joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420004]
jne 0x40100a
repz ret
jmp fcn.0040135f

Function at 0x40549b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00401961
and dword [ebp - 4], 0
cmp dword [0x421cd8], 0
mov ebx, eax
jne 0x40554c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4055fd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4055fd
push eax
call fcn.004018ef
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x421cd8], eax
call esi
push eax
call fcn.004018ef
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x421cdc], eax
call esi
push eax
call fcn.004018ef
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x421ce0], eax
call esi
push eax
call fcn.004018ef
pop ecx
mov dword [0x421ce8], eax
test eax, eax
je 0x40554c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004018ef
pop ecx
mov dword [0x421ce4], eax
mov eax, dword [0x421ce4]
cmp eax, ebx
je 0x4055a4
cmp dword [0x421ce8], ebx
je 0x4055a4
push eax
call fcn.0040196a
push dword [0x421ce8]
mov esi, eax
call fcn.0040196a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4055a4
test edi, edi
je 0x4055a4
call esi
test eax, eax
je 0x40559b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40559b
test byte [ebp - 0xc], 1
jne 0x4055a4
or dword [ebp + 0x10], 0x200000
jmp 0x4055dd
mov eax, dword [0x421cdc]
cmp eax, ebx
je 0x4055dd
push eax
call fcn.0040196a
pop ecx
test eax, eax
je 0x4055dd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4055dd
mov eax, dword [0x421ce0]
cmp eax, ebx
je 0x4055dd
push eax
call fcn.0040196a
pop ecx
test eax, eax
je 0x4055dd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x421cd8]
call fcn.0040196a
pop ecx
test eax, eax
je 0x4055fd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4055ff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41bb10
Capabilities:
Get hostname

Disassembly:
sub esp, 0x42c
mov eax, dword [0x420004]
xor eax, esp
mov dword [esp + 0x428], eax
push ebp
mov ebp, dword [esp + 0x434]
push edi
cmp ebx, 0x182
jne 0x41bb44
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x41bb7e
cmp ebx, 0x19f
jne 0x41bb7e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
push str.nekovikokozutawademehatabed
push str.gifudigezecona
push str.furawekutalari
push str.maduyupudotokisemiyexetalipiyuh
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
xor edi, edi
test ebx, ebx
jle 0x41bbf4
push esi
jmp 0x41bb90
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 5
mov dword [esp + 0x10], 0
call fcn.0041bb00
mov eax, dword [esp + 0x10]
add eax, 0x46
mov dword [esp + 0xc], eax
sub dword [esp + 0xc], 0x46
mov cl, byte [esp + 0xc]
xor byte [edi + ebp], cl
cmp ebx, 0xf
jne 0x41bbee
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
inc edi
cmp edi, ebx
jl 0x41bb90
pop esi
pop edi
pop ebp
cmp ebx, 0x2d
jne 0x41bc0f
mov dword [0x4fa500], 0xa62e7790
mov dword [0x4fa504], 0xffffffff
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00401000
add esp, 0x42c
ret
Function at 0x1001b42
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001b6e
xor esi, esi
push esi
push 0x10
push esi
push esi
push 0x4f5
jmp 0x1001bc5
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x10012e8
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push esi
jne 0x1001baf
push 0x10
push esi
push esi
push 0x4f6
jmp 0x1001bc5
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1001bcf
push esi
push 0x10
push esi
push esi
push 0x4f7
push esi
call fcn.01003c23
xor eax, eax
jmp 0x1001bd2
push 1
pop eax
pop esi
leave
ret

Function at 0x1001bd5
Capabilities:
Shutdown system

Disassembly:
test byte [esp + 4], 2
je 0x1001be1
push 2
pop eax
jmp 0x1001be6
call fcn.01001b18
cmp eax, 2
jne 0x1001c2e
test byte [esp + 4], 4
je 0x1001bf7
push 6
pop eax
jmp 0x1001c0e
push 4
push 0x40
push 0
push 0x10012c4
push 0x522
push 0
call fcn.01003c23
cmp eax, 6
jne 0x1001c2e
cmp word [0x100bc04], 0
jne 0x1001c29
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1001c2e
call fcn.01001b42
ret 4

Function at 0x1001c31
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x100a300], 0
je 0x1001c74
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001c74
push 0x100a300
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x1001e6b
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
xor ebx, ebx
cmp byte [0x100a300], bl
je 0x1001f63
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001f63
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x344]
push eax
push ebx
mov esi, 0x100a300
push ebx
push esi
mov dword [ebp - 8], 0x238
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001f59
mov al, byte [0x10012c4]
push edi
push 0x40
mov byte [ebp - 0x10c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1001f14
lea eax, [ebp - 0x10c]
push 0x10012c4
push eax
call fcn.010059ea
lea eax, [ebp - 0x10c]
push 0x100ae84
push eax
lea eax, [ebp - 0x344]
push str.rundll32.exe__sadvpack.dll_DelNodeRunDLL32___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x344]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x344]
push eax
push 1
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret
Function at 0x1001f66
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100208f
cmp byte [ebx], 0
je 0x100208f
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x104]
push 0x1001320
push eax
call esi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x100208f
lea eax, [ebp - 0x104]
push ebx
push eax
call edi
test byte [ebp - 0x244], 0x10
je 0x1002038
lea eax, [ebp - 0x218]
push 0x100131c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1002067
lea eax, [ebp - 0x218]
push 0x1001318
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1002067
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push 0x10012c4
push eax
call fcn.010059ea
lea eax, [ebp - 0x104]
push eax
call fcn.01001f66
jmp 0x1002067
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push pe_nt_image_headers32
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1001fca
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10020cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
lea eax, [ebp - 0x104]
push 0x104
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1002129
lea eax, [ebp - 0x104]
push 0x1001324
push eax
call fcn.010059ea
lea eax, [ebp - 0x104]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002129
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x100212f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002178
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100216f
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x1002723
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x100274c
mov al, byte [esi + 1]
inc esi
test al, al
je 0x1002744
cmp al, 0x22
jne 0x1002738
cmp byte [esi], 0x22
jne 0x1002756
inc esi
jmp 0x1002756
cmp al, 0x20
jle 0x1002756
inc esi
cmp byte [esi], 0x20
jg 0x1002750
mov al, byte [esi]
test al, al
je 0x1002763
cmp al, 0x20
jg 0x1002763
inc esi
jmp 0x1002756
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x100277d
movzx eax, word [ebp - 0x14]
jmp 0x1002780
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10027ff
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x100b6dc], eax
mov ecx, 0x23f
xor eax, eax
mov edi, 0x100ade0
rep stosd dword es:[edi], eax
mov ecx, 0xca
mov edi, 0x100aaa0
rep stosd dword es:[edi], eax
push 0x41
mov edi, 0x100b720
pop ecx
mov esi, 0x100adf4
rep stosd dword es:[edi], eax
push 1
xor ebx, ebx
pop edi
mov dword [ebp - 4], ebx
push 0x7f
push esi
push 0x10013a4
mov dword [0x100b08c], edi
call fcn.01003d7d
cmp eax, ebx
je 0x1002a1e
cmp eax, 0x80
ja 0x1002a1e
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x100aa7c], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 4
push 0x100b6d4
push 0x1001398
call fcn.01003d7d
test eax, eax
je 0x10028bc
test byte [0x100b6d4], 0xc0
je 0x100294c
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0x1001388
call fcn.01003d7d
test eax, eax
jne 0x10028db
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003c23
mov dword [0x100b704], 0x80070714
jmp 0x1002a2e
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x100aa80], eax
je 0x100294c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100294c
test byte [0x100b6d4], 0x80
je 0x100291b
push ebx
push 0x10
push ebx
push esi
push 0x54b
push ebx
call fcn.01003c23
jmp 0x1002931
push 4
push 0x20
push ebx
push esi
push 0x524
push ebx
call fcn.01003c23
cmp eax, 6
je 0x100294c
push dword [0x100aa80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100b704], 0x800700b7
jmp 0x1002a2e
push dword [ebp + 0xc]
mov dword [0x100b824], ebx
call fcn.010051a5
test eax, eax
jne 0x100296d
push ebx
push 0x10
push ebx
push ebx
push 0x520
jmp 0x1002a28
cmp byte [0x100aaba], bl
je 0x1002984
push 0x100aaba
call fcn.01001f66
jmp 0x1002a2e
push 0xa
push 0x100137c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x10029a5
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [0x100a2f8], ebx
je 0x10029b3
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x100aaa4], ebx
jne 0x1002a1a
push dword [ebp - 4]
call fcn.0100310e
test eax, eax
je 0x1002a2e
mov ax, word [0x100bc04]
cmp ax, di
je 0x10029d8
cmp ax, 2
jne 0x1002a1a
test byte [0x100b6d5], 1
je 0x1002a1a
test byte [0x100aab8], 1
jne 0x1002a1a
call fcn.01001600
test eax, eax
jne 0x1002a1a
push 0x83e
push 0x547
push 0x100170a
push ebx
push 0x7d6
push dword [0x100b6dc]
call fcn.010058e6
cmp eax, 0x83d
jne 0x1002a2e
mov eax, edi
jmp 0x1002a30
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003c23
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002b22
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
jmp 0x100490c
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [0x100ae80]
xor ebp, ebp
push edi
cmp esi, ebp
mov edi, esi
je 0x100495f
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x100aaa4], ebp
jne 0x100494f
cmp dword [0x100b6d0], ebp
jne 0x100494f
push pe_nt_image_headers32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [edi]
mov esi, dword [esi + 4]
call ebx
push edi
call ebx
cmp esi, ebp
mov edi, esi
jne 0x100492a
cmp dword [0x100aaa0], ebp
je 0x10049af
cmp dword [0x100aaa4], ebp
jne 0x10049af
cmp dword [0x100b6d0], ebp
jne 0x10049af
lea eax, [esp + 0x10]
push 0x100ae84
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100b6d4], 0x20
je 0x100499a
lea eax, [esp + 0x10]
push eax
call fcn.01005a29
push 0x1001318
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x10]
push eax
call fcn.01001f66
cmp word [0x100bc04], 1
je 0x10049c6
cmp dword [0x100aaa0], ebp
je 0x10049c6
call fcn.01001c31
pop edi
mov dword [0x100aaa0], ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x1003e7d
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 1
pop ebx
push edi
mov esi, ebx
call fcn.01005a6f
test eax, eax
jne 0x1003e97
mov eax, ebx
jmp 0x1003ef6
cmp dword [0x100ae7c], 0
jne 0x1003ee4
test byte [0x100aab8], bl
jne 0x1003ee4
push 6
push 0
push 0x1002e91
mov dword [0x100b0a4], edi
push dword [0x100aa78]
push 0x7d3
push dword [0x100b6dc]
call fcn.010058e6
sub eax, 6
je 0x1003ee2
dec eax
je 0x1003efc
sub eax, 0x832
jne 0x1003ee4
mov dword [0x100ae7c], ebx
mov esi, ebx
test esi, esi
je 0x1003ef4
push pe_nt_image_headers32
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
xor esi, esi
jmp 0x1003ee4

Function at 0x1004022
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov cl, byte [edi]
test cl, cl
je 0x1004086
mov al, byte [edi + 1]
lea esi, [edi + 1]
xor ebx, ebx
cmp al, 0x3a
jne 0x1004046
cmp byte [edi + 2], 0x5c
jne 0x1004046
lea esi, [edi + 3]
jmp 0x1004055
cmp cl, 0x5c
jne 0x1004055
cmp al, cl
jne 0x1004055
push 2
lea esi, [edi + 2]
pop ebx
mov al, byte [esi]
test al, al
je 0x1004086
cmp al, 0x5c
jne 0x100407b
cmp byte [esi - 1], 0x3a
je 0x100407b
test ebx, ebx
je 0x100406c
dec ebx
jmp 0x100407b
and byte [esi], 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
jmp 0x1004055
pop edi
pop esi
pop ebx
ret 4

Function at 0x10049d7
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [esp + 0x118]
push edi
xor edi, edi
xor ebp, ebp
mov eax, edi
inc edi
push eax
lea eax, [esp + 0x14]
push 0x1001470
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esp + 0x118]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.010059ea
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 0xffffffff
je 0x1004a3f
cmp edi, 0x190
jl 0x10049ec
jmp 0x1004a52
xor ebp, ebp
push ebp
push esi
call ebx
test eax, eax
je 0x1004a52
push 1
pop ebp
mov dword [0x100aaa0], ebp
test ebp, ebp
jne 0x1004a7d
push esi
push ebp
push 0x100146c
push dword [esp + 0x124]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1004a7d
push 1
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8
Function at 0x406960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x40690a
cld
nop
jmp 0x40691d
call 0x406bd1
jmp 0x406932
jmp 0x406940
pushal
nop
jmp 0x40694f
mov ebp, esp
nop
xor edx, edx
nop
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
nop
mov edx, dword [edx + 0x14]
nop
nop
mov esi, dword [edx + 0x28]
nop
movzx ecx, word [edx + 0x26]
nop
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
nop
jmp 0x40697c
cmp al, 0x61
jmp 0x406989
jl 0x4069bc
nop
jmp 0x40699c
jmp 0x4069ad
sub al, 0x20
jmp 0x4069bc
jmp 0x4069c7
ror edi, 0xd
jmp 0x4069db
add edi, eax
nop
jmp 0x4069e9
dec ecx
jmp 0x4069f4
jne 0x40696d
nop
jmp 0x406a0c
push edx
push edi
nop
jmp 0x406a1a
mov edx, dword [edx + 0x10]
jmp 0x406a2d
mov eax, dword [edx + 0x3c]
nop
jmp 0x406a3c
add eax, edx
jmp 0x406a4e
mov eax, dword [eax + 0x78]
jmp 0x406a5d
test eax, eax
nop
je 0x406b91
nop
jmp 0x406a72
nop
add eax, edx
nop
jmp 0x406a81
push eax
nop
mov ebx, dword [eax + 0x20]
nop
add ebx, edx
nop
jmp 0x406a96
mov ecx, dword [eax + 0x18]
nop
jmp 0x406aa9
nop
test ecx, ecx
je 0x406b90
nop
jmp 0x406ac3
dec ecx
nop
jmp 0x406ad6
xor edi, edi
jmp 0x406ae5
mov esi, dword [ebx + ecx*4]
nop
jmp 0x406af7
add esi, edx
xor eax, eax
nop
ror edi, 0xd
lodsb al, byte [esi]
nop
jmp 0x406b0b
add edi, eax
nop
cmp al, ah
jne 0x406af9
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
nop
jne 0x406aa9
jmp 0x406b30
pop eax
jmp 0x406b3c
mov ebx, dword [eax + 0x24]
nop
add ebx, edx
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
jmp 0x406b59
add ebx, edx
nop
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
nop
pop ebx
jmp 0x406b7a
pop ebx
jmp 0x406b89
popal
pop ecx
pop edx
push ecx
nop
jmp eax
pop eax
pop edi
nop
jmp 0x406ba6
pop edx
nop
mov edx, dword [edx]
nop
jmp 0x406bbc
jmp 0x406961
wait
aas
aas
cmc
salc
dec ebx
aas
aaa
stc
dec edx
cld
cmc
cld
xchg ecx, eax
das
dec ecx
aas
lahf
wait
lahf
aas
wait
dec eax
cdq
cmc
nop
salc
stc
das
daa
aaa
inc ebx
clc
dec edx
inc eax
stc
dec edx
cwde
inc ebx
daa
stc
cmc
inc ebx
das
dec ecx
cmc
clc
aaa
cmc
xchg ebx, eax
aas
dec edx
cmc
std
dec eax
aas
aas
cwde
cmc
clc
das
std
cdq
xchg ecx, eax
stc
xchg ecx, eax
cld
dec edx
nop
inc ecx
cld
cwde
xchg ebx, eax
cdq
aas
xchg edx, eax
clc
lahf
cld
dec ecx
dec eax
std
wait
cmc
cwde
cdq
cwde
aaa
cwde
aaa
dec edx
aaa
inc edx
stc
cmc
cmc
stc
aaa
dec ebx
std
daa
salc
inc ecx
nop
aaa
std
aaa
xchg ebx, eax
inc edx
dec edx
dec ebx
cld
dec ecx
dec eax
clc
cmc
das
nop
dec ebx
aas
dec eax
xchg ecx, eax
aas
lahf
xchg ebx, eax
cdq
aas
lahf
xchg ebx, eax
dec ecx
xchg ebx, eax
inc eax
salc
xchg edx, eax
wait
cwde
xchg ebx, eax
dec ecx
aas
daa
cwde
inc ebx
dec ecx
xchg ecx, eax
jmp 0x4068fe
Function at 0x409ed0
Capabilities:
Encode data using xor

Disassembly:
nop
nop
nop
mov eax, dword [0x410684]
test eax, eax
je 0x409e9a
push eax
call dword [0x405200]
mov dword [0xd50684], 0
add byte [eax], al
add byte [eax], al
add bl, al
nop
nop
lea edx, ss:[eax - 0x759574ab]
push ebp
mov ebp, dword [edx - 0x76]
ret
push ebp
mov ebp, dword [edx - 0x76]
dec ebp
xor ax, ax
dec ebp
sahf
and byte [ebp + eax - 0x48], dh
add dword [eax], eax
add byte [ebx - 0x1c], bl
shr dword [esi + 0x2f10274], 0xe0
rol dword [ecx], 0x74
add cl, byte [esp + eax]
mov dl, 0xa4
or al, 0xd3
or bl, byte [ebp - 0x3d]
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
test ecx, 0x1000e800
je 0x409ee6
or ecx, 5
jmp 0x409ee9
or ecx, 7
inc esi
ror dword [ecx - 0x1ddbf751], 1
jae 0x409efd
rol ecx, 1
loop 0x409efa
or edx, ecx
mov ecx, dword [eax + 0x71]
or ecx, 0x70a969
mov dword [eax + 8], edx
mov dword [eax - 0x1e], ecx
jno 0x409e7d
leave
imul ebp, dword [ecx + 0x50890070], 0xe2488908
inc edi
jp 0x409e95
dec ebp
or al, 0xf7
shl byte [ebx], 1
shl dword [eax], 0x86
sbb eax, eax
and eax, 0xc0011178
sbb bl, al
nop
nop
nop
nop
nop
push ebp
sbb ch, ah
push ebx
mov eax, dword [ecx + 5]
and ecx, dword [ebx - 0x46a8998b]
sbb byte [eax], al
scasb al, byte es:[edi]
add cl, ch
ror byte [ebx - 0x74d80c02], 0x43
adc byte [edx + edx*8 + 0xf120b9], al
push ebp
mov dword [ebp + 0xc], edx
mov dword [esi + 0x38], eax
mov dword [esi - 0x36], edx
call fcn.0040b870
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
mov ecx, dword [ebx + 0xc]
mov edx, eax
mov ebp, dword [eax + 0xbff333c]
ror dword [ebx], 1
invalid
Function at 0x401960
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x40a008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20a
lea eax, [ebp - 0x41c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x430], 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
push 0x105
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x430]
push eax
push 0x105
lea eax, [ebp - 0x41c]
push eax
push 0x407254
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
je 0x401a8f
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x42c]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x42c], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov edi, dword [ebp - 0x420]
mov eax, dword [ebp - 0x424]
mov edx, dword [ebp - 0x42c]
sar eax, 0x10
sar edi, 0x10
add edi, eax
sar edx, 0x10
mov eax, dword [ebp - 0x428]
sar eax, 0x10
add eax, dword [ebp - 0x420]
add eax, edi
add edx, eax
add edx, dword [ebp - 0x424]
add edx, dword [ebp - 0x428]
add edx, dword [ebp - 0x42c]
movzx ecx, dx
pop edi
pop esi
pop ebx
lea eax, [ecx - 1]
lea eax, [eax + eax*8]
imul eax, ecx
movzx eax, ax
imul eax, eax
add eax, dword [ebp - 0x430]
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404773
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00404773
mov esp, ebp
pop ebp
ret