joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4893c6
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x6ac94653
popal
sbb eax, 0xa0f1752
mov ebp, 0x1945eb85
test eax, 0x445129c7
fdivr qword [ecx + 0x787aa76d]
mov ah, 0xe9
mov ah, 2
pop eax
mov dword [eax], ecx
jge 0x489437
inc eax
mov edx, gs
int1
int1
outsd dx, dword [esi]
repz ret
mov byte [0x3e7170f6], al
cmpsd dword [esi], dword es:[edi]
jo 0x4894ac
cmpsd dword ds:[esi], dword es:[edi]
loope 0x48945f
push esp
cmp dword [ebx - 0x24f943c4], esi
sbb al, 1
fldcw word [0x8c5cb504]
push edi
popal
mov word [edi + 0x61], ss
movsd dword es:[edi], dword [esi]
pop ebp
invalid
sbb al, 0xc3
cmp al, 0xf1
sbb eax, 0x487d9976
jae 0x4894d6
lea esp, [ebx + 0x36]
add ebx, dword [ecx - 0x5c]
ja 0x4894b9
sbb eax, edx
test byte [edx], bl
inc esp
push edx
mov fs, word [esp + eax*8 - 0x5dcc452f]
in al, 3
xchg ebp, eax
push edi
inc edi
cmpsb byte [esi], byte es:[edi]
push edi
cmp al, 0x72
ja 0x4894b4
adc ah, byte [eax]
xchg esi, eax
lea esi, [edi + 0x1e]
loop 0x4894cb
loop 0x489439
aam 0x94
lahf
test byte [esi - 0xe4ed97b], ah
movsb byte es:[edi], byte [esi]
lahf
push ecx
add al, 0xb1
dec edx
jb 0x4894a8
rol dword [esi + 0x78441d50], 1
and esi, dword [ebx + 0x74]
js 0x4894cd
jae 0x489520
add byte [edx], dl
cmc
out dx, al
jb 0x489492
xchg dword [ebx], esp
insb byte es:[edi], dx
jno 0x48944d
out 0x20, al
mov ch, 0x45
sub dword [esi + 0x3ec965ef], 0x16ea14c0
rcl byte [edx + ebp*8], 0x16
enter 0x700f, 0xffffffffffffffe6
jno 0x4894fe
xor bh, byte [ecx - 0x5ab2443e]
mov ecx, 0xa54dbbc2
ret 0x4dbb
enter 0xffffffffffffcab4, 0xffffffffffffff86
loope 0x48945b
test byte [edx], bh
stosb byte es:[edi], al
inc ebp
invalid
cmp ch, byte [edx - 0x30b10fbb]
invalid
xor byte [bp - 0x326d], cl
in al, 0x94
xchg esp, eax
mov ecx, 0x9035020
push ss
inc ecx
sbb dl, bl
pushal
xor eax, 0x19a45753
pop ebx
call 0xfaee6e5f
in eax, 0x21
push 0xffffffffffffff86
in al, dx
jle 0x4894ff
jecxz 0x4894f8
nop
shr byte [eax], 0xe3
sub bl, ah
daa
popal
and byte [edx + edi*2 - 0x12], bl
xchg edx, eax
mov dword [ebx], esp
das
add eax, 0xb3cad421
sbb dword [edi - 0x10], edx
pminsw mm5, mm5
shr byte [edx - 0x6f], 0xdc
int1
cmpsd dword [esi], dword es:[edi]
xchg ecx, eax
jp 0x4894c1
retf 0x19b3
mov ebx, 0x8b87aca8
xor dword [ebp + 0x23], ebx
add word [esi + 5], 0xc5c
mov ah, al
pushfd
mov ecx, 0x6d75f334
nop
xchg dword [ebp + 0x26fdd6d3], edx
mov al, 0x3b
test byte [esi + 0x3c], dh
xor al, 8
add byte [eax + 0x21e442a6], ah
xchg ebp, eax
pushfd
popal
xchg edx, eax
shr dword [ebx + 0x19], 1
rol dword [eax - 0x69b0a586], 0x90
jl 0x48952f
inc ebp
insb byte es:[edi], dx
stosb byte es:[edi], al
xchg edx, eax
mov eax, dword [0xd5f37e8c]
int3
Function at 0x5fee76
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x36dc369
pop ss
sbb al, byte [ecx - 0x1f]
xor dword [ecx + 0x47706621], edi
and dword [esi + 0x70], esp
inc edi
and dword [esi + 0x70], esp
inc edi
mov ah, 0xe5
or al, 0x56
inc eax
mov esp, 0x84e7aa92
lcall 0xac16, 0xae1942bb
out 0xcb, eax
in al, 0x88
xor bh, byte [ebp]
and al, 0x94
or al, 0x44
dec ebx
insb byte es:[edi], dx
cdq
or al, 0x92
mov dword [ecx + esi*4 + 0x1e2551f8], eax
mov eax, dword [0xb800c935]
mov cl, 0x2b
out dx, al
call 0x11310ee2
pop ds
insb byte es:[edi], dx
and ch, byte [ebp - 0x47dc734b]
jne 0x5fee69
mov dh, 0xbc
out 0xa0, eax
int3

Function at 0x6184d2
Capabilities:
Encode data using xor

Disassembly:
sbb dword [edx + esi*4], edi
invalid
jge 0x618458
pop ds
test al, 0x2c
sbb byte [ecx], dh
xchg esi, eax
int3

Function at 0x6579fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6603b8
cmp edx, dword [eax]
je 0x657a1f
add eax, 8
inc ecx
cmp eax, 0x660448
jl 0x657a10
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6603b8]
jne 0x657b4d
mov eax, dword [0xa5cda4]
cmp eax, 1
je 0x657b27
test eax, eax
jne 0x657a50
cmp dword [0x6602e4], 1
je 0x657b27
cmp edx, 0xfc
je 0x657b4d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657a87
lea eax, [ebp - 0x1a4]
push 0x65ca88
push eax
call fcn.006583e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658870
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657aca
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658870
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65ca84
push edi
call fcn.0065a740
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65ca68
push eax
call fcn.006583e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006583f0
lea eax, [ebp - 0xa0]
push 0x65ca64
push eax
call fcn.006583f0
push dword [esi + 0x6603bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.006583f0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65ca3c
push eax
call fcn.0065a6b4
add esp, 0x2c
pop edi
jmp 0x657b4d
lea eax, [ebp + 8]
lea esi, [esi + 0x6603bc]
push 0
push eax
push dword [esi]
call fcn.00658870
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401d02
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push 4
push ebx
push ebx
mov dword [eax], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x401d28
xor eax, eax
pop ebx
leave
ret 8
push 5
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x401d48
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x401d23
push esi
push edi
mov esi, 0x1000
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
and dword [ebp - 8], ebx
mov edi, eax
lea eax, [ebp - 8]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x401d7e
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [edi + 4], 4
setne bl
mov dword [eax], ebx
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
pop edi
pop esi
je 0x401da5
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x401da5
xor ebx, ebx
cmp dword [ebp - 0x20], 4
sete bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x401d3b

Function at 0x40d8c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, ebx
jne 0x40d8dd
push 0x80004005
call fcn.004022ea
mov esi, dword [ebp + 8]
push edi
push esi
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 0x10], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, ebx
je 0x40d935
mov ecx, dword [edi]
cmp ecx, ebx
jbe 0x40d932
cmp dword [ebp + 0x10], ebx
jbe 0x40d92f
cmp dword [ebp + 0x10], 2
jbe 0x40d93c
cmp dword [ebp + 0x10], 7
jne 0x40d92f
test cl, 1
jne 0x40d92f
shr ecx, 1
cmp ecx, 1
jb 0x40d92f
cmp word [esi + ecx*2 - 2], bx
jne 0x40d92f
cmp ecx, 1
jbe 0x40d935
cmp word [esi + ecx*2 - 4], bx
je 0x40d935
push 0xd
pop eax
mov word [esi], bx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
test cl, 1
jne 0x40d92f
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
jmp 0x40d92d

Function at 0x40d94a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push esi
mov esi, ecx
jne 0x40d961
push 0x80004005
call fcn.004022ea
mov bl, byte [ebp + 0x10]
test bl, bl
mov eax, dword [ebp + 0x14]
je 0x40d975
cmp eax, 0xffffffff
jne 0x40d984
push 0x57
pop eax
jmp 0x40d9a0
cmp eax, 0xffffffff
jne 0x40d984
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add eax, eax
neg bl
push eax
push dword [ebp + 8]
sbb ebx, ebx
and ebx, 6
inc ebx
push ebx
push 0
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x40d9a6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8
Function at 0x40d9fc
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x40da12
push 0x80004005
call fcn.004022ea
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x40da15
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8
Function at 0x40f021
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x459310]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.0040d88f
mov edi, eax
cmp edi, esi
je 0x40f089
lea ecx, [ebp - 0x70]
call fcn.0040d82a
mov eax, edi
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bc78
add ebp, 0x198
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x40f0a1
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040f021
cmp eax, esi
jne 0x40f0d4
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x40f091
lea ecx, [ebp - 0x70]
call fcn.0040d82a
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.0040d82a
mov eax, esi
jmp 0x40f06f
Function at 0x4139fb
Capabilities:
Get user security identifier

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x459310]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0x1c
mov eax, 0x43e917
call fcn.0043bc87
mov esi, dword [ebp + 0x218]
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], ebx
call fcn.00419470
push 0x208
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 0x104
mov word [ebp], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
call edi
cmp dword [ebp - 0x10], ebx
jne 0x413b15
cmp eax, 0x7a
je 0x413b15
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041a530
push dword [eax]
lea eax, [ebp - 0x14]
push str.Unable_to_get_account_name._System_error:__s.
push eax
mov byte [ebp - 4], 1
call fcn.0041b950
add esp, 0x14
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00419480
lea ecx, [ebp - 0x14]
call fcn.004195a0
push eax
push 1
push 0x531
push 0x4465c0
push 0x4593c0
call fcn.0040e4bd
or dword [ebp - 4], 0xffffffff
add esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.00419480
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.0043bc78
add ebp, 0x210
leave
ret 4
push dword [ebp - 0x18]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
push ebx
call esi
mov esi, eax
call edi
cmp esi, ebx
jne 0x413bac
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0041a530
push dword [eax]
lea eax, [ebp - 0x14]
push str.Unable_to_get_account_name._System_error:__s.
push eax
mov byte [ebp - 4], 2
call fcn.0041b950
add esp, 0x14
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00419480
lea ecx, [ebp - 0x14]
call fcn.004195a0
push eax
push 1
push 0x53c
push 0x4465c0
push 0x4593c0
call fcn.0040e4bd
add esp, 0x14
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00419480
mov eax, ebx
jmp 0x413af0
mov ebx, dword [ebp - 0x10]
jmp 0x413b99
Function at 0x41c3d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43f93b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x459310]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x20]
xor ebx, ebx
push 0x10
mov dword [esi], vtable.CWorkerThread.0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 8], bl
mov dword [esi + 0x10], eax
mov byte [esi + 9], bl
mov dword [esi + 0xc], 2
call fcn.0043bf10
add esp, 4
cmp eax, ebx
je 0x41c433
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [esi + 0x34], eax
jmp 0x41c436
mov dword [esi + 0x34], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x41ca80
Capabilities:
Create thread

Disassembly:
push esi
push edi
xor edi, edi
cmp byte [esp + 0xc], 0
mov esi, ecx
je 0x41ca92
mov edi, 4
xor eax, eax
cmp dword [esi + 0x2c], eax
push 0x51
sete al
push str..WindowsWorkerThread.cpp
mov byte [esi + 8], 1
push eax
call fcn.0041ac80
mov edx, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esi + 4]
push ecx
push edi
push esi
push 0x41c1b0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, esi
mov dword [esi + 0x2c], eax
call fcn.0041c6f0
test al, al
je 0x41cae4
cmp dword [esi + 0x2c], 0
je 0x41cae4
pop edi
mov eax, 1
pop esi
ret 8
pop edi
xor eax, eax
pop esi
ret 8
Function at 0x41d330
Capabilities:
Get disk information
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x43fb28
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x459310]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
test esi, esi
je 0x41d4ce
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d366
sub eax, edx
sar eax, 1
je 0x41d4ce
push esi
lea ecx, [esp + 0x38]
call fcn.00419cb0
push esi
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x41d429
push 2
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x3c]
call fcn.0041a040
push 0x4485d0
mov ecx, eax
mov byte [esp + 0x30], 1
call fcn.0041af50
test eax, eax
lea ecx, [esp + 0xc]
sete bl
mov byte [esp + 0x2c], 0
call fcn.00419480
test bl, bl
je 0x41d429
push 0x4485fc
lea ecx, [esp + 0x10]
call fcn.00419cb0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x38], 2
call fcn.0041a3b0
add esp, 0xc
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 3
call fcn.00419db0
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.00419480
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.00419480
lea ecx, [esp + 0x34]
call fcn.00419520
cmp eax, 3
lea ecx, [esp + 0x34]
jg 0x41d47e
call fcn.004195a0
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x41d44f
jmp dword [eax*4 + 0x41d4ec]
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00419480
mov eax, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret
push 0x4443f4
call fcn.004196c0
lea ecx, [esp + 0x14]
call fcn.0042b7b0
push 0
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 4
call fcn.004195a0
push eax
lea ecx, [esp + 0x1c]
call fcn.0042b830
test eax, eax
mov byte [esp + 0x2c], 0
lea ecx, [esp + 0x14]
jne 0x41d4e2
call fcn.0042b500
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00419480
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret
call fcn.0042b500
jmp case.0x41d44f.2

Function at 0x41e780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0041d85d
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
invalid
Function at 0x41fd00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43fe84
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x459310]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.CLBFileFindInfo.0
call fcn.00419470
lea ecx, [esi + 8]
mov byte [esp + 0x18], 1
call fcn.00419470
lea ecx, [esi + 0x10]
mov byte [esp + 0x18], 2
mov dword [esi + 0xc], edi
call fcn.004282f0
lea ecx, [esi + 0x15]
mov byte [esp + 0x18], 3
call fcn.004282f0
lea ecx, [esi + 0x1a]
mov byte [esp + 0x18], 4
call fcn.004282f0
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4233d0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4401f0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x459310]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
xor ebx, ebx
cmp esi, ebx
je 0x42356a
lea ecx, [esp + 0x34]
call fcn.00419470
push esi
mov dword [esp + 0x30], ebx
call fcn.00426580
add esp, 4
test eax, eax
je 0x423432
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00426c10
add esp, 8
mov byte [esp + 0x2c], 1
jmp 0x423443
push 2
push esi
lea ecx, [esp + 0x14]
call fcn.00419b80
mov byte [esp + 0x2c], 2
push eax
lea ecx, [esp + 0x38]
call fcn.00419db0
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], bl
call fcn.00419480
push 0x5c
lea ecx, [esp + 0x38]
call fcn.00419680
push 0x5c
lea ecx, [esp + 0x38]
call fcn.0041a970
lea ecx, [esp + 0xc]
push ecx
push 0x105
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], ebx
call fcn.0040d310
mov eax, dword [esp + 0x18]
cmp eax, ebx
mov esi, dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov byte [esp + 0x2c], 3
je 0x4234a4
mov edx, dword [esp + 0x1c]
sub edx, eax
sar edx, 1
jne 0x4234aa
call esi
mov eax, dword [esp + 0x18]
push 0x104
push eax
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x50]
call fcn.004195a0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x42352d
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4234df
mov ecx, dword [esp + 0x1c]
sub ecx, eax
sar ecx, 1
jne 0x4234e5
call esi
mov eax, dword [esp + 0x18]
push str.NTFS
push eax
call dword [sym.imp.MSVCR80.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x42352d
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], bl
call fcn.0040d240
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00419480
mov eax, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret
mov eax, dword [esp + 0x18]
cmp eax, ebx
mov byte [esp + 0x2c], bl
je 0x42354d
mov edx, dword [esp + 0x20]
sub edx, eax
sar edx, 1
push edx
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::allocator_wchar_t_::deallocate_wchar_t___unsigned_int_]
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0xffffffff
call fcn.00419480
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x425a60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x440631
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x459310]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov edi, dword [esp + 0x30]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov ebp, 1
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0x34]
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push ebp
push esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x28], ebx
call eax
cmp dword [esp + 0x18], ebx
je 0x425b19
lea esp, [esp]
cmp eax, ebx
jne 0x425ae0
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.004259d0
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov byte [esp + 0x28], bl
je 0x425af4
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x14], ebx
mov ecx, dword [esi]
mov ecx, dword [ecx + 0xc]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push ebp
push esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x28], ebx
call ecx
cmp dword [esp + 0x18], ebx
jne 0x425ad0
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov byte [esp + 0x28], bl
je 0x425b2d
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x43ba71
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x459310]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0043b8d0
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x43bac0
cmp dword [ebp - 0x1c], 5
jb 0x43bad8
jmp 0x43bad4
cmp dword [ebp - 0x10], 1
jne 0x43bad8
cmp dword [ebp - 0x1c], 4
ja 0x43bad4
jne 0x43bad8
cmp dword [ebp - 0x18], 0
jbe 0x43bad8
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x44c870
call fcn.00402a0d
test eax, eax
jge 0x43baf9
mov byte [0x459334], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043bc78
add ebp, 0x78
leave
ret

Function at 0x43bc78
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x459310]
jne 0x43bc82
repz ret
jmp fcn.0043c73c