joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x4100b4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x409100
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x4100b4]
movzx eax, al
bt eax, esi
jae 0x409160
mov ecx, dword [0x4100a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x409005
test byte [0x40a028], 8
jne 0x4090a0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x40a038], 8
jne 0x409050
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x408fd4
cmp esi, 3
jbe 0x409010
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x40de9c]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x408fd4
mov ecx, dword [0x4100b4]
test ecx, ecx
je 0x409140
mov dword [esp], 0x40a038
call dword [0x4100b4]
test al, 8
je 0x408fab
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x408fab
mov ebx, dword [0x4100b4]
test ebx, ebx
je 0x409120
mov dword [esp], 0x40a028
call dword [0x4100b4]
test al, 8
je 0x408f96
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x408f9e
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4100b4
call sym._load_func.part.0
jmp 0x408f5d
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4100b4
call sym._load_func.part.0
jmp 0x4090aa
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4100b4
call sym._load_func.part.0
jmp 0x40905e
mov eax, 0xffffffff
jmp 0x409005
Function at 0x4092c0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x403ea6
Capabilities:
Delete registry value

Disassembly:
push ebx
push ecx
push ebp
push esi
push edi
mov esi, esp
sub esp, 0x24
mov eax, esp
mov edx, eax
add edx, 0x24
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x403eb7
mov eax, dword [esi + 0x18]
mov dword [esp], eax
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 4]
call fcn.0040b3f9
mov edx, dword [esi + 0x20]
lea ecx, [esp + 8]
call fcn.0040b3f9
mov edx, dword [esi + 0x24]
lea ecx, [esp + 0xc]
call fcn.0040b3f9
push dword [0x415e80]
push 1
mov eax, dword [esp + 0xc]
call fcn.0040b00a
inc dword [0x415e80]
mov edx, 0x4110ab
pop ecx
mov dword [0x415e80], ecx
call fcn.0040b458
je 0x403f41
push dword [0x415e80]
mov eax, dword [esp + 8]
call fcn.0040b047
mov ebx, eax
dec ebx
push ebx
mov eax, dword [esp + 0xc]
call fcn.0040b0b5
lea ecx, [esp + 8]
pop edx
call fcn.0040b38c
push dword [esp + 0xc]
mov edx, 0x4110b2
pop ecx
call fcn.0040b458
je 0x403f74
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegOpenKeyExA
mov dword [esp + 0x10], eax
jmp 0x403faa
lea eax, [esp + 0x1c]
push eax
push dword [esp + 4]
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegConnectRegistryA
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push dword [esp + 0x10]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegOpenKeyExA
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
cmp ebx, 0
jne 0x403fe0
mov eax, dword [esp + 8]
push eax
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegDeleteValueA
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
cmp ebx, 0
jne 0x403fd8
mov dword [esp + 0x20], 1
jmp 0x403fe0
mov dword [esp + 0x20], 0
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [esp + 0x20]
jmp 0x403ff1
mov edx, dword [esp + 0xc]
call fcn.0040b48c
mov edx, dword [esp + 4]
call fcn.0040b48c
mov edx, dword [esp + 8]
call fcn.0040b48c
add esp, 0x24
pop edi
pop esi
pop ebp
pop ecx
pop ebx
ret 0x10
Function at 0x4050ae
Capabilities:
Get common file path

Disassembly:
push ebx
push ecx
push ebp
push esi
push edi
push dword [esp + 0x18]
pop dword [0x415e80]
mov esi, esp
sub esp, 0x20
mov eax, esp
mov edx, eax
add edx, 0x20
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x4050c9
push dword [0x415e80]
mov eax, 0x22b
call fcn.0040b29b
lea ecx, [esp + 4]
pop edx
call fcn.0040b38c
push 0x22b
mov eax, dword [esp + 4]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x41119b
push dword [esp + 4]
push 0
call fcn.0040eefe
and eax, eax
je 0x405331
mov dword [esp + 4], 0
mov eax, 0x87
call fcn.0041a119
mov ebx, eax
mov eax, 0xd7
call fcn.0041a119
add ebx, eax
mov dword [esp + 8], ebx
xor eax, eax
call fcn.0041a0b0
call fcn.0040efe6
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x4052c7
push dword [0x415e80]
call fcn.0040eec2
lea ecx, [esp + 0x14]
pop edx
call fcn.0040b38c
mov ebx, dword [esp + 0xc]
cmp ebx, 1
jne 0x4052c7
push dword [0x415e80]
push 0
push str..dll
push dword [0x415e80]
mov eax, dword [esp + 0x20]
call fcn.0040afc2
pop eax
inc dword [0x415e80]
call fcn.0040af1e
pop dword [0x415e80]
mov ebx, eax
cmp ebx, 0
je 0x4051c4
mov ebx, dword [esp + 8]
cmp ebx, dword [esp + 4]
jne 0x4051c4
mov eax, 1
jmp 0x4051c6
xor eax, eax
and eax, eax
je 0x4052b1
push dword [0x415e80]
push 0x4110ad
push str..dll
push dword [0x415e80]
mov eax, dword [esp + 0x20]
call fcn.0040afc2
inc dword [0x415e80]
call fcn.0040e655
lea ecx, [esp + 0x18]
pop edx
call fcn.0040b38c
push dword [0x415e80]
mov edx, dword [esp + 4]
push dword [0x415e80]
call fcn.0040b438
mov edx, 0x4110ab
call fcn.0040b438
mov edx, dword [esp + 0x1c]
call fcn.0040b438
inc dword [0x415e80]
call fcn.0040ed20
pop dword [0x415e80]
mov ebx, eax
cmp ebx, 1
jge 0x405294
push dword [0x415e80]
push 0
push 0x4111a4
mov edx, dword [esp + 0xc]
push dword [0x415e80]
call fcn.0040b438
mov edx, 0x4110ab
call fcn.0040b438
mov edx, dword [esp + 0x20]
call fcn.0040b438
pop eax
inc dword [0x415e80]
call fcn.0040af1e
pop dword [0x415e80]
mov ebx, eax
cmp ebx, 0
jne 0x405294
mov eax, 1
jmp 0x405296
xor eax, eax
and eax, eax
je 0x4052af
mov edx, dword [esp + 0x14]
push dword [0x415e80]
call fcn.0040b438
pop eax
jmp 0x405339
jmp 0x4052c7
inc dword [esp + 4]
mov ebx, dword [esp + 4]
cmp ebx, dword [esp + 8]
jle 0x4052c7
mov dword [esp + 4], 0
mov ebx, dword [esp + 0xc]
cmp ebx, 0
jne 0x40513e
mov dword [esp + 0x18], 1
mov eax, 0xa
cmp eax, dword [esp + 0x18]
jl 0x40531f
mov edx, dword [esp + 0x1c]
push dword [0x415e80]
call fcn.0040b438
push dword [0x415e80]
mov eax, 0xf
call fcn.0041a119
add eax, 0x69
call fcn.0040af0b
pop eax
lea ecx, [esp + 0x20]
pop edx
call fcn.0040b38c
inc dword [esp + 0x18]
jmp 0x4052dc
mov edx, dword [esp + 0x1c]
push dword [0x415e80]
call fcn.0040b438
pop eax
jmp 0x405339
mov eax, dword [0x415e80]
mov byte [eax], 0
mov edx, dword [esp + 0x14]
call fcn.0040b48c
mov edx, dword [esp + 0x10]
call fcn.0040b48c
mov edx, dword [esp + 0x1c]
call fcn.0040b48c
mov edx, dword [esp]
call fcn.0040b48c
add esp, 0x20
pop edi
pop esi
pop ebp
pop ecx
pop ebx
ret
Function at 0x405809
Capabilities:
Set registry value

Disassembly:
push ebx
push ecx
push ebp
push esi
push edi
mov esi, esp
sub esp, 0x1c
mov eax, esp
mov edx, eax
add edx, 0x1c
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x40581a
mov eax, dword [esi + 0x18]
mov dword [esp], eax
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 4]
call fcn.0040b3f9
mov edx, dword [esi + 0x20]
lea ecx, [esp + 8]
call fcn.0040b3f9
mov edx, dword [esi + 0x24]
lea ecx, [esp + 0xc]
call fcn.0040b3f9
mov dword [esp + 0x10], 0xffffffff
lea eax, [esp + 0x14]
push eax
push dword [esp + 8]
push dword [esp + 8]
call sub.ADVAPI32.dll_RegCreateKeyA
mov ebx, eax
cmp ebx, 0
jne 0x4058b7
mov eax, dword [esp + 0xc]
call fcn.0040b047
mov dword [esp + 0x18], eax
push dword [esp + 0x18]
mov eax, dword [esp + 0x10]
push eax
push 1
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegSetValueExA
mov ebx, eax
cmp ebx, 0
jne 0x4058ae
mov dword [esp + 0x10], 1
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [esp + 0x10]
jmp 0x4058bf
mov edx, dword [esp + 8]
call fcn.0040b48c
mov edx, dword [esp + 4]
call fcn.0040b48c
mov edx, dword [esp + 0xc]
call fcn.0040b48c
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ecx
pop ebx
ret 0x10
Function at 0x40d130
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebx
push ecx
push ebp
push esi
push edi
push dword [esp + 0x20]
pop dword [0x415e80]
mov esi, esp
sub esp, 0x24
mov eax, esp
mov edx, eax
add edx, 0x24
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x40d14b
mov edx, dword [esi + 0x18]
lea ecx, [esp]
call fcn.0040b3f9
mov eax, dword [esi + 0x1c]
mov byte [esp + 4], al
mov byte [esp + 5], 1
mov dword [esp + 6], 0x80000000
mov dword [esp + 0xa], 0
mov dword [esp + 0xe], 0
mov dword [esp + 0x12], 0
push dword [0x415e80]
mov eax, 0x800
call fcn.0040b29b
lea ecx, [esp + 0x1a]
pop edx
call fcn.0040b38c
mov edx, 0x417d60
lea ecx, [esp + 0x1a]
call fcn.0040b3d8
push 0
push 0
push 0
movsx eax, byte [esp + 0x10]
push eax
push str.Opera_6.01
call sub.WININET.dll_InternetOpenA
mov dword [esp + 0xa], eax
push 0
push dword [esp + 0xa]
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x1e]
call sub.WININET.dll_InternetOpenUrlA
mov dword [esp + 0xe], eax
mov eax, 1
call fcn.0041a0b0
lea eax, [esp + 0x12]
push eax
mov eax, dword [esp + 0x1a]
call fcn.0040b047
push eax
mov eax, dword [esp + 0x1e]
push eax
push dword [esp + 0x1a]
call sub.WININET.dll_InternetReadFile
mov ebx, dword [esp + 0x12]
cmp ebx, 0
jne 0x40d235
mov byte [esp + 5], 0
jmp 0x40d262
mov edx, dword [esp + 0x1a]
push dword [0x415e80]
call fcn.0040b438
push dword [0x415e80]
push dword [esp + 0x1a]
mov eax, dword [esp + 0x22]
call fcn.0040b00a
pop eax
lea ecx, [esp + 0x1e]
pop edx
call fcn.0040b38c
mov ebx, dword [esp + 0x1e]
add ebx, dword [esp + 0x12]
mov dword [esp + 0x1e], ebx
movsx ebx, byte [esp + 5]
cmp ebx, 0
jne 0x40d1fe
push dword [esp + 0xe]
call sub.WININET.dll_InternetCloseHandle
push dword [esp + 0xa]
call sub.WININET.dll_InternetCloseHandle
mov edx, dword [esp + 0x1a]
push dword [0x415e80]
call fcn.0040b438
pop eax
jmp 0x40d2a4
mov edx, dword [esp + 0x16]
call fcn.0040b48c
mov edx, dword [esp + 0x1a]
call fcn.0040b48c
mov edx, dword [esp]
call fcn.0040b48c
add esp, 0x24
pop edi
pop esi
pop ebp
pop ecx
pop ebx
ret 8

Function at 0x40d2d0
Capabilities:
Get common file path

Disassembly:
push ebx
push ecx
push ebp
push esi
push edi
push dword [esp + 0x18]
pop dword [0x415e80]
mov esi, esp
sub esp, 4
mov eax, esp
mov edx, eax
add edx, 4
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x40d2eb
push dword [0x415e80]
mov eax, 0x1f4
call fcn.0040b29b
lea ecx, [esp + 4]
pop edx
call fcn.0040b38c
mov eax, dword [esp]
push eax
push 0x226
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov edx, dword [esp]
push dword [0x415e80]
call fcn.0040b438
pop eax
jmp 0x40d339
mov edx, dword [esp]
call fcn.0040b48c
add esp, 4
pop edi
pop esi
pop ebp
pop ecx
pop ebx
ret
Function at 0x40dc40
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebx
push ecx
push ebp
push esi
push edi
mov esi, esp
sub esp, 0x34
mov eax, esp
mov edx, eax
add edx, 0x34
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x40dc51
mov edx, dword [esi + 0x18]
lea ecx, [esp]
call fcn.0040b3f9
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
push str.SeDebugPrivilege
call fcn.0040df60
push 0x1000
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
push eax
push 0x400
push dword [esp + 0x10]
mov eax, dword [0x418f08]
call fcn.0040ac0c
mov dword [esp + 0x14], 1
mov ebx, dword [esp + 0x10]
sar ebx, 2
cmp ebx, dword [esp + 0x14]
jl 0x40ddd4
mov ebx, dword [esp + 8]
mov edi, dword [esp + 0x14]
add edi, 0xffffffff
sal edi, 2
add ebx, edi
mov dword [esp + 0xc], ebx
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp]
mov dword [esp + 0x18], eax
push dword [esp + 0x18]
push 0
push 0x410
call sub.KERNEL32.DLL_OpenProcess
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x40ddcb
lea eax, [esp + 0x24]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
mov eax, dword [0x418f0c]
call fcn.0040ac0c
push dword [0x415e80]
mov eax, 0xff
call fcn.0040b29b
lea ecx, [esp + 0x2c]
pop edx
call fcn.0040b38c
mov eax, dword [esp + 0x28]
call fcn.0040b047
push eax
mov eax, dword [esp + 0x2c]
push eax
push dword [esp + 0x28]
push dword [esp + 0x28]
mov eax, dword [0x418f18]
call fcn.0040ac0c
push dword [esp + 0x1c]
call sub.KERNEL32.DLL_CloseHandle
push dword [0x415e80]
mov eax, dword [esp + 0x2c]
call fcn.0040afc2
inc dword [0x415e80]
push dword [0x415e80]
mov eax, dword [esp + 8]
call fcn.0040afc2
pop edx
pop ecx
mov dword [0x415e80], ecx
call fcn.0040b458
je 0x40ddcb
push dword [esp + 0x18]
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x40ddcb
push dword [esp + 4]
push dword [esp + 0x20]
call sub.KERNEL32.DLL_TerminateProcess
mov dword [esp + 0x2c], eax
push dword [esp + 0x1c]
call sub.KERNEL32.DLL_CloseHandle
inc dword [esp + 0x14]
jmp 0x40dcad
push dword [esp + 8]
call sub.KERNEL32.DLL_GlobalFree
mov eax, dword [esp + 0x30]
jmp 0x40dde5
mov edx, dword [esp]
call fcn.0040b48c
mov edx, dword [esp + 0x28]
call fcn.0040b48c
add esp, 0x34
pop edi
pop esi
pop ebp
pop ecx
pop ebx
ret 8

Function at 0x40e82e
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
cmp dword [ebp + 8], 0
je 0x40e848
push dword [ebp + 8]
push 0x40e7c0
call sub.USER32.dll_EnumWindows
jmp 0x40e87f
mov edi, dword [0x417f20]
jmp 0x40e87b
mov esi, dword [edi]
call sub.KERNEL32.DLL_GetCurrentThreadId
cmp dword [edi + 8], eax
jne 0x40e879
push 1
push dword [edi + 0xc]
call sub.USER32.dll_EnableWindow
mov eax, edi
add eax, 8
push eax
push 0x417f20
call fcn.0040f760
add esp, 8
mov edi, esi
or edi, edi
jne 0x40e850
pop edi
pop esi
pop ebp
ret 4
Function at 0x40e9e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
or esi, esi
je 0x40eab8
mov dword [ebp - 0x40], esi
push esi
call sub.CRTDLL.dll_strlen
pop ecx
lea edi, [eax + esi - 1]
jmp 0x40ea0a
dec edi
cmp edi, esi
jbe 0x40ea13
cmp byte [edi], 0x5c
jne 0x40ea09
cmp edi, esi
jbe 0x40ea49
mov byte [edi], 0
push esi
lea eax, [ebp - 0x240]
push eax
call sub.CRTDLL.dll_strcpy
push 0x417f36
lea eax, [ebp - 0x240]
push eax
call sub.CRTDLL.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x240]
mov dword [ebp - 0x40], eax
mov byte [edi], 0x5c
jmp 0x40ea4d
and dword [ebp - 0x40], 0
mov eax, dword [ebp + 0x10]
or eax, eax
je 0x40ea5c
cmp byte [eax], 0
je 0x40ea5c
mov dword [ebp - 0x40], eax
xor edi, edi
inc edi
test byte [ebp + 0x14], 2
je 0x40ea67
xor edi, edi
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x20], edi
lea eax, str.Open
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
mov ebx, eax
or eax, eax
je 0x40eab8
cmp dword [ebp - 4], 0
je 0x40eab8
test byte [ebp + 0x14], 1
je 0x40eab5
push 0xffffffffffffffff
push dword [ebp - 4]
call sub.KERNEL32.DLL_WaitForSingleObject
mov ebx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x40eb00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
mov eax, dword [0x415e80]
mov dword [ebp - 8], eax
or ebx, 0xffffffff
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
jmp 0x40eb97
inc edi
cmp byte [edi], 0x20
je 0x40eb1c
cmp byte [edi], 0x22
jne 0x40eb49
inc edi
mov esi, edi
jmp 0x40eb2d
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x40eb39
cmp eax, 0x22
jne 0x40eb2c
cmp byte [edi], 0
je 0x40eb44
mov dword [ebp - 4], edi
inc edi
jmp 0x40eb67
mov dword [ebp - 4], edi
jmp 0x40eb67
mov esi, edi
jmp 0x40eb4e
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x40eb5a
cmp eax, 0x20
jne 0x40eb4d
cmp byte [edi], 0
je 0x40eb64
mov dword [ebp - 4], edi
jmp 0x40eb67
mov dword [ebp - 4], edi
cmp dword [0x417f40], ebx
jne 0x40eb96
mov eax, dword [ebp - 4]
sub eax, esi
push eax
push esi
push dword [0x415e80]
call sub.CRTDLL.dll_strncpy
add esp, 0xc
mov eax, dword [ebp - 4]
sub eax, esi
add eax, dword [0x415e80]
mov dword [0x415e80], eax
jmp 0x40eb9c
inc ebx
cmp byte [edi], 0
jne 0x40eb1d
mov eax, dword [0x415e80]
mov byte [eax], 0
inc dword [0x417f40]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ebc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
mov edi, 0x64
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.DLL_GetVersionExA
or eax, eax
je 0x40ec7e
mov eax, dword [ebp - 0x84]
cmp eax, 1
je 0x40ec01
cmp eax, 2
je 0x40ec30
jmp 0x40ec7e
mov eax, dword [ebp - 0x8c]
cmp eax, 0xa
je 0x40ec22
jg 0x40ec14
or eax, eax
je 0x40ec1b
jmp 0x40ec7e
cmp eax, 0x5a
je 0x40ec29
jmp 0x40ec7e
mov edi, 0xa
jmp 0x40ec7e
mov edi, 0x1e
jmp 0x40ec7e
mov edi, 0x28
jmp 0x40ec7e
mov eax, dword [ebp - 0x90]
cmp eax, 3
je 0x40ec47
cmp eax, 4
je 0x40ec4e
cmp eax, 5
je 0x40ec55
jmp 0x40ec7e
mov edi, 5
jmp 0x40ec7e
mov edi, 0x14
jmp 0x40ec7e
mov eax, dword [ebp - 0x8c]
or eax, eax
je 0x40ec6b
cmp eax, 1
je 0x40ec72
cmp eax, 2
je 0x40ec79
jmp 0x40ec7e
mov edi, 0x32
jmp 0x40ec7e
mov edi, 0x3c
jmp 0x40ec7e
mov edi, 0x41
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ed20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x544
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
or ebx, 0xffffffff
or edi, edi
je 0x40edf6
cmp byte [edi], 0
je 0x40edf6
push edi
lea eax, [ebp - 0x400]
push eax
call sub.CRTDLL.dll_strcpy
lea eax, [ebp - 0x400]
push eax
call sub.CRTDLL.dll_strlen
add esp, 0xc
mov esi, eax
lea eax, [ebp + esi - 0x401]
mov dword [ebp - 0x404], eax
cmp esi, 2
je 0x40ed78
cmp esi, 3
jne 0x40edb2
cmp byte [ebp - 0x3ff], 0x3a
jne 0x40edb2
cmp esi, 2
jne 0x40ed9a
push 0x417f70
lea eax, [ebp - 0x400]
push eax
call sub.CRTDLL.dll_strcat
add esp, 8
lea eax, [ebp - 0x400]
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 1
jbe 0x40edf6
mov ebx, 0xfffffffe
jmp 0x40edf6
mov eax, dword [ebp - 0x404]
cmp byte [eax], 0x5c
jne 0x40edc0
mov byte [eax], 0
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x400]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x40edf6
test byte [ebp - 0x544], 0x10
je 0x40edea
mov ebx, 0xfffffffe
jmp 0x40edf0
mov ebx, dword [ebp - 0x524]
push esi
call sub.KERNEL32.DLL_FindClose
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40f600
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push edi
and dword [ebp - 4], 0
and dword [ebp - 8], 0
cmp dword [0x419168], 0
je 0x40f65d
mov eax, dword [ebp + 8]
or eax, eax
je 0x40f63f
cmp byte [eax], 0
je 0x40f63f
push eax
call sub.CRTDLL.dll_strlen
pop ecx
push 0
lea edi, [ebp - 4]
push edi
push eax
push dword [ebp + 8]
push dword [0x419168]
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x417fa0
push dword [0x419168]
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 4
Function at 0x40fd4e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
push dword [ebp + 0xc]
pop dword [0x415e80]
mov eax, dword [0x415e80]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
or eax, eax
je 0x40fe59
cmp byte [eax], 0
je 0x40fe59
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40fe59
push 0
push eax
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
push 0xf4240
push 0
push dword [0x418ab0]
call sub.KERNEL32.DLL_HeapAlloc
mov ebx, eax
or eax, eax
je 0x40fe51
lea eax, [ebp - 0x60]
push eax
call fcn.0040fe70
pop ecx
jmp 0x40fe07
cmp edi, 0xf4240
jle 0x40fde1
mov esi, 0xf4240
jmp 0x40fde3
mov esi, edi
push 0
lea eax, [ebp - 0x74]
push eax
push 0xf4240
push ebx
push dword [ebp - 4]
call sub.KERNEL32.DLL_ReadFile
push esi
push ebx
lea eax, [ebp - 0x60]
push eax
call fcn.0040fe98
add esp, 0xc
sub edi, esi
or edi, edi
jg 0x40fdd2
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0040ff4a
add esp, 8
xor edi, edi
movzx eax, byte [ebp + edi - 0x70]
push eax
push str._02x
push dword [0x415e80]
call sub.CRTDLL.dll_sprintf
add esp, 0xc
add dword [0x415e80], 2
inc edi
cmp edi, 0x10
jl 0x40fe1d
push ebx
push 0
push dword [0x418ab0]
call sub.KERNEL32.DLL_HeapFree
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [0x415e80]
mov byte [eax], 0
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40fe70
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [esp + 4]
and dword [ecx + 0x14], 0
and dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret