joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454a60
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x407d80
mov eax, dword [0x7fcb80]
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebx, dword [esp + 8]
lea eax, [ebx + eax*8]
xor edx, eax
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor ecx, eax
imul eax, ecx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0xc], eax
ret
call fcn.004535d0
jmp 0x407d10
cmp byte [0x7fc9ef], 0
je 0x454a9b
mov eax, dword [esp + 4]
movq xmm0, qword [eax]
pinsrd xmm0, dword [esp + 8], 2
aesenc xmm0, xmmword [0x7fcc20]
aesenc xmm0, xmmword [0x7fcc30]
aesenc xmm0, xmmword [0x7fcc40]
movd dword [esp + 0xc], xmm0
ret
jmp 0x407d10

Function at 0x455730
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.00454960
call fcn.00432960
ret

Function at 0x455850
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x230
mov dword [esp], esp
mov dword [esp + 4], 0x230
call fcn.00455230
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.00455230
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xba0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x462d50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
test eax, eax
mov dword [0x8017a8], eax
je 0x462d96
mov dword [esp], 0x8017ac
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
add esp, 0x1c
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x3d
mov dword [esp + 4], 1
mov dword [esp], str.runtime:_failed_to_create_runtime_initialization_wait_event._n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x463417
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x304
mov ecx, dword [ebp + 8]
call fcn.004dd304
mov ecx, 0x8017cc
call fcn.0048ac00
test eax, eax
sete al
test al, al
je 0x463590
call fcn.004633d5
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x4634f8
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x2ec]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemWindowsDirectoryA
sub esp, 8
test eax, eax
sete al
test al, al
jne 0x4636ca
lea eax, [ebp - 0x5d]
mov ecx, eax
call fcn.004bbb70
lea eax, [ebp - 0x78]
lea edx, [ebp - 0x5d]
mov dword [esp + 4], edx
mov dword [esp], str.SysWOW64_
mov ecx, eax
call fcn.004e0910
sub esp, 8
lea eax, [ebp - 0x90]
lea edx, [ebp - 0x78]
mov dword [esp + 8], edx
lea edx, [ebp - 0x2ec]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004ef3e0
lea eax, [ebp - 0x90]
mov dword [esp], eax
mov ecx, 0x8017cc
call fcn.004e1000
sub esp, 4
lea eax, [ebp - 0x90]
mov ecx, eax
call fcn.004e0fc0
lea eax, [ebp - 0x78]
mov ecx, eax
call fcn.004e0fc0
lea eax, [ebp - 0x5d]
mov ecx, eax
call fcn.004bbba0
jmp 0x463590
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x2ec]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemDirectoryA
sub esp, 8
test eax, eax
sete al
test al, al
jne 0x4636cd
lea eax, [ebp - 0x29]
mov ecx, eax
call fcn.004bbb70
lea eax, [ebp - 0x44]
lea edx, [ebp - 0x29]
mov dword [esp + 4], edx
mov dword [esp], 0x7a36db
mov ecx, eax
call fcn.004e0910
sub esp, 8
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x44]
mov dword [esp + 8], edx
lea edx, [ebp - 0x2ec]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004ef3e0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
mov ecx, 0x8017cc
call fcn.004e1000
sub esp, 4
lea eax, [ebp - 0x5c]
mov ecx, eax
call fcn.004e0fc0
lea eax, [ebp - 0x44]
mov ecx, eax
call fcn.004e0fc0
lea eax, [ebp - 0x29]
mov ecx, eax
call fcn.004bbba0
lea eax, [ebp - 0x1e8]
mov dword [esp + 8], str..exe
mov dword [esp + 4], 0x8017cc
mov dword [esp], eax
call fcn.004ef4d0
lea eax, [ebp - 0x1e8]
mov ecx, eax
call fcn.0048aa60
mov edx, eax
lea eax, [ebp - 0x1d0]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x46364c
cmp dword [ebp - 0x10], 0
je 0x46364c
mov eax, dword [ebp - 0x1d0]
and eax, 0x10
test eax, eax
jne 0x463629
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x1d0]
add edx, 0x2c
mov dword [esp + 8], edx
mov dword [esp + 4], 0x8017cc
mov dword [esp], eax
call fcn.004ef4d0
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov ecx, dword [ebp + 8]
call fcn.004dd2d8
sub esp, 4
lea eax, [ebp - 0x28]
mov ecx, eax
call fcn.004e0fc0
lea eax, [ebp - 0x1d0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
setne al
test al, al
je 0x46364f
jmp 0x4635e1
nop
jmp 0x463650
nop
lea eax, [ebp - 0x1e8]
mov ecx, eax
call fcn.004e0fc0
jmp 0x4636ce
nop
jmp 0x4636ce
nop
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x46405d
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xb4
lea eax, [ebp - 0x30]
mov dword [esp], eax
call fcn.00463417
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x30]
mov ecx, eax
call fcn.00488f64
mov edx, eax
mov eax, dword [ebp - 0xc]
cmp edx, eax
seta al
test al, al
je 0x464234
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x84]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x84], 0x44
lea eax, [ebp - 0x30]
mov ecx, eax
call fcn.00488f64
sub eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00463339
mov edx, eax
lea eax, [ebp - 0x30]
mov dword [esp], edx
mov ecx, eax
call fcn.004dd35c
sub esp, 4
mov ecx, eax
call fcn.0048aa60
mov edx, eax
lea eax, [ebp - 0x40]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x84]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000004
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x464200
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], eax
call fcn.004636d6
cmp eax, 1
sete al
test al, al
je 0x4641d3
lea eax, [ebp - 0x24]
mov ecx, eax
call fcn.004dd304
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x30]
mov dword [esp], edx
mov ecx, eax
call fcn.004dd290
sub esp, 4
lea eax, [ebp - 0x24]
mov ecx, eax
call fcn.004dd31c
mov ebx, 1
jmp 0x464260
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x46422b
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
sub esp, 8
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x46422b
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x46422b
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
sub esp, 8
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
add dword [ebp - 0xc], 1
jmp 0x464079
lea eax, [ebp - 0x18]
mov ecx, eax
call fcn.004dd304
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x30]
mov dword [esp], edx
mov ecx, eax
call fcn.004dd290
sub esp, 4
lea eax, [ebp - 0x18]
mov ecx, eax
call fcn.004dd31c
mov ebx, 0
lea eax, [ebp - 0x30]
mov ecx, eax
call fcn.004dd31c
mov eax, ebx
jmp 0x464284
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x476ee0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x8021d8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x8021d0]
sub esp, 4
test ebx, ebx
je 0x476f2b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x476f24
test esi, esi
je 0x476f24
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x476f00
mov dword [esp], 0x8021d8
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x477110
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x477160
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x477238
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x47719e
cmp eax, 4
jne 0x4771c0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4771ae
cmp edx, 4
je 0x4771ae
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00477110
Function at 0x4792d0
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
xor esi, esi
sub esp, 0x14
mov eax, dword [0x8021d4]
test eax, eax
jne 0x476f60
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
test eax, eax
mov ebx, eax
je 0x476fbb
mov eax, dword [esp + 0x20]
mov dword [esp], 0x8021d8
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov eax, dword [0x8021d0]
sub esp, 4
mov dword [0x8021d0], ebx
mov dword [esp], 0x8021d8
mov dword [ebx + 8], eax
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
mov eax, esi
add esp, 0x14
pop ebx
pop esi
ret
mov esi, 0xffffffff
jmp 0x476f50
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x479300
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x47d5b0
add esp, 4
pop ebx
pop esi
jmp sub.KERNEL32.dll_GetLastError
mov eax, dword [esp + 8]
test eax, eax
je 0x47d5c0
jmp 0x476f40
xor eax, eax
ret

Function at 0x479340
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x479370
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x479394
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp sub.KERNEL32.dll_GetLastError
Function at 0x47ef80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1b
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x84]
mov esi, str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_http:__gcc.gnu.org_bugs.html_:_n
sub esp, 0x9c
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
lea eax, [edx + 1]
mov dword [ebp - 0x8c], eax
lea eax, [edx + 0x8a]
and eax, 0xfffffff0
call fcn.00478fb0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x84]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
movzx eax, word [esi]
mov word [edi], ax
movzx eax, byte [esi + 2]
mov byte [edi + 2], al
lea eax, [ebx + 0x6b]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x8c]
mov byte [ebx + eax + 0x6a], 0
mov dword [esp], ebx
call fcn.004eb500
nop
nop
nop
nop
nop
nop
nop
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x4fb6c4], 0
jne 0x47f054
mov byte [0x4fb6c4], 1
call fcn.004f1820
test eax, eax
je 0x47f0ee
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x1c], 0xffffffff
sete al
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.0046d620
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov ebp, eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
lea edi, [esi + 0x40]
mov dword [esp + 0xc], edi
call sub.msvcrt.dll_fwrite
cmp dword [esp + 0x1c], 0
mov dword [esp + 4], edi
je 0x47f04a
mov dword [esp], ebx
call sub.msvcrt.dll_fputs
lea eax, [esi + 0x40]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x7a37f1
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
cmp dword [esp + 0x1c], 0
je 0x47f081
call fcn.004f1c20
mov dword [esp], ebp
call sub.msvcrt.dll_fputs
jmp 0x47f01b
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
mov dword [esp], ebp
call sub.msvcrt.dll_free
jmp 0x47f045
call sub.msvcrt.dll_abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x47f0e9
Function at 0x402a4e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ebx, dword [ecx + 8]
mov dword [ebp - 0x18], edx
mov edx, dword [ecx + 4]
mov ecx, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xc6ef3720
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 0x20
mov ecx, eax
shl ecx, 4
add ecx, ebx
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 8]
add ecx, eax
shr eax, 5
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
xor eax, dword [ebp - 4]
xor edx, edx
xor eax, dword [ebp + 8]
mov dword [0xacf224], edx
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004029f1
mov edi, dword [ebp - 0xc]
mov eax, edi
shl eax, 4
cmp dword [0xadc964], 0x78c
mov dword [ebp + 8], eax
jne 0x402b0a
push edx
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
push edx
lea eax, [ebp - 0x82c]
push eax
push 0x4012b0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
or dword [0xacf22c], 0xffffffff
mov eax, edi
shr eax, 5
mov dword [0xacf228], 0xff6b3619
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x20]
add dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
xor dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
xor dword [ebp + 8], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00402a00
add dword [ebp - 8], 0x61c88647
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
jne 0x402a8d
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
leave
ret 8

Function at 0x402b6f
Capabilities:
Copy file
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push esi
xor esi, esi
cmp dword [0xadc964], 0x516
push edi
jne 0x402ba9
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x404]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov eax, dword [ebp + 0xc]
shr eax, 3
cmp eax, esi
jbe 0x402c16
mov edi, dword [ebp + 8]
push ebx
mov ebx, eax
cmp dword [0xadc964], 0xb7d
jne 0x402bdf
push esi
push esi
push esi
push esi
push 0x4012b8
push 0x4012f8
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
cmp dword [0xadc964], 0x1c
jne 0x402c06
push 0x40138c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
push dword [ebp + 0x10]
push edi
call fcn.00402a4e
add edi, 8
dec ebx
jne 0x402bb9
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x402c1c
Capabilities:
Connect pipe
Create directory
Create mailslot
Get common file path
Get disk information
Query environment variable
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2a00
call fcn.004034d0
cmp dword [0xadc964], 0x37
jne 0x402d85
push esi
push edi
xor eax, eax
xor esi, esi
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x50]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push esi
push esi
push esi
push 0x4013c0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xa00]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2200]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
lea eax, [ebp - 0xe4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x401424
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push esi
lea eax, [ebp - 0x1200]
push eax
push esi
call edi
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
lea eax, [ebp - 0x1e00]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
push esi
lea eax, [ebp - 0x2a00]
push eax
push esi
call edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
lea eax, [ebp - 0x1600]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x401450
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push esi
lea eax, [ebp - 0x600]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
push esi
push esi
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
pop edi
pop esi
mov eax, dword [ebp + 8]
mov ecx, dword [0xade4e8]
mov cl, byte [ecx + eax + 0x38d6]
mov edx, dword [0xacf220]
mov byte [edx + eax], cl
leave
ret 4
Function at 0x40318a
Capabilities:
Move file
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0xadc964], 0x26
push esi
jne 0x4031e1
xor esi, esi
push esi
push esi
push esi
call fcn.00403a2e
push esi
push esi
push esi
push esi
call fcn.00403993
push esi
call fcn.004038d2
push esi
call fcn.00403902
push esi
push esi
call fcn.004037c6
push esi
call fcn.00403667
push esi
call fcn.004038d2
add esp, 0x34
lea ecx, [ebp - 0x1c]
call fcn.00403367
call fcn.00403550
call fcn.00403506
mov eax, dword [0x416dd4]
mov ecx, dword [0x416008]
mov dword [0xadc964], eax
mov dword [0xade4e8], ecx
cmp eax, 0x81
jne 0x403278
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
push 0x4014a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
push esi
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00402ec8
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x406f2a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x7ffcc8]
jne 0x406f34
repz ret
jmp fcn.0040cb1c