joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cde58
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x4ce007
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.004049cc
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4cde93
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4cdeac
lea eax, [ebp - 0x10]
mov edx, dword [0x54dfdc]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404a2c
jmp 0x4cdebf
lea eax, [ebp - 0x10]
mov edx, dword [0x54dfdc]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404a2c
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4cdecb
adc edx, 0
mov edx, dword [edx*4 + 0x53b790]
call fcn.00404c2c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404c10
push eax
call fcn.00406bb4
mov esi, eax
cmp esi, 0xffffffff
je 0x4cdfd9
mov eax, 0x40
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406fe4
test eax, eax
je 0x4cdfcc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4cdfcc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.0040705c
mov eax, edi
call fcn.00402744
mov eax, 0x18
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406fe4
test eax, eax
je 0x4cdfcc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4cdfcc
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x4cdfcc
cmp dx, 0x150
ja 0x4cdfcc
mov eax, edi
call fcn.00402744
mov eax, 0xe0
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406fe4
test eax, eax
je 0x4cdfcc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x4cdfcc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404a08
mov eax, edi
call fcn.00402744
push esi
call fcn.00406b6c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404d38
jne 0x4cdff1
inc ebx
cmp ebx, 0x19
jne 0x4cde85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce00e
lea eax, [ebp - 0x10]
call fcn.004049cc
ret
Function at 0x4daf28
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
test edi, edi
jle 0x4dafbb
xor ebx, ebx
mov byte [ebp - 9], 0
lea eax, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
mov edx, dword [ebp + 8]
call fcn.0045c8a4
dec edi
test edi, edi
jl 0x4dafbb
inc edi
mov dword [ebp - 0x10], edi
xor edx, edx
inc ebx
mov esi, ebx
and esi, 0xff
mov al, byte [ebp + esi - 0x110]
add byte [ebp - 9], al
xor ecx, ecx
mov cl, byte [ebp - 9]
mov cl, byte [ebp + ecx - 0x110]
mov byte [ebp + esi - 0x110], cl
xor ecx, ecx
mov cl, byte [ebp - 9]
mov byte [ebp + ecx - 0x110], al
add al, byte [ebp + esi - 0x110]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + edx]
and eax, 0xff
xor cl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + edx], cl
inc edx
dec dword [ebp - 0x10]
jne 0x4daf64
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4e8f8c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0
jne 0x4e8fa0
call fcn.004e8bd8
pushal
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x556adc]
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
jne 0x4e9010
mov eax, dword [0x54de58]
mov eax, dword [eax]
mov eax, dword [eax + 0x180]
mov ebx, eax
mov edx, dword [0x54de58]
mov esi, eax
mov edx, dword [0x54de58]
mov edx, dword [edx]
add esi, dword [edx + 0x308]
mov edx, dword [0x54de58]
mov edi, eax
mov eax, dword [0x54de58]
mov eax, dword [eax]
add edi, dword [eax + 0x30c]
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
call esi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
call edi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x4ea2c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor esi, esi
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x4ea37b
add edx, ebx
mov eax, edx
mov edi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [eax + 0x20]
add edx, ebx
mov dword [ebp - 4], edx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0xc]
cmp edx, 0xffff
jbe 0x4ea35f
test edi, edi
jbe 0x4ea37b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.0040a708
test eax, eax
jne 0x4ea350
mov eax, dword [ebp - 8]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0xc]
mov esi, dword [eax]
test esi, esi
je 0x4ea37b
add ebx, esi
mov esi, ebx
jmp 0x4ea37b
add dword [ebp - 8], 2
add dword [ebp - 4], 4
dec edi
test edi, edi
ja 0x4ea325
jmp 0x4ea37b
mov edi, edx
sub edi, dword [eax + 0x10]
cmp edi, dword [eax + 0x14]
jae 0x4ea37b
mov eax, edi
shl eax, 2
add eax, dword [ebp - 0xc]
mov esi, dword [eax]
test esi, esi
je 0x4ea37b
add ebx, esi
mov esi, ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4fb564
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x4fb595
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4fb57d
add dl, dl
jne 0x4fb5a0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4fb5f1
xor eax, eax
add dl, dl
jne 0x4fb5ad
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4fb68e
add dl, dl
jne 0x4fb5bc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4fb5c7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4fb5d2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4fb5dd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4fb5e7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x4fb58c
mov eax, 1
add dl, dl
jne 0x4fb5ff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4fb60a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4fb5f6
sub eax, ebx
mov ebx, 1
jne 0x4fb63d
mov ecx, 1
add dl, dl
jne 0x4fb623
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4fb62e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4fb61a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4fb58c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4fb654
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4fb65f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4fb64b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4fb58c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4fb6af
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x4fb58c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x507870
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x50789e
mov eax, ebx
call fcn.00508324
cmp dword [ebx + 0x40], 0
je 0x507897
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x50790f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x507901
cmp dword [ebx + 8], 0
je 0x5078c0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5078d2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x507901
cmp dword [ebx + 8], 0
je 0x5078b3
cmp eax, 3
je 0x5078e5
dec eax
jne 0x5078b3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5078b3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5078b3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x50792d
cmp dword [ebx + 0x14], 0xcc
je 0x50792d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00507938
pop ebx
ret
Function at 0x51feb8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x557580
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x51feda
shr eax, 1
xor eax, 0xedb88320
jmp 0x51fedc
shr eax, 1
dec edx
jne 0x51fec8
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x51fec1
mov byte [0x557980], 1
pop esi
pop ebx
ret

Function at 0x51fef8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x557980], 0
jne 0x51ff0f
call fcn.0051feb8
mov eax, edi
dec eax
test eax, eax
jl 0x51ff38
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x557580]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x51ff19
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x522998
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x5229c9
dec al
je 0x522a05
dec al
je 0x522a49
dec al
je 0x522ab4
jmp 0x522b3e
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x522b3e
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5229d9
jmp 0x522b3e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x522b3e
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x522a15
jmp 0x522b3e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x522b3e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x522a77
xor ebp, ebp
jmp 0x522a88
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x522a91
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x522a59
jmp 0x522b3e
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x522b3e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x522b0c
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0051ff40
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x522ac8
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4a51737e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7e8603e1
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4095d3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411eb0]
jne 0x4095dd
repz ret
jmp fcn.0040bc83

Function at 0x40a490
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405e66
and dword [ebp - 4], 0
cmp dword [0x42d048], 0
mov ebx, eax
jne 0x40a541
push 0x402488
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a5f2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40247c
push edi
call esi
test eax, eax
je 0x40a5f2
push eax
call fcn.00405df4
mov dword [esp], 0x40246c
push edi
mov dword [0x42d048], eax
call esi
push eax
call fcn.00405df4
mov dword [esp], 0x402458
push edi
mov dword [0x42d04c], eax
call esi
push eax
call fcn.00405df4
mov dword [esp], 0x40243c
push edi
mov dword [0x42d050], eax
call esi
push eax
call fcn.00405df4
pop ecx
mov dword [0x42d058], eax
test eax, eax
je 0x40a541
push 0x402424
push edi
call esi
push eax
call fcn.00405df4
pop ecx
mov dword [0x42d054], eax
mov eax, dword [0x42d054]
cmp eax, ebx
je 0x40a599
cmp dword [0x42d058], ebx
je 0x40a599
push eax
call fcn.00405e6f
push dword [0x42d058]
mov esi, eax
call fcn.00405e6f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a599
test edi, edi
je 0x40a599
call esi
test eax, eax
je 0x40a590
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a590
test byte [ebp - 0xc], 1
jne 0x40a599
or dword [ebp + 0x10], 0x200000
jmp 0x40a5d2
mov eax, dword [0x42d04c]
cmp eax, ebx
je 0x40a5d2
push eax
call fcn.00405e6f
pop ecx
test eax, eax
je 0x40a5d2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a5d2
mov eax, dword [0x42d050]
cmp eax, ebx
je 0x40a5d2
push eax
call fcn.00405e6f
pop ecx
test eax, eax
je 0x40a5d2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42d048]
call fcn.00405e6f
pop ecx
test eax, eax
je 0x40a5f2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a5f4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401508
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x28], 1
push eax
push 0x104
mov word [ebp - 0x24], 5
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x25c]
push eax
call esi
xor edi, edi
cmp word [ebp + eax*2 - 0x25e], 0x5c
jne 0x401577
lea eax, [ebp - 0x25c]
push eax
call esi
mov word [ebp + eax*2 - 0x25e], di
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x25c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
pop edi
neg eax
sbb eax, eax
pop esi
inc eax
leave
ret

Function at 0x4015a5
Capabilities:
Read file on windows

Disassembly:
push esi
push 0x403064
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x4015bf
pop esi
ret
push edi
push 0
push 0x128057
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
mov edi, dword [esp + 0x1c]
push 0xc
pop ecx
xor eax, eax
push esi
push 0x30
rep stosd dword es:[edi], eax
push 1
pop edi
push edi
push dword [esp + 0x28]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
cmp eax, 0x30
je 0x4015f4
xor edi, edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x401601
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push 0
push dword [esp + 0x1c]
shr ecx, 2
push dword [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0x10
cmp eax, 0xffffffff
je 0x401652
push dword [esp + 0x10]
push esi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x40165e
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor eax, eax
jmp 0x401660
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x401000
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov byte [ebp - 0x19], 0x41
jmp 0x401022
mov al, byte [ebp - 0x19]
add al, 1
mov byte [ebp - 0x19], al
movsx ecx, byte [ebp - 0x19]
cmp ecx, 0x5a
jg 0x401103
movsx edx, byte [ebp - 0x19]
push edx
push 0x4072b0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x401084
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x14]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
mov dword [ebp - 0xc], 3
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401960
mov dword [ebp - 4], eax
jmp 0x4010fe
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x4010c2
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
call sub.MSVCR100.dll_strcpy
add esp, 8
mov dword [ebp - 0xc], 5
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401960
mov dword [ebp - 4], eax
jmp 0x4010fe
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x4010fe
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
mov dword [ebp - 0xc], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401960
mov dword [ebp - 4], eax
jmp 0x40101a
mov dword [ebp - 8], 1
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401960
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x401130
Capabilities:
Enumerate files on windows
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0xec], 0
mov byte [ebp - 0x60], 0
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffff
jne 0x4011c0
mov dword [ebp - 0xf0], 1
push str._
lea edx, [ebp - 0xec]
push edx
call sub.MSVCR100.dll_strcpy
add esp, 8
mov dword [ebp - 0x3c], 1
push 0
push 0
push 0xb8
lea eax, [ebp - 0xf0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401960
jmp 0x401349
push 0x160
push 0
lea edx, [ebp - 0x390]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x510
push 0x160
lea eax, [ebp - 0x390]
push eax
push 0x80
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea edx, [ebp - 0x204]
push edx
lea eax, [ebp - 0xec]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x230]
and ecx, 0x10
je 0x401223
mov dword [ebp - 0x40], 1
jmp 0x40122a
mov dword [ebp - 0x40], 0
mov edx, dword [ebp - 0x214]
imul edx, edx, 0xffffffff
add edx, dword [ebp - 0x210]
shr edx, 0xa
add edx, 1
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x398]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [ebp - 4]
push ecx
movzx edx, word [ebp - 6]
push edx
movzx eax, word [ebp - 8]
push eax
movzx ecx, word [ebp - 0xa]
push ecx
movzx edx, word [ebp - 0xe]
push edx
movzx eax, word [ebp - 0x10]
push eax
push str._4d__02d__02d__02d:_02d:_02d
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x20
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x60]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
mov dword [ebp - 0x3c], 1
push 0x4072e8
lea ecx, [ebp - 0x204]
push ecx
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
je 0x4012de
push 0x4072ec
lea edx, [ebp - 0x204]
push edx
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x4012e0
jmp 0x401306
push 0
push 0
push 0xb8
lea eax, [ebp - 0xf0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401960
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x401306
jmp 0x40131f
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4011c0
mov dword [ebp - 0x3c], 0
push 0
push 0
push 0xb8
lea ecx, [ebp - 0xf0]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401960
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esp, ebp
pop ebp
ret 8
Function at 0x401350
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push esi
push edi
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0xbc], 0
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
push 0x160
push 0
lea edx, [ebp - 0x360]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x510
push 0x160
lea eax, [ebp - 0x360]
push eax
push 0x80
lea ecx, [ebp - 0x1d4]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xbc]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x1e4]
imul ecx, ecx, 0xffffffff
add ecx, dword [ebp - 0x1e0]
mov dword [ebp - 0x3c], ecx
mov ecx, 0x2e
lea esi, [ebp - 0xc0]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8