1a], di
call fcn.6640cc30
mov ebx, eax
mov eax, esi
cmp al, 0x19
jbe 0x6640cdc0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x1e]
movzx eax, al
add word [ebp - 0x1e], ax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
sub esp, 4
mov dword [ebp - 0x3c], eax
cmp eax, 1
jbe 0x6640cdb5
lea eax, [ebp - 0x24]
mov dword [esp], edi
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x28]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceW]
sub esp, 0x14
test eax, eax
je 0x6640cdb5
mov eax, esi
movzx edi, al
imul edx, edi, 0x3d
add edx, ebx
mov byte [edx + 0x2b5], al
mov eax, dword [ebp - 0x2c]
mov byte [edx + 0x2b6], 0
mov byte [edx + 0x2ba], 0
mov word [edx + 0x2b7], ax
mov eax, dword [ebp - 0x30]
lea esi, [eax - 1]
mov ecx, esi
mov byte [edx + 0x2b9], cl
cmp eax, 1
jbe 0x6640ce68
mov edx, 1
lea esi, [esi]
shr eax, 1
mov esi, edx
add edx, 1
cmp eax, 1
jne 0x6640ce50
imul eax, edi, 0x3d
mov ecx, esi
mov byte [ebx + eax + 0x2ba], cl
imul ecx, edi, 0x3d
cmp dword [ebp - 0x3c], 3
mov edx, 0x200
lea eax, [ebx + ecx]
mov ebx, dword [ebp - 0x24]
mov word [eax + 0x2bf], dx
mov edx, dword [ebp - 0x28]
sete cl
xor esi, esi
lea ecx, [ecx*8 - 0x10]
mov dword [eax + 0x2bb], 0x2010000
mov byte [eax + 0x2cc], cl
xor ecx, ecx
mov byte [eax + 0x2c1], 0
mov word [eax + 0x2c2], bx
mov dword [eax + 0x2c4], 0x10001
mov dword [eax + 0x2c8], 0
mov byte [eax + 0x2cd], 0
mov dword [eax + 0x2ce], 0
mov word [eax + 0x2d2], cx
mov dword [eax + 0x2d4], edx
mov dword [eax + 0x2d8], 0xffff0000
mov dword [eax + 0x2dc], 0xffff
mov word [eax + 0x2e0], si
mov dword [eax + 0x2e2], ebx
mov dword [eax + 0x2e6], 0x20
mov dword [eax + 0x2ea], 0
mov dword [eax + 0x2ee], 0
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret