joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418847
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00418847
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xa
mov ebx, dword [ebp + 8]
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x418884
jmp 0x41897f
mov eax, esi
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x41889e
jmp 0x41897f
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
fldcw word [ebp - 0x10]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x4188be
jmp 0x41897f
call fcn.0044ec2b
call fcn.0045b616
mov dword [ebp - 0xa8], eax
mov ebx, dword [ebp + 0xc]
call fcn.0045b45a
push 0
mov ebx, esp
call fcn.0045a876
call fcn.004189a0
mov ebx, dword [ebp + 0xc]
call fcn.0045b45a
xor ebx, ebx
mov eax, dword [ebp - 0xa8]
mov word [ebp - 0x46], ax
mov ecx, pe_nt_image_headers32
mov eax, 1
mov dx, 0x20c1
call fcn.004502f9
mov eax, dword [ebp - 0xa8]
mov word [ebp - 0x46], ax
push dword [ebp - 0xa4]
mov eax, esi
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
fldcw word [ebp - 0x10]
pop ecx
call fcn.0045635d
call fcn.0045570f
xor ecx, ecx
mov eax, dword [ebp - 0xa8]
call fcn.00456419
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FreeResource]
fldcw word [ebp - 0x10]
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_FreeResource]
fldcw word [ebp - 0x10]
call fcn.0044ec13
test eax, eax
je 0x418975
mov dword [ebp - 0x98], 0
jmp 0x41897f
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41a097
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0041a097
xor esi, esi
push esi
push esi
push esi
push esi
push esi
mov ebx, dword [ebp + 0xc]
call fcn.0045b45a
mov eax, 1
mov ecx, 1
xchg ecx, eax
call fcn.004527ff
mov edx, 0x185e9b0
call fcn.0045b687
call fcn.0045abcf
jne 0x41a0fb
mov ebx, dword [ebp + 0xc]
call fcn.0045b45a
mov ecx, 2
mov eax, 0x7fffffff
call fcn.004527ff
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
call fcn.0045b4a3
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyA]
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebx]
call fcn.0045b670
call fcn.0045b655
push eax
mov ebx, dword [ebp + 0x14]
call fcn.0045b77c
push ebx
push 7
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x41e896
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0041e896
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0
push 0
push 0xf003f
mov edx, 0x185e9a0
call fcn.0045b687
lea ebx, [esp + 8]
call fcn.0045a938
mov edx, 0x185e9a0
call fcn.0045b687
lea ebx, [esp + 8]
call fcn.0045a938
call dword [sym.imp.ADVAPI32.DLL_OpenSCManagerA]
push eax
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00456355
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 8
fldcw word [ebp - 0x10]
mov esi, eax
fild dword [0x186b388]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
jne 0x41e924
jmp 0x41e98f
push 0
push 0
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push ebx
push 1
push 3
push 1
push 0xf01ff
mov ebx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CreateServiceA]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x41e96d
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
jmp 0x41e98f
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41ec16
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0041ec16
xor esi, esi
xor edi, edi
mov ecx, 0x52
push esi
dec ecx
jne 0x41ec32
push 0
mov eax, 2
mov ecx, 1
add eax, ecx
mov ecx, 4
add eax, ecx
mov ecx, 8
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x41ec68
jmp 0x41ecf8
mov eax, 0x128
mov dword [ebp - 0x1c0], eax
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
nop
nop
nop
nop
cmp dword [ebp - 0x1cc], 0
je 0x41ecec
fild dword [ebp + 8]
mov eax, dword [ebp - 0x1b8]
call fcn.0045a848
fcompp
fnstsw ax
sahf
jne 0x41ecd1
lea ebx, [ebp - 0x19c]
call fcn.0045b45a
lea ebx, [ebp - 0x98]
call fcn.0045a876
jmp 0x41ecec
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
jmp 0x41ec90
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x41ee9f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0041ee9f
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov eax, dword [0x45da14]
test eax, eax
je 0x41eecd
jmp 0x41efb6
inc dword [0x45e124]
cmp dword [0x45e124], 0x3c
jle 0x41eee6
mov dword [0x45da14], 1
push 0
push 0
mov edx, 0x1860120
call fcn.0045b687
lea ebx, [esp + 4]
call fcn.0045a938
mov edx, 0x1860114
call fcn.0045b687
lea ebx, [esp + 4]
call fcn.0045a938
call dword [sym.imp.USER32.DLL_FindWindowA]
push eax
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00456355
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 8
fldcw word [ebp - 0x10]
mov edi, eax
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
mov eax, edi
push eax
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call fcn.0041ec16
call fcn.0045b69e
xor eax, eax
call fcn.00451592
mov edx, 0x1860138
call fcn.0045b687
call fcn.0045abcf
jne 0x41efb6
mov eax, esi
push eax
push 1
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
fldcw word [ebp - 0x10]
mov dword [ebp - 0xa4], eax
push 1
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
fldcw word [ebp - 0x10]
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov dword [0x45da14], 1
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4235a6
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004235a6
xor esi, esi
xor edi, edi
mov ecx, 0x52
push esi
dec ecx
jne 0x4235c2
lea ebx, [ebp + 8]
call fcn.0045b45a
xor eax, eax
call fcn.00451592
lea ebx, [ebp + 8]
mov ecx, pe_nt_image_headers32
call fcn.0045b4a3
push 0
mov eax, 2
mov ecx, 1
add eax, ecx
mov ecx, 4
add eax, ecx
mov ecx, 8
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
fldcw word [ebp - 0x10]
mov edi, eax
mov eax, 0x128
mov dword [ebp - 0x1c0], eax
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
nop
nop
cmp dword [ebp - 0x1cc], 0
je 0x42368e
lea ebx, [ebp - 0x19c]
call fcn.0045b45a
xor eax, eax
call fcn.00451592
lea ebx, [ebp + 8]
call fcn.0045b45a
call fcn.0045abcf
jne 0x423673
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x98], eax
jmp 0x42368e
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
jmp 0x423630
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x80
Function at 0x4236b7
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004236b7
xor esi, esi
xor edi, edi
mov ecx, 0x52
push esi
dec ecx
jne 0x4236d3
push 0
mov eax, 2
mov ecx, 1
add eax, ecx
mov ecx, 4
add eax, ecx
mov ecx, 8
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
fldcw word [ebp - 0x10]
mov edi, eax
mov eax, 0x128
mov dword [ebp - 0x1c0], eax
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp - 0x1cc], 0
je 0x423798
mov eax, dword [ebp + 8]
call fcn.0045a848
mov eax, dword [ebp - 0x1b8]
call fcn.0045a848
fcompp
fnstsw ax
sahf
jne 0x42377d
lea ebx, [ebp - 0x19c]
call fcn.0045b45a
xor eax, eax
call fcn.00451592
lea ebx, [ebp - 0x98]
call fcn.0045a876
jmp 0x423798
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
jmp 0x423730
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4237c1
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004237c1
xor esi, esi
xor edi, edi
mov ecx, 0x52
push esi
dec ecx
jne 0x4237dd
lea ebx, [ebp + 8]
call fcn.0045b45a
xor eax, eax
call fcn.00451592
lea ebx, [ebp + 8]
mov ecx, pe_nt_image_headers32
call fcn.0045b4a3
push 0
mov eax, 2
mov ecx, 1
add eax, ecx
mov ecx, 4
add eax, ecx
mov ecx, 8
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
fldcw word [ebp - 0x10]
mov edi, eax
mov eax, 0x128
mov dword [ebp - 0x1c0], eax
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp - 0x1cc], 0
je 0x4238d5
lea ebx, [ebp - 0x19c]
call fcn.0045b45a
xor eax, eax
call fcn.00451592
lea ebx, [ebp + 8]
call fcn.0045b45a
call fcn.0045abcf
jne 0x4238b7
push dword [ebp - 0x1b8]
push 1
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
fldcw word [ebp - 0x10]
mov esi, eax
push 1
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x98], eax
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
jmp 0x423850
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x80
Function at 0x4249bd
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004249bd
xor esi, esi
push esi
push esi
push esi
push esi
mov edx, 0x1860a2c
call fcn.0045b687
mov eax, 0x80000080
call fcn.00452ee2
call fcn.004237c1
mov edx, 0x1860a40
call fcn.0045b687
mov eax, 0x80000080
call fcn.00452ee2
call fcn.004237c1
mov edx, 0x1860a50
call fcn.0045b687
mov eax, 0x80000080
call fcn.00452ee2
call fcn.004237c1
mov edx, 0x1860a64
call fcn.0045b687
mov eax, 0x80000080
call fcn.00452ee2
call fcn.004237c1
mov eax, dword [0x45db18]
test eax, eax
je 0x424a60
mov edx, 0x1860a78
call fcn.0045b687
push 0
mov ebx, esp
call fcn.0045a876
call fcn.00417148
mov eax, 0x3e8
call fcn.00455620
push 0
mov edx, 0x1860a8c
call fcn.0045b687
lea ebx, [esp]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x425510
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00425510
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov eax, dword [0x45db1c]
test eax, eax
jne 0x425556
fild dword [0x186b388]
mov eax, dword [0x45dab8]
call fcn.0045a848
fcompp
fnstsw ax
sahf
jne 0x4255d3
push 0
mov eax, 1
lea ebx, [esp]
push ebx
mov word [ebx], ax
push 1
call fcn.0042534d
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x4255a1
push 0
fild dword [0x186ac14]
fild dword [0x186ac10]
call fcn.0045a6e9
call fcn.0045a86f
push eax
call dword [sym.imp.USER32.DLL_ExitWindowsEx]
fldcw word [ebp - 0x10]
jmp 0x4255ce
push 0
fild dword [0x186ac0c]
fild dword [0x186ac18]
call fcn.0045a6e9
fild dword [0x186ac14]
call fcn.0045a6e9
call fcn.0045a86f
push eax
call dword [sym.imp.USER32.DLL_ExitWindowsEx]
fldcw word [ebp - 0x10]
jmp 0x4256bf
push 0
push 0
push pe_nt_image_headers32
push 3
lea ebx, [ebp - 0xa8]
push ebx
push 0
fild dword [0x186a9d4]
fild dword [0x186a9d0]
call fcn.0045a6e9
call fcn.0045a86f
push eax
mov edx, 0x1860c8c
call fcn.0045b687
lea ebx, [esp + 0x18]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186aa78]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x4256bf
mov eax, dword [ebp + 8]
test eax, eax
je 0x425686
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], edi
push ebx
push 0
push 0
push 0
push 0
push 0x30
call fcn.00416a15
push eax
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov edi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
jmp 0x4256b3
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], edi
push ebx
push 0
push 0
push 0
push 0
push 0x2f
call fcn.00416a15
push eax
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov edi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, 0x3e8
call fcn.00455620
push 0
mov eax, 1
lea ebx, [esp]
push ebx
mov word [ebx], ax
push 1
call fcn.0042534d
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x425714
push 0
fild dword [0x186ac14]
fild dword [0x186ac10]
call fcn.0045a6e9
call fcn.0045a86f
push eax
call dword [sym.imp.USER32.DLL_ExitWindowsEx]
fldcw word [ebp - 0x10]
jmp 0x425741
push 0
fild dword [0x186ac0c]
fild dword [0x186ac18]
call fcn.0045a6e9
fild dword [0x186ac14]
call fcn.0045a6e9
call fcn.0045a86f
push eax
call dword [sym.imp.USER32.DLL_ExitWindowsEx]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x425918
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00425918
xor esi, esi
mov ecx, 0x97
push esi
dec ecx
jne 0x425932
lea ebx, [ebp + 8]
call fcn.0045b45a
mov eax, 1
call fcn.00452863
mov edx, 0x185e9b0
call fcn.0045b687
call fcn.0045abcf
je 0x42597d
lea ebx, [ebp + 8]
call fcn.0045b45a
mov edx, 0x185e9b0
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp + 8]
mov ecx, 0x104
call fcn.0045b4a3
lea ebx, [ebp + 8]
call fcn.0045b45a
mov edx, 0x1860ca8
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x2e0]
mov ecx, 0x104
call fcn.0045b4a3
lea ebx, [ebp - 0x1dc]
push ebx
lea ebx, [ebp - 0x2e0]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186aa78]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x425a88
nop
nop
nop
nop
nop
fild dword [0x186aa28]
fild dword [0x186aa28]
mov eax, dword [ebp - 0x1dc]
call fcn.0045a848
call fcn.0045a6d3
fcompp
fnstsw ax
sahf
je 0x425a61
push 0
lea ebx, [ebp + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
call fcn.0045ab3a
lea ebx, [esp]
call fcn.0045a938
call fcn.00425886
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
test eax, eax
je 0x425a61
mov dword [ebp - 0x98], 1
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
jmp 0x425bba
lea ebx, [ebp - 0x1dc]
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x4259e0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
lea ebx, [ebp + 8]
call fcn.0045b45a
mov edx, 0x1860cb0
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x2e0]
mov ecx, 0x104
call fcn.0045b4a3
lea ebx, [ebp - 0x1dc]
push ebx
lea ebx, [ebp - 0x2e0]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186aa78]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x425bba
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
fild dword [0x186aa28]
fild dword [0x186aa28]
mov eax, dword [ebp - 0x1dc]
call fcn.0045a848
call fcn.0045a6d3
fcompp
fnstsw ax
sahf
jne 0x425b93
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
mov edx, 0x185ea14
call fcn.0045b687
call fcn.0045abcf
je 0x425b93
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
mov edx, 0x1860cb8
call fcn.0045b687
call fcn.0045abcf
je 0x425b93
lea ebx, [ebp + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
call fcn.0045ab3a
mov edx, 0x185e9b0
call fcn.0045b687
call fcn.0045ab3a
mov eax, 0x80000104
call fcn.00452ee2
call fcn.00425918
mov dword [ebp - 0x98], eax
lea ebx, [ebp - 0x1dc]
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x425af0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x425bd7
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00425bd7
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push 0
lea ebx, [ebp + 8]
push ebx
call fcn.0042583c
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x425c17
mov dword [ebp - 0x98], 1
jmp 0x425c85
lea ebx, [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
fldcw word [ebp - 0x10]
test eax, eax
je 0x425c3b
mov dword [ebp - 0x98], 1
jmp 0x425c85
push 0
lea ebx, [ebp + 8]
add ebx, 0x100
mov ecx, 0x41
push dword [ebx]
sub ebx, 4
dec ecx
jne 0x425c4b
call fcn.00425918
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x425c85
lea ebx, [ebp + 8]
add ebx, 0x100
mov ecx, 0x41
push dword [ebx]
sub ebx, 4
dec ecx
jne 0x425c72
call fcn.00425ca2
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104

Function at 0x425ca2
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00425ca2
xor esi, esi
mov ecx, 0xd
push esi
dec ecx
jne 0x425cbc
lea ebx, [ebp + 8]
call fcn.0045b45a
mov eax, 1
call fcn.00452863
mov edx, 0x185e9b0
call fcn.0045b687
call fcn.0045abcf
jne 0x425d1e
lea ebx, [ebp + 8]
call fcn.0045b45a
mov ecx, 1
mov eax, 1
lea ebx, [ebp + 8]
call fcn.0045b45a
mov dword [ebp - 0x30], eax
call fcn.0045b655
sub eax, dword [ebp - 0x30]
call fcn.004527ff
lea ebx, [ebp + 8]
mov ecx, 0x104
call fcn.0045b4a3
mov word [ebp - 0xa8], 0x414
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xb4], 3
lea ebx, [ebp + 8]
mov eax, ebx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], 0
push 0
lea ebx, [ebp - 0xb8]
push ebx
call dword [sym.imp.SHELL32.DLL_SHFileOperationA]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x425d88
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x426080
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00426080
xor esi, esi
xor edi, edi
mov ecx, 0x4a
push esi
dec ecx
jne 0x42609c
mov esi, 0x41
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 0x1000
lea ebx, [ebp - 0x1a4]
push ebx
push 0
mov eax, esi
call fcn.0044ef6c
call fcn.0044ef1d
mov edx, 0x185e9c0
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [esp + 8]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
test eax, eax
je 0x426191
lea ebx, [ebp - 0x1a4]
call fcn.0045b45a
xor eax, eax
call fcn.00451592
lea ebx, [ebp - 0x1a4]
mov ecx, 0x104
call fcn.0045b4a3
lea ebx, [ebp + 8]
call fcn.0045b45a
mov eax, 1
lea ebx, [ebp - 0x1a4]
call fcn.0045b45a
call fcn.0045020d
test eax, eax
je 0x426191
lea ebx, [ebp - 0x1a4]
call fcn.0045b45a
push 0
mov eax, esi
call fcn.0044ef6c
call fcn.0044ef1d
mov edx, 0x185e9c0
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp + 8]
push ebx
call fcn.0045b45a
call fcn.00459109
pop ebx
mov ecx, 0x104
call fcn.0045b4a3
jmp 0x42619c
inc esi
cmp esi, 0x5a
jle 0x4260b0
lea ebx, [ebp + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x98]
call fcn.0045a876
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104