joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6a0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404028
xor eax, eax
push ebp
push 0x4c6b7e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004c68e8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040960c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004095d8
cmp dword [ebp - 0xc], 0
je 0x4c6b19
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00408f00
mov edx, dword [ebp - 0x14]
mov eax, 0x4c6b94
call fcn.00404160
test eax, eax
jg 0x4c6a97
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00408f00
mov edx, dword [ebp - 0x18]
mov eax, 0x4c6ba4
call fcn.00404160
test eax, eax
jle 0x4c6acb
push 3
mov eax, dword [ebp - 0x10]
call fcn.00404038
push eax
mov eax, dword [ebp - 4]
call fcn.00404038
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404038
push eax
push 0x4c6bac
mov eax, ebx
call fcn.00437f60
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4c6b63
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004ca398
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov edx, 0x4c6bbc
call fcn.00403ec0
push 3
mov eax, dword [ebp - 0x10]
call fcn.00404038
push eax
mov eax, dword [ebp - 4]
call fcn.00404038
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404038
push eax
push 0x4c6bac
mov eax, ebx
call fcn.00437f60
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4c6b63
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00408f00
mov edx, dword [ebp - 0x20]
mov eax, 0x4c6b94
call fcn.00404160
test eax, eax
jne 0x4c6b45
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4c6b94
call fcn.00403ec0
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404038
push eax
push 0
mov eax, ebx
call fcn.00437f60
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6b85
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00403c18
ret
Function at 0x4ca9a8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404028
xor eax, eax
push ebp
push 0x4cabad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
shl eax, 8
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
add eax, edx
cmp eax, 0xc2e8
jge 0x4caa97
cmp eax, 0xb7a2
jge 0x4caa3a
cmp eax, 0xb2c1
jge 0x4caa0f
add eax, 0xffff4f5f
sub eax, 0x24
jb 0x4cab39
sub eax, 0x1fc
jb 0x4cab3d
jmp 0x4cab95
add eax, 0xffff4d3f
sub eax, 0x22d
jb 0x4cab41
sub eax, 0x1fc
jb 0x4cab45
sub eax, 0xb8
jb 0x4cab49
jmp 0x4cab95
cmp eax, 0xbbf7
jge 0x4caa6c
add eax, 0xffff485e
sub eax, 0x11f
jb 0x4cab4d
sub eax, 0x13d
jb 0x4cab51
sub eax, 0x1f9
jb 0x4cab55
jmp 0x4cab95
add eax, 0xffff4409
sub eax, 0x3af
jb 0x4cab59
sub eax, 0x106
jb 0x4cab5d
sub eax, 0x23c
jb 0x4cab61
jmp 0x4cab95
cmp eax, 0xc8f6
jge 0x4caaf7
cmp eax, 0xc5be
jge 0x4caace
add eax, 0xffff3d18
sub eax, 0x1db
jb 0x4cab65
sub eax, 0xf3
jb 0x4cab69
sub eax, 8
jb 0x4cab6d
jmp 0x4cab95
add eax, 0xffff3a42
sub eax, 0x11c
jb 0x4cab71
sub eax, 0x1e1
jb 0x4cab75
sub eax, 0x3b
jb 0x4cab79
jmp 0x4cab95
cmp eax, 0xcef4
jge 0x4cab1a
add eax, 0xffff370a
sub eax, 0x304
jb 0x4cab7d
sub eax, 0x1e0
jb 0x4cab81
sub eax, 0x11a
jb 0x4cab85
jmp 0x4cab95
add eax, 0xffff310c
sub eax, 0x295
jb 0x4cab89
add eax, 0xffffffd0
sub eax, 0x318
jb 0x4cab8d
sub eax, 0x329
jb 0x4cab91
jmp 0x4cab95
mov bl, 0x41
jmp 0x4cab97
mov bl, 0x42
jmp 0x4cab97
mov bl, 0x43
jmp 0x4cab97
mov bl, 0x44
jmp 0x4cab97
mov bl, 0x45
jmp 0x4cab97
mov bl, 0x46
jmp 0x4cab97
mov bl, 0x47
jmp 0x4cab97
mov bl, 0x48
jmp 0x4cab97
mov bl, 0x4a
jmp 0x4cab97
mov bl, 0x4b
jmp 0x4cab97
mov bl, 0x4c
jmp 0x4cab97
mov bl, 0x4d
jmp 0x4cab97
mov bl, 0x4e
jmp 0x4cab97
mov bl, 0x4f
jmp 0x4cab97
mov bl, 0x50
jmp 0x4cab97
mov bl, 0x51
jmp 0x4cab97
mov bl, 0x52
jmp 0x4cab97
mov bl, 0x53
jmp 0x4cab97
mov bl, 0x54
jmp 0x4cab97
mov bl, 0x57
jmp 0x4cab97
mov bl, 0x58
jmp 0x4cab97
mov bl, 0x59
jmp 0x4cab97
mov bl, 0x5a
jmp 0x4cab97
mov bl, 0x20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cabb4
lea eax, [ebp - 4]
call fcn.00403bf4
ret
Function at 0x40145c
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x40146e
mov eax, dword [0x49908b]
shl eax, 2
mov dword [0x49908f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004867ac
pop edx
call fcn.00486710
call fcn.004867ec
push 0
call fcn.00487dfc
pop ecx
push 0x499034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x499093], eax
push 0
jmp fcn.004916d4

Function at 0x401c1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push dword [0x4990c0]
call fcn.00486e0c
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0xc]
jge 0x401c62
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 4]
mov ecx, dword [0x4990c0]
mov al, byte [ecx + edx]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
xor byte [edx + ecx], al
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jl 0x401c3e
pop ecx
pop ecx
pop ebp
ret

Function at 0x401cbc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov eax, 0x4994ec
call fcn.0048715c
mov dword [ebp - 0x1c], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.00496224
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 8
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x3c]
push edx
push 0
push 0
push 0x499156
call sub.KERNEL32.DLL_GetVolumeInformationA
push 0xa
lea ecx, [ebp - 0x50]
push ecx
push dword [ebp - 0x3c]
call fcn.0048ea00
add esp, 0xc
push 0
push 0x14
lea eax, [ebp - 0x50]
push eax
call fcn.00401c68
add esp, 0xc
mov word [ebp - 0x28], 0x14
push 2
push 0x40000000
lea eax, [ebp - 0x14]
call fcn.00401800
push eax
inc dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov edx, dword [0x4990d0]
call fcn.004961ec
inc dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
lea eax, [ebp + 8]
pop ecx
call fcn.004963e8
lea eax, [ebp - 0x14]
call fcn.00401de4
push eax
lea edx, [ebp - 0xc]
push edx
call fcn.00411f84
add esp, 0x10
inc dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00496390
dec dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00496390
mov word [ebp - 0x28], 8
push 0x14
lea ecx, [ebp - 0x50]
push ecx
lea eax, [ebp - 0xc]
push eax
call fcn.00412010
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
call fcn.004120d0
pop ecx
dec dword [ebp - 0x1c]
push 2
lea ecx, [ebp - 0xc]
push ecx
call fcn.00412058
add esp, 8
dec dword [ebp - 0x1c]
lea eax, [ebp + 8]
mov edx, 2
call fcn.00496390
mov ecx, dword [ebp - 0x38]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x401e60
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401ed2
push dword [ebp - 8]
push dword [ebp + 8]
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401ed2
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 4], eax
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0x10]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_CloseHandle
mov esp, ebp
pop ebp
ret

Function at 0x40205c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov eax, 0x4995d4
call fcn.0048715c
mov dword [ebp - 0x14], 2
lea edx, [ebp + 0x10]
lea eax, [ebp + 0x10]
call fcn.00496224
inc dword [ebp - 0x14]
mov word [ebp - 0x20], 8
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.00496224
inc dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x436770]
call fcn.0043681c
mov dword [ebp - 0x34], eax
mov edx, reloc.WSOCK32.DLL_bind
mov eax, dword [ebp - 0x34]
call fcn.00496150
mov word [ebp - 0x20], 0x14
mov edx, 0x499285
lea eax, [ebp - 4]
call fcn.004961ec
inc dword [ebp - 0x14]
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
call fcn.00436924
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00496390
cmp byte [ebp + 8], 0
je 0x402115
mov word [ebp - 0x20], 0x20
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x34]
call fcn.00436c48
mov word [ebp - 0x20], 8
jmp 0x402144
mov word [ebp - 0x20], 0x2c
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x34]
call fcn.00436bc0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x34]
call fcn.00436a48
mov word [ebp - 0x20], 8
jmp 0x402144
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x402171
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov dword [ebp - 8], edx
mov word [ebp - 0x20], 0x44
mov edx, 3
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x20], 0x38
dec dword [ebp - 0x14]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00496390
dec dword [ebp - 0x14]
lea eax, [ebp + 0x10]
mov edx, 2
call fcn.00496390
mov ecx, dword [ebp - 0x30]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410870
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], 0x1f4
push 0x497e40
call sub.KERNEL32.DLL_GetPriorityClass
mov dword [ebp - 0x10], eax
push 0x497e4c
call sub.KERNEL32.DLL_GetThreadPriority
mov dword [ebp - 0x14], eax
push 0x100
push 0x497e40
call sub.KERNEL32.DLL_SetPriorityClass
push 0xf
push 0x497e4c
call sub.KERNEL32.DLL_SetThreadPriority
push 0xa
call sub.KERNEL32.DLL_Sleep
rdtsc
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.KERNEL32.DLL_Sleep
rdtsc
sub eax, dword [ebp - 0xc]
sbb edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
push dword [ebp - 0x14]
push 0x497e4c
call sub.KERNEL32.DLL_SetThreadPriority
push dword [ebp - 0x10]
push 0x497e40
call sub.KERNEL32.DLL_SetPriorityClass
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 0x18], edx
fild qword [ebp - 0x1c]
fld xword [0x410910]
fmulp st(1)
mov esp, ebp
pop ebp
ret
Function at 0x41091c
Capabilities:
Get cpu information
Get hostname
Get memory capacity
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7b8
mov eax, 0x49e160
call fcn.0048715c
mov dword [ebp - 0x2c], 0x100
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x728]
push ecx
call sub.KERNEL32.DLL_GetComputerNameA
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x334]
push edx
call sub.ADVAPI32.DLL_GetUserNameA
mov dword [ebp - 0x2c], 0x100
lea ecx, [ebp - 0x30]
push ecx
push 0x20019
push 0
push str.hardwareDESCRIPTION_systemCentralProcessor0
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x134]
push edx
push 0
push 0
push str.Identifier
push dword [ebp - 0x30]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x2c], 0x100
mov byte [ebp - 0x828], 0
push dword [ebp - 0x30]
call sub.ADVAPI32.DLL_RegCloseKey
lea ecx, [ebp - 0x30]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x828]
push edx
push 0
push 0
push str.version
push dword [ebp - 0x30]
call sub.ADVAPI32.DLL_RegQueryValueExA
lea ecx, [ebp - 0x828]
push ecx
lea eax, [ebp - 0x628]
push eax
call fcn.00486ddc
add esp, 8
lea edx, [ebp - 0x30]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x828]
push eax
push 0
push 0
push str.ProductName
push dword [ebp - 0x30]
call sub.ADVAPI32.DLL_RegQueryValueExA
lea edx, [ebp - 0x828]
push edx
lea ecx, [ebp - 0x628]
push ecx
call fcn.00486d00
add esp, 8
push dword [ebp - 0x30]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [ebp - 0x848], 0x20
lea eax, [ebp - 0x848]
push eax
call sub.KERNEL32.DLL_GlobalMemoryStatus
call fcn.00410870
call fcn.0048e710
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x830]
test edx, edx
jns 0x410a7c
add edx, 0xfffff
sar edx, 0x14
push edx
mov ecx, dword [ebp - 0x840]
test ecx, ecx
jns 0x410a90
add ecx, 0xfffff
sar ecx, 0x14
push ecx
push 0x49e0d1
lea eax, [ebp - 0x234]
push eax
call fcn.0048aa98
add esp, 0x10
lea edx, [ebp - 0x234]
push edx
lea ecx, [ebp - 0x628]
push ecx
push dword [ebp - 0x34]
lea eax, [ebp - 0x134]
push eax
lea edx, [ebp - 0x334]
push edx
lea ecx, [ebp - 0x728]
push ecx
push 0x49e0f0
lea eax, [ebp - 0x528]
push eax
call fcn.0048aa98
add esp, 0x20
mov word [ebp - 0x18], 8
lea edx, [ebp - 0x528]
lea eax, [ebp - 4]
call fcn.004961ec
mov edx, eax
inc dword [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.004963c0
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x14
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00496390
pop eax
mov word [ebp - 0x18], 8
inc dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x41146c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
mov eax, 0x49e364
call fcn.0048715c
push dword [ebp + 8]
call fcn.004113c0
pop ecx
mov dword [ebp - 0x164], 0x128
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4114b5
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
mov eax, edx
jmp 0x4115c4
lea ecx, [ebp - 0x164]
push ecx
push dword [ebp - 0x34]
call sub.KERNEL32.DLL_Process32First
test eax, eax
setne al
and eax, 1
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x4115ba
push 8
call fcn.00485e3c
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x411516
mov word [ebp - 0x20], 0x14
mov eax, dword [ebp - 4]
call fcn.00401800
inc dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 4
call fcn.00401800
inc dword [ebp - 0x14]
add dword [ebp - 0x14], 0xfffffffe
mov word [ebp - 0x20], 8
mov edx, dword [ebp - 4]
jmp 0x411519
mov edx, dword [ebp - 4]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x3c]
call fcn.0042bbd0
mov word [ebp - 0x20], 0x20
lea edx, [ebp - 0x140]
lea eax, [ebp - 8]
call fcn.004961ec
mov edx, eax
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
call fcn.004963c0
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00496390
mov word [ebp - 0x20], 0x2c
lea eax, [ebp - 0xc]
call fcn.00401800
mov edx, eax
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x15c]
call fcn.00409070
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x3c]
add eax, 4
call fcn.004963c0
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00496390
lea ecx, [ebp - 0x164]
push ecx
push dword [ebp - 0x34]
call sub.KERNEL32.DLL_Process32Next
test eax, eax
setne al
and eax, 1
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
jne 0x4114d9
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret

Function at 0x4115c8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0xc]
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4115f4
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
je 0x4115f4
mov al, 1
pop ecx
pop ebp
ret
xor eax, eax
pop ecx
pop ebp
ret
Function at 0x411d64
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [edx + str.80_]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
and eax, 7
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
sar edx, 3
mov ecx, dword [ebp + 8]
xor eax, eax
mov al, byte [ecx + edx]
mov edx, dword [ebp - 0x10]
and ax, word [edx*2 + 0x49e558]
je 0x411da8
mov cl, 1
jmp 0x411daa
xor ecx, ecx
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x4c], cl
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x38
jl 0x411d72
xor edx, edx
mov dword [ebp - 4], edx
cmp word [ebp + 0xc], 1
jne 0x411dd5
mov eax, 0xf
sub eax, dword [ebp - 4]
add eax, eax
mov dword [ebp - 0x10], eax
jmp 0x411ddd
mov edx, dword [ebp - 4]
add edx, edx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp + eax*4 - 0x104], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x104], edx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 4]
xor edx, edx
mov dl, byte [eax + 0x49e600]
add edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0x1c
jge 0x411e29
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + ecx - 0x4c]
mov edx, dword [ebp - 8]
mov byte [ebp + edx - 0x84], al
jmp 0x411e3a
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + ecx - 0x68]
mov edx, dword [ebp - 8]
mov byte [ebp + edx - 0x84], al
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1c
jl 0x411dff
mov dword [ebp - 8], 0x1c
mov ecx, dword [ebp - 4]
xor eax, eax
mov al, byte [ecx + 0x49e600]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x38
jge 0x411e74
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x4c]
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x84], cl
jmp 0x411e85
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x68]
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x84], cl
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x38
jl 0x411e4a
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
xor eax, eax
mov al, byte [ecx + 0x49e610]
cmp byte [ebp + eax - 0x84], 0
je 0x411ebc
mov edx, dword [ebp - 8]
mov ecx, dword [edx*4 + 0x49e568]
mov eax, dword [ebp - 0x10]
or dword [ebp + eax*4 - 0x104], ecx
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [edx + 0x49e628]
cmp byte [ebp + ecx - 0x84], 0
je 0x411ee5
mov eax, dword [ebp - 8]
mov edx, dword [eax*4 + 0x49e568]
mov ecx, dword [ebp - 0x14]
or dword [ebp + ecx*4 - 0x104], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x18
jl 0x411e93
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jl 0x411dbf
lea eax, [ebp - 0x104]
push eax
call fcn.0041168c
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x412010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
add eax, 4
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push dword [edx]
call sub.KERNEL32.DLL_WriteFile
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
pop ebp
ret
Function at 0x412034
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
add eax, 4
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push dword [edx]
call sub.KERNEL32.DLL_ReadFile
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
pop ebp
ret

Function at 0x41207c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x412090
push dword [ebp + 8]
call fcn.004120d0
pop ecx
push 0
push 0
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0xffffffff
jne 0x4120b7
xor eax, eax
pop ebp
ret
push 0
mov edx, dword [ebp + 8]
push dword [edx]
call sub.KERNEL32.DLL_GetFileSize
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov al, 1
pop ebp
ret

Function at 0x412b28
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov eax, 0x49f0e4
call fcn.0048715c
cmp byte [ebp + 0x14], 0
jne 0x412c57
mov word [ebp - 0x84], 8
push 0x49ef48
lea edx, [ebp - 8]
push edx
call fcn.00412ae4
pop ecx
push eax
inc dword [ebp - 0x78]
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
push ecx
call fcn.00412dc4
add esp, 0xc
push eax
add dword [ebp - 0x78], 4
lea eax, [ebp - 0x38]
push eax
call fcn.00412cbc
add esp, 0xc
lea edx, [ebp - 0x38]
push edx
add dword [ebp - 0x78], 4
call fcn.0040f174
pop ecx
push eax
call sub.KERNEL32.DLL_DeleteFileA
sub dword [ebp - 0x78], 4
push 2
lea ecx, [ebp - 0x38]
push ecx
call fcn.004086f8
add esp, 8
sub dword [ebp - 0x78], 4
push 2
lea eax, [ebp - 0x20]
push eax
call fcn.004086f8
add esp, 8
dec dword [ebp - 0x78]
push 2
lea edx, [ebp - 8]
push edx
call fcn.0040f28c
add esp, 8
mov word [ebp - 0x84], 0x14
push str..tmp
lea ecx, [ebp - 0x40]
push ecx
call fcn.00412ae4
pop ecx
push eax
inc dword [ebp - 0x78]
push dword [ebp + 0x10]
lea eax, [ebp - 0x58]
push eax
call fcn.00412dc4
add esp, 0xc
push eax
add dword [ebp - 0x78], 4
lea edx, [ebp - 0x70]
push edx
call fcn.00412cbc
add esp, 0xc
lea ecx, [ebp - 0x70]
push ecx
add dword [ebp - 0x78], 4
call fcn.0040f174
pop ecx
push eax
call sub.KERNEL32.DLL_DeleteFileA
sub dword [ebp - 0x78], 4
push 2
lea eax, [ebp - 0x70]
push eax
call fcn.004086f8
add esp, 8
sub dword [ebp - 0x78], 4
push 2
lea edx, [ebp - 0x58]
push edx
call fcn.004086f8
add esp, 8
dec dword [ebp - 0x78]
push 2
lea ecx, [ebp - 0x40]
push ecx
call fcn.0040f28c
add esp, 8
push dword [ebp + 0x10]
call sub.KERNEL32.DLL_DeleteFileA
mov eax, dword [ebp + 8]
mov dword [eax + 0x40], 0x270f
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0x44], ecx
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
call fcn.00412da4
add esp, 8
push dword [ebp + 0x10]
mov edx, dword [ebp + 8]
add edx, 0x28
push edx
call fcn.00412da4
add esp, 8
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
push 0
push dword [ebp + 8]
push 0x41242c
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x94]
mov dword fs:[0], eax
mov esp, ebp
pop ebp
ret
Function at 0x415374
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov eax, 0x49fe78
call fcn.0048715c
mov word [ebp - 0x14], 8
mov eax, dword [ebp + 8]
add eax, 0x20
call fcn.00401800
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0x24
call fcn.00401800
inc dword [ebp - 8]
push 0
push dword [ebp + 8]
call fcn.00415a14
add esp, 8
mov dl, 1
mov eax, dword [0x429500]
call fcn.00401bac
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0x1a
push 0
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
call fcn.00486c5c
add esp, 0xc
call sub.KERNEL32.DLL_GetLogicalDrives
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 1
xor eax, eax
mov dword [ebp - 0x30], eax
xor edx, edx
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x2c]
and ecx, dword [ebp - 0x28]
je 0x41540b
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x30]
mov cl, byte [ebp - 0x34]
add cl, 0x61
mov byte [eax + edx + 4], cl
inc dword [ebp - 0x30]
shl dword [ebp - 0x2c], 1
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1a
jl 0x4153f0
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret