joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b15e6c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4b15f91
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.04b15c74
mov esi, eax
mov eax, dword [0x4ea6410]
cmp byte [eax], 0
je 0x4b15f39
mov eax, dword [0x4ea61c0]
call fcn.04af76d4
call fcn.04af6f60
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4b15e3c]
call fcn.04afc118
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4b15fac
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4b15f75
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4ea6178]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4eaa624]
call fcn.04afc508
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b15f98
lea eax, [ebp - 4]
mov edx, dword [0x4b15e3c]
call fcn.04afc23c
ret
Function at 0x4b17050
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b17150
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.04afa068
lea eax, [ebp - 4]
call fcn.04afa184
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.04afa8f8
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4b1713a
mov eax, ebx
call fcn.04af6e0c
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4b17133
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.04afa8f8
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4b1711d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4b17164
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4b1711d
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1713a
mov eax, dword [ebp - 0x10]
call fcn.04af6e28
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b17157
lea eax, [ebp - 4]
call fcn.04af9c40
ret

Function at 0x4b18074
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.04afa118
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.04aff064
mov edi, eax
cmp edi, 0x104
jbe 0x4b1801f
mov eax, edi
add eax, eax
call fcn.04af6e0c
mov esi, eax
jmp 0x4b18021
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.04aff064
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4b1805a
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4b18044
mov eax, esp
cmp esi, eax
je 0x4b18067
mov eax, esi
call fcn.04af6e28
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4b180a0
cmp bl, 0
je 0x4b1809c
cmp bl, 0x41
jl 0x4b18097
cmp bl, 0x5a
jg 0x4b18097
or bl, 0x20
xor al, bl
inc esi
jmp 0x4b1807b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4b17fe0

Function at 0x4b188fc
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.04afa99c
add esp, 0x800
pop ebx
ret
Function at 0x4b57838
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b578d6
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4b5789a
cmp byte [ebx + 0x11], 0
jne 0x4b5789a
cmp byte [ebx + 0x24], 0
jne 0x4b5789a
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b578bb
lea edx, [ebp - 4]
mov eax, dword [0x4ea63b8]
call fcn.04afefd0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4b320b4]
call fcn.04b15fbc
call fcn.04af9280
jmp 0x4b578bb
lea edx, [ebp - 8]
mov eax, dword [0x4ea63b8]
call fcn.04afefd0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4b320b4]
call fcn.04b15fbc
call fcn.04af9280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b578dd
lea eax, [ebp - 8]
mov edx, 2
call fcn.04af9ca0
ret

Function at 0x4b580f0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b5813e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.04b576b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b58157
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4bbc198
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x4bbc1a0
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4e612f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.04af9d34
xor eax, eax
push ebp
push 0x4e613ec
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x78], 0
je 0x4e613ce
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x78]
add eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
dec eax
test eax, eax
jl 0x4e613ce
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4]
add eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov ecx, 0
call fcn.04afa310
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.04afa49c
jne 0x4e613c6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
movzx eax, word [eax + edx*2]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov eax, dword [eax + edx*4]
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
jmp 0x4e613ce
inc dword [ebp - 0x18]
dec dword [ebp - 0x24]
jne 0x4e6136a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e613f3
lea eax, [ebp - 0x28]
call fcn.04af9c64
lea eax, [ebp - 8]
call fcn.04af9c64
ret
Function at 0x4e6ddc4
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
xor ebx, ebx
cmp dword [esp], 0
je 0x4e6de29
mov eax, dword [esp]
call fcn.04e6e074
test al, al
je 0x4e6de29
mov eax, dword [esp]
call fcn.04e6de84
mov esi, eax
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
dec esi
mov eax, dword [esp]
movzx eax, word [eax + esi*2]
mov edx, eax
mov ecx, eax
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x4e6de0c
mov edx, eax
and dx, 0xffdf
mov eax, edx
cmp ax, 0x41
jb 0x4e6de29
cmp ax, 0x5a
ja 0x4e6de29
sub al, 0x41
mov ecx, eax
shr edi, cl
and edi, 1
cmp edi, 1
sete bl
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4e76bfc
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x4ea3f24
test edx, edx
jne 0x4e76c1b
xor eax, eax
jmp 0x4e76d39
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4e76c38
push esi
push edx
push eax
call fcn.04e76d40
add esp, 0xc
jmp 0x4e76d39
push esi
push edx
push eax
call fcn.04e77000
add esp, 0xc
jmp 0x4e76d39
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4e916be
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x30], eax
xor edx, edx
mov dword [esi + 0x4c], edx
xor ecx, ecx
mov dword [esi + 0x20], ecx
push esi
call fcn.04e9169c
pop ecx
xor ecx, ecx
mov eax, ecx
xor edx, edx
mov ebx, eax
shr ebx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ebx, eax
mov eax, ebx
inc edx
cmp edx, 8
jl 0x4e916e2
mov dword [esi + ecx*4 + 0x70], eax
inc ecx
cmp ecx, 0x100
jb 0x4e916de
pop esi
pop ebx
pop ebp
ret

Function at 0x4e9291e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov dword [ebx], eax
push dword [ebx]
call fcn.04e928bf
pop ecx
pop ebx
pop ecx
pop ebp
ret

Function at 0x4e9428f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov esi, pe_nt_image_headers32
or ebx, 0x100
add edi, edi
mov eax, ebx
shr eax, 7
and eax, 1
push eax
mov edx, esi
and edx, edi
add edx, esi
mov ecx, ebx
shr ecx, 8
add edx, ecx
shl edx, 2
add edx, dword [ebp + 0xc]
push edx
push dword [ebp + 8]
call fcn.04e941fd
add esp, 0xc
add ebx, ebx
mov ecx, ebx
xor ecx, edi
not ecx
and esi, ecx
cmp ebx, 0x10000
jb 0x4e942a6
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4e9434f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 0xc]
xor edx, edx
or eax, 0x100
mov ecx, eax
shr ecx, 8
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + ecx*4]
mov ebx, eax
shr ebx, 7
and ebx, 1
neg ebx
and ebx, 0x7ff
xor ecx, ebx
shr ecx, 4
mov ebx, dword [ebp + 0x10]
add edx, dword [ebx + ecx*4]
add eax, eax
cmp eax, 0x10000
jb 0x4e9435d
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x4e94391
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edx, pe_nt_image_headers32
or eax, 0x100
add ecx, ecx
mov esi, edx
and esi, ecx
add esi, edx
mov edi, eax
shr edi, 8
add esi, edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 7
and edi, 1
neg edi
and edi, 0x7ff
xor esi, edi
shr esi, 4
mov edi, dword [ebp + 0x14]
add ebx, dword [edi + esi*4]
add eax, eax
mov esi, eax
xor esi, ecx
not esi
and edx, esi
cmp eax, 0x10000
jb 0x4e943a9
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4e94473
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov edi, 1
shl edi, cl
or eax, edi
cmp eax, 1
je 0x4e944b8
mov ecx, eax
shr ecx, 1
mov ecx, dword [ebx + ecx*4]
mov edi, eax
and edi, 1
neg edi
and edi, 0x7ff
xor ecx, edi
shr ecx, 4
add edx, dword [esi + ecx*4]
shr eax, 1
cmp eax, 1
jne 0x4e94495
mov eax, edx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4e944bf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
mov eax, 1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4e9450a
mov edx, ebx
and edx, 1
shr ebx, 1
mov esi, dword [ebp + 8]
mov esi, dword [esi + eax*4]
mov edi, edx
neg edi
and edi, 0x7ff
xor esi, edi
shr esi, 4
mov edi, dword [ebp + 0x14]
mov esi, dword [edi + esi*4]
add dword [ebp - 4], esi
add eax, eax
or edx, eax
mov eax, edx
dec ecx
test ecx, ecx
jne 0x4e944da
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x405e85
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x406056
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x406056
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x406056
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x406056
mov eax, dword [ebp + 8]
test eax, eax
jl 0x406056
cmp eax, 0x1a
jge 0x406056
add eax, 0x41
push eax
lea eax, [ebp - 0x10]
push str._c:_
push eax
call fcn.004b00aa
add esp, 0xc
mov eax, 0x105
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x1c], 0x104
push eax
push ecx
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
je 0x406056
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x140]
push eax
call fcn.004c6033
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov dword [ebx], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405e26
test eax, eax
je 0x406004
cmp dword [ebp - 0x14], 0
je 0x406004
push 0x50f5c8
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x406051
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x405fa8
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x10]
push ecx
call eax
test eax, eax
jle 0x405ff9
mov eax, dword [ebp - 0x24]
mov dword [edi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 4], eax
jmp 0x405ff9
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
je 0x406056
mov eax, dword [ebp + 0x10]
mul dword [ebp + 0x14]
mov ebx, eax
push edx
push ebx
push 0
push dword [ebp + 0x18]
mov dword [ebp - 4], edx
call fcn.004af6a0
push dword [ebp - 4]
mov dword [edi], eax
mov dword [edi + 4], edx
push ebx
push 0
push dword [ebp + 8]
call fcn.004af6a0
mov dword [esi], eax
mov dword [esi + 4], edx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
jmp 0x406051
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
je 0x406056
mov eax, dword [ebp + 0x10]
mul dword [ebp + 0x14]
mov ebx, eax
push edx
push ebx
push 0
push dword [ebp + 0x18]
mov dword [ebp - 4], edx
call fcn.004af6a0
push dword [ebp - 4]
mov dword [edi], eax
mov dword [edi + 4], edx
push ebx
push 0
push dword [ebp + 8]
call fcn.004af6a0
mov dword [esi], eax
mov dword [esi + 4], edx
push 1
pop eax
jmp 0x406058
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x40defa
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push 0x50f55c
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
xor esi, esi
cmp eax, esi
je 0x40df47
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, esi
je 0x40df47
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push dword [ebp + 8]
call eax
test eax, eax
je 0x40df81
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
jmp 0x40df7d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
je 0x40df81
mov eax, dword [ebp - 4]
push esi
mul dword [ebp - 8]
push dword [ebp - 0xc]
push edx
push eax
call fcn.004af6a0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
xor eax, eax
jmp 0x40df8c
mov eax, dword [ebp + 0xc]
push 1
mov dword [eax], esi
mov dword [eax + 4], esi
pop eax
pop esi
leave
ret
Function at 0x40193b
Capabilities:
Accept command line arguments

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str._test:
push eax
call fcn.00401f48
pop ecx
test eax, eax
pop ecx
je 0x40196b
add eax, 6
push eax
push dword [esp + 8]
push str.test
push 0x406168
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
ret
push 0x10
push str.Extracting
push dword [esp + 0xc]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
ret

Function at 0x40197f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push 0x81
call fcn.00401e3f
xor ebx, ebx
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
mov byte [eax], bl
mov dword [esp], 0x4074a8
call fcn.00401837
mov eax, dword [0x407418]
cmp eax, ebx
je 0x4019e8
push ebx
lea ecx, [ebp - 8]
push ebx
push ecx
push 0x400
push eax
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00401837
push 0x4060bc
lea ecx, [ebp - 4]
call fcn.004018bd
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x40741c]
lea ecx, [ebp - 4]
push dword [eax]
call fcn.004018bd
push str._lerr:
lea ecx, [ebp - 4]
call fcn.004018bd
push dword [0x407418]
call fcn.00401ea3
pop ecx
push eax
lea ecx, [ebp - 4]
call fcn.004018bd
cmp dword [0x407314], ebx
je 0x401a4b
push str._uz:
lea ecx, [ebp - 4]
call fcn.004018bd
lea eax, [ebp - 0x30]
push 0xa
push eax
push dword [0x407314]
call fcn.00401e86
add esp, 0xc
lea ecx, [ebp - 4]
push eax
call fcn.004018bd
push 0x7f00
push dword [0x4074a4]
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push dword [ebp - 4]
call fcn.0040193b
cmp dword [ebp - 4], ebx
pop ecx
pop ebx
je 0x401a7b
push dword [ebp - 4]
call fcn.00401e4a
pop ecx
push 1
pop eax
leave
ret

Function at 0x401a80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push 0
push 0x4060ac
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00401aac
add esp, 0x10
pop ebp
ret
Function at 0x401aac
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 0x14]
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x401bcf
cmp eax, 0xffffffff
je 0x401bcf
mov eax, dword [ebp + 0x10]
cmp eax, esi
jg 0x401afc
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub eax, dword [ebp + 0xc]
push ebx
push edi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, 0x10000
push edi
call fcn.00401e3f
pop ecx
mov dword [ebp + 0xc], eax
mov ebx, dword [ebp + 0x10]
cmp ebx, esi
je 0x401bb6
cmp ebx, edi
jb 0x401b2f
mov ebx, edi
lea eax, [ebp - 8]
push esi
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
cmp eax, ebx
jb 0x401b67
lea ecx, [ebp - 0x10]
push esi
sub dword [ebp + 0x10], eax
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jne 0x401b8a
jmp 0x401b1e
mov ecx, dword [0x40741c]
push str.CopyF__r____
call fcn.00401837
push dword [ebp + 0x14]
mov ecx, dword [0x40741c]
call fcn.004018bd
mov dword [ebp - 4], esi
jmp 0x401bb6
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x40741c]
push str.WrF
mov dword [0x407418], eax
call fcn.00401837
push dword [ebp + 0x14]
mov ecx, dword [0x40741c]
call fcn.004018bd
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call fcn.00401e4a
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop ebx
jmp 0x401bfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x40741c]
push str.Creat
mov dword [0x407418], eax
call fcn.00401837
push dword [ebp + 0x14]
mov ecx, dword [0x40741c]
call fcn.00401837
xor eax, eax
pop esi
leave
ret

Function at 0x401dc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
xor esi, esi
push 0x44
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00402018
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x24], 5
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 8]
call fcn.00401d45
pop ecx
pop esi
leave
ret
Function at 0x414de4
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], edx
add ecx, 4
cmp ecx, eax
jne fcn.00414de4
add esi, ebx
push esi
mov edi, dword [esp]
add esp, 4
ret
Function at 0x401400
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x10], 0x441030
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
call sub.msvcrt.dll_rand
mov edx, eax
mov eax, edx
sar eax, 0x1f
shr eax, 0x1f
lea eax, [edx + eax]
sar eax, 1
add eax, eax
sub edx, eax
mov eax, edx
add eax, 5
mov dword [esp], eax
call sym.zlP6__66_6_mMGli4Fk0W4_
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x43d000
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
leave
ret

Function at 0x4015c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
leave
ret