joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415724
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004035b4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x415795
mov eax, dword [ebp - 8]
mov edx, 0x104
call fcn.00403b60
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x41578b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004039f4
call fcn.004072fc
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00403b60
jmp 0x415795
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00403b60
mov esp, ebp
pop ebp
ret

Function at 0x415e54
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [0x448bf4]
cmp dword [eax], 2
jne 0x415ec1
test byte [ebp - 4], 0xb
je 0x415ec1
lea eax, [ebp - 0xc]
push eax
push 0x20
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x415ec1
lea eax, [ebp - 0x18]
push eax
push 0x415edc
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x415ec1
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x415ed5
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x415f14
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00406c50
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x415ffd
xor eax, eax
push ebp
push 0x415ff6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
lea edx, [ebp - 0x54]
mov ecx, 0x40
mov eax, dword [ebp - 0x10]
call fcn.00406cb4
cmp eax, 0x40
je 0x415f75
call fcn.0040316c
jmp 0x415ffd
cmp word [ebp - 0x54], 0x5a4d
jne 0x415f83
cmp dword [ebp - 0x18], 0
jne 0x415f8a
call fcn.0040316c
jmp 0x415ffd
mov eax, dword [ebp - 4]
call fcn.00417a14
cmp eax, dword [ebp - 0x18]
jg 0x415f9e
call fcn.0040316c
jmp 0x415ffd
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00406d0c
inc eax
jne 0x415fb5
call fcn.0040316c
jmp 0x415ffd
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00406cb4
cmp eax, 4
je 0x415fd1
call fcn.0040316c
jmp 0x415ffd
cmp dword [ebp - 0x14], 0x4550
jne 0x415fe0
mov eax, dword [ebp - 8]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415ffd
mov eax, dword [ebp - 0x10]
call fcn.00406d18
ret
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x4167d4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e4
xor eax, eax
push ebp
push 0x4168e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x24]
mov dl, 0x22
mov eax, dword [ebp - 4]
call fcn.0040fd28
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0040364c
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4168c4
mov eax, dword [ebp - 0x14]
inc eax
call fcn.004025b0
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4168bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x4168f4
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x41688d
call fcn.0040316c
jmp 0x4168c4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4168c4
mov eax, dword [ebp - 0x1c]
call fcn.004025c8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4168e9
lea eax, [ebp - 0x24]
call fcn.004035b4
lea eax, [ebp - 4]
call fcn.004035b4
ret
Function at 0x416eec
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1e0], edx
mov byte [ebp - 0x1cd], al
xor eax, eax
push ebp
push 0x41715c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e0]
call fcn.00419c4c
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 0x1e0]
call fcn.00407008
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x1d8]
call fcn.00417ac4
lea edx, [ebp - 0x1dc]
mov eax, dword [ebp - 0x1d8]
call fcn.00407008
push 1
lea eax, [ebp - 0x238]
push eax
mov ecx, 0x417170
xor edx, edx
mov eax, dword [ebp - 0x1dc]
call fcn.00417460
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d4]
mov edx, dword [ebp - 0x1dc]
call fcn.0040387c
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cc]
call fcn.00404d52
lea eax, [ebp - 0x1cc]
call fcn.00404fda
call fcn.00402674
push ebp
mov eax, 0x417180
call fcn.00416e7c
pop ecx
push ebp
push 0x417190
push dword [ebp - 0x1e0]
push 0x4171a0
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00416e7c
pop ecx
push ebp
push 0x4171ac
push dword [ebp - 0x1e0]
push 0x4171a0
push 0x4171c0
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00416e7c
pop ecx
cmp byte [ebp - 0x1cd], 0
je 0x41705b
push ebp
push 0x4171d4
push dword [ebp - 0x1d8]
push 0x4171a0
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00416e7c
pop ecx
push ebp
push 0x417190
push dword [ebp - 0x1d4]
push 0x4171a0
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00416e7c
pop ecx
lea eax, [ebp - 0x1cc]
call fcn.00404df4
call fcn.00402674
lea eax, [ebp - 0x234]
xor ecx, ecx
mov edx, 0x44
call fcn.004029a4
mov dword [ebp - 0x208], 1
mov word [ebp - 0x204], 0
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x1dc]
call fcn.004039f4
push eax
push 0
push 0x8000040
push 0
push 0
push 0
push 0x4171a0
push dword [ebp - 0x1d4]
push 0x4171a0
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.004039f4
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x417133
mov eax, dword [ebp - 0x1ec]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x1f0]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417163
lea eax, [ebp - 0x238]
call fcn.004035b4
lea eax, [ebp - 0x1e0]
mov edx, 4
call fcn.004035d8
ret

Function at 0x417294
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00417270
mov ebx, eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetFileSize_1
cmp ebx, eax
jge 0x4172bd
mov byte [ebp - 5], 0
jmp 0x4172c1
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x417680
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e4
xor eax, eax
push ebp
push 0x4176db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4176bc
test byte [ebp - 0xc], 0x10
jne 0x4176c0
xor eax, eax
jmp 0x4176c2
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4176e2
lea eax, [ebp - 4]
call fcn.004035b4
ret

Function at 0x417c78
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e4
xor eax, eax
push ebp
push 0x417de1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.004176ec
test al, al
je 0x417dbe
mov eax, dword [0x448bf4]
cmp dword [eax], 1
jne 0x417cdf
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.0040703c
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00417968
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.0040364c
mov eax, dword [0x448b90]
mov al, byte [eax]
sub al, 2
jae 0x417d3b
mov eax, dword [0x448b90]
cmp dword [eax + 0xd], 0x457
jge 0x417d3b
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
je 0x417dbe
mov eax, dword [ebp - 0x30]
imul dword [ebp - 0x2c]
imul dword [ebp - 0x34]
test eax, eax
jns 0x417d30
add eax, 0x3ff
sar eax, 0xa
mov dword [ebp - 8], eax
jmp 0x417dbe
push 0x417df0
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x417dbe
xor eax, eax
push ebp
push 0x417db7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x417e00
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x417da0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call dword [ebp - 0x10]
test eax, eax
je 0x417da0
mov eax, dword [ebp - 0x14]
shl eax, 0x16
mov edx, dword [ebp - 0x18]
shr edx, 0xa
or eax, edx
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417dbe
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417de8
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.004035d8
lea eax, [ebp - 4]
call fcn.004035b4
ret
Function at 0x417e14
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0x80
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00406eb8
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x418790
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004035b4
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00406c50
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x418819
xor eax, eax
push ebp
push 0x418812
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetFileSize_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4187fc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00403b60
mov eax, dword [ebp - 8]
call fcn.00403a00
mov edx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00406cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418819
mov eax, dword [ebp - 0xc]
call fcn.00406d18
ret
mov esp, ebp
pop ebp
ret

Function at 0x418820
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406d88
test al, al
je 0x41884a
mov edx, 0x21
mov eax, dword [ebp - 4]
call fcn.00406c50
mov dword [ebp - 0xc], eax
jmp 0x418855
mov eax, dword [ebp - 4]
call fcn.00406c90
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4188b1
xor eax, eax
push ebp
push 0x4188aa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x41888b
mov eax, dword [ebp - 8]
call fcn.00403830
push eax
mov eax, dword [ebp - 8]
call fcn.004039f4
mov edx, eax
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.00406ce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4188b1
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_SetEndOfFile_1
mov eax, dword [ebp - 0xc]
call fcn.00406d18
ret
mov esp, ebp
pop ebp
ret

Function at 0x4190a4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004035b4
cmp dword [ebp - 4], 0
je 0x419102
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jle 0x419102
mov edx, dword [ebp - 0xc]
dec edx
mov eax, dword [ebp - 8]
call fcn.00403b60
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004039f4
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov esp, ebp
pop ebp
ret
Function at 0x419710
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4197c0
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0040d790
xor eax, eax
push ebp
push 0x4197a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x41977c
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00403768
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00403830
inc eax
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x41975a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4197aa
mov eax, dword [ebp - 4]
call fcn.0040d84c
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
ret

Function at 0x4199a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x419a7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00403b60
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004039f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403830
push eax
call sub.KERNEL32.DLL_GetTempPathA
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00403b60
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00417968
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040364c
lea eax, [ebp - 0xc]
call fcn.00407288
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00417968
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004068dc
test eax, eax
jne 0x419a64
mov eax, dword [0x448bf4]
cmp dword [eax], 1
jne 0x419a57
lea eax, [ebp - 0xc]
call fcn.00419ab0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00417968
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, 0x419a94
call fcn.0040387c
jmp 0x419a64
mov eax, dword [ebp - 4]
mov edx, 0x419aa4
call fcn.0040364c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419a86
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004035d8
ret

Function at 0x419e10
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov edx, dword [0x419d38]
call fcn.00403e24
xor eax, eax
push ebp
push 0x419e75
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040364c
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x419d5c
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419e7c
lea eax, [ebp - 0x10]
mov edx, dword [0x419d38]
call fcn.00403eec
ret
Function at 0x426e6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x426e91
inc ecx
xor esi, esi
mov bl, byte [eax + esi]
xor bl, byte [edx + esi]
mov edi, dword [ebp - 4]
mov byte [edi + esi], bl
inc esi
dec ecx
jne 0x426e81
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x42bd0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 3], cl
mov word [ebp - 2], dx
mov esi, eax
xor eax, eax
push ebp
push 0x42be5b
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov ax, word [ebp - 2]
mov word [esi + 0x1b], ax
test byte [esi + 0x1b], 1
setne al
xor al, 1
mov byte [esi + 0x18], al
mov eax, dword [esi + 0x24]
call fcn.00406d88
test al, al
je 0x42be45
mov byte [esi + 0x19], 1
push 1
lea eax, [ebp - 8]
push eax
mov eax, dword [0x448bd8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
xor ecx, ecx
xor edx, edx
call fcn.00417460
mov ecx, dword [ebp - 8]
mov eax, dword [0x448bd8]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
lea eax, [esi + 0x28]
call fcn.0040387c
mov eax, dword [esi + 0x24]
call fcn.004129bc
xor ecx, ecx
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
call fcn.00418764
mov ebx, eax
test byte [ebp - 3], bl
je 0x42be45
test byte [esi + 0x1b], 4
je 0x42bdb6
mov eax, dword [esi + 0x24]
call fcn.00416710
test byte [esi + 0x1b], 8
je 0x42bdda
mov eax, dword [esi + 0x24]
call fcn.004039f4
push eax
call sub.gdi32.dll_RemoveFontResourceA
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendMessageA
mov eax, dword [esi + 0x24]
call fcn.00417e14
test al, al
jne 0x42be45
mov byte [esi + 0x34], 1
lea eax, [esi + 0x2c]
mov edx, 0x104
call fcn.00403b60
mov eax, dword [esi + 0x2c]
call fcn.004039f4
push eax
push 0
push 0x42be6c
lea edx, [ebp - 8]
mov eax, dword [esi + 0x24]
call fcn.00407008
mov eax, dword [ebp - 8]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov eax, dword [esi + 0x2c]
call fcn.004039f4
mov edx, eax
lea eax, [esi + 0x2c]
call fcn.00403768
mov eax, dword [0x448bd8]
mov eax, dword [eax]
mov cl, 1
mov edx, 0x42be78
call fcn.00425158
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42be62
lea eax, [ebp - 8]
call fcn.004035b4
ret

Function at 0x42db90
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 1], 0
lea eax, [ebp - 0x10]
push eax
push 4
push 0
mov eax, dword [0x4496e4]
push eax
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42dc0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_ResumeThread
call fcn.00419be8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetExitCodeThread
cmp dword [ebp - 8], 0x103
je 0x42dbcb
cmp dword [ebp - 8], 0
je 0x42dbf3
call fcn.0040316c
jmp 0x42dc15
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42dc15
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
ret
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x42e440
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x42e5c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40c568]
call fcn.00402c4c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42e5a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x448b40]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov edx, 0x42e5dc
call fcn.00412d50
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x42e4b8
inc esi
xor ebx, ebx
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 8]
call fcn.00417e14
inc ebx
dec esi
jne 0x42e49f
mov eax, dword [0x448b40]
mov eax, dword [eax]
mov edx, 0x42e5dc
call fcn.004130f4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [0x448b40]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov edx, 0x42e5f0
call fcn.00412d50
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x42e51e
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 8]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_RemoveDirectoryA_1
dec ebx
cmp ebx, 0xffffffff
jne 0x42e4fd
mov eax, dword [0x448b40]
mov eax, dword [eax]
mov edx, 0x42e5f0
call fcn.004130f4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [0x448b40]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov edx, 0x42e604
call fcn.00412d50
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x42e580
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00414024
dec ebx
cmp ebx, 0xffffffff
jne 0x42e563
mov eax, dword [0x448b40]
mov eax, dword [eax]
mov edx, 0x42e604
call fcn.004130f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e5ae
mov eax, dword [ebp - 4]
call fcn.00402c74
ret
Function at 0x42fff4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4300d2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x24]
call fcn.0040703c
lea eax, [ebp - 4]
mov edx, 0x4300ec
call fcn.00403838
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 5
sete al
test al, al
je 0x430047
and dword [ebx + 0x30], 0xfffffffe
push 0
push 1
xor eax, eax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
fld qword [ebx + 0x34]
fstp xword [ebp - 0x48]
wait
lea eax, [ebp - 0x48]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 3
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], 1
mov byte [ebp - 0x10], 0
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x3c]
mov eax, dword [0x448aec]
mov ecx, 6
call fcn.004255f4
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.00438ac0
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4300d9
lea eax, [ebp - 4]
call fcn.004035b4
ret