joyce8/EMBER2024-capa huggingface dataset:
Function at 0x565800
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x5f4d7c]
test eax, eax
je 0x56590a
movzx eax, byte [0x5f4d94]
test al, al
jne 0x5658fb
mov eax, dword [0x5f4d84]
mov esi, dword [0x5f4d80]
cmp esi, eax
jbe 0x565851
mov ecx, dword [0x5f4d98]
lea esi, [esi]
add eax, eax
lea edx, [ecx + 1]
cmp esi, eax
mov ecx, edx
ja 0x565840
mov dword [0x5f4d98], edx
lea eax, [esi + esi + 2]
xor edi, edi
mov dword [esp], eax
call fcn.0052a9a8
movzx ebx, word [0x5f4d84]
mov dword [0x5f4dbc], eax
mov edx, eax
mov esi, dword [0x5f4d80]
xor ecx, ecx
lea esi, [esi]
lea edi, [edi]
cmp ecx, ebx
jbe 0x565890
lea eax, [ebx + ebx]
movzx ebx, ax
lea eax, [edi + 1]
movzx edi, ax
mov word [edx], di
lea eax, [ecx + 1]
movzx ecx, ax
add edx, 2
cmp ecx, esi
jbe 0x565880
mov eax, dword [0x5f4d98]
shl eax, 4
mov dword [esp], eax
call fcn.0052a9a8
mov dword [0x5f4dac], eax
mov ebx, dword [0x613e08]
test ebx, ebx
jne 0x565963
xor esi, esi
cmp esi, dword [0x5f4d98]
jae 0x5658fb
lea esi, [esi]
mov dword [esp], 4
mov eax, dword [0x5f4dac]
mov ebx, esi
shl ebx, 4
inc esi
add ebx, eax
call fcn.0052a9a8
mov dword [ebx], eax
mov eax, dword [ebx]
mov dword [eax], 0
cmp esi, dword [0x5f4d98]
jb 0x5658d0
mov byte [0x5f4db0], 1
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.GLIBCXX_FORCE_NEW
mov eax, 8
mov edi, 0x1000
mov dword [0x5f4d7c], eax
mov eax, pe_nt_image_headers32
mov esi, 0xa
mov dword [0x5f4d80], eax
mov eax, 8
mov dword [0x5f4d84], eax
mov eax, 0xff0
mov dword [0x5f4d88], eax
mov dword [0x5f4d8c], edi
mov dword [0x5f4d90], esi
call sub.msvcrt.dll_getenv
test eax, eax
setne al
mov byte [0x5f4d94], al
jmp 0x56581d
mov eax, dword [0x5f4d8c]
mov ebx, 1
shl eax, 3
mov dword [esp], eax
call fcn.0052a9a8
cmp dword [0x5f4d8c], 1
mov dword [0x5f4da0], eax
jmp 0x5659ab
mov edx, dword [0x5f4da0]
lea eax, [ebx*8]
mov ecx, dword [0x5f4da0]
lea edx, [eax + edx]
add eax, ecx
mov dword [edx - 4], ebx
inc ebx
cmp dword [0x5f4d8c], ebx
mov dword [edx - 8], eax
ja 0x565986
mov eax, dword [0x5f4da0]
xor ecx, ecx
mov dword [eax + ebx*8 - 8], ecx
mov eax, dword [0x5f4da0]
mov dword [eax + ebx*8 - 4], ebx
mov dword [esp], 0x5f4da4
call fcn.00535088
mov dword [esp], 0x5f4d9c
mov edx, 0x565be0
mov dword [esp + 4], edx
call fcn.00534f98
mov dword [ebp - 0x10], 0
mov esi, dword [0x5f4d8c]
xor eax, eax
inc esi
cmp eax, dword [0x5f4d98]
jae 0x5658fb
lea edi, [esi*4]
lea esi, [esi]
lea edi, [edi]
mov dword [esp], edi
mov edx, dword [ebp - 0x10]
mov eax, dword [0x5f4dac]
shl edx, 4
lea ebx, [edx + eax]
call fcn.0052a9a8
mov dword [ebx], eax
mov dword [esp], edi
call fcn.0052a9a8
mov dword [ebx + 4], eax
mov dword [esp], edi
call fcn.0052a9a8
mov dword [ebx + 8], eax
mov dword [esp], 8
call fcn.0052a9a8
mov dword [ebx + 0xc], eax
mov dword [esp], eax
call fcn.00535088
xor edx, edx
jmp 0x565a7e
mov eax, dword [ebx]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 4]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 8]
mov dword [eax + edx*4], 0
inc edx
cmp edx, esi
jb 0x565a60
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x5f4d98]
jb 0x565a10
jmp 0x5658fb
Function at 0x402010
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0043fc04

Function at 0x402e10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x402e39
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402e4f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402e46
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402e82
nop
cmp esi, ecx
jae 0x402e46
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402e70
cmp esi, ecx
jae 0x402e46
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4149e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ad77e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x620024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x414b9f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, 0x5f42ac
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x414a51
movzx eax, ax
push eax
call fcn.00403130
jmp 0x414a5d
push 3
push 0x5f42ac
call fcn.00402d30
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ecx, ecx
mov ebx, eax
mov dword [ebp - 0x14], ecx
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x414ba9
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x18], 1
test ebx, ebx
je 0x414b63
xor eax, eax
test bl, 1
je 0x414b54
mov edi, dword [esi - 0xc]
test edi, edi
jle 0x414b95
cmp dword [esi - 4], 1
jle 0x414aca
push edi
lea ecx, [ebp - 0x10]
call fcn.00402f30
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
add eax, 0x41
mov word [esi], ax
cmp edi, dword [esi - 8]
jg 0x414b95
xor eax, eax
mov dword [esi - 0xc], edi
push esi
mov word [esi + edi*2], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x414b51
cmp dword [esi - 0xc], 0
jl 0x414b95
mov edx, dword [ebp + 8]
movzx eax, word [esi]
mov dword [ebp - 0x20], eax
mov eax, dword [edx]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + 1]
test edi, edi
js 0x414b95
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or eax, ecx
jge 0x414b30
push edi
mov ecx, edx
call fcn.00403000
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov word [eax + ecx*2], si
mov eax, dword [edx]
mov esi, dword [ebp - 0x10]
cmp edi, dword [eax - 8]
jg 0x414b95
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [edx]
mov word [eax + edi*2], cx
mov eax, dword [ebp - 0x14]
inc eax
shr ebx, 1
mov dword [ebp - 0x14], eax
jne 0x414aa1
mov edi, dword [ebp + 8]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x414b7f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
int3
Function at 0x4176e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5adbb0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x620024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 1
push 0x44
push dword [edi]
call fcn.0044c4b5
test eax, eax
je 0x417722
mov eax, dword [edi]
push 1
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, edi
call fcn.00417890
lea ecx, [edi + 0x208]
call fcn.0044c414
mov eax, dword [edi + 0x202]
test eax, eax
je 0x41777e
push fcn.00401e00
lea esi, [eax - 4]
mov dword [ebp - 4], 0
push dword [esi]
push 0xae
push eax
call fcn.0058629d
imul eax, dword [esi], 0xae
add eax, 4
push eax
push esi
call fcn.0058628f
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov dword [edi + 0x202], 0
xorps xmm0, xmm0
or esi, 0xffffffff
movq qword [edi + 0x1fa], xmm0
mov eax, esi
mov dword [edi + 0x202], 0
mov edx, dword [edi + 0x1c0]
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4177b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [edi + 0x1a0]
call fcn.0044c50a
lea ecx, [edi + 0x18c]
call fcn.0044c50a
lea ecx, [edi + 0xb8]
call fcn.00401e00
lea ecx, [edi + 0x68]
mov dword [edi + 0x9c], 0x3a0020
mov dword [edi + 0xa0], 0x5c
mov byte [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0x200
mov byte [edi + 0xb0], 0
call fcn.0044c50a
lea ecx, [edi + 0x54]
call fcn.0044c50a
mov edx, dword [edi + 0x50]
sub edx, 0x10
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x417832
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [edi + 0x3c]
call fcn.0044c414
lea ecx, [edi + 0x34]
call fcn.0044c414
lea ecx, [edi + 0x2c]
call fcn.0044c414
lea ecx, [edi + 0x24]
call fcn.0044c414
lea eax, [edi + 0xc]
mov dword [edi + 4], vtable.CCriticalSection.0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [edi + 4]
call fcn.0044c317
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x417d00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5add52
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x620024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x270], 0
mov byte [ebp - 0x261], 1
call fcn.00403880
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x268]
mov edx, dword [eax - 0xc]
lea ecx, [edx - 1]
test ecx, ecx
js 0x417ec1
cmp ecx, edx
jg 0x417ec1
cmp word [eax + ecx*2], 0x5c
je 0x417d8d
push 1
push 0x5f4568
lea ecx, [ebp - 0x268]
call fcn.00405b30
mov eax, dword [ebp - 0x268]
mov byte [ebp - 4], 1
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x417da3
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x417db9
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x417ecb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x268]
push 1
push 0x5f5268
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.00416370
mov esi, dword [ebp - 0x26c]
lea eax, [ebp - 0x260]
add esp, 0x14
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
or ebx, 0xffffffff
mov byte [ebp - 4], 0
mov edi, eax
add esi, 0xfffffff0
mov ecx, ebx
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x417e25
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp edi, 0xffffffff
je 0x417e7d
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x260], 0x10
je 0x417e6f
cmp word [ebp - 0x234], 0x2e
jne 0x417e6f
mov ax, word [ebp - 0x232]
test ax, ax
je 0x417e5f
cmp ax, 0x2e
jne 0x417e6f
cmp word [ebp - 0x230], 0
jne 0x417e6f
lea eax, [ebp - 0x260]
push eax
push edi
call esi
test eax, eax
jne 0x417e30
jmp 0x417e76
mov byte [ebp - 0x261], 0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x417e9f
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, byte [ebp - 0x261]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00586281
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00403300
push 0x80004005
call fcn.00403300
int3
Function at 0x41a2e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ae1cd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x620024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0
push dword [0x62b89c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41a336
mov eax, 0xfffffff4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
mov ecx, edi
call fcn.00418280
test eax, eax
jns 0x41a362
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [eax + 0x38]
call edi
mov eax, dword [ebp - 0x14]
push dword [eax + 0x28]
call edi
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
push 1
add eax, 4
push eax
call fcn.0044c3e1
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x206], 0
je 0x41a3a8
push dword [eax + 0x20c]
call edi
lea ecx, [ebp - 0x24]
call fcn.0044c483
mov eax, dword [ebp - 0x14]
push 0x1d4c0
push dword [eax + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41a41f
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
call fcn.0044c45b
mov eax, dword [ebp - 0x14]
push 1
push 0x44
push dword [eax]
call fcn.0044c4b5
test eax, eax
je 0x41a417
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x41a417
cmp dword [ebp - 0x18], 0x103
jne 0x41a417
mov eax, dword [ebp - 0x14]
push 0xffffffffffffffff
mov eax, dword [eax]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 0x14]
push dword [eax + 0x40]
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
call fcn.0044c45b
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0044c483
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ba40
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x620024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push dword [0x62b89c]
mov si, dx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41ba81
mov eax, 0xfffffff4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00586281
mov esp, ebp
pop ebp
ret
movzx eax, si
push eax
push edi
call fcn.0044c4c4
test eax, eax
jne 0x41baa4
mov eax, 0xfffffffe
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00586281
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
push edi
call esi
push 0x2000
push edi
call esi
cmp byte [0x62b64e], 0
je 0x41badd
push ecx
lea edx, [ebp - 0x218]
mov ecx, edi
call fcn.00417b70
add esp, 4
lea eax, [ebp - 0x218]
push eax
jmp 0x41bade
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
dec eax
pop esi
call fcn.00586281
mov esp, ebp
pop ebp
ret
Function at 0x41bd60
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 0
push dword [0x62b89c]
mov si, dx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41bd8c
mov eax, 0xfffffff4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, si
push eax
push ebx
call fcn.0044c4c4
test eax, eax
jne 0x41bda6
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push 1
push 8
push esi
call fcn.0044c4b5
test eax, eax
jne 0x41bdc3
mov eax, 0xfffffffc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
mov dword [esi], 0
push eax
lea eax, [ebp - 0x24]
mov dword [esi + 4], 0
push eax
lea eax, [ebp - 0x2c]
or edi, 0xffffffff
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x41be00
mov eax, dword [ebp - 0x1c]
xor edi, edi
mov ecx, dword [ebp - 0x18]
mov dword [esi], eax
mov eax, edi
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x41be2c
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0xc]
mul dword [ebp - 0x10]
xor edi, edi
mov dword [esi + 4], edx
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e4f0
Capabilities:
Empty the recycle bin
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x620024]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x41e602
mov eax, dword [ecx]
push ebx
push esi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x18], 0x14
mov byte [ebp - 0x19], 1
test ebx, ebx
je 0x41e5c4
push edi
nop
push 3
push 0x5f42ac
lea ecx, [ebp - 0x20]
call fcn.00402d30
mov esi, dword [ebp - 0x20]
test bl, 1
je 0x41e5b5
mov edi, dword [esi - 0xc]
test edi, edi
jle 0x41e5f8
cmp dword [esi - 4], 1
jle 0x41e574
push edi
lea ecx, [ebp - 0x20]
call fcn.00402f30
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
add eax, 0x41
mov word [esi], ax
cmp edi, dword [esi - 8]
jg 0x41e5f8
xor eax, eax
mov dword [esi - 0xc], edi
push esi
mov word [esi + edi*2], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x41e5b5
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHQueryRecycleBinW]
test eax, eax
jne 0x41e5b5
mov eax, dword [ebp - 0xc]
or eax, dword [ebp - 8]
je 0x41e5b5
xor al, al
mov byte [ebp - 0x19], al
jmp 0x41e5b8
mov al, byte [ebp - 0x19]
inc dword [ebp - 0x24]
shr ebx, 1
jne 0x41e540
pop edi
test al, al
je 0x41e5d0
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41e5e8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00586281
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00403300
push 0x80004005
call fcn.00403300
int3
Function at 0x4266b0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x620024]
xor eax, esp
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x10], 0x107bc
push esi
mov dword [esp + 0x1c], eax
mov esi, ecx
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], 0x10000
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x42672d
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x42672d
lea eax, [esp + 4]
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x42672d
mov al, 1
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00586281
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x24]
xor al, al
pop esi
xor ecx, esp
call fcn.00586281
mov esp, ebp
pop ebp
ret
Function at 0x428bf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
call ebx
mov edi, eax
mov dword [ebp - 4], edi
call ebx
sub eax, edi
cmp eax, esi
jae 0x428c63
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call esi
test eax, eax
je 0x428c55
lea eax, [ebp - 0x24]
push eax
call edi
lea eax, [ebp - 0x24]
push eax
call ebx
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call esi
test eax, eax
jne 0x428c37
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x428c25
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4298c0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x620024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x64
lea eax, [ebp - 0x68]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.00588550
push 0x100
lea eax, [ebp - 0x168]
push 0
push eax
call fcn.00588550
add esp, 0x18
mov dword [ebp - 0x170], 0x64
lea eax, [ebp - 0x174]
mov dword [ebp - 0x16c], 0x100
push eax
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x42994d
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00586281
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x68]
push eax
push 0xf0000000
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00586281
mov esp, ebp
pop ebp
ret
Function at 0x42bcd0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x62b64e], 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov dword [esi], 0
mov dword [edi], 0x200
je 0x42bd4c
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp + 8], 0
push eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x42bd3f
mov eax, dword [ebp + 8]
mov dword [edi], eax
imul eax, dword [ebp - 4]
pop edi
test eax, eax
mov dword [esi], eax
pop esi
setne al
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
test eax, eax
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret
push edi
call fcn.00425960
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42bd60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x620024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.00588550
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x42be3b
lea eax, [ebp - 0x20c]
push str.FAT32
push eax
call fcn.0058f7fd
add esp, 8
test eax, eax
jne 0x42bdde
mov byte [esi + 8], 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00586281
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push 0x5f66a8
push eax
call fcn.0058f7fd
add esp, 8
test eax, eax
jne 0x42be0b
mov byte [esi + 8], 1
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00586281
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push str.NTFS
push eax
call fcn.0058f7fd
add esp, 8
neg eax
sbb al, al
and al, 0xfb
add al, 5
mov byte [esi + 8], al
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00586281
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00586281
mov esp, ebp
pop ebp
ret