joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487770
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe4c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403fc4
xor eax, eax
push ebp
push 0x4878e1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0xc], 0xffffffff
jne 0x4878cb
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00403be4
mov eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], 0xffffffff
xor eax, eax
mov dword [ebx + 0x1034], eax
mov dl, 2
mov al, 2
call fcn.004075a4
mov esi, eax
lea eax, [ebp - 0x1b4]
push eax
push esi
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4878cb
cmp byte [ebp - 0x1b4], 2
jne 0x4877fc
mov ax, word [ebp - 0x1b4]
call fcn.004075c4
cmp al, 2
je 0x487806
call sub.wsock32.dll_WSACleanup
jmp 0x4878cb
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
test esi, esi
jl 0x4878cb
mov dword [ebp - 0xc], 1
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0xffff
push esi
call sub.wsock32.dll_setsockopt
test eax, eax
jl 0x4878cb
mov word [ebp - 0x24], 2
mov ax, word [ebx + 8]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x22], ax
xor eax, eax
mov dword [ebp - 0x20], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push esi
call sub.wsock32.dll_bind
test eax, eax
jge 0x48786e
push esi
call sub.wsock32.dll_closesocket
jmp 0x4878cb
mov eax, dword [ebx + 4]
call fcn.00403fd4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x14], eax
push 0
call sub.wsock32.dll_htonl
mov dword [ebp - 0x10], eax
push 8
lea eax, [ebp - 0x14]
push eax
push 5
push 0
push esi
call sub.wsock32.dll_setsockopt
test eax, eax
jge 0x4878a5
push esi
call sub.wsock32.dll_closesocket
jmp 0x4878cb
push 0x23
push edi
mov eax, dword [0x49ae8c]
call fcn.004431bc
push eax
push esi
call sub.wsock32.dll_WSAAsyncSelect
inc eax
jne 0x4878c4
push esi
call sub.wsock32.dll_closesocket
jmp 0x4878cb
mov dword [ebx + 0xc], esi
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4878e8
lea eax, [ebp - 4]
call fcn.00403b90
ret

Function at 0x488a78
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
add esp, 0xffffffe8
mov ebx, edx
mov esi, eax
test si, 2
jne 0x488a96
test si, 1
jne 0x488a96
test si, 8
je 0x488af2
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x488af2
lea eax, [esp + 0xc]
push eax
push 0x488b0c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x488afa
or si, 4
push 0
movzx eax, si
push eax
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
pop esi
pop ebx
ret
Function at 0x489da8
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x430], edx
mov dword [ebp - 0x434], edx
mov dword [ebp - 0x42c], edx
mov edi, eax
xor eax, eax
push ebp
push 0x489f9e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ebx, [ebp - 0x400]
mov byte [ebx + 0xd], 0xa
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0x65
mov dword [ebx + 0x10], 0x301032b
mov dword [ebx + 0x14], 0x53530000
mov al, byte [0x489fac]
mov byte [0x498c54], al
call fcn.00409e08
fstp qword [ebp - 0x428]
wait
call fcn.00409e34
fadd qword [ebp - 0x428]
fld qword [0x498bb4]
fadd dword [0x489fb0]
fcompp
fnstsw ax
sahf
jae 0x489e30
add dword [ebx + 0x14], 4
cmp dword [0x49d090], 0
jne 0x489e6f
cmp dword [0x498b1c], 0
je 0x489e6f
mov eax, dword [0x49d044]
call fcn.00408c98
test al, al
je 0x489e62
mov eax, dword [0x49d044]
call fcn.00408c30
cmp eax, dword [0x498b1c]
je 0x489e6f
inc dword [ebx + 0x14]
mov al, byte [0x489fb4]
mov byte [0x498c54], al
cmp dword [0x498b18], 0
je 0x489eac
mov eax, dword [0x49d040]
call fcn.00408c98
test al, al
je 0x489e98
mov eax, dword [0x49d040]
call fcn.00408c30
cmp eax, dword [0x498b18]
je 0x489eac
add dword [ebx + 0x14], 2
mov al, byte [0x489fb8]
or al, byte [0x498c54]
mov byte [0x498c54], al
lea eax, [ebp - 0x420]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x418]
shr eax, 0x14
mov dword [ebx + 0x18], eax
mov eax, dword [0x498b54]
mov dword [ebx + 0x1c], eax
cmp dword [0x49d02c], 0
jne 0x489ef0
lea eax, [ebp - 0x42c]
call fcn.00472508
mov edx, dword [ebp - 0x42c]
mov eax, 0x49d02c
call fcn.00403be4
mov eax, dword [0x49d028]
call fcn.00403fd4
mov edx, eax
lea eax, [ebx + 0x20]
mov ecx, 0x1b
call fcn.004091cc
lea eax, [ebx + 0x3c]
mov edx, dword [0x498bf4]
mov dword [eax], edx
lea eax, [ebp - 0x434]
call fcn.0047236c
push dword [ebp - 0x434]
push 0x489fc4
push dword [0x49d02c]
lea eax, [ebp - 0x430]
mov edx, 3
call fcn.00403ed0
mov edx, dword [ebp - 0x430]
lea eax, [ebx + 0x40]
call fcn.00409200
lea esi, [ebx + 0x40]
mov eax, esi
call fcn.0040913c
inc eax
add esi, eax
mov edx, dword [0x49d024]
mov eax, esi
call fcn.00409200
mov eax, esi
call fcn.0040913c
inc eax
add esi, eax
sub esi, ebx
mov dword [ebx + 4], esi
mov edx, ebx
mov eax, edi
call fcn.00489c68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489fa5
lea eax, [ebp - 0x434]
mov edx, 3
call fcn.00403bb4
ret
Function at 0x48a0ec
Capabilities:
Get disk information
Get disk size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x348], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x48a2e0
push dword fs:[eax]
mov dword fs:[eax], esp
lea esi, [ebp - 0x220]
mov byte [esi + 0xd], 0xb
mov byte [esi + 0xe], 0
mov byte [esi + 0xc], 0xac
mov bl, 0x63
lea eax, [ebp - 0x244]
mov edx, ebx
call fcn.00403d38
mov edx, dword [ebp - 0x244]
lea eax, [ebp - 4]
mov ecx, 0x48a2f8
call fcn.00403e5c
lea eax, [ebp - 4]
call fcn.00403fe0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x48a1b5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
call fcn.00403fe0
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
mov eax, dword [ebp - 0xc]
shr eax, 9
imul dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push 0
push 0x800
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
call fcn.00406558
call fcn.0040659e
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
jmp 0x48a1c3
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov al, bl
mov edx, dword [ebp - 0x20]
mov dword [esi + eax*4 - 0x17c], edx
inc ebx
cmp bl, 0x67
jne 0x48a12d
lea ebx, [esi + 0x20]
mov edx, ebx
lea eax, [esi + 0x10]
mov ecx, 0x10
call fcn.00472194
lea eax, [ebp - 0x240]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x238]
add eax, 0x100000
dec eax
shr eax, 0x14
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x234]
shr eax, 0x14
mov dword [ebx + 0x14], eax
mov eax, dword [0x49923c]
mov edx, dword [eax + 4]
mov eax, dword [eax]
shrd eax, edx, 4
shr edx, 4
mov dword [ebx + 0x18], eax
lea eax, [ebp - 0x348]
call fcn.004724cc
mov edx, dword [ebp - 0x348]
lea eax, [ebp - 0x344]
mov ecx, 0xff
call fcn.00403dec
lea edx, [ebp - 0x344]
lea eax, [ebx + 0x1c]
mov cl, 0x1f
call fcn.00402a48
mov eax, dword [0x498bf4]
mov dword [ebx + 0x3c], eax
mov eax, dword [0x498bf8]
mov dword [ebx + 0x40], eax
mov eax, dword [0x498bfc]
mov dword [ebx + 0x44], eax
mov eax, dword [0x498f84]
cmp byte [eax], 0
je 0x48a295
mov eax, dword [0x498d80]
push esi
push edi
mov esi, eax
lea edi, [ebx + 0x48]
mov ecx, 0x3b
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
jmp 0x48a2a4
lea eax, [ebx + 0x48]
xor ecx, ecx
mov edx, 0xec
call fcn.00402b6c
mov dword [esi + 4], 0x154
mov edx, esi
mov eax, edi
call fcn.00489c68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a2e7
lea eax, [ebp - 0x348]
call fcn.00403b90
lea eax, [ebp - 0x244]
call fcn.00403b90
lea eax, [ebp - 4]
call fcn.00403b90
ret
Function at 0x48c6cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x48c792
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x49cf14
mov ecx, 0x105
call fcn.00403dc0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x48c7a8
call fcn.00403e5c
mov dx, 0xffff
mov eax, dword [ebp - 4]
call fcn.00470fd8
mov ebx, eax
test ebx, ebx
je 0x48c777
mov ecx, dword [esi + 4]
sub ecx, 0x20
lea edx, [esi + 0x20]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 8]
mov eax, ebx
call fcn.00402e84
mov eax, 0xc8
call fcn.004721cc
push 1
push 0x48c7b8
push 0x48c7c4
push dword [ebp - 4]
push 0x48c7d4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403ed0
mov eax, dword [ebp - 0xc]
call fcn.00403fd4
push eax
push 0x48c7d8
push 0x48c7e4
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c799
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403bb4
ret

Function at 0x48cde4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48ced0
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
mov dword [ebx], eax
push 0x7f
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x48ce7c
lea edx, [ebp - 4]
lea eax, [ebp - 0x88]
call fcn.00409384
push 0x7f
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x48ce57
lea edx, [ebp - 8]
lea eax, [ebp - 0x88]
call fcn.00409384
jmp 0x48ce5f
lea eax, [ebp - 8]
call fcn.00403b90
push dword [ebp - 4]
push 0x48cee8
push dword [ebp - 8]
push 0x48cef4
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403ed0
xor esi, esi
mov edi, 0x498c74
cmp esi, 3
jl 0x48ce99
mov edx, dword [ebp - 4]
mov eax, dword [edi]
call fcn.004040fc
test eax, eax
setg bl
jmp 0x48cea6
mov eax, dword [edi]
mov edx, dword [ebp - 4]
call fcn.00403f20
sete bl
test bl, bl
jne 0x48ceb5
inc esi
add edi, 4
cmp esi, 4
jne 0x48ce83
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ced7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403bb4
ret
Function at 0x48e954
Capabilities:
Change the wallpaper
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403fc4
xor eax, eax
push ebp
push 0x48eb3b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x48e9a0
xor eax, eax
mov dword [ebp - 8], eax
push 3
lea eax, [ebp - 8]
push eax
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
jmp 0x48eb10
mov eax, dword [ebp - 4]
call fcn.00408c98
test al, al
je 0x48eb10
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00408f7c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.004086dc
mov eax, dword [ebp - 0xc]
mov edx, 0x48eb54
call fcn.00403f20
je 0x48e9e8
mov eax, dword [ebp - 0xc]
mov edx, 0x48eb64
call fcn.00403f20
jne 0x48eb10
lea eax, [ebp - 0x10]
mov ecx, 0x48eb74
mov edx, dword [0x49d01c]
call fcn.00403e5c
mov edx, 0x20
mov eax, dword [ebp - 0x10]
call fcn.00408d00
mov eax, dword [ebp - 0xc]
mov edx, 0x48eb64
call fcn.00403f20
jne 0x48ea35
push 0
lea eax, [ebp - 0x10]
call fcn.00403fe0
push eax
lea eax, [ebp - 4]
call fcn.00403fe0
push eax
call sub.kernel32.dll_CopyFileA
jmp 0x48ead4
mov dl, 1
mov eax, dword [0x458c2c]
call fcn.00458edc
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, dword [0x4163cc]
call fcn.0041c7dc
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x48eaba
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
call fcn.0041cd48
xor ecx, ecx
xor edx, edx
call fcn.00417d50
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48eac4
mov eax, dword [ebp - 0x14]
call fcn.00402e84
mov eax, dword [ebp - 0x18]
call fcn.00402e84
mov ecx, 0x48eb8c
mov edx, 0x48eb98
mov eax, 0x48ebb0
call fcn.004710a0
mov ecx, 0x48ebe4
mov edx, 0x48ebf0
mov eax, 0x48ebb0
call fcn.004710a0
push 3
lea eax, [ebp - 0x10]
call fcn.00403fe0
push eax
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48eb42
lea eax, [ebp - 0x1c]
call fcn.00403b90
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403bb4
lea eax, [ebp - 4]
call fcn.00403b90
ret
Function at 0x48f13c
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48f1f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403b90
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x48f1da
mov eax, dword [ebp - 4]
call fcn.00408658
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x48f1d3
test ebx, ebx
je 0x48f1d3
lea eax, [ebx + 0x1b0]
push eax
call sub.wsock32.dll_inet_addr
cmp esi, eax
jne 0x48f1cd
xor esi, esi
lea ecx, [ebp - 8]
xor eax, eax
mov al, byte [ebx + esi + 0x194]
mov edx, 2
call fcn.00408a98
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00403e18
inc esi
cmp esi, 6
jne 0x48f1a5
jmp 0x48f1da
mov ebx, dword [ebx]
test ebx, ebx
jne 0x48f193
mov eax, ebx
call fcn.0040279c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f1f7
lea eax, [ebp - 8]
call fcn.00403b90
ret
Function at 0x491bbc
Capabilities:
Get disk size

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push ebx
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x491c32
mov eax, dword [esp + 0xc]
xor edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
call fcn.00406558
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
push 0
push 0x200
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
call fcn.00406558
cmp edx, 0
jne 0x491c2d
cmp eax, 0x40000000
seta al
jmp 0x491c34
setg al
jmp 0x491c34
xor eax, eax
add esp, 0x18
pop ebx
ret

Function at 0x492600
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], eax
xor eax, eax
push ebp
push 0x4926a0
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x4926ac
call sub.kernel32.dll_ExpandEnvironmentStringsA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00403dc0
lea eax, [ebp - 0x108]
mov edx, 0x4926c4
call fcn.00403e18
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x104]
call fcn.004086dc
mov edx, dword [ebp - 0x104]
mov eax, 0x498c98
call fcn.00403be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4926a7
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.00403bb4
ret

Function at 0x492cf4
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffa8
mov esi, edx
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x44
call fcn.00402b6c
mov dword [esp + 4], 0x44
mov dword [esp + 0x30], 0x101
mov word [esp + 0x34], 0
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [0x499104]
call fcn.00403fe0
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push esi
push ebx
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x492d86
push 0x1388
mov eax, dword [esp + 0x4c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x492d6b
mov eax, 2
jmp 0x492d8b
push esp
mov eax, dword [esp + 0x4c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x492d7f
mov eax, dword [esp]
jmp 0x492d8b
mov eax, 3
jmp 0x492d8b
mov eax, 4
add esp, 0x58
pop esi
pop ebx
ret
Function at 0x492f70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor edx, edx
push ebp
push 0x4930b0
push dword fs:[edx]
mov dword fs:[edx], esp
cmp al, byte [0x498cb8]
je 0x493095
mov byte [0x498cb8], al
cmp dword [0x49d1e8], 0
jne 0x492fb4
mov dl, 1
mov eax, dword [0x40d9d8]
call fcn.00402e54
mov dword [0x49d1e8], eax
mov eax, dword [0x49d1e8]
mov eax, dword [eax + 8]
test eax, eax
jle 0x492fea
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x492fe0
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [0x49d1e8]
call fcn.0040f0f8
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x492fca
mov eax, dword [0x49d1e8]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x49d01c]
mov al, byte [eax]
mov byte [ebp - 1], al
mov eax, dword [0x499104]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp - 2], al
cmp byte [0x498cb8], 0
je 0x493095
mov bl, 0x41
cmp bl, byte [ebp - 1]
je 0x49308b
cmp bl, byte [ebp - 2]
je 0x49308b
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00403d38
lea eax, [ebp - 0xc]
mov edx, 0x4930c8
call fcn.00403e18
mov eax, dword [ebp - 0xc]
call fcn.00403fd4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x49308b
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403d38
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4930d4
call fcn.00403e5c
push 0
push 0x22
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 8]
call fcn.00403fe0
push eax
call sub.kernel32.dll_CreateFileA_1
cmp eax, 0xffffffff
je 0x49308b
mov edx, eax
mov eax, dword [0x49d1e8]
call fcn.0040ef9c
inc ebx
cmp bl, 0x5b
jne 0x49300f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4930b7
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403bb4
ret

Function at 0x4934bc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403fc4
mov eax, dword [ebp - 8]
call fcn.00403fc4
xor eax, eax
push ebp
push 0x493560
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00408c30
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00408c30
mov ecx, eax
test ecx, ecx
jle 0x493543
test ebx, ebx
jle 0x493522
mov eax, ecx
sub eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jg 0x493515
mov bl, 1
jmp 0x493545
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00408d00
push 0
lea eax, [ebp - 4]
call fcn.00403fe0
push eax
lea eax, [ebp - 8]
call fcn.00403fe0
push eax
call sub.kernel32.dll_CopyFileA
neg eax
sbb ebx, ebx
neg ebx
jmp 0x493545
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493567
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403bb4
ret
Function at 0x8380f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf08275ec
jmp 0x838156
mov dword [esp], ecx
jmp 0x83811f
mov dword [esp], ecx
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0x838150
pushfd
jmp 0x837cea
rdtsc
lea ebx, [ebx + esi]
lea esi, [edi + edi]
lea esi, [esi - 0x75]
jmp 0x83818a
lea ebp, [esp]
inc cl
jae 0x8381b6
mov dl, byte [esp]
rcl edx, 0xd
jmp 0x8386c1
mov esi, dword [esp + 0x2c]
xchg bl, bh
mov ch, byte [esp]
lea edx, [edi*4]
mov eax, dword [esp]
jmp 0x838174
mov dl, byte [esp]
jmp 0x8385d1
rcl edx, 0xd
lea edx, [ebx*4]
jmp 0x83866c
mov eax, esi
mov bx, word [esp]
mov dl, ch
bswap ebx
call 0x838617
cmp byte [esi - 0x79], ah
fimul dword [edi]
stosd dword es:[edi], eax
not cl
mov bx, 0xacf3
xchg dword [esp], ebp
jmp 0x838648
clc
jne 0x838607
je 0x838607
clc
sub esp, 0xc
mov ecx, ebx
pop dword [esp + 2]
mov byte [esp + 2], al
jmp 0x838692
xchg ecx, ebx
mov ebx, eax
mov bx, si
push esp
xchg word [esp], dx
lea ebp, [ebp - 0x25]
jmp 0x838632
sub esp, 0xc0
mov edi, esp
mov dx, word [esp]
rdtsc
jmp 0x83862d
lea esp, [esp + 2]
push dword [esp + 0x20]
ret 0x24
xchg dword [esp + 0xc], ebp
lea edx, [eax + esi]
bt ecx, edx
sub esp, 0x1a
bswap ebx
pop ebx
jmp 0x83867c
lea edx, [ebx*4]
jmp 0x83866c
Function at 0x83cb84
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
jmp 0x83bca6
mov dword [esp + 4], ebp
push edx
mov byte [esp + 1], dh
mov dword [esp + 4], esi
mov dword [esp], edi
jmp 0x83cb26
mov byte [esp + 2], cl
jmp 0x83cb3c

Function at 0x85cc3b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [edx - 8]
stc
lea edi, [ebx + ebp]
jmp 0x85cb81
jmp 0x85cce5
dec di
mov edi, 0x9b10a3c9
mov edi, dword [ecx - 8]
clc
jmp 0x85cc89
cmc
jmp 0x85cbf2
mov edi, dword [ecx - 4]
clc
mov dword [ecx - 4], eax
mov ax, word [esp]
not ax
jmp 0x85cbb6
mov dword [edx - 4], edi
jmp 0x85cc32
mov eax, dword [edx]
jmp 0x85cbdc
mov eax, dword [edx - 4]
cmc
mov dword [edx - 8], edi
mov edi, 0xc42245ab
jmp 0x85cbcc
mov dword [ecx], eax
lea eax, [esp + ebx]
mov eax, ebx
push ebp
jmp 0x85cc57
push ebp
mov ebp, ecx
mov edi, dword [ebp]
pop ebp
jmp 0x85cc17
jmp 0x85cc64
push esi
mov esi, ecx
add esi, 4
jmp 0x85cc72
mov eax, dword [edx + 4]
clc
mov dword [edx], edi
bswap edi
call fcn.0085cc3b
mov edi, dword [ecx + 4]
pushfd
sub esp, 0x1e
pushfd
lea esp, [esp + 2]
jmp 0x85cc3d
mov dword [esi], eax
pop esi
jmp 0x85ccd6
add dword [ebp - 4], 4
mov dword [ecx - 8], eax
mov eax, 0xd8a2265d
jmp 0x85cc09
lea esp, [esp + 0x20]
sub edx, 0x10
jmp 0x85cd20
lea esp, [esp + 1]
lea esp, [esp + 0x14]
add ecx, 0x10
pushal
mov dword [esp + 0x10], esi
jmp 0x85cc9a
mov dword [edx + 4], edi
lea esp, [esp + 0x2c]
sub ebx, 4
sub esp, 0x15
jmp 0x85ccb0
cmp eax, 1
jmp 0x85cd08
push ebp
mov eax, dword [ebp - 8]
lea esp, [esp + 4]
jmp 0x828ae6
jle 0x828a63
mov bh, dl
shr cl, 1
jmp 0x85cd33
cmp dword [ebp - 4], ebx
jl 0x828ab6
mov al, byte [esp]
mov eax, 0xfba89865
jmp 0x85ccfb
lea ecx, [eax - 1]
setnp bh
mov dword [ebp - 4], ecx
bswap ebx
jmp 0x85ce94
mov ecx, 0xff
jmp 0x828a4d