joyce8/EMBER2024-capa huggingface dataset:
Function at 0x807a70
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00807c20
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x807b6e
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x807b11
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x807b54
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x807b28
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x807b43
test al, 0x40
je 0x807b3a
mov ecx, dword [edi + 0x20]
jmp 0x807b41
test al, 0x80
je 0x807b54
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x807b54
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x807ae0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x80833d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5d8ac8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5d87dc
or edi, edi
call fcn.005d8b0a
mov edx, 0xcdb76eb1
add edi, 0x948795be
or edi, edi
xor dword [esi], eax
mov edi, edx
add edx, 0x7947cb99
add esi, 2
or edx, edi
inc edx
add edx, edx
cmp esi, ecx
jl fcn.005d8ac8
and edx, edi
mov edi, 0x5d071ce
sub edi, 0x5c2abd47
ret
Function at 0x403444
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00413500
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0
jne 0x403462
xor al, al
jmp 0x4035cc
push ebx
push edi
push esi
call fcn.004035d3
push esi
call fcn.004187c3
pop ecx
push esi
mov edi, eax
call fcn.004035ff
test al, al
je 0x4034f4
push esi
call fcn.004035d3
test al, al
je 0x4034ab
lea eax, [edi + 4]
cmp dword [ebp + 0x10], eax
jbe 0x4035c8
push dword [ebp + 0x10]
push str.__
push dword [ebp + 0xc]
call fcn.004067b8
push dword [ebp + 0x10]
jmp 0x4035bb
push 0x5c
pop eax
cmp word [esi], ax
jne 0x4035c8
lea ebx, [esi + 2]
cmp word [ebx], ax
jne 0x4035c8
mov esi, dword [ebp + 0x10]
lea eax, [edi + 6]
cmp esi, eax
jbe 0x4035c8
push esi
push str.__
push dword [ebp + 0xc]
call fcn.004067b8
push esi
push 0x4285b4
push dword [ebp + 0xc]
call fcn.00406790
push esi
push ebx
jmp 0x4035bc
lea eax, [ebp - 0x1000]
mov ebx, 0x7ff
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4035c8
cmp eax, ebx
ja 0x4035c8
movzx eax, word [esi]
push eax
call fcn.00403635
test al, al
je 0x40355b
lea eax, [edi + 6]
mov edi, dword [ebp + 0x10]
cmp edi, eax
jbe 0x4035c8
push edi
push str.__
push dword [ebp + 0xc]
call fcn.004067b8
xor eax, eax
mov word [ebp - 0xffc], ax
lea eax, [ebp - 0x1000]
push edi
push eax
push dword [ebp + 0xc]
call fcn.00406790
jmp 0x4035ba
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.00403071
lea eax, [ebp - 0x1000]
push eax
call fcn.004187c3
add edi, 4
add eax, edi
mov edi, dword [ebp + 0x10]
pop ecx
cmp edi, eax
jbe 0x4035c8
push edi
push str.__
push dword [ebp + 0xc]
call fcn.004067b8
push edi
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call fcn.00406790
cmp word [esi], 0x2e
jne 0x4035ba
movzx eax, word [esi + 2]
push eax
call fcn.00403635
test al, al
je 0x4035ba
add esi, 4
push edi
push esi
push dword [ebp + 0xc]
call fcn.00406790
mov al, 1
jmp 0x4035ca
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4018bf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
shr edi, 2
xor ebx, ebx
mov eax, edi
mov dword [ebp - 4], 1
shr eax, 1
mov ecx, ebx
add eax, 3
mov dword [esi], eax
add esi, 0x10
test edi, edi
je 0x4018f6
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jb 0x4018e9
mov edx, dword [esi + edi*4 - 4]
imul eax, edi, 0xc
add eax, 0x70
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jne 0x401964
movzx eax, dl
mov ebx, dword [ebp - 4]
push 0x1b
movzx ecx, byte [eax + 0xa705c0]
mov eax, edx
shr eax, 0x18
shl ecx, 8
movzx eax, byte [eax + 0xa705c0]
or ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
shr edx, 8
shl ecx, 8
movzx eax, byte [eax + 0xa705c0]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0xa705c0]
xor edx, ebx
add ebx, ebx
or edx, ecx
test ebx, 0x100
pop eax
cmovne ebx, eax
mov dword [ebp - 4], ebx
mov ebx, edi
jmp 0x4019b1
cmp ebx, 4
jne 0x4019b4
cmp edi, 6
jbe 0x4019b4
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + 0xa705c0]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + 0xa705c0]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0xa705c0]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0xa705c0]
or edx, ecx
mov eax, dword [ebp + 8]
xor edx, dword [esi]
dec ebx
mov dword [esi + edi*4], edx
add esi, 4
cmp esi, eax
jne 0x401905
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402b17
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0xaaa06c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x368]
mov dword [ebp - 0x368], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402b57
cmp dword [ebp - 0x364], 6
jne 0x402b57
cmp dword [ebp - 0x360], 0
je 0x402b81
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402b81
push 0xc00
call eax
test eax, eax
jne 0x402c16
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402c16
cmp eax, 0x104
ja 0x402c16
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x402bc1
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.UXTHEME], 0
push esi
mov esi, str.UXTHEME
je 0x402c15
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov edx, edi
mov cl, byte [esi]
inc esi
movzx eax, cl
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x402bdc
push str..dll
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x402bda
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009f5f09
leave
ret
Function at 0x408e03
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.00a4b186
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x408e2f
call fcn.00408d15
mov esi, eax
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x40aee8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0x10]
xor ebx, ebx
lea ecx, [ebp - 4]
push 0x2002
mov dword [ebp - 4], ebx
call fcn.0040d996
test al, al
je 0x40af41
push esi
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40af40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.00a47600
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x40af40
mov dword [ebp - 4], ebx
mov bl, 1
pop esi
lea ecx, [ebp - 4]
call fcn.0040d9b9
mov al, bl
pop ebx
leave
ret 0xc

Function at 0x40af50
Capabilities:
Open clipboard

Disassembly:
push 0x18
mov eax, 0xa6bdc2
call fcn.009f61aa
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne al
mov byte [ebp + 0xb], al
test al, al
je 0x40b011
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x40b00e
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
lea eax, [eax*2 + 2]
push eax
push dword [esi]
push 0xd
call fcn.0040aee8
push 0
mov bl, al
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0040a4c9
mov ecx, dword [ebp - 0x14]
xor eax, eax
inc eax
inc ecx
push ecx
push dword [ebp - 0x18]
mov byte [ebp - 4], al
push eax
call fcn.0040aee8
push 1
pop edi
push edi
test al, al
movzx ebx, bl
push esi
lea eax, [ebp - 0x24]
cmovne ebx, edi
push eax
call fcn.0040a4c9
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00409521
push dword [ebp - 0x24]
call fcn.009f6165
mov eax, dword [ebp - 0x14]
pop ecx
inc eax
push eax
push dword [ebp - 0x18]
push 7
call fcn.0040aee8
push dword [ebp - 0x18]
test al, al
movzx ebx, bl
cmovne ebx, edi
call fcn.009f6165
pop ecx
jmp 0x40b017
mov al, byte [ebp + 0xb]
xor bl, bl
test al, al
je 0x40b01d
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
call fcn.009f6178
ret 8
Function at 0x40bbe5
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0xa6beba
call fcn.009f61aa
cmp byte [0xaae4d4], 0
mov edi, dword [ebp + 8]
jne 0x40bc21
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.0040a299
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.009f6165
pop ecx
test esi, esi
jmp 0x40bc2d
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bc33
mov al, 1
jmp 0x40bc79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40bc44
xor al, al
jmp 0x40bc79
lea ecx, [ebp - 0x50]
call fcn.0040c07e
lea ecx, [ebp - 0x28]
call fcn.004094fd
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0040c2e8
test al, al
je 0x40bc6e
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.009f6165
pop ecx
mov al, bl
call fcn.009f6178
ret 4

Function at 0x40bc81
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0xaae4d4], 0
jne 0x40bcb7
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.009f6165
pop ecx
test esi, esi
pop esi
jmp 0x40bcc4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bcca
mov al, 1
jmp 0x40bccc
xor al, al
leave
ret 4

Function at 0x40bcd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040c91e
cmp eax, 0xffffffff
je 0x40bcfd
mov ecx, eax
and cl, 0x11
cmp cl, 1
jne 0x40bcfd
and eax, 0xfffffffe
push eax
push esi
call fcn.0040bf9e
test al, al
je 0x40bd35
cmp byte [0xaae4d4], 0
push esi
jne 0x40bd27
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.009f6165
pop ecx
test esi, esi
jmp 0x40bd2f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40bd35
mov al, 1
jmp 0x40bd37
xor al, al
pop esi
leave
ret 4

Function at 0x40bef3
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0xaae4d4], 0
jne 0x40bf27
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.009f6165
pop ecx
test esi, esi
pop esi
jmp 0x40bf32
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40bf38
mov al, 1
jmp 0x40bf3a
xor al, al
leave
ret 4
Function at 0x40bf9e
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0xaae4d4], 0
jne 0x40bfd5
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.009f6165
pop ecx
test esi, esi
pop esi
jmp 0x40bfe3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40bfe9
mov al, 1
jmp 0x40bfeb
xor al, al
leave
ret 8

Function at 0x40c91e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0xaae4d4], 0
jne 0x40c952
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.009f6165
pop ecx
mov eax, esi
pop esi
jmp 0x40c965
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
leave
ret 4
Function at 0x40c9f0
Capabilities:
Get disk information

Disassembly:
push 0x2c
mov eax, 0xa6bfdc
call fcn.009f61aa
mov ecx, dword [ebp + 8]
call fcn.00408f10
cmp byte [0xaae4d4], 0
jne 0x40cadd
mov ecx, dword [ebp + 8]
call fcn.00408f10
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x40caf0
push edi
call fcn.009f615c
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x40cb92
cmp edi, dword [ebp - 0x18]
ja 0x40cb92
lea ecx, [ebp - 0x2c]
call fcn.0040933c
mov byte [ebp - 4], 1
test edi, edi
je 0x40cad3
xor eax, eax
mov dword [ebp - 0x14], edi
inc eax
mov ecx, edi
mov dword [ebp - 0x10], eax
cmp byte [esi + eax - 1], 0
jne 0x40cac4
lea eax, [ebx + esi]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00409571
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0040a257
mov edi, eax
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00408f92
mov ecx, dword [ebp + 8]
push edi
call fcn.00408ecc
push dword [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.009f6165
pop ecx
mov ecx, dword [ebp - 0x14]
mov eax, ebx
inc eax
sub ecx, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
jne 0x40ca78
mov edi, dword [ebp - 0x1c]
push dword [ebp - 0x2c]
cmp ebx, edi
jmp 0x40cb89
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x40caf7
xor al, al
jmp 0x40cb9b
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040c013
mov esi, dword [ebp - 0x1c]
push esi
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x40cb92
cmp edi, dword [ebp - 0x18]
ja 0x40cb92
lea ecx, [ebp - 0x38]
call fcn.004094fd
mov byte [ebp - 4], 4
mov edx, ebx
mov dword [ebp - 0x18], edx
mov eax, ebx
mov dword [ebp - 0x10], eax
test edi, edi
je 0x40cb84
push 2
pop ecx
mov dword [ebp - 0x14], ecx
cmp word [esi + ecx - 2], bx
jne 0x40cb73
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x38]
call fcn.004096a8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
inc eax
mov dword [ebp - 0x18], eax
call fcn.00408f92
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
call fcn.00408ecc
mov ecx, dword [ebp - 0x14]
mov edx, ecx
mov eax, dword [ebp - 0x10]
inc eax
add ecx, 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, edi
jb 0x40cb3d
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x38]
cmp edx, edi
sete bl
call fcn.009f6165
pop ecx
push esi
call fcn.009f6165
mov al, bl
pop ecx
call fcn.009f6178
ret 4
Function at 0x41e0a3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa6c699
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0xaaa06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00421936
lea ecx, [esi + 0x30]
call fcn.0041e046
push dword [esi + 0x24]
call fcn.009f6165
pop ecx
lea ecx, [esi + 0xc]
call fcn.00408e58
mov ecx, esi
call fcn.0041df5a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret

Function at 0x4223ad
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0xaaa06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
mov edx, 0x4011
test al, al
mov ecx, 0x4110
lea eax, [ebp - 0x164]
cmovne ecx, edx
push ecx
push 0x160
push eax
push 0x90
push 0xa708e4
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009f5f09
leave
ret 4
Function at 0x424939
Capabilities:
Get file system object information

Disassembly:
push 0x1d4
mov eax, 0xa6dcbe
call fcn.009f61dd
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1d4]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1a4], eax
call fcn.004094fd
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x4249be
push dword [edi + 0xc]
lea eax, [ebp - 0x1e0]
push dword [edi + 8]
push eax
call fcn.004247c7
push eax
push 0xdb0
lea eax, [ebp - 0x1b0]
mov byte [ebp - 4], 1
push eax
call fcn.00424788
push eax
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 2
call fcn.004095c8
push dword [ebp - 0x1b0]
call fcn.009f6165
push dword [ebp - 0x1e0]
mov byte [ebp - 4], 0
call fcn.009f6165
pop ecx
pop ecx
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1a0], eax
call fcn.00409fcf
mov esi, eax
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x1c8]
call fcn.004093a4
mov eax, dword [edi + 0x18]
lea ecx, [ebp - 0x1bc]
add eax, 2
mov byte [ebp - 4], 3
lea eax, [eax + esi*2]
push eax
call fcn.004094c7
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.004248d8
lea eax, [ebp - 0x1bc]
mov ecx, ebx
push eax
call fcn.004248d8
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00409429
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 5
call fcn.00409867
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0040979a
lea ecx, [ebp - 0x19c]
call fcn.00409867
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0040979a
lea ecx, [ebp - 0x19c]
call fcn.00409867
cmp byte [edi + 1], 0
je 0x424abc
push 0x3f4
lea eax, [ebp - 0x19c]
push eax
call fcn.004238cc
push 0xa71c94
lea ecx, [ebp - 0x19c]
call fcn.004097d8
push 0
lea eax, [ebp - 0x30]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.0040dde1
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x19c]
call fcn.004097d8
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
push dword [ebp - 0x19c]
push eax
call fcn.0040e812
push 0
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x1b0]
push eax
call fcn.0040a4c9
push 0x110
push 0x160
lea eax, [ebp - 0x190]
push eax
push 0x80
push dword [ebp - 0x1b0]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1b0]
mov esi, eax
call fcn.009f6165
pop ecx
test esi, esi
je 0x424b3d
push dword [ebp - 0x1a4]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x190]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x19c]
call fcn.009f6165
push dword [ebp - 0x1bc]
call fcn.009f6165
push dword [ebp - 0x1c8]
call fcn.009f6165
push dword [ebp - 0x1d4]
call fcn.009f6165
add esp, 0x10
call fcn.009f618c
ret 0xc