joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a5fa
Capabilities:
Copy file

Disassembly:
mov eax, 0x42a786
call fcn.0041c1e4
sub esp, 0x58
push ebx
push esi
mov esi, ecx
call fcn.004091c9
xor ebx, ebx
sub eax, ebx
je 0x40a656
dec eax
jne 0x40a6c8
mov eax, dword [ebp + 8]
cmp dword [eax + 0x28], 0x10
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
jb 0x40a624
mov edi, dword [eax + 0x14]
jmp 0x40a627
lea edi, [eax + 0x14]
cmp dword [esi + 0x28], 0x10
jb 0x40a632
mov ecx, dword [esi + 0x14]
jmp 0x40a635
lea ecx, [esi + 0x14]
lea edx, [ebp - 0x14]
push edx
push eax
xor eax, eax
cmp byte [ebp + 0xc], bl
sete al
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push eax
mov ecx, esi
call fcn.00408b39
pop edi
jmp 0x40a6c8
call fcn.00401388
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call fcn.004094e0
cmp byte [ebp + 0x10], bl
je 0x40a6c8
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.0040a393
mov esi, dword [ebp - 0x18]
mov dword [ebp - 4], ebx
jmp 0x40a6bb
mov eax, dword [esi + 8]
add eax, 0xffffffe4
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x64]
push eax
call fcn.0040974d
add esp, 0xc
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
push eax
call fcn.0040a5ec
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.00403cad
add esi, 0x48
cmp esi, dword [ebp - 0x14]
jne 0x40a685
lea ecx, [ebp - 0x1c]
call fcn.00404e4a
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x40a6d8
Capabilities:
Move file

Disassembly:
mov eax, 0x42a7a0
call fcn.0041c1e4
sub esp, 0x40
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp byte [ebp + 0xc], bl
push edi
mov edi, ecx
je 0x40a708
mov ecx, esi
call fcn.00408156
test al, al
je 0x40a708
push ebx
push ebx
mov ecx, esi
call fcn.0040a51b
lea eax, [ebp - 0x4c]
push eax
mov ecx, edi
call fcn.004085f4
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.004085f4
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
push eax
call fcn.0040ed6e
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp + 0xf], al
call fcn.00401ef6
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.00401ef6
cmp byte [ebp + 0xf], bl
je 0x40a76c
push 1
push ebx
push esi
mov ecx, edi
call fcn.0040a5ec
push ebx
push 1
mov ecx, edi
call fcn.0040a51b
jmp 0x40a7a3
cmp dword [esi + 0x28], 0x10
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
jb 0x40a77d
mov ecx, dword [esi + 0x14]
jmp 0x40a780
lea ecx, [esi + 0x14]
cmp dword [edi + 0x28], 0x10
jb 0x40a78b
mov eax, dword [edi + 0x14]
jmp 0x40a78e
lea eax, [edi + 0x14]
lea edx, [ebp - 0x14]
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push eax
mov ecx, edi
call fcn.00408b39
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40af7e
Capabilities:
Resume thread

Disassembly:
mov eax, 0x42a7c4
call fcn.0041c1e4
sub esp, 0x10
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x40afc0
lea ecx, [ebp - 0x1c]
call fcn.0040ab61
mov eax, dword [ebp - 0x18]
and dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
push 0x433620
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0x42dc08
call fcn.0041c394
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x40b208
Capabilities:
Get disk size

Disassembly:
mov eax, 0x42a832
call fcn.0041c1e4
sub esp, 0x2c
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x10]
call fcn.0040a836
and dword [ebp - 4], 0
cmp dword [esi + 0x18], 0x10
jb 0x40b230
mov esi, dword [esi + 4]
jmp 0x40b233
add esi, 4
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x40b271
lea ecx, [ebp - 0x28]
call fcn.0040ab61
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
push 0x433620
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0x42dc08
call fcn.0041c394
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40b292
Capabilities:
Get disk size

Disassembly:
mov eax, 0x42a832
call fcn.0041c1e4
sub esp, 0x2c
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x10]
call fcn.0040a836
and dword [ebp - 4], 0
cmp dword [esi + 0x18], 0x10
jb 0x40b2ba
mov esi, dword [esi + 4]
jmp 0x40b2bd
add esi, 4
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x40b2fb
lea ecx, [ebp - 0x28]
call fcn.0040ab61
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
push 0x433620
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0x42dc08
call fcn.0041c394
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40b29f
Capabilities:
Get disk size

Disassembly:
mov eax, 0x42a832
call fcn.0041c1e4
sub esp, 0x2c
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x10]
call fcn.0040a836
and dword [ebp - 4], 0
cmp dword [esi + 0x18], 0x10
jb 0x40b2ba
mov esi, dword [esi + 4]
jmp 0x40b2bd
add esi, 4
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x40b2fb
lea ecx, [ebp - 0x28]
call fcn.0040ab61
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
push 0x433620
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0x42dc08
call fcn.0041c394
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40b665
Capabilities:
Get disk information

Disassembly:
cmp dword [ecx + 0x18], 0x10
jb 0x40b670
mov eax, dword [ecx + 4]
jmp 0x40b673
lea eax, [ecx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
dec eax
je 0x40b696
dec eax
je 0x40b693
dec eax
je 0x40b68f
dec eax
je 0x40b68b
push 4
jmp 0x40b691
push 2
jmp 0x40b691
push 3
pop eax
ret
xor eax, eax
ret
xor eax, eax
inc eax
ret

Function at 0x40b8d0
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov eax, 0x42a897
call fcn.0041c1e4
sub esp, 0x40
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [ebp - 0x14]
call fcn.0040a836
and dword [ebp - 4], 0
lea eax, [ebp - 0x4c]
push eax
call fcn.0041434b
pop ecx
push 5
pop ecx
mov esi, eax
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x34], 6
jne 0x40b949
xor eax, eax
cmp dword [ebx + 0x18], 0x10
mov dword [ebp - 0x10], eax
jb 0x40b918
mov ebx, dword [ebx + 4]
jmp 0x40b91b
add ebx, 4
push eax
push eax
lea ecx, [ebp - 0x10]
push ecx
push eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x40b93e
lea ecx, [ebp - 0x24]
call fcn.0040ab61
mov byte [ebp - 4], 1
jmp 0x40b972
mov ebx, dword [ebp - 0x10]
shr ebx, 0x13
and bl, 1
jmp 0x40b9a2
cmp dword [ebx + 0x18], 0x10
jb 0x40b954
mov eax, dword [ebx + 4]
jmp 0x40b957
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x40b98d
lea ecx, [ebp - 0x24]
call fcn.0040ab61
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
push 0x433620
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x42dc08
call fcn.0041c394
mov ecx, ebx
call fcn.0040b665
cmp eax, 2
jne 0x40b9a0
mov bl, 1
test byte [ebp - 0x10], bl
jne 0x40b9a2
xor bl, bl
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40e334
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1260
call fcn.0041daa0
push ebx
push esi
lea eax, [ebp - 0x3c]
push edi
xor ebx, ebx
push eax
mov dword [ebp - 8], ebx
call fcn.0041434b
pop ecx
push 5
pop ecx
mov esi, eax
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x28]
call fcn.00407fe0
test al, al
je 0x40e450
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40e533
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcessModules
push eax
call esi
push str.GetModuleInformation
push dword [ebp - 4]
mov edi, eax
call esi
cmp edi, ebx
mov dword [ebp - 0xc], eax
je 0x40e533
cmp eax, ebx
je 0x40e533
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x40e533
lea ecx, [ebp - 0x10]
push ecx
push 0x1000
lea ecx, [ebp - 0x1260]
push ecx
push eax
call edi
test eax, eax
je 0x40e533
shr dword [ebp - 0x10], 2
je 0x40e533
lea edi, [ebp - 0x1260]
mov esi, fcn.0040e334
cmp dword [ebp + 8], 0
jne 0x40e40e
cmp dword [ebp - 8], 0
jne 0x40e533
push 0xc
lea eax, [ebp - 0x20]
push eax
push dword [edi]
push dword [ebp - 0x14]
call dword [ebp - 0xc]
test eax, eax
je 0x40e442
mov eax, dword [ebp - 0x20]
cmp eax, esi
ja 0x40e435
mov ecx, dword [ebp - 0x1c]
add ecx, eax
cmp ecx, esi
jbe 0x40e435
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40e442
push edi
call fcn.0040e074
inc ebx
add edi, 4
cmp ebx, dword [ebp - 0x10]
jb 0x40e3fe
jmp 0x40e533
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40e533
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push eax
call esi
push str.Module32First
push dword [ebp - 4]
mov edi, eax
call esi
push str.Module32Next
push dword [ebp - 4]
mov ebx, eax
call esi
test edi, edi
mov dword [ebp - 0xc], eax
je 0x40e533
test ebx, ebx
je 0x40e533
test eax, eax
je 0x40e533
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call edi
mov edi, eax
test edi, edi
je 0x40e533
mov esi, 0x224
push esi
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.0041c590
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push edi
mov dword [ebp - 0x260], esi
call ebx
test eax, eax
je 0x40e533
mov esi, fcn.0040e334
xor ecx, ecx
cmp dword [ebp + 8], ecx
jne 0x40e4f4
cmp dword [ebp - 8], ecx
jne 0x40e533
mov eax, dword [ebp - 0x24c]
cmp eax, esi
ja 0x40e513
mov edx, dword [ebp - 0x248]
add edx, eax
cmp edx, esi
jbe 0x40e513
mov eax, dword [ebp - 0x244]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], ecx
je 0x40e524
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.0040e074
lea eax, [ebp - 0x260]
push eax
push edi
call dword [ebp - 0xc]
test eax, eax
jne 0x40e4e8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e77b
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x42aa99
call fcn.0041c1e4
sub esp, 0x64
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
xor ebx, ebx
push 0x44
lea eax, [esi + 4]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [esi], 0x42ed24
call fcn.0041c590
push 0x10
lea eax, [esi + 0x48]
push ebx
push eax
call fcn.0041c590
mov eax, dword [ebp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 0x18
cmp eax, ebx
jne 0x40e7bb
push 0xfffffffffffffff6
call edi
jmp 0x40e7bd
mov eax, dword [eax]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0x18]
cmp eax, ebx
jne 0x40e7cd
push 0xfffffffffffffff5
call edi
jmp 0x40e7d0
mov eax, dword [eax + 4]
mov dword [esi + 0x40], eax
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
jne 0x40e7e0
push 0xfffffffffffffff4
call edi
jmp 0x40e7e3
mov eax, dword [eax + 4]
mov dword [esi + 0x44], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp + 0x17]
push eax
push ebx
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov byte [ebp + 0x17], 0x22
call fcn.004061f9
mov ecx, dword [ebp + 8]
call fcn.004286fc
cmp dword [eax + 0x18], 0x10
jb 0x40e81b
mov edi, dword [eax + 4]
jmp 0x40e81e
lea edi, [eax + 4]
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
call fcn.004286fc
mov ecx, eax
call fcn.00405648
push dword [ebp + 8]
mov eax, dword [eax]
push eax
push edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
call fcn.00405c97
lea eax, [ebp + 0x17]
push eax
push dword [ebp - 0x20]
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp + 0x17], 0x22
call fcn.004061f9
lea eax, [ebp + 0x17]
push eax
push dword [ebp - 0x20]
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp + 0x17], 0x20
call fcn.004061f9
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x18], 0x10
jb 0x40e87f
mov edi, dword [ecx + 4]
jmp 0x40e882
lea edi, [ecx + 4]
lea eax, [ebp + 0x14]
push eax
call fcn.00405648
push dword [ebp + 8]
mov eax, dword [eax]
push eax
push edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
call fcn.00405c97
lea eax, [ebp + 0x17]
push eax
push dword [ebp - 0x20]
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp + 0x17], bl
call fcn.004061f9
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00407ff9
test al, al
je 0x40e8c9
xor edi, edi
jmp 0x40e8df
mov ecx, dword [ebp + 0x10]
call fcn.004286fc
cmp dword [eax + 0x18], 0x10
jb 0x40e8dc
mov edi, dword [eax + 4]
jmp 0x40e8df
lea edi, [eax + 4]
push 0x42d3b8
lea ecx, [ebp - 0x70]
call fcn.00408f3d
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [esi + 0x48]
push eax
lea eax, [esi + 4]
push eax
push edi
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x24]
mov byte [ebp - 4], 2
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp + 8]
push eax
call fcn.00408b39
lea ecx, [ebp - 0x70]
call fcn.00403cad
lea ecx, [ebp - 0x28]
call fcn.0040ba0b
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x1c
Function at 0x40ea4f
Capabilities:
Get disk size

Disassembly:
mov eax, 0x42aada
call fcn.0041c1e4
sub esp, 0x60
mov ecx, dword [ecx]
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x6c]
push eax
xor esi, esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call fcn.0040e9e1
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.004286fc
cmp dword [eax + 0x18], 0x10
jb 0x40ea91
mov eax, dword [eax + 4]
jmp 0x40ea94
add eax, 4
push ebx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
lea ecx, [ebp - 0x6c]
mov ebx, eax
call fcn.00403cad
cmp ebx, edi
pop ebx
je 0x40eac5
mov esi, dword [ebp - 0x10]
imul esi, dword [ebp - 0x14]
mov dword [ebp - 0x20], edi
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40ebd3
Capabilities:
Get disk information

Disassembly:
mov eax, 0x42ab19
call fcn.0041c1e4
sub esp, 0x17c
push ebx
push esi
push edi
mov ebx, ecx
push 0x41
pop ecx
xor eax, eax
mov byte [ebp - 0x188], 0
lea edi, [ebp - 0x187]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx]
lea eax, [ebp - 0x80]
push eax
call fcn.0040e9e1
xor ecx, ecx
mov cl, byte [0x42ecae]
xor esi, esi
mov dword [ebp - 4], esi
push ecx
mov ecx, eax
call fcn.004286fc
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00408542
add esp, 0xc
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.00403cad
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x40ec41
lea eax, [ebp - 0x34]
push 0x104
lea ecx, [ebp - 0x188]
push ecx
push esi
push esi
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x40ec84
lea ecx, [ebp - 0x1c]
call fcn.0040ab61
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
push 0x433620
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], 0x42dc08
call fcn.0041c394
lea eax, [ebp - 0x188]
push str.NTFS
push eax
mov esi, 0x42eef0
call fcn.0041cab4
test eax, eax
pop ecx
pop ecx
jne 0x40eca7
mov esi, 0x42eeb0
jmp 0x40ecc3
lea eax, [ebp - 0x188]
push str.FAT32
push eax
call fcn.0041cab4
test eax, eax
pop ecx
pop ecx
jne 0x40ecc3
mov esi, 0x42ee68
mov ecx, dword [ebx]
call fcn.0040b208
jmp 0x40ecd9
cmp edx, ecx
jl 0x40ece4
jg 0x40ecd6
cmp eax, edi
jb 0x40ece4
add esi, 0x10
mov edi, dword [esi]
mov ecx, dword [esi + 4]
mov ebx, edi
or ebx, ecx
jne 0x40eccc
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
push 0
lea ecx, [ebp - 0x38]
push 1
call fcn.00401ef6
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov edx, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40f366
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x42ac1d
call fcn.0041c1e4
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
push 8
pop ecx
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x34], ebx
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp + 0x14]
xor ecx, ecx
push ecx
push eax
push edi
push dword [ebp + 0x10]
mov dword [esi], eax
call fcn.0041cb50
xor ecx, ecx
push ecx
push dword [ebp - 0x18]
push edx
push eax
call fcn.0041cc00
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0xc], edx
mov edx, dword [ebp + 0x10]
sub edx, eax
sbb edi, dword [esi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x18]
add edx, eax
adc edi, ecx
mov dword [esi + 0x18], eax
mov al, byte [ebp + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edi
mov byte [esi + 0x20], al
mov dword [ebp + 0x1c], 1
call fcn.004286fc
cmp dword [eax + 0x18], 0x10
jb 0x40f3fa
mov ecx, dword [eax + 4]
jmp 0x40f3fd
lea ecx, [eax + 4]
push dword [ebp + 8]
mov dl, byte [ebp + 0xc]
neg dl
lea eax, [ebp + 0x1c]
push eax
push ebx
push 0x80
push 3
push dword [ebp + 0x20]
sbb edx, edx
mov eax, 0xc0000000
and edx, eax
push 3
add edx, eax
push edx
push ecx
lea edi, [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
mov ecx, edi
call fcn.0040f176
mov eax, dword [edi]
lea ecx, [ebp + 8]
push ecx
xor ecx, ecx
cmp byte [ebp + 0xc], bl
push ebx
sete cl
push ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
lea edi, [esi + 0x28]
lea ecx, [ecx + ecx + 2]
push ecx
push dword [ebp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push eax
mov ecx, edi
call fcn.0040ab8b
push dword [esi + 0x10]
mov eax, dword [esi + 8]
push dword [esi + 8]
mov edx, dword [esi + 0xc]
mov edi, dword [edi]
mov cl, 0x20
mov byte [ebp - 4], 1
call fcn.0041ce80
push eax
xor eax, eax
cmp byte [ebp + 0xc], bl
sete al
lea eax, [eax + eax + 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
sub ecx, dword [esi + 8]
mov dword [esi + 0x2c], eax
add ecx, dword [ebp + 0x10]
cmp eax, ebx
mov dword [esi + 0x30], ecx
jne 0x40f4cc
lea ecx, [ebp + 0x18]
call fcn.0040ab61
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0x14], eax
push 0x433620
lea eax, [ebp + 0x10]
push eax
mov byte [ebp - 4], 2
mov dword [ebp + 0x10], 0x42dc08
call fcn.0041c394
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x1c
Function at 0x410212
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x28]
push edi
lea edi, [esi + 0x48]
push edi
call fcn.0040bfe2
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 8], 6
je 0x410258
mov esi, dword [esi + 0x28]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov al, 1
test byte [ecx + esi + 8], al
jne 0x4102b0
lea ecx, [ebp - 4]
call fcn.0040f8d8
push 0x434c64
lea eax, [ebp - 4]
push eax
call fcn.0041c394
mov al, byte [edi]
cmp al, 0x20
je 0x4102ae
cmp al, 9
je 0x4102ae
cmp al, 0xd
jne 0x41026a
add al, 0xf6
jmp 0x4102b0
cmp al, 0x3b
jne 0x410272
add al, 0xca
jmp 0x4102b0
cmp al, 0x2c
jne 0x41027a
add al, 0xdd
jmp 0x4102b0
cmp al, 0x5b
jne 0x410282
add al, 0xab
jmp 0x4102b0
cmp al, 0x5d
jne 0x41028a
add al, 0xaa
jmp 0x4102b0
cmp al, 0xa
jne 0x410292
add al, 0xfa
jmp 0x4102b0
cmp al, 0x3d
jne 0x41029a
add al, 0xcb
jmp 0x4102b0
cmp al, 0x5e
jne 0x4102a2
add al, 0xac
jmp 0x4102b0
cmp al, 0x1f
seta al
dec al
and eax, 0xb
jmp 0x4102b0
mov al, 2
pop edi
pop esi
leave
ret

Function at 0x41434b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xb0
push esi
push edi
push 0x14
xor edi, edi
lea eax, [ebp + 0x60]
push edi
push eax
call fcn.0041c590
mov esi, 0x94
push esi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.0041c590
add esp, 0x18
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x414412
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
push 5
pop ecx
xor esi, esi
push 2
inc esi
mov dword [ebp + 0x70], eax
mov eax, dword [ebp - 0x38]
pop edi
cmp dword [ebp - 0x2c], edi
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x6c], edx
jne 0x4143d7
cmp eax, ecx
jne 0x4143cb
cmp edx, esi
jb 0x4143c2
mov dword [ebp + 0x64], 6
jmp 0x4143fb
test edx, edx
jne 0x41440c
mov dword [ebp + 0x64], ecx
jmp 0x4143fb
push 4
pop edx
cmp eax, edx
jne 0x41440c
mov dword [ebp + 0x64], edx
jmp 0x4143fb
cmp dword [ebp - 0x2c], esi
jne 0x41440c
cmp edx, 0x5a
jne 0x4143ea
mov dword [ebp + 0x64], 3
jmp 0x4143fb
cmp edx, 0xa
jne 0x4143f4
mov dword [ebp + 0x64], edi
jmp 0x4143fb
test edx, edx
jne 0x41440c
mov dword [ebp + 0x64], esi
mov eax, dword [ebp + 0x7c]
lea esi, [ebp + 0x60]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
add ebp, 0x74
leave
ret
and dword [ebp + 0x7c], 0
jmp 0x414415
mov dword [ebp + 0x7c], edi
lea eax, [ebp + 0x7c]
push eax
lea ecx, [ebp + 0x58]
call fcn.00414337
push 0x434a88
lea eax, [ebp + 0x58]
push eax
call fcn.0041c394
int3
Function at 0x418ede
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x42b80d
call fcn.0041c1e4
sub esp, 0x20
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040af0f
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [esi], 0x42f54c
mov dword [esi + 0x10], eax
mov dword [ebp - 4], edi
mov dword [esi + 0x14], edi
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.00401824
mov byte [ebp - 4], 2
call fcn.00401388
push eax
push edi
lea eax, [ebp - 0x2c]
push eax
lea ecx, [esi + 0x18]
call fcn.0040b52e
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401ef6
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8