joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4647e8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x464a00
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x471488]
cmp byte [eax], 0
jne 0x4649e5
mov eax, dword [0x4716fc]
cmp byte [eax], 0
jne 0x4649e5
call fcn.004450b8
test al, al
jne 0x4649e5
mov eax, dword [0x471598]
cmp byte [eax], 0
jne 0x464848
mov eax, dword [0x471470]
cmp byte [eax], 0
je 0x464944
lea ecx, [ebp - 8]
mov eax, dword [0x4714a0]
mov eax, dword [eax]
mov edx, 0x464a18
call fcn.004181e8
mov eax, dword [ebp - 8]
call fcn.0044d640
test al, al
jne 0x46488c
lea edx, [ebp - 0xc]
mov eax, 0x464a24
call fcn.00457a04
mov eax, dword [ebp - 0xc]
call fcn.0044a21c
mov eax, 0xbb8
call fcn.0045c22c
call fcn.0045c334
lea ecx, [ebp - 0x10]
mov eax, dword [0x4714a0]
mov eax, dword [eax]
mov edx, 0x464a74
call fcn.004181e8
mov eax, dword [ebp - 0x10]
call fcn.0044d640
test al, al
jne 0x4648d0
lea edx, [ebp - 0x14]
mov eax, 0x464a80
call fcn.00457a04
mov eax, dword [ebp - 0x14]
call fcn.0044a21c
mov eax, 0xbb8
call fcn.0045c22c
call fcn.0045c334
mov eax, dword [0x471864]
mov eax, dword [eax]
call fcn.0045dc94
test al, al
jne 0x4648e5
call fcn.0046386c
mov eax, dword [0x471864]
mov eax, dword [eax]
call fcn.0045dc94
test al, al
jne 0x46493a
call fcn.0046386c
lea edx, [ebp - 0x1c]
mov eax, 0x464acc
call fcn.00457a04
push dword [ebp - 0x1c]
mov eax, dword [0x471864]
push dword [eax]
push 0x464b14
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040486c
mov eax, dword [ebp - 0x18]
call fcn.0044a21c
mov eax, 0xbb8
call fcn.0045c22c
call fcn.0045c334
call fcn.00444310
call fcn.0045c334
mov eax, dword [0x4714dc]
cmp byte [eax], 0
jne 0x464958
mov eax, dword [0x4716c4]
cmp byte [eax], 0
je 0x46497c
mov ecx, dword [0x471618]
mov ecx, dword [ecx]
mov edx, dword [0x4716f8]
mov edx, dword [edx]
lea eax, [ebp - 0x20]
call fcn.004047f8
mov eax, dword [ebp - 0x20]
call fcn.0045dc94
test al, al
je 0x4649e5
lea eax, [ebp - 4]
mov edx, 0x464b28
call fcn.00404568
mov eax, 0x4634cc
call fcn.004547c4
mov esi, eax
mov eax, 0x2710
call fcn.0045c22c
push 0
push esi
call sub.kernel32.dll_TerminateThread
mov eax, 0x4634cc
call fcn.004547c4
mov esi, eax
mov eax, 0x1f40
call fcn.0045c22c
push 0
push esi
call sub.kernel32.dll_TerminateThread
push 0
push 0
push 0
mov eax, dword [0x4715c8]
call fcn.00404a04
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.00458b08
call fcn.0045c334
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464a07
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004044f4
ret
Function at 0x638460
Capabilities:
Parse pe header

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
mov ecx, dword [edi]
mov dword [esp + 0x10], ebx
push ecx
call ebp
cmp esi, eax
jg 0x6384f1
mov ebx, dword [esp + 0x1c]
test esi, esi
jge 0x638495
mov edx, dword [edi]
push edx
call ebp
mov esi, eax
jmp 0x6384a9
mov eax, dword [ebx]
push eax
call ebp
mov ecx, dword [esp + 0x20]
mov esi, dword [ecx]
add esi, 1
jo 0x6384fb
sub esi, eax
jo 0x6384fb
mov ebp, dword [esp + 0x24]
mov edx, dword [edi]
mov eax, dword [ebx]
push 1
mov ecx, dword [ebp]
push edx
push eax
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
test eax, eax
je 0x6384e5
cmp eax, esi
jg 0x6384e5
mov edx, dword [edi]
mov ecx, dword [ebp]
mov dword [esp + 0x10], eax
add eax, 1
jo 0x6384fb
push eax
mov eax, dword [ebx]
push edx
push eax
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
test eax, eax
jne 0x6384c3
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret 0x10
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x58396c43
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..text
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x7c9d68f4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401320
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x42a044]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0x134], ax
mov dword [ebp - 0x130], 0
push 0x118
push 0
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00417a20
add esp, 0xc
mov dword [ebp - 0x130], 0x11c
lea edx, [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40141a
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 8], ecx
mov dx, word [ebp - 0x1c]
mov word [ebp - 0x134], dx
cmp dword [ebp - 0xc], 5
jne 0x4013cc
cmp dword [ebp - 8], 0
jne 0x4013cc
movzx eax, word [ebp - 0x134]
cmp eax, 4
jl 0x4013cc
mov dword [ebp - 4], 1
cmp dword [ebp - 0xc], 5
jne 0x4013df
cmp dword [ebp - 8], 2
jne 0x4013df
mov dword [ebp - 4], 2
cmp dword [ebp - 0xc], 5
jne 0x4013f8
cmp dword [ebp - 8], 2
jae 0x4013f1
cmp dword [ebp - 8], 1
jne 0x4013f8
mov dword [ebp - 4], 3
cmp dword [ebp - 0xc], 6
jne 0x40141a
cmp dword [ebp - 8], 0
jne 0x40140d
mov dword [ebp - 4], 4
jmp 0x40141a
cmp dword [ebp - 8], 1
jne 0x40141a
mov dword [ebp - 4], 5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004109d5
mov esp, ebp
pop ebp
ret

Function at 0x4018e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
push 0
push 0
push 3
push 0
push 3
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40191e
or eax, 0xffffffff
or edx, 0xffffffff
jmp 0x40194d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
jne 0x40193d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401ec0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x42a044]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x138], 0x114
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x134], 5
jne 0x401f62
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x140], ecx
cmp dword [ebp - 0x140], 0
je 0x401f1c
cmp dword [ebp - 0x140], 1
je 0x401f2c
cmp dword [ebp - 0x140], 2
je 0x401f49
jmp 0x401f59
mov dword [ebp - 0xc], 0xa0
mov dword [ebp - 0x10], 0xa4
jmp 0x401f60
push 0x427c94
call fcn.00411419
add esp, 4
mov dword [ebp - 0xc], 0x88
mov dword [ebp - 0x10], 0x8c
jmp 0x401f60
mov dword [ebp - 0xc], 0x8a
mov dword [ebp - 0x10], 0x8e
jmp 0x401f60
xor eax, eax
jmp 0x4020aa
jmp 0x401f94
cmp dword [ebp - 0x134], 4
jne 0x401f8d
cmp dword [ebp - 0x130], 0
jne 0x401f8d
cmp dword [ebp - 0x128], 2
jne 0x401f8d
mov dword [ebp - 0xc], 0x98
mov dword [ebp - 0x10], 0x9c
jmp 0x401f94
xor eax, eax
jmp 0x4020aa
mov dword [ebp - 8], 0xffffffff
mov edx, dword [ebp + 8]
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x401fbc
xor eax, eax
jmp 0x4020aa
mov eax, dword [ebp + 8]
push eax
call fcn.00401d00
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401fd8
xor eax, eax
jmp 0x4020aa
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
push 0x427c9c
call fcn.00411419
add esp, 8
mov edx, dword [ebp - 4]
push edx
push 0x427cac
call fcn.00411419
add esp, 8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
push ecx
call fcn.004111bc
add esp, 4
push 0x427cbc
call fcn.00411419
add esp, 4
push 4
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
push eax
call fcn.00401e30
add esp, 0xc
test eax, eax
je 0x40209e
push 4
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
push edx
call fcn.00401e30
add esp, 0xc
test eax, eax
je 0x40209c
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 4
push ecx
call fcn.00401e70
add esp, 0xc
test eax, eax
je 0x40209c
push 4
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.00401e70
add esp, 0xc
test eax, eax
je 0x40209c
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4020aa
jmp 0x4020aa
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004109d5
mov esp, ebp
pop ebp
ret
Function at 0x4038b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x42a044]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0x2c], ax
xor ecx, ecx
mov dword [ebp - 0x2a], ecx
mov dword [ebp - 0x26], ecx
mov dword [ebp - 0x22], ecx
mov dword [ebp - 0x1e], ecx
mov dword [ebp - 0x1a], ecx
mov dword [ebp - 0x16], ecx
mov dword [ebp - 0x12], ecx
mov word [ebp - 0xe], cx
push 0x68
push 0
lea edx, [ebp - 0x98]
push edx
call fcn.00417a20
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
push 0x20
lea ecx, [ebp - 0x98]
push ecx
call fcn.00410a10
add esp, 0xc
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x34], edx
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401070
add esp, 8
lea edx, [ebp - 0x2c]
push edx
push 0x10
lea eax, [ebp - 0x56]
push eax
call fcn.00410a10
add esp, 0xc
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xa0], 0
jmp 0x403969
mov edx, dword [ebp - 0xa0]
add edx, 1
mov dword [ebp - 0xa0], edx
cmp dword [ebp - 0xa0], 0x68
jae 0x403993
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0xa0]
movzx ecx, byte [eax]
not ecx
mov edx, dword [ebp - 0x9c]
add edx, dword [ebp - 0xa0]
mov byte [edx], cl
jmp 0x40395a
push 0x42791c
mov eax, dword [ebp + 8]
push eax
call fcn.00410b45
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4039b1
jmp 0x4039cf
mov ecx, dword [ebp - 8]
push ecx
push 0x68
push 1
mov edx, dword [ebp - 0x9c]
push edx
call fcn.00411cc8
add esp, 0x10
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
je 0x4039e1
mov eax, dword [ebp - 8]
push eax
call fcn.00410c26
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004109d5
mov esp, ebp
pop ebp
ret

Function at 0x403a00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403a58
mov edx, dword [ebp + 8]
push edx
call fcn.004018e0
add esp, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x10]
jne 0x403a58
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], 1
cmp dword [ebp - 0xc], 0
jne 0x403ac6
push 0x180000
call fcn.00411216
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x180000
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00402130
add esp, 0x10
test eax, eax
je 0x403aba
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00408e90
add esp, 0xc
cmp eax, 1
jne 0x403ab3
mov dword [ebp - 4], 1
jmp 0x403aba
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
push edx
call fcn.0041138b
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x403d30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x42a044]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x620], ax
push 0x206
push 0
lea ecx, [ebp - 0x61e]
push ecx
call fcn.00417a20
add esp, 0xc
xor edx, edx
mov word [ebp - 0x418], dx
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00417a20
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00417a20
add esp, 0xc
xor eax, eax
mov word [ebp - 0x640], ax
xor ecx, ecx
mov dword [ebp - 0x63e], ecx
mov dword [ebp - 0x63a], ecx
mov dword [ebp - 0x636], ecx
mov dword [ebp - 0x632], ecx
mov dword [ebp - 0x62e], ecx
mov dword [ebp - 0x62a], ecx
mov dword [ebp - 0x626], ecx
mov word [ebp - 0x622], cx
lea edx, [ebp - 0x418]
push edx
call fcn.00401000
add esp, 4
push 0x4279ec
push 0x104
lea eax, [ebp - 0x418]
push eax
call fcn.004114de
add esp, 0xc
mov ecx, dword [0x42e0ca]
push ecx
mov edx, dword [0x42e0c6]
push edx
push 0x42e0ce
lea eax, [ebp - 0x418]
push eax
call fcn.004038b0
add esp, 0x10
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
lea ecx, [ebp - 0x620]
push ecx
call fcn.00401000
add esp, 4
push 0x427a00
push 0x104
lea edx, [ebp - 0x620]
push edx
call fcn.004114de
add esp, 0xc
push 0x42e10e
push 0x104
lea eax, [ebp - 0x620]
push eax
call fcn.004114de
add esp, 0xc
push 0x427a04
push 0x104
lea ecx, [ebp - 0x620]
push ecx
call fcn.004114de
add esp, 0xc
lea edx, [ebp - 0x644]
push edx
push 0x427a10
push 0x83
call fcn.004058c0
add esp, 0xc
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0
jne 0x403ec0
jmp 0x403f0d
mov eax, dword [ebp - 0x644]
push eax
mov ecx, dword [ebp - 0x648]
push ecx
lea edx, [ebp - 0x620]
push edx
call fcn.00403a00
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0x427a28
lea eax, [ebp - 0x620]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x648], 0
je 0x403f31
mov ecx, dword [ebp - 0x648]
mov dword [ebp - 0x64c], ecx
mov edx, dword [ebp - 0x64c]
push edx
call fcn.004111bc
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004109d5
mov esp, ebp
pop ebp
ret
Function at 0x404c20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x42a044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
movzx eax, byte [0x42dfcb]
cmp eax, 2
jne 0x404c46
jmp 0x404d95
xor ecx, ecx
mov word [ebp - 0x388], cx
push 0x206
push 0
lea edx, [ebp - 0x386]
push edx
call fcn.00417a20
add esp, 0xc
mov dword [ebp - 0x508], 0
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0x504], 0xffffffff
mov dword [ebp - 0x390], 0
mov dword [ebp - 0x38c], 0
mov dword [ebp - 0x17c], 0
push 0x427b04
call fcn.00408f90
add esp, 4
push 0x427b20
call fcn.00408f90
add esp, 4
push 0x427b4c
call fcn.00408f90
add esp, 4
push 0x104
lea eax, [ebp - 0x388]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [ebp - 0x388]
sub ecx, 0x41
mov dword [ebp - 0x508], ecx
lea edx, [ebp - 0x50c]
push edx
mov eax, dword [ebp - 0x508]
push eax
call fcn.00405630
add esp, 8
mov dword [ebp - 0x390], eax
mov ecx, dword [ebp - 0x50c]
push ecx
call fcn.004054c0
add esp, 4
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 0xffffffff
jne 0x404d28
jmp 0x404d95
lea edx, [ebp - 0x178]
push edx
call fcn.00405b50
add esp, 4
test eax, eax
jne 0x404d3f
jmp 0x404d95
mov eax, dword [ebp - 0x504]
push eax
call fcn.00404e50
add esp, 4
mov ecx, dword [ebp - 0x178]
mov dword [ebp - 0x17c], ecx
mov ecx, 0x5b
lea esi, [ebp - 0x178]
lea edi, [ebp - 0x500]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [ebp - 0x17c]
mov dword [ebp - 0x500], edx
push 0
push 0x1e
lea eax, [ebp - 0x500]
push eax
mov ecx, dword [ebp - 0x504]
push ecx
call fcn.00405d90
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004109d5
mov esp, ebp
pop ebp
ret

Function at 0x4050a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x4050d3
jmp 0x405124
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
push 0
push 0x200
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00415d00
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
shl eax, 9
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x405340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x405373
jmp 0x4053c4
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
push 0
push 0x200
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00415d00
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
shl eax, 9
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x405750
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x40579f
jmp 0x405887
mov dword [ebp - 8], 0xc00
mov eax, dword [ebp - 8]
push eax
call fcn.00410df1
add esp, 4
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
push 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
push 0
push 0
push 0x70050
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4057ea
jmp 0x405887
mov dword [ebp - 4], 0
jmp 0x4057fc
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x40586a
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x90
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + eax + 0x3c]
cmp edx, dword [ebp - 0xc]
jl 0x405868
jg 0x405834
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + eax + 0x38]
cmp edx, dword [ebp - 0x10]
jbe 0x405868
mov eax, dword [ebp - 4]
imul eax, eax, 0x90
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ecx + eax + 0x3c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x90
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + ecx + 0x40]
mov dword [ebp - 0x20], eax
mov ecx, dword [edx + ecx + 0x44]
mov dword [ebp - 0x1c], ecx
jmp 0x4057f3
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
adc eax, dword [ebp - 0x1c]
push 0
push 0x200
push eax
push edx
call fcn.0041dae0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x24], 0
je 0x4058a6
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004111bc
add esp, 4
mov dword [ebp - 0x24], 0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4058c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40590c
jmp 0x4059af
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov ecx, dword [ebp - 8]
shr ecx, 9
mov eax, dword [ebp - 8]
xor edx, edx
mov esi, 0x200
div esi
neg edx
sbb edx, edx
neg edx
add ecx, edx
shl ecx, 9
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00410df1
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.00417a20
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.004182b0
add esp, 0xc
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
pop esi
mov esp, ebp
pop ebp
ret