joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e60
Capabilities:
Move file

Disassembly:
sub dword [ebp - 8], 0x1b
sub bl, 5
sub dword [ebp - 0x52], edi
add ah, byte [ebp - 0x4e]
add esp, 4
add dword [0x4051c5], 0x16
adc eax, ebx
or dword [ebp - 0x16], 0xffffff86
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
or edi, dword [ebp - 0x53]
and dword [0x40523c], esi
and edi, eax
push 0x1c
push 0x405415
lea eax, [0x405411]
push dword [eax]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor bh, al
sbb dword [ebp - 0x2a], ebx
adc ebx, edi
mov ecx, dword [ebp - 0x33]
call fcn.00403802
sbb ebx, ebx
and edi, 0x27
xchg ecx, ebx
sbb dword [ebp - 0x19], ecx

Function at 0x402ee3
Capabilities:
Authenticate hmac
Get disk information
Move file
Read .ini file

Disassembly:
mov edx, dword [ebp - 0x46]
mov dword [ebp - 0x53], edx
pop edx
or ebx, edi
adc eax, 0x12
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne 0x401b6e
sub dword [ebp - 0x1f], esi
mov ebx, 0xffffffa4
lea edx, [0x40544e]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
sub esi, 0xffffff9b
mov esi, ebx
add eax, eax
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne 0x401b6e
sub dword [ebp - 0x40], esi
and edi, dword [ebp - 0x34]
add dword [ebp - 0xb], 0xffffff83
mov edx, 0x45
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne 0x401b6e
sbb dword [ebp - 0x54], 0xffffff91
sbb dword [0x40521d], 0xffffffaa
call 0x402f8f
or eax, dword [0x4052ba]
sub edi, edi
or edi, dword [ebp - 0x27]
xor dword [ebp - 2], 0xffffffb6
add dword [ebp - 0xe], edi
sub esp, 0xfffffffc
adc edi, 0x24
adc edi, eax
sub dword [ebp - 0x5b], 0x2e
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x403dbf
mov dword [ebp - 0x41], 9
mov edx, dword [ebp - 0x31]
and ebx, dword [ebp - 0x41]
add ebx, dword [0x405291]
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne 0x403dbf
and al, 0x93
xor eax, dword [ebp - 0x46]
xor dword [ebp - 5], 0xffffffb9
add eax, dword [0x40527a]
lea eax, [0x40544e]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
and edi, eax
mov edx, dword [ebp - 0x4e]
sub dword [ebp - 0x20], 0xffffff9c
lea edx, [0x40544e]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov edx, eax
sbb esi, 0xffffffaa
xor dword [ebp - 0xb], esi
call fcn.0040227b
xor eax, 0xffffffb8
adc dword [0x40520a], edx
sub edi, dword [ebp - 0x36]
and dword [ebp - 0x2a], 0x6f
Function at 0x402f8f
Capabilities:
Authenticate hmac
Get disk information
Move file
Read .ini file

Disassembly:
mov edx, dword [ebp - 0x46]
mov dword [ebp - 0x53], edx
pop edx
or ebx, edi
adc eax, 0x12
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne 0x401b6e
sub dword [ebp - 0x1f], esi
mov ebx, 0xffffffa4
lea edx, [0x40544e]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
sub esi, 0xffffff9b
mov esi, ebx
add eax, eax
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne 0x401b6e
sub dword [ebp - 0x40], esi
and edi, dword [ebp - 0x34]
add dword [ebp - 0xb], 0xffffff83
mov edx, 0x45
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne 0x401b6e
sbb dword [ebp - 0x54], 0xffffff91
sbb dword [0x40521d], 0xffffffaa
call 0x402f8f
or eax, dword [0x4052ba]
sub edi, edi
or edi, dword [ebp - 0x27]
xor dword [ebp - 2], 0xffffffb6
add dword [ebp - 0xe], edi
sub esp, 0xfffffffc
adc edi, 0x24
adc edi, eax
sub dword [ebp - 0x5b], 0x2e
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x403dbf
mov dword [ebp - 0x41], 9
mov edx, dword [ebp - 0x31]
and ebx, dword [ebp - 0x41]
add ebx, dword [0x405291]
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne 0x403dbf
and al, 0x93
xor eax, dword [ebp - 0x46]
xor dword [ebp - 5], 0xffffffb9
add eax, dword [0x40527a]
lea eax, [0x40544e]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
and edi, eax
mov edx, dword [ebp - 0x4e]
sub dword [ebp - 0x20], 0xffffff9c
lea edx, [0x40544e]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov edx, eax
sbb esi, 0xffffffaa
xor dword [ebp - 0xb], esi
call fcn.0040227b
xor eax, 0xffffffb8
adc dword [0x40520a], edx
sub edi, dword [ebp - 0x36]
and dword [ebp - 0x2a], 0x6f

Function at 0x403064
Capabilities:
Get disk information
Move file
Read .ini file

Disassembly:
xor bh, byte [ebp - 0x34]
mov ecx, ebx
sub ecx, 0xffffff9f
pop ebx
adc dword [0x4051a0], 0xfffffff6
add ecx, 0xffffffdb
xor dword [ebp - 0x1d], ecx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
mov edx, dword [ebp - 0x34]
adc ebx, 0xfffffff8
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
adc dword [ebp - 0x54], 0x2d
sub eax, 0xffffff9a
add dword [ebp - 0x4c], 0xffffffc7
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor dword [ebp - 0x2f], ebx
adc edi, esi
sbb eax, esi
mov edx, dword [ebp - 2]
call fcn.00402439
add dword [ebp - 0x2e], edi
adc edi, 0x2d
Function at 0x4030f3
Capabilities:
Get disk information
Move file
Read .ini file

Disassembly:
adc dword [0x40525c], 0x62
sub edi, eax
adc eax, dword [ebp - 0x4b]
sub ebx, dword [0x40523f]
sub esp, 0xfffffffc
and dword [ebp - 0x37], 0xffffffed
adc dword [ebp - 0x31], 0xffffffd5
mov dword [ebp - 0x13], eax
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
sbb byte [ebp - 0x13], bl
adc esi, 0x3a
sbb dword [ebp - 0x23], 0xffffffbe
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, 0
jne fcn.00402439
or dword [ebp - 0x55], edi
or edi, 0xfffffffc
or edi, ebx
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
sub dword [0x405227], 0x69
xor dword [ebp - 0x2c], eax
and ebx, esi
call fcn.00403064
sub dword [0x4051e3], 0x44
add dword [ebp - 0xa], eax
sub eax, dword [ebp - 0xb]
xor dword [ebp - 0x3d], eax

Function at 0x4031ad
Capabilities:
Get disk information
Move file
Read .ini file

Disassembly:
adc eax, dword [0x4051ba]
mov edi, 0x20
sub dword [ebp - 0x4d], 0x11
pop ecx
and dword [ebp - 0x28], 0x3d
mov ecx, dword [ebp - 0x27]
mov dword [ebp - 0x16], ecx
and dword [ebp - 0x2b], 0xffffff96
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne fcn.00402439
sbb dword [ebp - 0xd], eax
xor eax, esi
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne fcn.00402439
adc esi, 0x62
mov edx, 0xffffffe2
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
sub al, byte [ebp - 0x15]
sbb dword [ebp - 0x26], esi
call fcn.00402439
sub esi, 7
or dword [ebp - 0xc], 0x7f
adc bl, al

Function at 0x40324c
Capabilities:
Get disk information
Move file
Read .ini file

Disassembly:
mov ecx, ebx
and dword [ebp - 0x14], 0xffffffad
pop eax
sub dword [ebp - 0x40], 0xffffffa6
sbb bl, al
xchg ebx, eax
mov edx, dword [ebp - 0x43]
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
add ebx, dword [ebp - 0x4a]
adc ebx, 0xffffffb1
xor dword [ebp - 0x3c], 0xffffff95
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov edx, eax
xor ebx, ebx
add dword [ebp - 0x54], edi
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
cmp eax, 0
jne fcn.00402439
mov edx, dword [ebp - 0x46]
add dword [ebp - 0x59], 0x15
mov ecx, edx
xor edx, 0xffffffce
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
adc dword [ebp - 8], 0xffffffd1
mov edx, eax
call fcn.00402439
adc edi, ebx
add esi, ebx
add ebx, edi
or dl, bl
Function at 0x403302
Capabilities:
Get disk information
Move file
Read .ini file

Disassembly:
and dword [ebp - 0x38], 0x43
sbb edi, dword [ebp - 0x5a]
pop eax
sbb edi, 0x73
sub esi, 0x45
add ebx, 0x56
and eax, edi
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne fcn.00402439
adc dword [ebp - 0x4a], 0x7a
mov esi, dword [ebp - 0x59]
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov dword [ebp - 0x55], 0xfe
or dword [ebp - 0xa], 0x6b
xor dword [ebp - 0x28], 0xffffff92
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
adc eax, eax
sub bl, ah
adc dword [ebp - 0x38], 0xfffffffe
xor esi, esi
call fcn.00402439
add edi, dword [ebp - 0x33]
mov edx, esi
mov ecx, esi
or dword [ebp - 0x2f], edi
add eax, 0xffffffc8
mov edi, 0x4f
pop esi
or ebx, edi
xor al, 0x36
and dword [ebp - 0x3a], 8
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
xor dword [ebp - 0x11], 0xffffffa6
and ah, 0x61
mov bl, 0x11
or dword [ebp - 0x41], ebx
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
and esi, eax
mov ecx, 0x68
or eax, ecx
or dword [ebp - 7], esi
call fcn.00402439
xor dword [ebp - 0x46], ecx
sub ebx, dword [ebp - 0x20]
Function at 0x4034d8
Capabilities:
Move file
Read .ini file

Disassembly:
adc esi, dword [ebp - 0x59]
xor dword [ebp - 0x11], 0x7d
add esp, 4
add dword [ebp - 0x5a], 0xffffffd5
xchg edi, esi
sbb ebx, dword [ebp - 0x1f]
and esi, 0xffffffc6
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne fcn.00402439
or dword [ebp - 0x12], esi
add esi, eax
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, 0
jne fcn.00402439
adc al, 0x88
mov ecx, dword [ebp - 0x44]
mov ebx, edi
call 0x401a2d
sub ecx, 0xffffffe0
or eax, dword [ebp - 0x57]
sbb ebx, dword [0x4051f0]
adc dword [0x405106], 0xffffffc4
pop edi
or dword [ebp - 0x36], 0xffffffeb
xor dword [ebp - 0x59], esi
sub esi, esi
sub edi, 0x2e
push 0x1c
push 0x405415
lea esi, [0x405411]
push dword [esi]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
sub ebx, dword [ebp - 0x1c]
mov ecx, ebx
add dword [0x4052ce], edi
mov edx, 0xffffffd1
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne fcn.00402439
sbb dword [ebp - 0x46], eax
mov edx, eax
call fcn.004014ba
and eax, dword [0x405282]
and esi, edx
or dword [ebp - 0x3a], 0x18
add edi, dword [0x405111]
add eax, edi
mov ecx, dword [ebp - 0x57]
sbb dword [ebp - 0x47], 0xffffffa2
or eax, dword [0x4051d0]
pop eax
and eax, 0xffffffd3
sbb dword [ebp - 0x39], esi
or ecx, esi
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, 0
jne fcn.00402439
xor al, byte [ebp - 0x2c]
xor dword [ebp - 0x4b], edi
xor eax, dword [0x4051e1]
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov ebx, dword [ebp - 0x2e]
sbb dword [ebp - 0x46], 0x5c
xchg al, bl
adc ah, 0xa9
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
xor dword [ebp - 0x3c], esi
and esi, 1
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne fcn.00402439
mov ecx, ebx
xor eax, dword [ebp - 0x45]
call fcn.004027ab
mov dword [ebp - 0xa], 0x3a
sbb ebx, dword [ebp - 0x25]
adc byte [ebp - 0x3e], bl

Function at 0x403699
Capabilities:
Move file
Read .ini file

Disassembly:
sub dword [ebp - 0x42], 0xffffffd1
adc esi, ebx
add eax, eax
pop esi
xor esi, dword [ebp - 0x33]
mov edx, 0xffffffc1
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
and dword [ebp - 0x50], edi
add eax, dword [ebp - 0x3c]
xor edi, dword [ebp - 0xe]
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne fcn.00402439
adc dword [ebp - 0x41], 0x46
and ebx, 0xffffffb0
mov ebx, eax
call fcn.00402439
sub dword [ebp - 0x21], ebx
or edi, dword [ebp - 4]
sub dword [ebp - 8], 0x46
Function at 0x40370f
Capabilities:
Move file
Read .ini file

Disassembly:
add byte [ebp - 0x3b], bl
adc eax, 0xfffffff6
mov ebx, dword [ebp - 0x21]
xor dword [ebp - 0x1a], edi
pop edx
mov edx, esi
sbb esi, 0xffffff8b
or edx, edx
sub dword [ebp - 0x33], ebx
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
and dword [0x4051e4], 0x5e
add dword [ebp - 0xa], 0xffffffcd
push 0x1c
push 0x405415
lea edi, [0x405411]
push dword [edi]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
sub bh, bh
and ebx, edi
adc al, 0x7d
call fcn.00402439
xor eax, dword [ebp - 0x3a]
add esi, 0xffffffc5
xor bl, byte [0x405271]
mov edi, ebx
adc bh, byte [ebp - 0x35]
adc dword [0x40520f], 0xffffffd4
sub dword [ebp - 0x2f], 0xffffff95
pop ebx
mov ecx, dword [ebp - 0x4f]
or ebx, 0x46
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
sub al, al
adc dword [0x4050e7], 0xffffffcb
and dword [ebp - 0x5a], edi
adc bl, byte [ebp - 0x5b]
push 0x1c
push 0x405415
lea eax, [0x405411]
push dword [eax]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov edx, edi
adc dword [ebp - 0xd], 0x13
call fcn.00402439
mov edx, 0x13
mov ecx, dword [ebp - 0x4c]

Function at 0x403786
Capabilities:
Move file
Read .ini file

Disassembly:
add byte [ebp - 0x3b], bl
adc eax, 0xfffffff6
mov ebx, dword [ebp - 0x21]
xor dword [ebp - 0x1a], edi
pop edx
mov edx, esi
sbb esi, 0xffffff8b
or edx, edx
sub dword [ebp - 0x33], ebx
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
and dword [0x4051e4], 0x5e
add dword [ebp - 0xa], 0xffffffcd
push 0x1c
push 0x405415
lea edi, [0x405411]
push dword [edi]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
sub bh, bh
and ebx, edi
adc al, 0x7d
call fcn.00402439
xor eax, dword [ebp - 0x3a]
add esi, 0xffffffc5
xor bl, byte [0x405271]
mov edi, ebx
adc bh, byte [ebp - 0x35]
adc dword [0x40520f], 0xffffffd4
sub dword [ebp - 0x2f], 0xffffff95
pop ebx
mov ecx, dword [ebp - 0x4f]
or ebx, 0x46
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
sub al, al
adc dword [0x4050e7], 0xffffffcb
and dword [ebp - 0x5a], edi
adc bl, byte [ebp - 0x5b]
push 0x1c
push 0x405415
lea eax, [0x405411]
push dword [eax]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov edx, edi
adc dword [ebp - 0xd], 0x13
call fcn.00402439
mov edx, 0x13
mov ecx, dword [ebp - 0x4c]

Function at 0x403802
Capabilities:
Move file
Read .ini file

Disassembly:
mov edx, edi
sbb edx, 0xffffff95
sub esp, 0xfffffffc
sub esi, dword [ebp - 0x20]
add dword [ebp - 0x32], 0xffffffb6
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov edi, ebx
and ebx, dword [ebp - 0x34]
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
mov edx, edi
and edi, dword [ebp - 0x24]
sub eax, dword [ebp - 0x32]
xor edi, dword [ebp - 0x45]
call fcn.00402439
mov edi, 0x6c
add dword [ebp - 0x2f], 0x30
adc ebx, dword [ebp - 0x16]
Function at 0x403872
Capabilities:
Move file
Read .ini file

Disassembly:
sub dword [ebp - 0x2e], esi
or ebx, ebx
pop ecx
and esi, dword [ebp - 4]
adc eax, ebx
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne fcn.00402439
mov ecx, dword [ebp - 0x23]
mov edx, esi
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
test eax, eax
jne fcn.00402439
mov edx, dword [ebp - 0x23]
xor esi, edi
and ebx, edx
or dword [ebp - 0x15], ebx
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
sbb eax, ebx
mov byte [ebp - 0x1f], al
call fcn.00402439
and al, 0x73
xchg esi, eax
mov edx, 5
add dword [ebp - 0x19], esi
Function at 0x403902
Capabilities:
Move file

Disassembly:
sbb dword [ebp - 0x41], 0x2a
mov edx, esi
pop esi
xor dword [ebp - 0x39], 0xffffffb5
add eax, edi
push 0x1c
push 0x405415
lea ebx, [0x405411]
push dword [ebx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov edx, 0xffffffdf
mov ecx, 2
adc edi, dword [ebp - 0x28]
push 0x1c
push 0x405415
lea edx, [0x405411]
push dword [edx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
or dword [ebp - 0x2e], 0x30
adc dword [ebp - 0x18], 0x1a
call fcn.0040243d
or eax, dword [0x4051de]
sub dword [ebp - 0xa], 0xffffffc3
add ah, byte [ebp - 0x20]
and edi, 5
mov ecx, dword [0x4051a8]
and eax, dword [ebp - 0x24]
xor esi, ebx
pop ecx
or dword [ebp - 0x27], 0x5e
or eax, ebx
adc ebx, dword [ebp - 0x23]
or cl, bl
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
add esi, dword [ebp - 0x37]
mov ecx, 0x11
or dword [ebp - 8], ecx
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
or dword [ebp - 0x3a], edi
mov ecx, eax
sub dword [ebp - 0xf], esi
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne fcn.00402439
mov edx, dword [ebp - 1]
and dword [ebp - 0xd], edx
mov dword [ebp - 0x36], ebx
lea ecx, [0x40544e]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
add dword [ebp - 0x42], ebx
add dword [0x4051e0], 0x5b
call fcn.0040324c
xor dword [ebp - 1], edi
adc dword [ebp - 0xc], 0xffffffed
sub dword [ebp - 5], esi
xor esi, ebx
and esi, dword [0x4052a2]
sbb byte [0x40523b], bh
add esp, 4
sbb dword [ebp - 6], 5
or ebx, 0xffffffa5
and edi, dword [ebp - 3]
xor byte [ebp - 3], bh
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, 0
jne 0x40272e
sub edi, dword [ebp - 0x26]
and dword [ebp - 8], 0xffffff8e
adc ah, byte [ebp - 7]
adc edi, 0xfffffff8
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x40272e
adc dword [ebp - 0x38], 0xffffffb9
mov ecx, dword [ebp - 0x27]
mov edx, pe_nt_image_headers32
adc ah, bl
call fcn.00403e6b
xor ecx, ebx
or dword [ebp - 0x11], ecx
or edi, eax
sub dword [ebp - 0x12], 0x56
sbb eax, 0x5e
sbb edi, 0x6b
sub esp, 0xfffffffc
sub dword [ebp - 0x22], 0x57
add dword [0x4051d0], 0x7c
sub dword [ebp - 0x35], eax
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne fcn.00402439
mov edx, ebx
mov esi, dword [0x405193]
mov ecx, dword [ebp - 0x1a]
xchg esi, ebx
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
mov ecx, dword [0x405275]
sbb dword [ebp - 0x4d], edi
call fcn.0040161b
add dword [ebp], 0x79
add dword [ebp - 0x22], esi
mov edx, dword [0x40513f]
add ebx, 0x14
Function at 0x4039c1
Capabilities:
Get disk information
Move file
Read .ini file

Disassembly:
sbb dword [ebp - 0x41], 0x2a
mov edx, esi
pop esi
xor dword [ebp - 0x39], 0xffffffb5
add eax, edi
push 0x1c
push 0x405415
lea ebx, [0x405411]
push dword [ebx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov edx, 0xffffffdf
mov ecx, 2
adc edi, dword [ebp - 0x28]
push 0x1c
push 0x405415
lea edx, [0x405411]
push dword [edx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
or dword [ebp - 0x2e], 0x30
adc dword [ebp - 0x18], 0x1a
call fcn.0040243d
or eax, dword [0x4051de]
sub dword [ebp - 0xa], 0xffffffc3
add ah, byte [ebp - 0x20]
and edi, 5
mov ecx, dword [0x4051a8]
and eax, dword [ebp - 0x24]
xor esi, ebx
pop ecx
or dword [ebp - 0x27], 0x5e
or eax, ebx
adc ebx, dword [ebp - 0x23]
or cl, bl
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
add esi, dword [ebp - 0x37]
mov ecx, 0x11
or dword [ebp - 8], ecx
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
or dword [ebp - 0x3a], edi
mov ecx, eax
sub dword [ebp - 0xf], esi
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne fcn.00402439
mov edx, dword [ebp - 1]
and dword [ebp - 0xd], edx
mov dword [ebp - 0x36], ebx
lea ecx, [0x40544e]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
add dword [ebp - 0x42], ebx
add dword [0x4051e0], 0x5b
call fcn.0040324c
xor dword [ebp - 1], edi
adc dword [ebp - 0xc], 0xffffffed
sub dword [ebp - 5], esi
xor esi, ebx
and esi, dword [0x4052a2]
sbb byte [0x40523b], bh
add esp, 4
sbb dword [ebp - 6], 5
or ebx, 0xffffffa5
and edi, dword [ebp - 3]
xor byte [ebp - 3], bh
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, 0
jne 0x40272e
sub edi, dword [ebp - 0x26]
and dword [ebp - 8], 0xffffff8e
adc ah, byte [ebp - 7]
adc edi, 0xfffffff8
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x40272e
adc dword [ebp - 0x38], 0xffffffb9
mov ecx, dword [ebp - 0x27]
mov edx, pe_nt_image_headers32
adc ah, bl
call fcn.00403e6b
xor ecx, ebx
or dword [ebp - 0x11], ecx
or edi, eax
sub dword [ebp - 0x12], 0x56
sbb eax, 0x5e
sbb edi, 0x6b
sub esp, 0xfffffffc
sub dword [ebp - 0x22], 0x57
add dword [0x4051d0], 0x7c
sub dword [ebp - 0x35], eax
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne fcn.00402439
mov edx, ebx
mov esi, dword [0x405193]
mov ecx, dword [ebp - 0x1a]
xchg esi, ebx
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
mov ecx, dword [0x405275]
sbb dword [ebp - 0x4d], edi
call fcn.0040161b
add dword [ebp], 0x79
add dword [ebp - 0x22], esi
mov edx, dword [0x40513f]
add ebx, 0x14