joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
dec dword [0x44ad4c]
mov eax, dword [0x44ad4c]
mov ecx, dword [ebp + 0xc]
and eax, 0xddf94f1f
or eax, 0x9ce84917
add eax, dword [0x453898]
mov dword [0x453898], eax
movsx eax, word [0x437202]
imul eax, eax, 0xbfc18071
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [0x44a850], eax
mov bl, byte [ecx]
movzx edx, byte [esi]
movzx eax, bl
sub edx, eax
jne 0x4154d3
sub esi, ecx
jmp 0x4154c0
test bl, bl
je 0x4154d3
mov bl, byte [ecx + 1]
inc ecx
movzx eax, bl
movzx edx, byte [esi + ecx]
sub edx, eax
je 0x4154c0
mov eax, dword [0x454948]
inc dword [0x454948]
add eax, 0x5ae1a2e4
and eax, 0xc32fa723
pop esi
pop ebx
cmp eax, 0x46202
jl 0x41551f
mov eax, dword [0x44f6c8]
sub eax, 0x1165eaf8
cmp eax, 0xc19336d5
jl 0x41551f
mov ecx, dword [0x452f84]
movzx eax, word [0x43b260]
not ecx
xor ecx, 0x3cf7150c
and eax, ecx
mov word [0x43b260], ax
test edx, edx
jns 0x41555c
inc word [0x439ee8]
mov edx, 0x96661db7
mov cx, word [0x439ee8]
mov eax, dword [0x44bad4]
sub edx, eax
movsx eax, cx
or eax, dword [0x440dd4]
or eax, edx
or edx, 0xffffffff
mov dword [0x440dd4], eax
and dword [0x45694c], 0xdffff7ff
jmp 0x41557d
jle 0x41557d
mov dword [0x44cf24], 0xfc7130a4
mov edx, 1
imul ecx, dword [0x441640], 0xf5d90aeb
mov dword [0x441640], ecx
movzx ecx, word [0x43ea58]
mov eax, edx
imul ecx, ecx, 0xf407a0b4
mov word [0x435540], cx
pop ebp
ret
Function at 0x42d3e0
Capabilities:
Hash data with md5

Disassembly:
movzx eax, word [0x43e8b8]
mov edx, ecx
imul eax, eax, 0x4e16240
mov word [0x43e8b8], ax
mov dword [edx], 0
mov eax, dword [0x44b48c]
mov ecx, dword [0x44a810]
and eax, 0xfff0f418
shl eax, 0xa
or ecx, eax
mov eax, dword [0x4419d0]
inc dword [0x44a810]
xor eax, 0x3f56362a
cmp ecx, eax
jne 0x42d451
mov ecx, dword [0x4530a4]
mov eax, dword [0x4499e4]
dec dword [0x4499e4]
sar ecx, 1
sub ecx, eax
sub ecx, 0x7f59634d
cmp ecx, 0xd28fe580
jl 0x42d451
or dword [0x44bfc0], 0xf5950fe3
mov dword [edx + 4], 0
add dword [0x4420ac], 0x55ddab8a
mov dword [edx + 8], 0x67452301
mov eax, dword [0x453398]
shl eax, 4
sub eax, 0x5675bd79
or eax, 0x769b78eb
xor dword [0x4439b8], eax
mov dword [edx + 0xc], 0xefcdab89
mov dword [0x44e97c], 0x79c3d70e
mov dword [edx + 0x10], 0x98badcfe
inc dword [0x4543c0]
mov ecx, dword [0x4543c0]
movsx eax, word [0x43be78]
add eax, ecx
movsx ecx, word [0x43da6a]
sar ecx, 2
or ecx, eax
cmp ecx, 0x1c9a9f00
je 0x42d4ce
or dword [0x446a00], 0xcad91800
jmp 0x42d508
movsx eax, word [0x4382ba]
mov ecx, dword [0x44d2e8]
add eax, 0x1bd4d8d0
shl ecx, 6
xor ecx, eax
cmp ecx, 0xf355bc6b
jle 0x42d508
dec dword [0x44b9b4]
mov eax, dword [0x449678]
mov eax, dword [0x441e28]
mov eax, dword [0x44f3ac]
dec dword [0x44f3ac]
mov dword [edx + 0x14], 0x10325476
mov eax, dword [0x4429ec]
or eax, 0x79d37138
sub dword [0x4527a0], eax
inc dword [0x4429ec]
ret
Function at 0x67a920ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x67a92164
jmp 0x67a921ed
jmp 0x67a92276
jmp 0x67a922ff
jmp 0x67a92388
jmp 0x67a92411
jmp 0x67a9249a
jmp 0x67a92523
jmp 0x67a925ac
jmp 0x67a92635
jmp 0x67a926be
jmp 0x67a92747
jmp 0x67a927d0
jmp 0x67a92859
jmp 0x67a928e2
jmp 0x67a9296b
jmp 0x67a929f4
jmp 0x67a92a7d
jmp 0x67a92b06
jmp 0x67a92b8f
jmp 0x67a92c18
jmp 0x67a92ca1
jmp 0x67a92d2a
jmp 0x67a92db3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x67a92e42
jmp 0x67a92ecb
jmp 0x67a92f54
jmp 0x67a92fdd
jmp 0x67a93066
jmp 0x67a930ef
jmp 0x67a93178
jmp 0x67a93201
jmp 0x67a9328a
jmp 0x67a93313
jmp 0x67a9339c
jmp 0x67a93425
jmp 0x67a934ae
jmp 0x67a93537
jmp 0x67a935c0
jmp 0x67a93649
jmp 0x67a936d2
jmp 0x67a9375b
jmp 0x67a937e4
jmp 0x67a9386d
jmp 0x67a938f6
jmp 0x67a9397f
jmp 0x67a93a08
jmp 0x67a93a91
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x67a93b34
jmp 0x67a93bbd
jmp 0x67a93c46
jmp 0x67a93ccf
jmp 0x67a93d58
jmp 0x67a93de1
jmp 0x67a93e6a
jmp 0x67a93ef3
jmp 0x67a93f7c
jmp 0x67a94005
jmp 0x67a9408e
jmp 0x67a94117
jmp 0x67a941a0
jmp 0x67a94229
jmp 0x67a942b2
jmp 0x67a9433b
jmp 0x67a943c4
jmp 0x67a9444d
jmp 0x67a944d6
jmp 0x67a9455f
jmp 0x67a945e8
jmp 0x67a94671
jmp 0x67a946fa
jmp 0x67a94783
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x67a94815
jmp 0x67a9489e
jmp 0x67a94927
jmp 0x67a949b0
jmp 0x67a94a39
jmp 0x67a94ac2
jmp 0x67a94b4b
jmp 0x67a94bd4
jmp 0x67a94c5d
jmp 0x67a94ce6
jmp 0x67a94d6f
jmp 0x67a94df8
jmp 0x67a94e81
jmp 0x67a94f0a
jmp 0x67a94f93
jmp 0x67a9501c
jmp 0x67a950a5
jmp 0x67a9512e
jmp 0x67a951b7
jmp 0x67a95240
jmp 0x67a952c9
jmp 0x67a95352
jmp 0x67a953db
jmp 0x67a95464
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x67a95506
jmp 0x67a9558f
jmp 0x67a95618
jmp 0x67a956a1
jmp 0x67a9572a
jmp 0x67a957b3
jmp 0x67a9583c
jmp 0x67a958c5
jmp 0x67a9594e
jmp 0x67a959d7
jmp 0x67a95a60
jmp 0x67a95ae9
jmp 0x67a95b72
jmp 0x67a95bfb
jmp 0x67a95c84
jmp 0x67a95d0d
jmp 0x67a95d96
jmp 0x67a95e1f
jmp 0x67a95ea8
jmp 0x67a95f31
jmp 0x67a95fba
jmp 0x67a96043
jmp 0x67a960cc
jmp 0x67a96155
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1c]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x2c], eax
jmp 0x67a961f8
jmp 0x67a96281
jmp 0x67a9630a
jmp 0x67a96393
jmp 0x67a9641c
jmp 0x67a964a5
jmp 0x67a9652e
jmp 0x67a965b7
jmp 0x67a96640
Function at 0x67ab74cd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6825b018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6825b018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x67ab7576
jmp 0x67ab75ff
jmp 0x67ab7688
jmp 0x67ab7711
jmp 0x67ab779a
jmp 0x67ab7823
jmp 0x67ab78ac
jmp 0x67ab7935
jmp 0x67ab79be
jmp 0x67ab7a47
jmp 0x67ab7ad0
jmp 0x67ab7b59
jmp 0x67ab7be2
jmp 0x67ab7c6b
jmp 0x67ab7cf4
jmp 0x67ab7d7d
jmp 0x67ab7e06
jmp 0x67ab7e8f
jmp 0x67ab7f18
jmp 0x67ab7fa1
jmp 0x67ab802a
jmp 0x67ab80b3
jmp 0x67ab813c
jmp 0x67ab81c5
mov dword [ebp - 0x14], 0
jmp 0x67ab8255
jmp 0x67ab82de
jmp 0x67ab8367
jmp 0x67ab83f0
jmp 0x67ab8479
jmp 0x67ab8502
jmp 0x67ab858b
jmp 0x67ab8614
jmp 0x67ab869d
jmp 0x67ab8726
jmp 0x67ab87af
jmp 0x67ab8838
jmp 0x67ab88c1
jmp 0x67ab894a
jmp 0x67ab89d3
jmp 0x67ab8a5c
jmp 0x67ab8ae5
jmp 0x67ab8b6e
jmp 0x67ab8bf7
jmp 0x67ab8c80
jmp 0x67ab8d09
jmp 0x67ab8d92
jmp 0x67ab8e1b
jmp 0x67ab8ea4
mov dword [ebp - 0x18], 0
jmp 0x67ab8f34
jmp 0x67ab8fbd
jmp 0x67ab9046
jmp 0x67ab90cf
jmp 0x67ab9158
jmp 0x67ab91e1
jmp 0x67ab926a
jmp 0x67ab92f3
jmp 0x67ab937c
jmp 0x67ab9405
jmp 0x67ab948e
jmp 0x67ab9517
jmp 0x67ab95a0
jmp 0x67ab9629
jmp 0x67ab96b2
jmp 0x67ab973b
jmp 0x67ab97c4
jmp 0x67ab984d
jmp 0x67ab98d6
jmp 0x67ab995f
jmp 0x67ab99e8
jmp 0x67ab9a71
jmp 0x67ab9afa
jmp 0x67ab9b83
mov dword [ebp - 0x10], 0
jmp 0x67ab9c13
jmp 0x67ab9c9c
jmp 0x67ab9d25
jmp 0x67ab9dae
jmp 0x67ab9e37
jmp 0x67ab9ec0
jmp 0x67ab9f49
jmp 0x67ab9fd2
jmp 0x67aba05b
jmp 0x67aba0e4
jmp 0x67aba16d
jmp 0x67aba1f6
jmp 0x67aba27f
jmp 0x67aba308
jmp 0x67aba391
jmp 0x67aba41a
jmp 0x67aba4a3
jmp 0x67aba52c
jmp 0x67aba5b5
jmp 0x67aba63e
jmp 0x67aba6c7
jmp 0x67aba750
jmp 0x67aba7d9
jmp 0x67aba862
mov dword [ebp - 0x10], 0
jmp 0x67abe8ee
jmp 0x67aba8f7
jmp 0x67aba980
jmp 0x67abaa09
jmp 0x67abaa92
jmp 0x67abab1b
jmp 0x67ababa4
jmp 0x67abac2d
jmp 0x67abacb6
jmp 0x67abad3f
jmp 0x67abadc8
jmp 0x67abae51
jmp 0x67abaeda
jmp 0x67abaf63
jmp 0x67abafec
jmp 0x67abb075
jmp 0x67abb0fe
jmp 0x67abb187
jmp 0x67abb210
jmp 0x67abb299
jmp 0x67abb322
jmp 0x67abb3ab
jmp 0x67abb434
jmp 0x67abb4bd
jmp 0x67abb546
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6825b014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x67abb5e0
jmp 0x67abb669
jmp 0x67abb6f2
jmp 0x67abb77b
jmp 0x67abb804
jmp 0x67abb88d
jmp fcn.67abb916
mov eax, dword [0x6825b018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x67aba86e
nop
leave
ret
Function at 0x6119810
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x61199d4
pushal
mov esi, 0x60cc000
lea edi, [esi - 0x1b000]
push edi
or ebp, 0xffffffff
jmp 0x611983a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6119841
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6119830
mov eax, 1
add ebx, ebx
jne 0x6119853
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6119848
jne 0x6119864
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6119848
xor ecx, ecx
sub eax, 3
jb 0x6119878
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x61198ea
mov ebp, eax
add ebx, ebx
jne 0x6119883
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x6119890
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x61198b4
inc ecx
add ebx, ebx
jne 0x61198a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6119895
jne 0x61198b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6119895
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x61198d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x61198c5
jmp 0x6119836
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x61198d4
add edi, ecx
jmp 0x6119836
pop esi
mov edi, esi
mov ecx, 0xcdc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x61198f2
cmp byte [edi], 6
jne 0x61198f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x61198f7
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x6119966
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x291e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x29274]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6119924
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x29278]
or eax, eax
je 0x6119960
mov dword [ebx], eax
add ebx, 4
jmp 0x6119941
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x6119997
cmp al, 0xef
ja 0x611998a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x611996c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6119979
mov ebp, dword [esi + 0x2927c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x61199cb
sub esp, 0xffffff80
jmp 0x610b4d8
Function at 0x4046a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442bc0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x45e070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov byte [edi + 0x88], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x64
dec esi
cmp dword [edi + 0x84], 1
je 0x404708
push 0xa
call ebx
test esi, esi
jne 0x4046f6
mov eax, dword [edi + 0x40]
test eax, eax
je 0x404718
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x404726
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x18]
lea ebx, [edi + 0x18]
mov dword [ebp - 0x10], ebx
mov esi, dword [eax]
cmp esi, eax
je 0x40476c
mov edi, ebx
mov ebx, dword [esi + 8]
mov ecx, ebx
push 1
call fcn.00406de0
mov ecx, ebx
call fcn.00406dc0
test ebx, ebx
je 0x404760
mov ecx, ebx
call fcn.00406ad0
push 0x44
push ebx
call fcn.0040fd67
add esp, 8
mov esi, dword [esi]
cmp esi, dword [edi]
jne 0x404737
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov eax, dword [edi + 0x44]
test eax, eax
je 0x404787
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [edi + 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x40478d
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x9c]
test eax, eax
je 0x40479a
push eax
call esi
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [edi + 0x80]
cmp ecx, 8
jb 0x4047de
mov eax, dword [edi + 0x6c]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x4047d4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404858
mov eax, edx
push ecx
push eax
call fcn.0040fd67
add esp, 8
xor eax, eax
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 7
mov word [edi + 0x6c], ax
mov ecx, dword [edi + 0x34]
cmp ecx, 8
jb 0x40482b
mov eax, dword [edi + 0x20]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x404821
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404858
mov eax, edx
push ecx
push eax
call fcn.0040fd67
add esp, 8
xor eax, eax
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 7
mov ecx, ebx
mov word [edi + 0x20], ax
call fcn.00404610
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042ddfe
int3
Function at 0x4053e0
Capabilities:
Create pipe

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x84], 0
jne 0x405484
push 0
push 1
push 0
mov dword [esi + 0x84], 2
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x405484
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x405484
push 4
push 0xffffffffffffffff
push esi
push 0x405160
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x405484
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x405449
mov eax, dword [eax]
push dword [esi + 0x38]
push 0
push 0x40
push 0x40
push 1
push 6
push 0x40080003
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x405484
push dword [esi + 0x9c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x405488
mov dword [esi + 0x84], 1
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
Function at 0x40b900
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x45e070]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], edi
call fcn.00427af0
add esp, 0xc
call fcn.0040c390
test eax, eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
je 0x40b94f
push 0x44585c
jmp 0x40b954
push str.programfiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.v01sec
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.CrashDump
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov dword [edi + 0x10], 0
lea ecx, [ebp - 0x20c]
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b9a0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.004029e0
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0040fcd6
mov esp, ebp
pop ebp
ret
Function at 0x40c3f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x45e070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push edi
mov edi, dword [ebp + 8]
push 0x208
push 0
mov dword [ebp - 0x62c], edi
push eax
mov dword [ebp - 0x62c], esi
call fcn.00427af0
add esp, 0xc
test esi, esi
jne 0x40c45f
xor eax, eax
mov dword [edi + 0x10], esi
push eax
mov dword [edi + 0x14], 7
mov ecx, edi
push 0x44541c
mov word [edi], ax
call fcn.004029e0
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fcd6
mov esp, ebp
pop ebp
ret
push ebx
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00427af0
push 0x104
lea eax, [ebp - 0x520]
push 0
push eax
call fcn.00427af0
add esp, 0x18
push 1
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x40c5c9
push 1
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x40c5c9
push 0x104
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00427af0
push 0x104
lea eax, [ebp - 0x624]
push 0
push eax
call fcn.00427af0
add esp, 0x18
lea eax, [ebp - 0x214]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x40c5bb
xor ebx, ebx
cmp word [ebp - 0x214], bx
je 0x40c5bb
lea esi, [ebp - 0x214]
mov dword [ebp - 0x628], ebx
nop
push 0x4485b8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40c597
push 0x4485c0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40c597
movzx eax, word [esi]
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0x628]
push 0x104
movzx eax, word [ebp + eax - 0x212]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x40c5c9
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [ebp - 0x62c]
push eax
mov dword [ebp - 0x628], eax
lea eax, [ebp - 0x624]
push eax
push esi
call fcn.0042e956
add esp, 0xc
test eax, eax
je 0x40c5fc
add ebx, 4
lea esi, [ebp - 0x214]
lea eax, [ebx + ebx]
add esi, eax
mov dword [ebp - 0x628], eax
cmp word [esi], 0
jne 0x40c510
mov esi, dword [ebp - 0x62c]
push esi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov dword [edi + 0x10], 0
push eax
mov dword [edi + 0x14], 7
mov word [edi], ax
push 0x44541c
mov ecx, edi
call fcn.004029e0
mov ecx, dword [ebp - 4]
mov eax, edi
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0040fcd6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 0x628]
lea eax, [esi + ecx*2]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov dword [edi + 0x10], 0
lea ecx, [ebp - 0x41c]
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c640
sub ecx, edx
lea eax, [ebp - 0x41c]
sar ecx, 1
push ecx
push eax
jmp 0x40c5e2
Function at 0x40c660
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x45e070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.00427af0
add esp, 0xc
call fcn.0040c390
test eax, eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
je 0x40c6af
push 0x44585c
jmp 0x40c6b4
push str.programfiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.v01sec
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x20c]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c6f0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004029e0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040fcd6
mov esp, ebp
pop ebp
ret

Function at 0x412b08
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x437db1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00437c30
Function at 0x40a411
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417354]
jne 0x40a41b
repz ret
jmp fcn.0040efec

Function at 0x412cf4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040cf8d
and dword [ebp - 0x14], 0
cmp dword [0x439f08], 0
mov dword [ebp - 0x18], eax
jne 0x412da7
push 0x40374c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x412e4f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403740
push ebx
call edi
test eax, eax
je 0x412e4f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403730
push ebx
mov dword [0x439f08], eax
call edi
push eax
call esi
push 0x40371c
push ebx
mov dword [0x439f0c], eax
call edi
push eax
call esi
push 0x403700
push ebx
mov dword [0x439f10], eax
call edi
push eax
call esi
mov dword [0x439f18], eax
test eax, eax
je 0x412da7
push 0x4036e8
push ebx
call edi
push eax
call esi
mov dword [0x439f14], eax
mov eax, dword [0x439f14]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x412e00
cmp dword [0x439f18], ecx
je 0x412e00
push eax
call esi
push dword [0x439f18]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x412e00
test ebx, ebx
je 0x412e00
call edi
test eax, eax
je 0x412df7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x412df7
test byte [ebp - 8], 1
jne 0x412e00
or dword [ebp + 0x10], 0x200000
jmp 0x412e33
mov eax, dword [0x439f0c]
cmp eax, dword [ebp - 0x18]
je 0x412e33
push eax
call esi
test eax, eax
je 0x412e33
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x412e33
mov eax, dword [0x439f10]
cmp eax, dword [ebp - 0x18]
je 0x412e33
push eax
call esi
test eax, eax
je 0x412e33
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x439f08]
call esi
test eax, eax
je 0x412e4f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x412e51
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a411
leave
ret
Function at 0x414c30
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1000
call fcn.004142c0
cmp dword [0x46b1dc], 0x37
jne 0x414ca6
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0x404020
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x404040
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x404058
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea edx, [esp + 0x804]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x46bdc0]
mov edx, dword [0x46823c]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1000
ret