joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f48f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40f52c
push ebx
push esi
call fcn.0040f458
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040f3ec
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40f4d9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40f52b
push edi
push eax
call fcn.0040cc25
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40f4f9
call fcn.0040bb9f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40f52a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040f3ec
add esp, 0x20
test eax, eax
jne 0x40f518
push edi
call fcn.0040bb9f
jmp 0x40f520
push ebx
call fcn.0040bb9f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4175e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41760d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41760d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40a5a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40a608
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004043dc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406d5c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a60f
lea eax, [ebp - 0xc]
call fcn.00404188
ret

Function at 0x40b3f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
mov eax, dword [ebp - 8]
call fcn.0040461c
xor eax, eax
push ebp
push 0x40b46a
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
mov eax, dword [ebp - 4]
call fcn.0040462c
push eax
push 0
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b471
lea eax, [ebp - 8]
mov edx, 2
call fcn.004041ac
ret

Function at 0x40d040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x104], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d0b4
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004043dc
mov eax, dword [ebp - 0x104]
mov ecx, esi
mov edx, ebx
call fcn.0040cf20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d0bb
lea eax, [ebp - 0x104]
call fcn.00404188
ret

Function at 0x40d0c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x104], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d138
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004043dc
mov eax, dword [ebp - 0x104]
mov ecx, esi
mov edx, ebx
call fcn.0040cf20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d13f
lea eax, [ebp - 0x104]
call fcn.00404188
ret
Function at 0x40d148
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x104], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d1bc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004043dc
mov eax, dword [ebp - 0x104]
mov ecx, esi
mov edx, ebx
call fcn.0040cf20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d1c3
lea eax, [ebp - 0x104]
call fcn.00404188
ret

Function at 0x40dd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x40dd29
mov eax, dword [ebp - 4]
add esp, 0xfffff7dc
push ebx
xor ebx, ebx
mov dword [ebp - 0x2828], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040461c
mov eax, dword [ebp - 8]
call fcn.0040461c
mov eax, dword [ebp - 0xc]
call fcn.0040461c
xor eax, eax
push ebp
push 0x40dedc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.004041dc
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040dc24
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040462c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40deb6
xor edx, edx
push ebp
push 0x40deaf
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x20], 0x2801
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2821]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40de98
cmp dword [ebp - 0x1c], 4
jne 0x40de23
cmp dword [ebp - 0x20], 4
jne 0x40de23
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x2821]
mov ecx, 4
call fcn.00402694
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.00406d34
jmp 0x40de98
cmp dword [ebp - 0x1c], 7
jne 0x40de8b
cmp dword [ebp - 0x20], 2
jle 0x40de8b
jmp 0x40de34
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0
jle 0x40de54
mov eax, dword [ebp - 0x20]
dec eax
cmp eax, 0x2800
jbe 0x40de4a
call fcn.00403770
cmp byte [ebp + eax - 0x2821], 0
je 0x40de31
lea edx, [ebp - 0x2821]
mov eax, ebx
mov ecx, dword [ebp - 0x20]
call fcn.00404278
lea eax, [ebp - 0x2828]
push eax
mov eax, dword [ebx]
mov ecx, 0x40def4
mov edx, 0x40df00
call fcn.0040cda8
mov edx, dword [ebp - 0x2828]
mov eax, ebx
call fcn.004041dc
jmp 0x40de98
mov edx, ebx
lea eax, [ebp - 0x2821]
call fcn.00407600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40deb6
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dee3
lea eax, [ebp - 0x2828]
call fcn.00404188
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041ac
ret
Function at 0x40dfa8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x40dfb1
mov eax, dword [ebp - 4]
add esp, 0xfffff800
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.0040462c
push eax
push 0x2801
lea eax, [ebp - 0x2801]
push eax
mov eax, dword [ebp + 0xc]
call fcn.0040462c
push eax
mov eax, edi
call fcn.0040462c
push eax
mov eax, esi
call fcn.0040462c
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x2801]
mov eax, dword [ebp + 8]
call fcn.00404278
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40e228
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40e2a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404188
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x40e28a
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.00407600
mov eax, dword [ebp - 0x108]
mov edx, ebx
call fcn.00406bac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e2aa
lea eax, [ebp - 0x108]
call fcn.00404188
ret

Function at 0x40e2b0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40e32b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404188
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x40e312
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.00407600
mov eax, dword [ebp - 0x108]
mov edx, ebx
call fcn.00406bac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e332
lea eax, [ebp - 0x108]
call fcn.00404188
ret
Function at 0x40e520
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40e61c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0040462c
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040462c
mov edi, eax
push edi
push 0
call sub.advapi32.dll_LookupAccountNameA
mov edx, dword [ebp - 8]
inc edx
mov eax, ebx
call fcn.004047b8
mov eax, dword [ebp - 4]
call fcn.00406b50
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40e5ff
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0040462c
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
push 0
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x40e5e2
mov eax, dword [ebx]
call fcn.0040462c
lea edx, [ebp - 0x14]
call fcn.00407600
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.004041dc
jmp 0x40e5e9
mov eax, ebx
call fcn.00404188
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e606
mov eax, dword [ebp - 0xc]
call fcn.00402570
ret

Function at 0x40e678
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00404188
test ebx, ebx
je 0x40e6b1
push 0x400
lea eax, [esp + 4]
push eax
test ebx, ebx
jns 0x40e6a2
call fcn.00403770
push ebx
call sub.user32.dll_GetWindowTextA
mov edx, esi
mov eax, esp
call fcn.00407600
add esp, 0x400
pop esi
pop ebx
ret

Function at 0x412e98
Capabilities:
Get file size

Disassembly:
add esp, 0xfffffff4
lea edx, [esp + 8]
push edx
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
mov eax, dword [esp + 8]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, ecx
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
ret
Function at 0x413448
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x413536
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xbff00000
cmp byte [0x427bc4], 0xff
jne 0x41349e
mov byte [0x427bc4], 0
mov edx, 0x413550
mov eax, 0x41356c
call fcn.0040b4fc
test eax, eax
je 0x41349e
mov byte [0x427bc4], 1
cmp byte [0x427bc4], 0
sete dl
lea eax, [ebp - 4]
call fcn.004133b8
mov ebx, eax
cmp byte [0x427bc4], 1
jne 0x4134dc
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
mov eax, dword [0x427e00]
mov eax, dword [eax]
call eax
test eax, eax
je 0x413520
fild qword [ebp - 0x20]
fstp qword [ebp - 0x10]
wait
jmp 0x413520
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x413520
mov eax, dword [ebp - 0x24]
imul dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
fild qword [ebp - 0x38]
fstp qword [ebp - 0x10]
wait
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
fild qword [ebp - 0x38]
fmul qword [ebp - 0x10]
fstp qword [ebp - 0x10]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41353d
lea eax, [ebp - 4]
call fcn.00404188
ret

Function at 0x413a10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x413b13
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404188
mov edx, dword [ebp - 4]
mov eax, 0x413b2c
call fcn.00404770
cmp eax, 2
jne 0x413aa2
lea eax, [ebp - 8]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040468c
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDriveTypeA
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x413a86
cmp eax, dword [esp]
pop edx
pop eax
jne 0x413af8
mov eax, dword [ebp - 4]
call fcn.00406f14
test al, al
je 0x413af8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004041dc
jmp 0x413af8
mov bl, 0x43
inc ebx
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404354
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x413b2c
call fcn.00404478
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDriveTypeA
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x413add
cmp eax, dword [esp]
pop edx
pop eax
jne 0x413aee
mov ecx, esi
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00413824
cmp bl, 0x5a
je 0x413af8
cmp dword [esi], 0
je 0x413aa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413b1a
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041ac
ret
Function at 0x413ed0
Capabilities:
Create process on windows
Self delete
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x413ed8
push ebx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4140b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
call fcn.00404188
lea edx, [ebp - 0x20]
mov al, 1
call fcn.0040d148
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
mov ecx, 0x4140d0
call fcn.00404478
lea eax, [ebp - 0x18]
mov edx, 0x4140e8
call fcn.00404220
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404220
lea eax, [ebp - 0x10]
call fcn.0040cfc4
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0040cfd4
cmp byte [ebp - 1], 0
je 0x413faa
push 0
push 0
xor ecx, ecx
mov edx, 0x4140f4
mov eax, dword [ebp - 8]
call fcn.004130a0
lea eax, [ebp - 0x18]
call fcn.00404188
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00407388
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0xc]
call fcn.00404220
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.00407388
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
call fcn.00404220
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
call fcn.00407388
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
call fcn.00404220
mov eax, dword [ebp - 8]
call fcn.0040716c
push dword [ebp - 0x1c]
push 0x414104
push 0x414114
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004044ec
push dword [ebp - 0x1c]
push 0x414120
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push 0x414114
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.004044ec
push dword [ebp - 0x1c]
push 0x414130
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push 0x414144
push 0x414114
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004044ec
test bl, bl
je 0x414036
push dword [ebp - 0x1c]
push 0x414158
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x414114
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.004044ec
push dword [ebp - 0x1c]
push 0x414120
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0x414114
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.004044ec
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.0040d148
mov eax, dword [ebp - 0x30]
call fcn.0040462c
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
cmp dword [ebp - 0x1c], 0
je 0x414088
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.004130a0
cmp dword [ebp - 0x1c], 0
je 0x41409e
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4140c0
lea eax, [ebp - 0x30]
mov edx, 0xb
call fcn.004041ac
ret
Function at 0x414f64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x4150f7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004028c4
mov eax, 0x1869f
call fcn.00402d4c
mov edx, dword [ebp - 8]
call fcn.00406c48
mov eax, dword [ebp - 4]
call fcn.0040442c
mov ebx, eax
test ebx, ebx
jle 0x414fcf
mov esi, 1
lea eax, [ebp - 4]
call fcn.00404684
sub byte [eax + esi - 1], 0x32
inc esi
dec ebx
jne 0x414fbe
lea eax, [ebp - 0x10]
call fcn.00404188
lea eax, [ebp - 0x18]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040468c
mov eax, dword [ebp - 0x18]
call fcn.0040d968
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00404354
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00404434
lea eax, [ebp - 4]
mov ecx, 2
mov edx, 1
call fcn.004046cc
cmp dword [ebp - 4], 0
jne 0x414fd7
mov eax, dword [ebp - 0x10]
call fcn.0040442c
mov edi, eax
cmp edi, 4
jle 0x4150d4
mov eax, dword [ebp - 0x10]
mov al, byte [eax + edi - 2]
mov byte [ebp - 0xa], al
xor eax, eax
mov ebx, edi
test ebx, ebx
jle 0x41505e
mov esi, 1
mov edx, edi
dec edx
cmp esi, edx
je 0x41505a
mov edx, dword [ebp - 0x10]
add al, byte [edx + esi - 1]
inc esi
dec ebx
jne 0x41504c
cmp al, byte [ebp - 0xa]
jne 0x4150d4
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + edi - 1]
xor al, dl
mov byte [ebp - 9], al
mov ebx, edi
dec ebx
sub ebx, 2
jl 0x41509c
inc ebx
mov esi, 2
lea eax, [ebp - 0x10]
call fcn.00404684
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + esi - 1]
xor dl, byte [ebp - 9]
mov byte [eax + esi - 1], dl
inc esi
dec ebx
jne 0x415082
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 1]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 2]
mov esi, eax
and esi, 0xff
add esi, 3
inc esi
and eax, 0xff
sub edi, eax
xor eax, eax
mov al, dl
sub edi, eax
sub edi, 4
mov eax, dword [ebp - 8]
push eax
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.0040468c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4150fe
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004041ac
lea eax, [ebp - 4]
call fcn.00404188
ret
Function at 0x415108
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x4151d5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x41513f
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00406dc0
mov esi, eax
push 0
push 0
xor edx, edx
mov eax, esi
call fcn.00412d9c
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.00406e3c
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.00406e3c
cmp byte [ebp - 5], 0x4d
jne 0x4151b2
cmp byte [ebp - 6], 0x5a
jne 0x4151b2
push 0
push pe_nt_image_headers32
xor edx, edx
mov eax, esi
call fcn.00412d9c
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.00406e3c
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.00406e3c
cmp byte [ebp - 5], 0x50
jne 0x4151b2
cmp byte [ebp - 6], 0x45
jne 0x4151b2
mov bl, 1
cmp dword [ebp - 4], 0
je 0x4151bf
mov eax, esi
call fcn.00406e94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4151dc
lea eax, [ebp - 4]
call fcn.00404188
ret

Function at 0x415388
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x41540c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040468c
mov eax, dword [ebp - 0x18]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x4153ee
mov ebx, dword [ebp - 8]
imul ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415413
lea eax, [ebp - 0x18]
call fcn.00404188
lea eax, [ebp - 4]
call fcn.00404188
ret

Function at 0x419c08
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, ecx
mov edi, edx
mov dword [esp], eax
xor ebp, ebp
test esi, esi
jbe 0x419c93
mov ebx, 1
mov eax, esi
xor edx, edx
push edx
push eax
push 0
push 0x10000
call fcn.0040b560
mov dword [esp + 4], eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, edi
call fcn.00404684
lea eax, [eax + ebx - 1]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x419c60
or ebp, 0xffffffff
add ebx, dword [esp + 8]
sub esi, dword [esp + 8]
xor eax, eax
call fcn.0040c0f4
cmp ebp, 0xffffffff
je 0x419c7f
mov eax, dword [edi]
call fcn.0040442c
cmp ebx, eax
jle 0x419c21
mov eax, dword [edi]
call fcn.0040442c
cmp ebx, eax
jle 0x419c93
mov eax, dword [edi]
call fcn.0040442c
mov ebp, eax
mov eax, ebp
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret