joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095b0
Capabilities:
Check for time delay via gettickcount
Read and send data from client to server
Read file via mapping
Send data
Send data on socket

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov edx, ecx
push edi
test esi, esi
mov dword [esp + 0x10], edx
je 0x409665
cmp dword [esi + 0x34], 0xffffffff
je 0x409665
mov ecx, dword [esi + 0x28]
mov ebp, dword [esi + 0x20]
mov eax, dword [esi + 0x2c]
mov ebx, dword [esi + 0x24]
sub ebp, ecx
mov dword [esp + 0x20], 0
sbb ebx, eax
mov eax, dword [edx + 0xa4]
mov edi, dword [eax + 0x788]
mov eax, edi
cdq
push edx
push eax
mov eax, dword [esi + 0x2c]
push eax
push ecx
call fcn.004440e0
sub edi, eax
test ebx, ebx
jl 0x409671
jg 0x409612
test ebp, ebp
jbe 0x409671
mov eax, edi
cdq
cmp ebx, edx
jl 0x409627
jg 0x40961f
cmp ebp, eax
jbe 0x409627
mov ebp, eax
mov dword [esp + 0x18], edx
jmp 0x40962b
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x10]
push 0
push ebp
mov eax, dword [eax + 0xa4]
mov eax, dword [eax + 0x784]
cdq
push edx
push eax
mov eax, dword [esi + 0x2c]
push eax
mov eax, dword [esi + 0x28]
push eax
call fcn.004440e0
mov ebp, dword [esi + 0x30]
mov ecx, dword [esi + 8]
add eax, ebp
mov edx, dword [ecx + 8]
push eax
push edx
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
jge 0x409675
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
mov eax, dword [esp + 0x20]
mov edi, dword [esi + 0x28]
cdq
add edi, eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], edi
mov ecx, dword [esi + 0x2c]
adc ecx, edx
mov dword [esi + 0x2c], ecx
mov ecx, dword [esi + 0x28]
mov edi, dword [esi + 0x2c]
cmp ecx, eax
jne 0x4096ac
cmp edi, dword [esi + 0x24]
jne 0x4096ac
mov eax, dword [esi + 0x18]
sub al, 0x62
neg al
sbb eax, eax
and eax, 2
add eax, 7
mov dword [esi + 0x48], eax
jmp 0x409721
mov ebp, dword [esp + 0x10]
mov edx, dword [ebp + 0xa4]
mov eax, dword [edx + 0x784]
cdq
push edx
push eax
push edi
push ecx
call fcn.004440e0
or eax, edx
jne 0x409721
mov eax, dword [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi + 0x28]
mov edi, dword [esi + 0x20]
mov edx, dword [ebp + 0xa4]
mov ebx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x24]
sub edi, eax
mov eax, dword [edx + 0x784]
cdq
sbb ecx, ebx
cmp ecx, edx
jl 0x409701
jg 0x4096fb
cmp edi, eax
jbe 0x409701
mov dword [esp + 0x18], edx
jmp 0x409707
mov eax, edi
mov dword [esp + 0x18], ecx
mov edx, dword [esi + 0x38]
push eax
mov eax, dword [esi + 0x28]
mov ecx, ebx
push eax
push ebx
push 4
push edx
sar ecx, 0x1f
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 8]
pop edi
pop esi
pop ebp
mov dword [ecx + 0x20], eax
mov eax, 1
pop ebx
add esp, 0xc
ret 4
Function at 0x40a620
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4445db
push eax
mov dword fs:[0], esp
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
test ebp, ebp
mov edi, ecx
je 0x40a67e
lea ebx, [edi + 0x40]
mov ecx, ebx
call fcn.0043ed90
test eax, eax
je 0x40a67e
lea esi, [eax - 0x50]
test esi, esi
je 0x40a67e
cmp dword [esi + 0x64], ebp
jne 0x40a668
mov ecx, esi
call fcn.0041d6e0
test eax, eax
je 0x40a6db
add esi, 0x50
mov ecx, ebx
push esi
call fcn.0043eda0
test eax, eax
je 0x40a67e
lea esi, [eax - 0x50]
test esi, esi
jne 0x40a658
push 0x10474
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x20], eax
xor esi, esi
cmp eax, esi
mov dword [esp + 0x18], esi
je 0x40a6c8
mov ecx, dword [esp + 0x24]
mov edx, dword [edi + 0x9c]
push ecx
mov ecx, dword [edi + 0xa4]
push ebp
push edx
lea edx, [edi + 0x68]
push ecx
mov ecx, dword [edi + 0xa0]
push edx
mov edx, dword [edi + 0x98]
push ecx
push edx
mov ecx, eax
call fcn.004192b0
mov esi, eax
test esi, esi
mov dword [esp + 0x18], 0xffffffff
jne 0x40a6e7
xor eax, eax
jmp 0x40a761
push 1
push esi
mov ecx, edi
call fcn.0040c340
jmp 0x40a75c
lea eax, [esi + 0x50]
lea ecx, [edi + 0x40]
push eax
call fcn.0043ed40
mov edx, dword [esi]
push 0
mov ecx, esi
call dword [edx + 0x184]
mov eax, dword [esi]
push 0xa
mov ecx, esi
call dword [eax + 0xc]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + pe_nt_image_headers32]
push 1
push esi
mov ecx, edi
call fcn.0040c430
mov eax, dword [edi + 0x74]
test eax, eax
jne 0x40a75c
mov eax, dword [edi + 0xa4]
mov ecx, dword [eax + 0x840]
test ecx, ecx
jne 0x40a75c
mov cx, word [edi + 0xb4]
push 1
push ecx
call dword [sym.imp.WSOCK32.dll_htons]
and eax, 0xffff
push eax
push str.127.0.0.1
call dword [sym.imp.WSOCK32.dll_inet_addr]
push eax
mov ecx, edi
call fcn.0040bb00
mov eax, 1
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x410600
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x410629
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x41062b
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x410629
mov eax, dword [eax + 0xc]
pop esi
mov ecx, dword [eax]
mov eax, dword [ecx]
ret
xor eax, eax
pop esi
ret

Function at 0x410870
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x310
lea eax, [esp + 4]
push esi
push eax
push ecx
call fcn.00410800
add esp, 8
test eax, eax
jne 0x410895
pop esi
add esp, 0x310
ret
push ebx
push edi
lea edx, [esp + 0x10]
push 0
push edx
call fcn.0043dbb0
mov edi, 0x455db4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x334]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 2
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
push 3
lea eax, [esp + 0x2c]
push 0x40000000
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0043db60
add esp, 0x24
mov esi, eax
cmp esi, 0xffffffff
pop edi
pop ebx
jne 0x41092f
xor eax, eax
pop esi
add esp, 0x310
ret
mov eax, dword [esp + 0x320]
lea ecx, [esp + 4]
push 0
push ecx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x310
ret

Function at 0x410e20
Capabilities:
Open clipboard

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x410e30
ret
push esi
mov esi, dword [sym.imp.USER32.dll_EnumClipboardFormats]
push edi
xor edi, edi
push edi
call esi
test eax, eax
je 0x410e67
cmp eax, 2
je 0x410e62
cmp eax, 8
je 0x410e62
cmp eax, 0x11
je 0x410e62
push eax
call esi
test eax, eax
jne 0x410e41
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop edi
pop esi
ret
mov edi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop edi
pop esi
ret
Function at 0x410e80
Capabilities:
Get hostname
Get session user name
Resolve dns

Disassembly:
sub esp, 0x504
push ebx
push ebp
mov ebx, ecx
push esi
xor ebp, ebp
push edi
mov dword [ebx + 8], ebp
call fcn.004103b0
mov esi, dword [esp + 0x518]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x51c]
mov dword [ebx + 4], 0xffffffff
push eax
mov dword [ebx], 0xffffffff
mov dword [ebx + 0x14], ebp
mov dword [ebx + 0xc0], esi
call dword [sym.imp.WSOCK32.dll_htons]
and eax, 0xffff
xor ecx, ecx
mov dword [ebx + 0xc4], eax
mov eax, dword [esp + 0x520]
cmp eax, ebp
mov dword [ebx + 0x10], eax
setne cl
push ecx
mov ecx, ebx
call fcn.00411060
test eax, eax
je 0x41103f
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x18], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x410f29
push ebp
push str.GetComputerName__
call fcn.004100c0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x504
ret 0xc
push ebp
lea edi, [ebx + 0x70]
push ebp
push 0x50
push edi
lea ecx, [esp + 0x24]
push 0xffffffffffffffff
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xfde9
call ebp
push 0
push 0
lea edx, [ebx + 0x118]
push 0x50
push edx
lea eax, [esp + 0x24]
push 0xffffffffffffffff
push eax
push 0
push 0
call ebp
test esi, esi
jne 0x410fbe
lea ecx, [esp + 0x114]
push 0x400
push ecx
call dword [sym.imp.WSOCK32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x410f9f
or ecx, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x114]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x410fbe
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebx + 0xc0], ecx
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x18], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x410ff7
push eax
push str.GetUserName__
call fcn.004100c0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x504
ret 0xc
push 0
lea esi, [ebx + 0x20]
push 0
push 0x50
push esi
lea ecx, [esp + 0x24]
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call ebp
push 0
push 0
lea edx, [ebx + 0xc8]
push 0x50
push edx
lea eax, [esp + 0x24]
push 0xffffffffffffffff
push eax
push 0
push 0
call ebp
lea edi, [ebx + 0x170]
mov ecx, 0x2a
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 8], 1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x504
ret 0xc
Function at 0x411ba0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
xor eax, eax
push ebx
mov dword [esp + 4], eax
mov ebx, dword [esp + 0x20]
mov dword [esp + 8], eax
push ebp
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x1c]
push esi
mov ebp, dword [sym.imp.WSOCK32.dll_sendto]
mov esi, ecx
mov dword [esp + 0x18], eax
mov cx, word [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
lea eax, [esp + 0x10]
push 0x10
push eax
mov word [esp + 0x1a], cx
mov ecx, dword [esi]
push 0
push edi
push ebx
push ecx
mov word [esp + 0x28], 2
mov dword [esp + 0x2c], edx
call ebp
cmp eax, 0xffffffff
jne 0x411c8b
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
sub eax, 0x2742
je 0x411c38
sub eax, 0xf
je 0x411c19
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10
mov eax, dword [0x45b180]
test eax, eax
jne 0x411c2c
mov dword [0x45b180], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10
mov ecx, esi
call fcn.004113b0
test eax, eax
jne 0x411c4d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
mov eax, dword [esi + 0x14]
test eax, eax
je 0x411c6a
push eax
mov ecx, esi
call fcn.004114b0
test eax, eax
jne 0x411c6a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
mov eax, dword [esi]
lea edx, [esp + 0x10]
push 0x10
push edx
push 0
push edi
push ebx
push eax
call ebp
cmp eax, 0xffffffff
jne 0x411c8b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 0x10

Function at 0x411ce0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, ecx
lea eax, [esp + 8]
push esi
mov edx, dword [ebx + 4]
lea ecx, [esp + 0x14]
push eax
push ecx
push edx
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x1c], 1
call dword [sym.imp.WSOCK32.dll_accept]
mov esi, dword [esp + 0x2c]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
je 0x411dc6
push edi
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
lea ecx, [esp + 0x14]
push 4
push ecx
push 1
push 0xffff
push eax
call edi
mov eax, dword [esp + 0x1a]
mov edx, dword [esp + 0x1c]
and eax, 0xffff
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], 1
mov dword [esi + 0x14], 1
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx + 0x78c]
test eax, eax
mov dword [esp + 0xc], eax
jle 0x411d91
mov eax, dword [esi + 8]
lea edx, [esp + 0xc]
push 4
push edx
push 0x1001
push 0xffff
push eax
call edi
test eax, eax
je 0x411d91
mov eax, dword [esp + 0xc]
cdq
sub eax, edx
sar eax, 1
test eax, eax
mov dword [esp + 0xc], eax
jg 0x411d65
mov ecx, dword [esp + 0x2c]
push esi
push ecx
mov ecx, ebx
call fcn.00411f10
test eax, eax
pop edi
je 0x411dbc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], eax
pop esi
mov eax, 1
pop ebx
add esp, 0x1c
ret 8
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
pop esi
xor eax, eax
pop ebx
add esp, 0x1c
ret 8
Function at 0x411dd0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x24]
push 0
push 1
mov ebx, ecx
push 2
mov dword [esi + 0x14], 0
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
je 0x411ef9
lea ecx, [esp + 8]
mov dword [esp + 8], 1
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
test eax, eax
jne 0x411ef9
mov eax, dword [esi + 8]
push edi
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
lea edx, [esp + 0xc]
push 4
push edx
push 1
push 0xffff
push eax
call edi
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx + 0x78c]
test eax, eax
mov dword [esp + 0x28], eax
jle 0x411e73
mov eax, dword [esi + 8]
lea edx, [esp + 0x28]
push 4
push edx
push 0x1002
push 0xffff
push eax
call edi
test eax, eax
je 0x411e73
mov eax, dword [esp + 0x28]
cdq
sub eax, edx
sar eax, 1
test eax, eax
mov dword [esp + 0x28], eax
jg 0x411e47
mov ecx, dword [esp + 0x24]
push esi
push ecx
mov ecx, ebx
call fcn.00411f10
test eax, eax
pop edi
je 0x411eef
mov ax, word [esi + 0x10]
xor edx, edx
mov dword [esp + 0xc], edx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x10], edx
mov word [esp + 0xe], ax
mov eax, dword [esi + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
lea edx, [esp + 0xc]
push 0x10
push edx
push eax
mov word [esp + 0x18], 2
mov dword [esp + 0x1c], ecx
call dword [sym.imp.WSOCK32.dll_connect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x18], eax
jne 0x411ed6
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x411eef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], eax
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret 8
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret 8
Function at 0x416b40
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x10340]
mov edi, dword [ecx + 0x48]
mov eax, dword [ecx + 0x50]
mov ebx, dword [ecx + 0x30]
mov ebp, dword [ecx + 0x48]
mov edx, dword [ecx + 0x4c]
sub edi, eax
mov eax, dword [ecx + 0xc]
sub ebx, ebp
mov ebp, dword [ecx + 0x34]
sbb ebp, edx
test eax, eax
jne 0x416b8d
mov eax, dword [esi + 0x10288]
mov eax, dword [eax + 0x790]
sub eax, edi
cdq
cmp ebp, edx
jl 0x416b8d
jg 0x416b87
cmp ebx, eax
jbe 0x416b8d
mov ebx, eax
mov dword [esp + 0x14], edx
mov edx, dword [ecx + 0x58]
mov eax, dword [ecx]
push 0
add edx, edi
mov ecx, dword [eax + 8]
push ebx
push edx
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov ebp, eax
test ebp, ebp
jg 0x416bb2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esi + 0x10340]
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x416bd8
cmp dword [eax + 0x5c], 0xffffffff
jne 0x416bd8
mov ecx, esi
call fcn.00416a20
test eax, eax
jne 0x416bd8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 0x10340]
add edi, ebp
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x416c51
mov ebx, dword [ecx + 0x48]
mov eax, ebp
cdq
add ebx, eax
mov eax, dword [ecx + 0x4c]
adc eax, edx
mov edx, dword [ecx + 0x34]
cmp eax, edx
jg 0x416c10
jl 0x416c02
cmp ebx, dword [ecx + 0x30]
jae 0x416c10
mov edx, dword [esi + 0x10288]
cmp dword [edx + 0x790], edi
jne 0x416c51
mov edx, dword [ecx + 0x58]
lea eax, [esp + 0x10]
push 0
push eax
mov eax, dword [ecx + 0x5c]
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x416cd6
cmp edi, dword [esp + 0x10]
jne 0x416cd6
mov ecx, dword [esi + 0x10340]
mov eax, edi
cdq
mov edi, dword [ecx + 0x50]
add edi, eax
mov dword [ecx + 0x50], edi
mov eax, dword [ecx + 0x54]
adc eax, edx
mov dword [ecx + 0x54], eax
mov ecx, dword [esi + 0x10340]
mov eax, ebp
cdq
mov edi, dword [ecx + 0x48]
add edi, eax
mov dword [ecx + 0x48], edi
mov ebp, dword [ecx + 0x4c]
adc ebp, edx
mov dword [ecx + 0x4c], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x10340]
mov edx, eax
mov ecx, dword [ecx]
sub edx, dword [ecx + 0x20]
cmp edx, 0x3e8
jb 0x416c9b
mov dword [ecx + 0x20], eax
mov eax, dword [esi]
push 0
push 0
push 0x470
mov ecx, esi
call dword [eax + 0x100]
mov esi, dword [esi + 0x10340]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x34]
cmp ecx, eax
jl 0x416cc9
jg 0x416cb7
mov edx, dword [esi + 0x48]
mov eax, dword [esi + 0x30]
cmp edx, eax
jb 0x416cc9
mov eax, dword [esi + 8]
neg eax
sbb eax, eax
and al, 0xfe
add eax, 9
mov dword [esi + 0x84], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
mov edi, dword [esi]
push 0
push 0x455a78
push 0
push 0x7a
call fcn.0043e790
add esp, 8
mov ecx, esi
push eax
call dword [edi + 0xec]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x41d720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x444a88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push 0
push 0
push 0
lea ecx, [esp + 0x18]
call fcn.004402f0
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push ecx
push ebp
push ebx
mov dword [esp + 0x38], 0
call fcn.00410c30
add esp, 0x10
test eax, eax
jne 0x41d795
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00440320
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp + 0x38]
cmp eax, 8
ja case.default.0x41d79e
jmp dword [eax*4 + 0x41d870]
mov dword [esp + 0x34], 0x808080
jmp case.default.0x41d79e
mov dword [esp + 0x34], 0xb4b4f0
jmp case.default.0x41d79e
mov dword [esp + 0x34], 0xc8c8ff
jmp case.default.0x41d79e
mov dword [esp + 0x34], 0xc8a0a0
jmp case.default.0x41d79e
mov dword [esp + 0x34], 0xf0b4b4
jmp case.default.0x41d79e
mov dword [esp + 0x34], 0xe6e6e6
jmp case.default.0x41d79e
mov dword [esp + 0x34], 0xe6e6ff
jmp case.default.0x41d79e
mov dword [esp + 0x34], 0xffc8c8
jmp case.default.0x41d79e
mov dword [esp + 0x34], 0xffffff
xor eax, eax
push esi
test ebp, ebp
jle 0x41d83c
mov dl, byte [esp + 0x3a]
push edi
mov esi, eax
mov ecx, dword [esp + 0x20]
imul esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add esi, ecx
add esi, edi
test ebx, ebx
jle 0x41d836
mov di, word [esp + 0x3c]
mov ecx, esi
mov word [ecx], di
lea edi, [esi + 3]
mov byte [ecx + 2], dl
lea ecx, [ebx + ebx*2 - 3]
rep movsb byte es:[edi], byte [esi]
inc eax
cmp eax, ebp
jl 0x41d809
pop edi
lea edx, [esp + 0x10]
push edx
call fcn.00410cb0
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.00440320
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x41e650
Capabilities:
Get disk information

Disassembly:
sub esp, 0x3fc
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x40]
cmp eax, 0x23e
jne 0x41e6fc
mov eax, dword [esi]
lea ecx, [esp + 0xf8]
push 0x30c
push ecx
push 0x426
mov ecx, esi
call dword [eax + 0xb8]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x41e812
mov edx, dword [esi]
push 0
push 0
push 0xf0
push 0x424
mov ecx, esi
call dword [edx + 0x118]
test eax, eax
jne 0x41e812
lea eax, [esp + 0xf8]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
je 0x41e812
mov edi, dword [esi]
push 0
push 0x455a78
push 0
push 0x87
call fcn.00440480
add esp, 8
mov ecx, esi
push eax
call dword [edi + 0xe4]
pop edi
xor eax, eax
pop esi
add esp, 0x3fc
ret
cmp eax, 0x23f
jne 0x41e812
mov edx, dword [esi]
push ebx
lea eax, [esp + 0xac]
push 0x50
push eax
push 0x43d
mov ecx, esi
call dword [edx + 0xb8]
mov edx, dword [esi]
lea eax, [esp + 0xc]
push 0x50
push eax
push 0x40b
mov ecx, esi
call dword [edx + 0xb8]
mov edx, dword [esi]
lea eax, [esp + 0x5c]
push 0x50
push eax
push 0x40c
mov ecx, esi
call dword [edx + 0xb8]
lea edi, [esp + 0x5c]
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x41e77d
test cl, cl
je 0x41e779
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x41e77d
add eax, 2
add edi, 2
test cl, cl
jne 0x41e755
xor eax, eax
jmp 0x41e782
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
je 0x41e799
mov edi, dword [esi]
push 0
push 0x455a78
push 0
push 0x82
jmp 0x41e7f6
mov ecx, dword [esi + 0x50]
lea eax, [esp + 0xa8]
add ecx, 0x1660
push eax
push ecx
call fcn.0040fc30
add esp, 8
test eax, eax
jne 0x41e812
mov al, byte [esp + 0xa8]
test al, al
jne 0x41e7d2
mov al, byte [esp + 8]
test al, al
jne 0x41e7d2
mov al, byte [esp + 0x58]
test al, al
je 0x41e812
mov edx, dword [esi]
push 0x45b008
push 0x403
mov ecx, esi
call dword [edx + 0xc4]
mov edi, dword [esi]
push 0
push 0x455a78
push 0
push 0x81
call fcn.0043e790
add esp, 8
mov ecx, esi
push eax
call dword [edi + 0xec]
pop edi
xor eax, eax
pop esi
add esp, 0x3fc
ret
pop edi
mov eax, 1
pop esi
add esp, 0x3fc
ret
Function at 0x41e656
Capabilities:
Get disk information

Disassembly:
sub esp, 0x3fc
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x40]
cmp eax, 0x23e
jne 0x41e6fc
mov eax, dword [esi]
lea ecx, [esp + 0xf8]
push 0x30c
push ecx
push 0x426
mov ecx, esi
call dword [eax + 0xb8]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x41e812
mov edx, dword [esi]
push 0
push 0
push 0xf0
push 0x424
mov ecx, esi
call dword [edx + 0x118]
test eax, eax
jne 0x41e812
lea eax, [esp + 0xf8]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
je 0x41e812
mov edi, dword [esi]
push 0
push 0x455a78
push 0
push 0x87
call fcn.00440480
add esp, 8
mov ecx, esi
push eax
call dword [edi + 0xe4]
pop edi
xor eax, eax
pop esi
add esp, 0x3fc
ret
cmp eax, 0x23f
jne 0x41e812
mov edx, dword [esi]
push ebx
lea eax, [esp + 0xac]
push 0x50
push eax
push 0x43d
mov ecx, esi
call dword [edx + 0xb8]
mov edx, dword [esi]
lea eax, [esp + 0xc]
push 0x50
push eax
push 0x40b
mov ecx, esi
call dword [edx + 0xb8]
mov edx, dword [esi]
lea eax, [esp + 0x5c]
push 0x50
push eax
push 0x40c
mov ecx, esi
call dword [edx + 0xb8]
lea edi, [esp + 0x5c]
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x41e77d
test cl, cl
je 0x41e779
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x41e77d
add eax, 2
add edi, 2
test cl, cl
jne 0x41e755
xor eax, eax
jmp 0x41e782
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
je 0x41e799
mov edi, dword [esi]
push 0
push 0x455a78
push 0
push 0x82
jmp 0x41e7f6
mov ecx, dword [esi + 0x50]
lea eax, [esp + 0xa8]
add ecx, 0x1660
push eax
push ecx
call fcn.0040fc30
add esp, 8
test eax, eax
jne 0x41e812
mov al, byte [esp + 0xa8]
test al, al
jne 0x41e7d2
mov al, byte [esp + 8]
test al, al
jne 0x41e7d2
mov al, byte [esp + 0x58]
test al, al
je 0x41e812
mov edx, dword [esi]
push 0x45b008
push 0x403
mov ecx, esi
call dword [edx + 0xc4]
mov edi, dword [esi]
push 0
push 0x455a78
push 0
push 0x81
call fcn.0043e790
add esp, 8
mov ecx, esi
push eax
call dword [edi + 0xec]
pop edi
xor eax, eax
pop esi
add esp, 0x3fc
ret
pop edi
mov eax, 1
pop esi
add esp, 0x3fc
ret
Function at 0x426750
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x42676a
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x42676a
mov edx, dword [esp + 8]
push edx
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]