joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465bdc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4bbbec]
cmp dword [eax + 0x30], 0
je 0x465c86
cmp dword [ebx + 0x94], 0
jne 0x465c80
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x465b6c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x465c80
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x465c46
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x465c80
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419094
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x465c55
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4667e8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46681d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404b00
jmp 0x46682a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404a64
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x467934
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x467975
mov eax, esi
call fcn.0044dd6c
test al, al
je 0x467975
mov eax, dword [ebx + 0x84]
call fcn.0044da68
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x467975
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044da68
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x468684
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415d98]
call fcn.004053f0
xor eax, eax
push ebp
push 0x4687c8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4b8fc0], 0
jne 0x4686d7
mov ecx, dword [0x4ba10c]
mov dl, 1
mov eax, dword [0x407fc0]
call fcn.0040cd6c
call fcn.004043c8
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403368
mov eax, ebx
call fcn.004052a0
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4687d8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004064c8
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004052b0
test eax, eax
jle 0x46876f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x468768
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404c98
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404c80
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408e18
test eax, eax
jne 0x468768
mov ebx, 0x15
jmp 0x468774
mov ebx, 0x10
jmp 0x468774
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4b8fc0]
call fcn.004685dc
mov eax, dword [ebp - 8]
call fcn.004685dc
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004064e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4687cf
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404a34
lea eax, [ebp - 0x10]
mov edx, dword [0x415d98]
call fcn.004054c0
ret
Function at 0x46b860
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x46b9e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.0046b540
mov eax, ebx
call fcn.00423400
dec al
je 0x46b8a4
dec al
je 0x46b8aa
jmp 0x46b8b0
mov byte [ebp - 0x77], 2
jmp 0x46b8b4
mov byte [ebp - 0x77], 1
jmp 0x46b8b4
mov byte [ebp - 0x77], 0
mov eax, dword [ebp - 0x8c]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0x8c], eax
mov eax, ebx
call fcn.0042338c
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0x84], eax
mov eax, ebx
call fcn.004233c8
test al, 1
je 0x46b900
or dword [ebp - 0x88], 1
mov eax, ebx
call fcn.004233c8
test al, 2
je 0x46b912
or dword [ebp - 0x88], 2
mov eax, ebx
call fcn.004233c8
test al, 4
je 0x46b924
or dword [ebp - 0x88], 4
mov eax, ebx
call fcn.004233c8
test al, 8
je 0x46b936
or dword [ebp - 0x88], 8
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.00423318
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x76]
mov ecx, 0x20
call fcn.00409bc8
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x46b969
cmp edi, 0x20000000
jne 0x46b975
mov dword [ebp - 0x88], 0x40000000
jmp 0x46b97f
mov eax, edi
call fcn.00422c48
mov dword [ebp - 0x7c], eax
or dword [ebp - 0x8c], 0x8000000
mov eax, ebx
call fcn.00423430
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x3c]
push eax
push 0x3c
mov eax, ebx
call fcn.0042311c
push eax
call sub.gdi32.dll_GetObjectA
test eax, eax
je 0x46b9bc
or dword [ebp - 0x8c], 0x400000
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x56], ax
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.0046b5ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b9e9
lea eax, [ebp - 0x94]
call fcn.00404a10
ret
Function at 0x478630
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x478890
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x478693
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004780f8
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d6b4
cmp al, 1
jne 0x478693
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00478410
test al, al
je 0x47881f
cmp dword [ebp - 8], 0
jge 0x4786b1
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004780f8
mov eax, dword [ebp - 0x210]
call fcn.00404cd0
cmp ebx, eax
jge 0x4786fb
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004780f8
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4ba8a8]
and eax, 0xff
bt dword [edx], eax
jae 0x4786fb
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x47870f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0047860c
cmp ebx, dword [ebp - 8]
je 0x478811
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x47873b
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403e38
and eax, 0x7f
movzx eax, word [eax*2 + 0x4b914c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4787fe
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403e38
and eax, 0x7f
movzx eax, word [eax*2 + 0x4b914c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0044da68
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403e38
and eax, 0x7f
movzx eax, word [eax*2 + 0x4b914c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044da68
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478805
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x478872
cmp dword [ebp - 8], 0
jge 0x47882a
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004780f8
mov eax, dword [ebp - 0x218]
call fcn.00404cd0
cmp eax, dword [ebp - 8]
jg 0x478864
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004780f8
mov eax, dword [ebp - 0x21c]
call fcn.00404cd0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047860c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478897
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404a34
ret
Function at 0x499e58
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x499e60
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49a052
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x49a068
mov eax, esi
call fcn.00497ce4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404a64
lea ecx, [ebp - 0x10]
mov edx, 0x49a07c
mov eax, esi
call fcn.00497ce4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404a64
lea ecx, [ebp - 0x14]
mov edx, 0x49a094
mov eax, esi
call fcn.00497ce4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404a64
lea ecx, [ebp - 0x18]
mov edx, 0x49a0b0
mov eax, esi
call fcn.00497ce4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404a64
lea ecx, [ebp - 0x1c]
mov edx, 0x49a0cc
mov eax, esi
call fcn.00497ce4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404a64
lea ecx, [ebp - 0x24]
mov edx, 0x49a0e4
mov eax, esi
call fcn.00497ce4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408e88
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409400
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x49a0fc
mov eax, esi
call fcn.00497ce4
mov eax, dword [ebp - 0x28]
call fcn.004917bc
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x49a10c
mov eax, esi
call fcn.00497ce4
mov eax, dword [ebp - 0x2c]
call fcn.004917bc
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x49a124
mov eax, esi
call fcn.00497ce4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409400
inc eax
je 0x499ff5
lea ecx, [ebp - 0x34]
mov edx, 0x49a124
mov eax, esi
call fcn.00497ce4
mov eax, dword [ebp - 0x34]
call fcn.004093c4
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040aaf4
fstp qword [ebp - 0x3c]
wait
call fcn.0040ae84
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x49a010
lea ecx, [ebp - 0x40]
mov edx, 0x49a124
mov eax, esi
call fcn.00497ce4
mov eax, dword [ebp - 0x40]
call fcn.004917bc
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x49a134
mov eax, esi
call fcn.00497ce4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404a64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a059
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404a34
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404a34
ret
Function at 0x4a0de4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4a0e3e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004a0dd4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00490428
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00490028
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0e45
lea eax, [ebp - 4]
call fcn.00404a10
ret

Function at 0x4a97ec
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ec0
xor eax, eax
push ebp
push 0x4a9959
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 1]
push eax
lea eax, [ebx + 0x509f8]
mov ecx, 1
mov edx, dword [0x4a801c]
call fcn.00405e04
add esp, 4
mov ecx, ebx
mov dl, 1
mov eax, dword [0x431b84]
call fcn.00432d68
mov edi, eax
mov eax, dword [ebx + 0x509f8]
mov dword [eax + esi*4], edi
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00447248
mov edx, dword [ebp + 8]
add edx, 2
mov eax, dword [ebx + 0x509f8]
mov eax, dword [eax + esi*4]
call fcn.00446988
mov edx, dword [ebp + 0xc]
add edx, 2
mov eax, dword [ebx + 0x509f8]
mov eax, dword [eax + esi*4]
call fcn.004469ac
mov edx, dword [ebx + 0x50a00]
sub edx, 4
mov eax, dword [ebx + 0x509f8]
mov eax, dword [eax + esi*4]
call fcn.004469d4
xor edx, edx
mov eax, dword [ebx + 0x3a0]
call fcn.004808c0
mov edx, eax
mov eax, dword [ebx + 0x509f8]
mov eax, dword [eax + esi*4]
call fcn.004469f8
mov eax, dword [ebx + 0x3a0]
mov edx, dword [eax + 0x30]
mov eax, dword [ebx + 0x509f8]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [ebx + 0x3a0]
mov edx, dword [eax + 0x240]
mov eax, dword [ebx + 0x509f8]
mov eax, dword [eax + esi*4]
call fcn.004473b8
mov eax, dword [ebx + 0x509f8]
mov eax, dword [eax + esi*4]
mov dl, 1
call fcn.00447138
mov eax, dword [ebx + 0x509f8]
mov eax, dword [eax + esi*4]
xor edx, edx
call fcn.00433190
mov eax, dword [ebx + 0x509f8]
mov eax, dword [eax + esi*4]
mov dl, 1
call fcn.00447368
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x509f8]
mov eax, dword [eax + esi*4]
call fcn.00447218
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x509f8]
mov eax, dword [eax + esi*4]
add eax, 0x80
call fcn.00404a64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9960
lea eax, [ebp - 8]
call fcn.00404a10
lea eax, [ebp - 4]
call fcn.00404a10
ret
Function at 0x4a996c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ec0
xor eax, eax
push ebp
push 0x4a9abe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 1]
push eax
lea eax, [ebx + 0x509fc]
mov ecx, 1
mov edx, dword [0x4a803c]
call fcn.00405e04
add esp, 4
mov ecx, ebx
mov dl, 1
mov eax, dword [0x43b8f4]
call fcn.0043f350
mov edi, eax
mov eax, dword [ebx + 0x509fc]
mov dword [eax + esi*4], edi
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00447248
mov edx, dword [ebp + 8]
add edx, 2
mov eax, dword [ebx + 0x509fc]
mov eax, dword [eax + esi*4]
call fcn.00446988
mov edx, dword [ebp + 0xc]
add edx, 2
mov eax, dword [ebx + 0x509fc]
mov eax, dword [eax + esi*4]
call fcn.004469ac
xor edx, edx
mov eax, dword [ebx + 0x3a0]
call fcn.004808a0
mov edx, dword [ebx + 0x50a00]
sub edx, 4
sub edx, eax
mov eax, dword [ebx + 0x509fc]
mov eax, dword [eax + esi*4]
call fcn.004469d4
xor edx, edx
mov eax, dword [ebx + 0x3a0]
call fcn.004808c0
mov edx, eax
mov eax, dword [ebx + 0x509fc]
mov eax, dword [eax + esi*4]
call fcn.004469f8
mov eax, dword [ebx + 0x3a0]
mov edx, dword [eax + 0x30]
mov eax, dword [ebx + 0x509fc]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [ebx + 0x509fc]
mov eax, dword [eax + esi*4]
mov dl, 1
call fcn.00447138
mov eax, dword [ebx + 0x509fc]
mov eax, dword [eax + esi*4]
mov dl, 1
call fcn.00447368
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x509fc]
mov eax, dword [eax + esi*4]
call fcn.00447218
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x509fc]
mov eax, dword [eax + esi*4]
add eax, 0x80
call fcn.00404a64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9ac5
lea eax, [ebp - 8]
call fcn.00404a10
lea eax, [ebp - 4]
call fcn.00404a10
ret
Function at 0x4aac00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4aadaf
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov ebx, 1
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x42]
call fcn.00404bf8
lea eax, [ebp - 0x24]
mov edx, 0x4aadc8
call fcn.00404cd8
mov eax, dword [ebp - 0x24]
call fcn.00404ed0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4aacc6
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x42]
call fcn.00404bf8
lea eax, [ebp - 0x28]
mov edx, 0x4aadc8
call fcn.00404cd8
mov eax, dword [ebp - 0x28]
call fcn.00404ed0
lea ecx, [ebp - 8]
lea edx, [ebp - 0x10]
call fcn.004a931c
cmp dword [ebp - 0xc], 0
jne 0x4aaca9
cmp dword [ebp - 0x10], 0x200000
jbe 0x4aacc6
jmp 0x4aacab
jle 0x4aacc6
fild qword [ebp - 0x10]
fdiv dword [0x4aadcc]
call fcn.00402c60
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
lea eax, [ebp - 0x2c]
lea edx, [ebx + 0x42]
call fcn.00404bf8
lea eax, [ebp - 0x2c]
mov edx, 0x4aadc8
call fcn.00404cd8
mov eax, dword [ebp - 0x2c]
call fcn.00404ed0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
je 0x4aad00
cmp esi, 0xf
jg 0x4aad00
inc ebx
cmp ebx, 0x15
jne 0x4aac42
cmp esi, 0xf
jle 0x4aad14
lea eax, [ebp - 0x1c]
mov edx, 0x4aadd8
call fcn.00404aa8
jmp 0x4aad23
lea ecx, [ebp - 0x1c]
mov edx, 1
mov eax, esi
call fcn.0040936c
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 0x20]
mov eax, 6
call fcn.00409394
mov eax, dword [ebp - 0x20]
call fcn.00404cd0
cmp eax, 0xf
jle 0x4aad52
lea eax, [ebp - 0x1c]
mov edx, 0x4aadd8
call fcn.00404cd8
jmp 0x4aad72
mov eax, dword [ebp - 0x20]
call fcn.00404cd0
lea ecx, [ebp - 0x30]
mov edx, 1
call fcn.0040936c
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x1c]
call fcn.00404cd8
push 0x4aade4
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404d90
mov eax, edi
mov edx, dword [ebp - 0x1c]
call fcn.00404a64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aadb6
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00404a34
ret
Function at 0x4ab38c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ab476
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ab459
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ab426
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.004685dc
lea eax, [ebp - 8]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004685dc
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4ab414
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404c80
jmp 0x4ab41c
mov eax, dword [ebp - 4]
call fcn.00404a10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ab438
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab460
cmp dword [ebp - 8], 0
je 0x4ab458
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
Function at 0x4b1adc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ec0
xor eax, eax
push ebp
push 0x4b1c2d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004b19b8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004099b4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00409980
cmp dword [ebp - 0xc], 0
je 0x4b1bc8
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00408c74
mov edx, dword [ebp - 0x14]
mov eax, 0x4b1c44
call fcn.00405014
test eax, eax
jg 0x4b1b66
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00408c74
mov edx, dword [ebp - 0x18]
mov eax, 0x4b1c54
call fcn.00405014
test eax, eax
jle 0x4b1b97
push 3
mov eax, dword [ebp - 0x10]
call fcn.00404ed0
push eax
mov eax, dword [ebp - 4]
call fcn.00404ed0
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404ed0
push eax
push 0x4b1c5c
mov eax, ebx
call fcn.0044da68
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b1c12
push 3
mov eax, dword [ebp - 0x10]
call fcn.00404ed0
push eax
mov eax, dword [ebp - 4]
call fcn.00404ed0
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404ed0
push eax
push 0x4b1c5c
mov eax, ebx
call fcn.0044da68
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b1c12
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00408c74
mov edx, dword [ebp - 0x1c]
mov eax, 0x4b1c44
call fcn.00405014
test eax, eax
jne 0x4b1bf4
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4b1c44
call fcn.00404d1c
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404ed0
push eax
push 0
mov eax, ebx
call fcn.0044da68
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1c34
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404a34
ret
Function at 0x403968
Capabilities:
Terminate process

Disassembly:
jmp 0x456a69
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x456a7a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405f83
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403aa3
Capabilities:
Query environment variable

Disassembly:
jmp 0x4ac7c2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4ac7d3
pop esi
ret
push ebx
push edi
push esi
call fcn.004ac6a9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0040440d
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4ac7fb
push ebx
push esi
push edi
call fcn.00405d49
add esp, 0xc
push 0
call fcn.004069ba
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x405e20
Capabilities:
Parse pe header

Disassembly:
jmp 0x445c2b
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x445c6a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x445c6a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x445c6a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x445c6a
cmp dword [ecx + 0x74], 0xe
jbe 0x445c6a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret