joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41700c
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1e0], edx
mov byte [ebp - 0x1cd], al
xor eax, eax
push ebp
push 0x41727c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e0]
call fcn.0041a2a8
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 0x1e0]
call fcn.004070f0
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x1d8]
call fcn.00417bb8
lea edx, [ebp - 0x1dc]
mov eax, dword [ebp - 0x1d8]
call fcn.004070f0
push 1
lea eax, [ebp - 0x238]
push eax
mov ecx, 0x417290
xor edx, edx
mov eax, dword [ebp - 0x1dc]
call fcn.00417580
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d4]
mov edx, dword [ebp - 0x1dc]
call fcn.00403880
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cc]
call fcn.00404e66
lea eax, [ebp - 0x1cc]
call fcn.004050ee
call fcn.00402674
push ebp
mov eax, 0x4172a0
call fcn.00416f9c
pop ecx
push ebp
push 0x4172b0
push dword [ebp - 0x1e0]
push 0x4172c0
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f4
mov eax, dword [ebp - 0x238]
call fcn.00416f9c
pop ecx
push ebp
push 0x4172cc
push dword [ebp - 0x1e0]
push 0x4172c0
push 0x4172e0
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.004038f4
mov eax, dword [ebp - 0x238]
call fcn.00416f9c
pop ecx
cmp byte [ebp - 0x1cd], 0
je 0x41717b
push ebp
push 0x4172f4
push dword [ebp - 0x1d8]
push 0x4172c0
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f4
mov eax, dword [ebp - 0x238]
call fcn.00416f9c
pop ecx
push ebp
push 0x4172b0
push dword [ebp - 0x1d4]
push 0x4172c0
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f4
mov eax, dword [ebp - 0x238]
call fcn.00416f9c
pop ecx
lea eax, [ebp - 0x1cc]
call fcn.00404f08
call fcn.00402674
lea eax, [ebp - 0x234]
xor ecx, ecx
mov edx, 0x44
call fcn.0040298c
mov dword [ebp - 0x208], 1
mov word [ebp - 0x204], 0
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x1dc]
call fcn.004039f8
push eax
push 0
push 0x8000040
push 0
push 0
push 0
push 0x4172c0
push dword [ebp - 0x1d4]
push 0x4172c0
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f4
mov eax, dword [ebp - 0x238]
call fcn.004039f8
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x417253
mov eax, dword [ebp - 0x1ec]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x1f0]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417283
lea eax, [ebp - 0x238]
call fcn.004035b8
lea eax, [ebp - 0x1e0]
mov edx, 4
call fcn.004035dc
ret

Function at 0x4173b4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00417390
mov ebx, eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetFileSize
cmp ebx, eax
jge 0x4173dd
mov byte [ebp - 5], 0
jmp 0x4173e1
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4177a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e8
xor eax, eax
push ebp
push 0x4177fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004039f8
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4177dc
test byte [ebp - 0xc], 0x10
jne 0x4177e0
xor eax, eax
jmp 0x4177e2
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417802
lea eax, [ebp - 4]
call fcn.004035b8
ret

Function at 0x417d6c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e8
xor eax, eax
push ebp
push 0x417ed5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0041780c
test al, al
je 0x417eb2
mov eax, dword [0x449c64]
cmp dword [eax], 1
jne 0x417dd3
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.00407124
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00417a5c
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.00403650
mov eax, dword [0x449bfc]
mov al, byte [eax]
sub al, 2
jae 0x417e2f
mov eax, dword [0x449bfc]
cmp dword [eax + 0xd], 0x457
jge 0x417e2f
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 4]
call fcn.004039f8
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
je 0x417eb2
mov eax, dword [ebp - 0x30]
imul dword [ebp - 0x2c]
imul dword [ebp - 0x34]
test eax, eax
jns 0x417e24
add eax, 0x3ff
sar eax, 0xa
mov dword [ebp - 8], eax
jmp 0x417eb2
push 0x417ee4
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x417eb2
xor eax, eax
push ebp
push 0x417eab
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x417ef4
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x417e94
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.004039f8
push eax
call dword [ebp - 0x10]
test eax, eax
je 0x417e94
mov eax, dword [ebp - 0x14]
shl eax, 0x16
mov edx, dword [ebp - 0x18]
shr edx, 0xa
or eax, edx
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417eb2
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417edc
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.004035dc
lea eax, [ebp - 4]
call fcn.004035b8
ret
Function at 0x417f08
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0x80
mov eax, dword [ebp - 4]
call fcn.004039f8
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00406fa0
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x418884
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41895e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00406d84
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x418948
xor eax, eax
push ebp
push 0x418941
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4188ea
call fcn.00403170
jmp 0x418948
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00403b64
cmp dword [ebp - 0x14], 0
jle 0x41891c
lea eax, [ebp - 0x18]
call fcn.00403a04
mov edx, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00406de8
cmp eax, dword [ebp - 0x14]
je 0x41891c
call fcn.00403170
jmp 0x418948
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.0040360c
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418948
mov eax, dword [ebp - 0x10]
call fcn.00406e4c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418965
lea eax, [ebp - 0x18]
call fcn.004035b8
ret

Function at 0x418990
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xa], 0
mov eax, dword [ebp - 4]
call fcn.00406ebc
test al, al
je 0x4189c1
mov edx, 0x21
mov eax, dword [ebp - 4]
call fcn.00406d84
mov dword [ebp - 0x10], eax
jmp 0x4189cc
mov eax, dword [ebp - 4]
call fcn.00406dc4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x418a56
xor eax, eax
push ebp
push 0x418a4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00403834
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x418a13
mov eax, dword [ebp - 8]
call fcn.004039f8
mov edx, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00406e14
cmp eax, dword [ebp - 0x14]
sete byte [ebp - 0xa]
jmp 0x418a17
mov byte [ebp - 0xa], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418a56
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
test eax, eax
jne 0x418a35
mov byte [ebp - 0xa], 0
mov al, byte [ebp - 0xa]
and al, byte [ebp - 9]
je 0x418a46
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_FlushFileBuffers
mov eax, dword [ebp - 0x10]
call fcn.00406e4c
ret
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret
Function at 0x4196ec
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004035b8
cmp dword [ebp - 4], 0
je 0x41974a
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004039f8
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jle 0x41974a
mov edx, dword [ebp - 0xc]
dec edx
mov eax, dword [ebp - 8]
call fcn.00403b64
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004039f8
push eax
mov eax, dword [ebp - 4]
call fcn.004039f8
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov esp, ebp
pop ebp
ret

Function at 0x419d58
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x419e1b
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0040d878
xor eax, eax
push ebp
push 0x419df9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x419dd2
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0040376c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0040f710
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00403834
inc eax
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x419da5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419e00
mov eax, dword [ebp - 4]
call fcn.0040d934
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
ret
Function at 0x419ffc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41a0db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00403b64
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004039f8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403834
push eax
call sub.KERNEL32.DLL_GetTempPathA
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00403b64
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00417a5c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00403650
lea eax, [ebp - 0xc]
call fcn.00407370
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00417a5c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00406a10
test eax, eax
jne 0x41a0c0
mov eax, dword [0x449c64]
cmp dword [eax], 1
jne 0x41a0b3
lea eax, [ebp - 0xc]
call fcn.0041a10c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00417a5c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, 0x41a0f0
call fcn.00403880
jmp 0x41a0c0
mov eax, dword [ebp - 4]
mov edx, 0x41a100
call fcn.00403650
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a0e2
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004035dc
ret

Function at 0x41a46c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41a394]
call fcn.00403e48
xor eax, eax
push ebp
push 0x41a4d1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00403650
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x41a3b8
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a4d8
lea eax, [ebp - 0x10]
mov edx, dword [0x41a394]
call fcn.00403f10
ret

Function at 0x427858
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x42787d
inc ecx
xor esi, esi
mov bl, byte [eax + esi]
xor bl, byte [edx + esi]
mov edi, dword [ebp - 4]
mov byte [edi + esi], bl
inc esi
dec ecx
jne 0x42786d
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x42c780
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 3], cl
mov word [ebp - 2], dx
mov esi, eax
xor eax, eax
push ebp
push 0x42c8cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov ax, word [ebp - 2]
mov word [esi + 0x1b], ax
test byte [esi + 0x1b], 1
setne al
xor al, 1
mov byte [esi + 0x18], al
mov eax, dword [esi + 0x24]
call fcn.00406ebc
test al, al
je 0x42c8b9
mov byte [esi + 0x19], 1
push 1
lea eax, [ebp - 8]
push eax
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
xor ecx, ecx
xor edx, edx
call fcn.00417580
mov ecx, dword [ebp - 8]
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
lea eax, [esi + 0x28]
call fcn.00403880
mov eax, dword [esi + 0x24]
call fcn.00412af8
xor ecx, ecx
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
call fcn.00418858
mov ebx, eax
test byte [ebp - 3], bl
je 0x42c8b9
test byte [esi + 0x1b], 4
je 0x42c82a
mov eax, dword [esi + 0x24]
call fcn.00416830
test byte [esi + 0x1b], 8
je 0x42c84e
mov eax, dword [esi + 0x24]
call fcn.004039f8
push eax
call sub.gdi32.dll_RemoveFontResourceA
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendMessageA
mov eax, dword [esi + 0x24]
call fcn.00417f08
test al, al
jne 0x42c8b9
mov byte [esi + 0x34], 1
lea eax, [esi + 0x2c]
mov edx, 0x104
call fcn.00403b64
mov eax, dword [esi + 0x2c]
call fcn.004039f8
push eax
push 0
push 0x42c8e0
lea edx, [ebp - 8]
mov eax, dword [esi + 0x24]
call fcn.004070f0
mov eax, dword [ebp - 8]
call fcn.004039f8
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov eax, dword [esi + 0x2c]
call fcn.004039f8
mov edx, eax
lea eax, [esi + 0x2c]
call fcn.0040376c
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov cl, 1
mov edx, 0x42c8ec
call fcn.00425af4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c8d6
lea eax, [ebp - 8]
call fcn.004035b8
ret

Function at 0x42e5b0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 1], 0
lea eax, [ebp - 0xc]
push eax
push 4
push 0
mov eax, dword [0x44aaec]
push eax
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov edx, dword [0x449c58]
mov dword [edx], eax
xor eax, eax
push ebp
push 0x42e63f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x449c58]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_ResumeThread
call fcn.0041a244
lea eax, [ebp - 8]
push eax
mov eax, dword [0x449c58]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetExitCodeThread
cmp dword [ebp - 8], 0x103
je 0x42e5f4
cmp dword [ebp - 8], 0
je 0x42e620
call fcn.00403170
jmp 0x42e646
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e646
mov eax, dword [0x449c58]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x4308c8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4309a6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x24]
call fcn.00407124
lea eax, [ebp - 4]
mov edx, 0x4309c0
call fcn.0040383c
mov eax, dword [ebp - 4]
call fcn.004039f8
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 5
sete al
test al, al
je 0x43091b
and dword [ebx + 0x30], 0xfffffffe
push 0
push 1
xor eax, eax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
fld qword [ebx + 0x34]
fstp xword [ebp - 0x48]
wait
lea eax, [ebp - 0x48]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 3
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], 1
mov byte [ebp - 0x10], 0
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x3c]
mov eax, dword [0x449b60]
mov ecx, 6
call fcn.00425f90
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.00438d90
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4309ad
lea eax, [ebp - 4]
call fcn.004035b8
ret
Function at 0x432fe0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43315d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406ebc
test al, al
je 0x43312c
mov eax, ebx
call fcn.00417b08
mov edi, eax
mov eax, ebx
call fcn.004039f8
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
je 0x433031
and esi, 0xfffffffe
mov eax, ebx
call fcn.00406e54
call fcn.00407274
fstp qword [ebp - 8]
wait
lea eax, [ebp - 0xc]
call fcn.004035b8
mov byte [0x4496cc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.00432560
pop ecx
dec eax
jne 0x433147
cmp dword [0x44ab18], 0
je 0x43308f
mov eax, dword [0x44ab18]
test byte [eax + 0x29], 4
je 0x43308f
mov byte [0x4496cc], 1
cmp byte [0x4496cc], 0
je 0x4330af
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov eax, 0x44ab28
mov ecx, pe_nt_image_headers32
call fcn.004281b8
mov eax, 0x432f70
push eax
push 0
mov ecx, 0x432ef4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004185e4
mov byte [ebp - 0xd], al
cmp byte [0x4496cc], 0
je 0x4330dc
mov eax, 0x44ab28
call fcn.004282b8
cmp byte [ebp - 0xd], 0
je 0x433111
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
je 0x4330fa
push esi
mov eax, dword [ebp - 0xc]
call fcn.004039f8
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push dword [ebp - 4]
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.00432ca4
jmp 0x433147
mov eax, dword [0x449b3c]
cmp byte [eax], 0
jne 0x433147
mov byte [0x44ab22], 1
mov eax, dword [0x449b3c]
mov byte [eax], 1
jmp 0x433147
mov eax, 0x44ab10
mov edx, ebx
call fcn.0040360c
mov byte [0x44ab22], 1
mov eax, dword [0x449b3c]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433164
lea eax, [ebp - 0xc]
call fcn.004035b8
ret
Function at 0x4335d0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x433788
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
xor eax, eax
push ebp
push 0x433764
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x54]
dec eax
test eax, eax
jl 0x43375a
inc eax
mov dword [ebp - 8], eax
xor ebx, ebx
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422bc0
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x54]
mov edi, eax
dec edi
test edi, edi
jl 0x433750
inc edi
xor esi, esi
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422bc0
mov eax, dword [eax + 0x3c]
mov edx, esi
call fcn.00422c40
mov eax, dword [eax + 0x2c]
lea edx, [ebp - 0xc]
call fcn.004071b8
cmp dword [ebp - 0xc], 0
jne 0x4336c7
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422bc0
mov eax, dword [eax + 0x24]
push eax
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422bc0
mov eax, dword [eax + 0x3c]
mov edx, esi
call fcn.00422c40
mov edx, dword [eax + 0x30]
lea ecx, [ebp - 0xc]
mov eax, dword [0x449c40]
mov eax, dword [eax]
call fcn.004250e4
mov edx, dword [ebp - 0xc]
mov eax, dword [0x449c28]
mov eax, dword [eax]
mov cl, 1
call fcn.0042c338
jmp 0x433748
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422bc0
mov eax, dword [eax + 0x3c]
mov edx, esi
call fcn.00422c40
mov eax, dword [eax + 0x2c]
call fcn.004039f8
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0x10
jne 0x433748
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422bc0
mov eax, dword [eax + 0x24]
push eax
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422bc0
mov eax, dword [eax + 0x3c]
mov edx, esi
call fcn.00422c40
mov edx, dword [eax + 0x30]
lea ecx, [ebp - 0xc]
mov eax, dword [0x449c40]
mov eax, dword [eax]
call fcn.004250e4
mov edx, dword [ebp - 0xc]
mov eax, dword [0x449c28]
mov eax, dword [eax]
mov cl, 1
call fcn.0042c338
inc esi
dec edi
jne 0x433643
inc ebx
dec dword [ebp - 8]
jne 0x43361c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x433772
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43378f
lea eax, [ebp - 0xc]
call fcn.004035b8
ret
Function at 0x43829c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4382b0
add esp, 0xfffffff0
call fcn.00402d5c
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x43838f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00402c34
mov eax, dword [0x44ab64]
call fcn.0040d430
mov edx, eax
dec edx
mov eax, dword [0x44ab64]
call fcn.0040d438
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
xor edx, edx
call fcn.0042359c
mov edx, dword [eax + 0x30]
lea eax, [edi + 8]
call fcn.0040360c
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov edx, 1
call fcn.0042359c
mov edx, dword [eax + 0x30]
lea eax, [edi + 0xc]
call fcn.0040360c
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
xor edx, edx
call fcn.0042359c
add eax, 0x30
push eax
lea edx, [ebp - 4]
mov eax, esi
call fcn.00406c88
mov edx, dword [ebp - 4]
pop eax
call fcn.0040360c
mov eax, dword [0x449c40]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov edx, 1
call fcn.0042359c
add eax, 0x30
push eax
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00406c88
mov edx, dword [ebp - 4]
pop eax
call fcn.0040360c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438396
lea eax, [ebp - 4]
call fcn.004035b8
ret