joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a840
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419d08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4251dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
mov byte [ebp - 0x15], 0
call fcn.00402130
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40a8aa
mov byte [ebp - 0x15], 0
jmp 0x40a905
mov edi, dword [ebp + 0x14]
xor esi, esi
mov dword [ebp - 0x14], 0
test edi, edi
je 0x40a8eb
lea ebx, [ebx]
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0
lea eax, [eax + esi*2]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a8eb
add esi, dword [ebp - 0x14]
cmp esi, edi
jb 0x40a8c0
cmp esi, edi
jne 0x40a8fe
mov eax, dword [ebp - 0x1c]
shr edi, 1
xor ecx, ecx
mov byte [ebp - 0x15], 1
mov word [eax + edi*2], cx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.004010d0
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ee55
mov esp, ebp
pop ebp
ret

Function at 0x40aca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4251dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
test ebx, ebx
jne 0x40accf
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ee55
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x40ad0b
lea ebx, [ebx]
push 0
lea eax, [ebp - 8]
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [ecx + esi]
push eax
push ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40ad0b
add esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
cmp esi, edi
jb 0x40ace0
mov ecx, dword [ebp - 4]
xor eax, eax
cmp esi, edi
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ee55
mov esp, ebp
pop ebp
ret
Function at 0x40c0b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a11c
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4251dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [ebp + 8]
push str.kernel32
mov dword [ebp - 0x224], 0
call esi
push str.kernel32
mov ebx, eax
mov dword [ebp - 0x21c], 0
call esi
mov ecx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test ecx, ecx
je 0x40c139
push str.IsWow64Process
push ecx
call eax
mov esi, eax
test esi, esi
je 0x40c134
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [ebp - 0x21c], 0
je 0x40c191
test ebx, ebx
je 0x40c191
push str.GetSystemWow64DirectoryW
push ebx
call eax
test eax, eax
je 0x40c191
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call eax
push 8
call fcn.0040eddc
add esp, 4
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x40c1d4
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
mov dword [eax], 0
call fcn.00401070
jmp 0x40c1d6
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 8
call fcn.0040eddc
add esp, 4
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x40c1d4
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
mov dword [eax], 0
call fcn.00401070
jmp 0x40c1d6
xor eax, eax
push eax
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
mov dword [0x42603c], eax
call fcn.00401000
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ee55
mov esp, ebp
pop ebp
ret
Function at 0x40c3e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a1a0
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x4251dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x41c], edi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x418]
push eax
push 0x20019
push 0
lea ecx, [ebp + 0x10]
mov dword [ebp - 4], 1
mov dword [ebp - 0x418], 0
call fcn.00402130
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x40c512
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x410]
push eax
push esi
push esi
lea ecx, [ebp + 0x18]
mov dword [ebp - 0x414], 0x400
call fcn.00402130
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x40c4e9
push dword [ebp - 0x414]
call fcn.0040eddc
add esp, 4
mov edi, eax
lea eax, [ebp - 0x414]
push eax
push edi
push 0
push 0
lea ecx, [ebp + 0x18]
call fcn.00402130
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x40c4d8
mov eax, dword [ebp - 0x414]
shr eax, 1
dec eax
push eax
push edi
mov ecx, ebx
call fcn.00401820
push edi
call fcn.0040ee50
mov edi, dword [ebp - 0x41c]
add esp, 4
jmp 0x40c506
cmp esi, 2
je 0x40c506
mov eax, dword [ebp - 0x414]
shr eax, 1
dec eax
push eax
lea eax, [ebp - 0x410]
push eax
mov ecx, ebx
call fcn.00401820
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x10]
mov dword [edi], esi
mov byte [ebp - 4], 0
call fcn.004010d0
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.004010d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ee55
mov esp, ebp
pop ebp
ret
Function at 0x40c550
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a1ee
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4251dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov dword [ebp - 4], 0
test eax, eax
je 0x40c59a
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [edi], 0
push 0
push 0x41b47c
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 0x228], 0
call fcn.00401d10
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.00402190
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00402190
cmp esi, eax
jne 0x40c651
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x40c5f4
xor bl, bl
jmp 0x40c667
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0
call fcn.00401070
sub esp, 8
lea eax, [ebp + 8]
mov ecx, esp
push eax
mov byte [ebp - 4], 2
call fcn.00401000
push 0x5c
lea ecx, [ebp - 0x220]
call fcn.004014e0
sub esp, 8
mov ecx, esp
push eax
call fcn.00401000
lea ecx, [ebp + 8]
call fcn.00401840
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call fcn.004010d0
lea ecx, [ebp + 8]
call fcn.00402130
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [edi], eax
setne bl
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0
call fcn.004010d0
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.004010d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ee55
mov esp, ebp
pop ebp
ret 8
Function at 0x414dca
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4251dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004139be
mov dword [ebp - 0x14], eax
cmp dword [0x426db8], edi
jne 0x414ebb
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x414e48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x414f9b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x414f9b
push 0x41e10c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414f9b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x426db8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x426dbc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x426dc0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x426dc8], eax
test eax, eax
je 0x414eb8
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x426dc4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x414ee0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x414ed3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x414ef5
push 4
pop eax
jmp 0x414f9d
cmp dword [ebp - 0x14], edi
je 0x414ef5
push dword [0x426db8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x414eda
mov eax, dword [0x426dc4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x414f53
cmp dword [0x426dc8], esi
je 0x414f53
push eax
call ebx
push dword [0x426dc8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x414f53
test eax, eax
je 0x414f53
call ecx
test eax, eax
je 0x414f48
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x414f48
test byte [ebp - 8], 1
jne 0x414f53
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x414f83
mov eax, dword [0x426dbc]
cmp eax, esi
je 0x414f80
push eax
call ebx
test eax, eax
je 0x414f80
call eax
mov edi, eax
test edi, edi
je 0x414f80
mov eax, dword [0x426dc0]
cmp eax, esi
je 0x414f80
push eax
call ebx
test eax, eax
je 0x414f80
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x426db8]
call ebx
test eax, eax
je 0x414f9b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x414f9d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ee55
leave
ret
Function at 0x45fc4d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420ff6
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00421080
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x45fca8
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x45fc9f
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x468a2c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4c4190]
jne 0x468a39
call fcn.00468b13
mov eax, dword [0x4c7ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c7ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x468a71
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c4190]
jne 0x468a83
call fcn.00468b13
mov eax, dword [0x4c7ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c7ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x468ac6
fadd qword [0x4bbac8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4bbaa0]
mov esp, ebp
pop ebp
ret

Function at 0x468ad6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4c7530], ecx
inc esi
mov ecx, 0x4c7530
mov edx, esi
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c7eec
jl 0x468ae7
mov dword [0x4c4190], esi
mov dword [0x4c7518], esi
pop esi
ret
Function at 0x4725e2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0x30], 0
je 0x4725f1
pop ebp
jmp fcn.004726b2
pop ebp
jmp fcn.004725f7

Function at 0x472990
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0xd0], 0
je 0x4729cd
cmp byte [ebp + 8], 0
je 0x4729cd
sub esp, 0x10
lea ecx, [esi + 0xd4]
call fcn.00471a2e
push esi
push 0
push 0x472a60
call fcn.00425efc
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], eax
sete al
jmp 0x4729d5
push dword [ebp + 8]
call fcn.00471c02
pop esi
pop ebp
ret 4
Function at 0x402ce4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x412020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402d7c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402d5c
xor eax, eax
push ebp
push 0x402d55
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402d98
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402d5c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x412020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x412020], ax
mov esp, ebp
pop ebp
ret
Function at 0x4049ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call fcn.004011c8
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404bdc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404a2f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404bdc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404a2f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404bf8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404ab8
xor eax, eax
push ebp
push 0x404ab1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004047f4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404a96
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404c18
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404a96
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ab8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call fcn.00401200
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call fcn.004011e8
push eax
call fcn.004011c0
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404bd2
cmp byte [ebp - 0xd], 0
jne 0x404aff
cmp byte [ebp - 0x12], 0
je 0x404bd2
lea eax, [ebp - 0x11d]
push eax
call fcn.00401208
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404b18
dec ebx
cmp byte [ebx], 0x2e
je 0x404b27
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404b17
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404bd2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404b64
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call fcn.00401200
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.004011f0
mov esi, eax
test esi, esi
jne 0x404bd2
cmp byte [ebp - 0xd], 0
je 0x404bd2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.00401200
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.004011f0
mov esi, eax
test esi, esi
jne 0x404bd2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.00401200
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.004011f0
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406c40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x409404
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
jle 0x40943d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004039e8
jmp 0x409446
mov eax, ebx
mov edx, esi
call fcn.0040394c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409450
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
jle 0x409471
mov al, byte [esp]
jmp 0x409473
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a858
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40a8bc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403b68
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_DeleteCriticalSection
mov edx, eax
pop eax
call fcn.00406978
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a8c3
lea eax, [ebp - 0xc]
call fcn.004038f8
ret
Function at 0x40cbd4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce8
push ebx
push esi
push edi
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
test byte [eax + 1], 0x20
jne 0x40cbfc
mov eax, 0x80070057
call fcn.0040cab4
mov eax, dword [ebp - 0x304]
mov ax, word [eax]
mov edx, eax
and dx, 0xfff
cmp dx, 0xc
jne 0x40cd38
mov edx, dword [ebp - 0x304]
test ah, 0x40
je 0x40cc34
mov eax, dword [ebp - 0x304]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x308], eax
jmp 0x40cc43
mov eax, dword [ebp - 0x304]
mov eax, dword [eax + 8]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
movzx eax, word [eax]
mov dword [ebp - 0x310], eax
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x40ccc8
inc ebx
xor edi, edi
lea esi, [ebp - 0x300]
mov eax, esi
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
add eax, 4
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x308]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
call fcn.0040cab4
lea eax, [ebp - 0x30c]
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x308]
push eax
call sub.KERNEL32.DLL_FreeLibrary
call fcn.0040cab4
mov eax, dword [ebp - 0x318]
mov edx, dword [ebp - 0x30c]
sub edx, dword [eax + 4]
inc edx
mov eax, dword [ebp - 0x318]
mov dword [eax], edx
inc edi
add esi, 8
dec ebx
jne 0x40cc66
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x40cced
inc ebx
lea eax, [ebp - 0x2fc]
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
mov dword [edx], ecx
add edx, 4
add eax, 8
dec ebx
jne 0x40cce0
push ebp
mov ebx, dword [ebp - 0x310]
dec ebx
mov eax, ebx
call fcn.0040cb48
pop ecx
test al, al
je 0x40cd2b
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x308]
push eax
call sub.KERNEL32.DLL_GetCommandLineA
call fcn.0040cab4
mov eax, dword [ebp - 0x314]
call fcn.0040cdcc
push ebp
mov eax, ebx
call fcn.0040cb78
pop ecx
test al, al
jne 0x40cced
mov eax, dword [ebp - 0x304]
push eax
call sub.KERNEL32.DLL_RtlUnwind
call fcn.0040cab4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ce74
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
mov dword [ebp - 0x308], ecx
mov ebx, edx
mov dword [ebp - 0x304], eax
test byte [ebx + 1], 0x20
jne 0x40ce9e
mov eax, 0x80070057
call fcn.0040cab4
mov ax, word [ebx]
mov edx, eax
and dx, 0xfff
cmp dx, 0xc
jne 0x40d025
test ah, 0x40
je 0x40cec4
mov eax, dword [ebx + 8]
mov eax, dword [eax]
mov dword [ebp - 0x314], eax
jmp 0x40cecd
mov eax, dword [ebx + 8]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
movzx eax, word [eax]
mov dword [ebp - 0x310], eax
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x40cf52
inc ebx
xor edi, edi
lea esi, [ebp - 0x300]
mov eax, esi
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
add eax, 4
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
call fcn.0040cab4
lea eax, [ebp - 0x30c]
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_FreeLibrary
call fcn.0040cab4
mov eax, dword [ebp - 0x320]
mov edx, dword [ebp - 0x30c]
sub edx, dword [eax + 4]
inc edx
mov eax, dword [ebp - 0x320]
mov dword [eax], edx
inc edi
add esi, 8
dec ebx
jne 0x40cef0
lea eax, [ebp - 0x300]
push eax
mov eax, dword [ebp - 0x310]
push eax
push 0xc
call sub.KERNEL32.DLL_FindClose
mov esi, eax
test esi, esi
jne 0x40cf72
call fcn.0040c80c
mov eax, dword [ebp - 0x304]
call fcn.0040cdcc
mov eax, dword [ebp - 0x304]
mov word [eax], 0x200c
mov eax, dword [ebp - 0x304]
mov dword [eax + 8], esi
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x40cfb6
inc ebx
lea eax, [ebp - 0x2fc]
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
mov dword [edx], ecx
add edx, 4
add eax, 8
dec ebx
jne 0x40cfa9
push ebp
mov ebx, dword [ebp - 0x310]
dec ebx
mov eax, ebx
call fcn.0040cde8
pop ecx
test al, al
je 0x40d016
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_GetCommandLineA
call fcn.0040cab4
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x100]
push eax
push esi
call sub.KERNEL32.DLL_GetCommandLineA
call fcn.0040cab4
mov eax, dword [ebp - 0x318]
mov edx, eax
mov eax, dword [ebp - 0x31c]
call dword [ebp - 0x308]
push ebp
mov eax, ebx
call fcn.0040ce18
pop ecx
test al, al
jne 0x40cfb6
jmp 0x40d037
push ebx
mov eax, dword [ebp - 0x304]
push eax
call sub.KERNEL32.DLL_UnhandledExceptionFilter
call fcn.0040cab4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret