joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d260
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48d39e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
mov edx, ebx
lea eax, [ebp - 0x14c]
call fcn.004034ac
lea eax, [ebp - 0x14c]
mov edx, 0x48d3b4
call fcn.00403594
mov eax, dword [ebp - 0x14c]
call fcn.00403750
push eax
call fcn.0040587c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x48d37d
xor eax, eax
push ebp
push 0x48d376
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x48d3c4
lea eax, [ebp - 0x11c]
mov ecx, 5
call fcn.004073f0
test eax, eax
jne 0x48d347
test byte [ebp - 0x148], 0x10
jne 0x48d347
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00403574
mov ecx, dword [ebp - 0x14c]
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004035d8
mov esi, dword [ebp - 0x148]
test esi, 1
je 0x48d33f
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.00403750
push eax
call fcn.00405abc
mov eax, dword [ebp - 8]
call fcn.00406ee8
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00405884
test eax, eax
jne 0x48d2d7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d37d
mov eax, dword [ebp - 4]
push eax
call fcn.00405874
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d3a5
lea eax, [ebp - 0x14c]
call fcn.00403418
lea eax, [ebp - 8]
call fcn.00403418
ret

Function at 0x48d3cc
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48d4c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00403418
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0042c888
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x48d4d8
call fcn.0040788c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004035d8
mov eax, dword [ebp - 0x10]
call fcn.00403750
push eax
call fcn.0040591c
mov esi, eax
cmp esi, 0xffffffff
je 0x48d46a
test esi, 0x10
jne 0x48d49a
test esi, 1
je 0x48d46a
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 0x10]
call fcn.00403750
push eax
call fcn.00405abc
push 1
mov eax, dword [ebp - 0x10]
call fcn.00403750
push eax
mov eax, dword [ebp - 4]
call fcn.00403750
push eax
call fcn.00405a5c
test eax, eax
je 0x48d494
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004034ac
jmp 0x48d4a7
inc edi
cmp edi, 0xa
je 0x48d4a7
inc ebx
cmp ebx, 0x3e8
jne 0x48d40b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d4c9
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403438
ret
Function at 0x4042a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
lea edi, [ebp - 0x5c]
mov ecx, 0x17
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov byte [ebp - 8], 0
jmp 0x4042c6
mov al, byte [ebp - 8]
add al, 1
mov byte [ebp - 8], al
mov ecx, dword [ebp - 8]
and ecx, 0xff
cmp ecx, 0x32
jge 0x4042ed
mov edx, dword [ebp - 8]
and edx, 0xff
imul edx, edx, 0xc
cmp dword [edx + 0x434488], 0
jne 0x4042eb
jmp 0x4042ed
jmp 0x4042be
mov eax, dword [ebp - 8]
and eax, 0xff
cmp eax, 0x32
jne 0x404302
or eax, 0xffffffff
jmp 0x4043a1
mov ecx, dword [ebp - 8]
and ecx, 0xff
imul ecx, ecx, 0xc
mov dword [ecx + 0x434488], 1
mov dword [ebp + 0x10], 0
mov dword [ebp - 0x18], 0
mov esi, esp
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.00407b00
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40436c
mov eax, dword [ebp - 8]
and eax, 0xff
imul eax, eax, 0xc
mov dword [eax + 0x434488], 0
or eax, 0xffffffff
jmp 0x4043a1
mov ecx, dword [ebp - 8]
and ecx, 0xff
imul ecx, ecx, 0xc
mov dword [ecx + 0x434490], 0
mov edx, dword [ebp - 8]
and edx, 0xff
imul edx, edx, 0xc
mov ax, word [ebp - 0x1c]
mov word [edx + 0x43448c], ax
mov eax, dword [ebp - 8]
and eax, 0xff
pop edi
pop esi
pop ebx
add esp, 0x5c
cmp ebp, esp
call fcn.00407b00
mov esp, ebp
pop ebp
ret

Function at 0x4053d0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
lea edi, [ebp - 0x40]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
cmp dword [0x434d94], 0
je 0x4053f6
jmp 0x40547c
mov esi, esp
push str.emWinLCDMap
push 1
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
cmp esi, esp
call fcn.00407b00
mov dword [0x434d94], eax
cmp dword [0x434d94], 0
jne 0x405445
mov esi, esp
push str.emWinLCDMap
push section..text
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp esi, esp
call fcn.00407b00
mov dword [0x434d94], eax
mov esi, esp
push section..text
push 0
push 0
push 6
mov eax, dword [0x434d94]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp esi, esp
call fcn.00407b00
mov dword [0x434e68], eax
mov ecx, dword [0x434e68]
add ecx, 0x1000
mov dword [0x434d28], ecx
pop edi
pop esi
pop ebx
add esp, 0x40
cmp ebp, esp
call fcn.00407b00
mov esp, ebp
pop ebp
ret
Function at 0x401126
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret

Function at 0x40116d
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push 0x464301
push ecx
call fcn.0044c485
add esp, 8
xor esi, esi
test eax, eax
je 0x4011fa
mov edi, eax
push 2
push 0
push eax
call fcn.0044a8bd
add esp, 0xc
push edi
call fcn.0044ac0c
add esp, 4
test eax, eax
js 0x4011f1
mov ebp, eax
push edi
call fcn.0044e286
add esp, 4
lea eax, [ebp + 1]
push eax
call dword [0x470054]
add esp, 4
test eax, eax
je 0x4011f1
mov ebx, eax
push edi
push ebp
push 1
push eax
call fcn.0044d909
add esp, 0x10
test eax, eax
je 0x4011df
mov ebp, eax
push edi
call fcn.0044d263
add esp, 4
test eax, eax
je 0x401201
push edi
call fcn.0044d0de
add esp, 4
push ebx
call dword [0x470050]
jmp 0x4011f7
push edi
call fcn.0044d0de
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.0044d0de
add esp, 4
mov byte [ebx + ebp], 0
mov esi, ebx
jmp 0x4011fa

Function at 0x402652
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
test edx, edx
je 0x40267a
mov edi, 0x1505
xor esi, esi
movzx ebx, byte [ecx + esi]
test ebx, ebx
je 0x402681
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp edx, esi
jne 0x402660
jmp 0x402683
mov eax, 0x1505
jmp 0x402683
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x40b558
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov ebp, dword [esp + 0x6c]
mov edx, dword [esp + 0x68]
mov edi, esp
mov ecx, 5
mov esi, 0x464628
rep movsd dword es:[edi], dword [esi]
cmp ebp, 0x40
jb 0x40b5d8
shr ebp, 6
xor ebx, ebx
mov esi, edx
xor edi, edi
movzx eax, byte [esi + edi]
mov dword [esp + edi + 0x14], eax
movzx ecx, byte [esi + edi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + edi + 0x14], ecx
movzx eax, byte [esi + edi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + edi + 0x14], eax
movzx ecx, byte [esi + edi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + edi + 0x14], ecx
add edi, 4
cmp edi, 0x40
jne 0x40b583
mov ecx, esp
lea edx, [esp + 0x14]
call fcn.0040b672
inc ebx
lea edx, [esi + edi]
cmp ebx, ebp
jne 0x40b57f
add esi, edi
mov edx, esi
mov ebp, dword [esp + 0x6c]
xor ebx, ebx
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov esi, ebp
and esi, 0x3f
je 0x40b60c
xor eax, eax
movzx edi, byte [edx + eax]
mov ecx, ebx
and cl, 0x18
shl edi, cl
mov ecx, eax
and ecx, 0xfffffffc
xor dword [esp + ecx + 0x14], edi
inc eax
add ebx, 8
cmp esi, eax
jne 0x40b5f0
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
xor eax, eax
inc eax
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x14], eax
cmp esi, 0x38
jb 0x40b644
mov ecx, esp
lea edi, [esp + 0x14]
mov edx, edi
call fcn.0040b672
xor eax, eax
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x70]
lea edx, [esp + 0x14]
mov dword [edx + 0x38], ebx
shr ebp, 0x1d
mov dword [edx + 0x3c], ebp
mov ecx, esp
call fcn.0040b672
xor eax, eax
mov ecx, dword [esp + eax*4]
mov dword [esi + eax*4], ecx
inc eax
cmp eax, 5
jne 0x40b65e
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x412c68
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x412d67
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x412d60
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebp, esi
sub ebp, eax
xor edx, edx
cmp ebp, 8
mov dword [esp], esi
jb 0x412d11
xor esi, esi
mov eax, esi
movzx edx, byte [ebx + esi]
add edx, edi
add ecx, edx
movzx esi, byte [ebx + esi + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea esi, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x412cb1
mov edx, ebp
and edx, 0x1ff8
add ebx, esi
mov esi, dword [esp]
mov eax, ebp
sub eax, edx
jbe 0x412d2b
xor edx, edx
movzx esi, byte [ebx + edx]
add edi, esi
add ecx, edi
inc edx
cmp eax, edx
jne 0x412d19
add ebx, eax
mov esi, dword [esp]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, ebp
mov ebp, 0x15b0
jne 0x412ca5
shl ecx, 0x10
or ecx, edi
jmp 0x412d6a
xor ecx, ecx
inc ecx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x412d74
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
not ebx
cmp ecx, 4
jb 0x412de9
mov eax, 0xff
mov esi, ebx
shr esi, 8
movzx edi, byte [edx]
and ebx, eax
xor ebx, edi
xor esi, dword [ebx*4 + 0x464850]
mov edi, esi
shr edi, 8
movzx ebx, byte [edx + 1]
and esi, eax
xor esi, ebx
xor edi, dword [esi*4 + 0x464850]
mov esi, edi
shr esi, 8
movzx ebx, byte [edx + 2]
and edi, eax
xor edi, ebx
xor esi, dword [edi*4 + 0x464850]
mov ebx, esi
shr ebx, 8
movzx edi, byte [edx + 3]
and esi, eax
xor esi, edi
xor ebx, dword [esi*4 + 0x464850]
add edx, 4
add ecx, 0xfffffffc
cmp ecx, 3
ja 0x412d8f
test ecx, ecx
je 0x412e0d
xor esi, esi
mov eax, ebx
shr eax, 8
movzx edi, byte [edx + esi]
movzx ebx, bl
xor ebx, edi
xor eax, dword [ebx*4 + 0x464850]
inc esi
mov ebx, eax
cmp ecx, esi
jne 0x412df1
jmp 0x412e0f
mov eax, ebx
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x41ac88
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push esi
call fcn.0044ac3c
add esp, 4
test edi, edi
js 0x41acbc
mov ecx, dword [esp + 0x10]
xor eax, ecx
xor edx, edi
or edx, eax
je 0x41acc0
push 0
push edi
push ecx
push esi
call fcn.0044a8f7
add esp, 0x10
test eax, eax
je 0x41acc0
xor eax, eax
jmp 0x41acd3
push esi
push dword [esp + 0x20]
push 1
push dword [esp + 0x24]
call fcn.0044d909
add esp, 0x10
pop esi
pop edi
ret
Function at 0x42375d
Capabilities:
Get disk information

Disassembly:
push esi
push eax
xor eax, eax
mov esi, esp
mov dword [esi], eax
push eax
push eax
push eax
push eax
push esi
push eax
push eax
push 0x46633c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [esi]
add esp, 4
pop esi
ret

Function at 0x424365
Capabilities:
Get hostname

Disassembly:
push edi
push esi
push eax
mov eax, 0x400
mov edi, esp
mov dword [edi], eax
push eax
call fcn.0044deb4
add esp, 4
mov esi, eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov eax, esi
add esp, 4
pop esi
pop edi
ret

Function at 0x425380
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
mov eax, 0x2004
call fcn.0043f6a0
mov eax, esp
lea ecx, [esp + 4]
push eax
push 0x2000
push ecx
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x4253a9
cmp dword [esp], 0xc7
jbe 0x4253b0
add esp, 0x2004
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x42f0bc
Capabilities:
Create process on windows
Encode data using base64
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push eax
call fcn.004258b2
mov dword [esp], 0x6077240
mov eax, 0x6077240
cmp eax, 0x6077240
je 0x42f0e5
cmp eax, 0x39d9b857
je 0x42f0f1
cmp eax, 0xf67daab0
jne 0x42f0ce
jmp 0x42f0f8
call fcn.00409e88
mov eax, 0x39d9b857
jmp 0x42f0ce
mov eax, 0xf67daab0
jmp 0x42f0ce
mov dword [esp], eax
call fcn.0041f418
pop eax
jmp fcn.00428630
Function at 0x43fcbf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43fcfe
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43fcfe
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43fcfe
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43fcfe
cmp dword [ecx + 0x74], 0xe
jbe 0x43fcfe
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x449c89
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00449ee0
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x449e01
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x449e01
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x449db0
jg 0x449ce2
test eax, eax
je 0x449da6
push 1
push 0x1000
call fcn.00455d80
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x449d08
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x449d9d
push 0x8000
push ebx
call fcn.0044c08c
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x449d34
jg 0x449d2f
cmp ecx, 0x1000
jb 0x449d34
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00455e14
add esp, 0x10
cmp eax, 0xffffffff
je 0x449d79
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x449d2f
jl 0x449d60
test ecx, ecx
jne 0x449d21
push dword [ebp - 0xc]
push ebx
call fcn.0044c08c
push esi
call fcn.00453c74
add esp, 0xc
xor edi, edi
jmp 0x449e12
cmp byte [edi + 0x24], 0
je 0x449d90
cmp dword [edi + 0x20], 5
jne 0x449d90
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x449d9b
mov edi, dword [edi + 0x18]
jmp 0x449d9d
xor edi, edi
push esi
call fcn.00453c74
pop ecx
jmp 0x449e12
test ecx, ecx
jg 0x449d72
jl 0x449db0
test eax, eax
jae 0x449d72
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0045690a
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x449dd3
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x449d72
jmp 0x449e0a
push ebx
call fcn.0045594c
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x449d72
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x449e12
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x449e0f
mov edi, dword [edi + 0x18]
jmp 0x449e12
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0045690a
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44acce
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0043f6a0
mov eax, dword [0x4707d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0044a896
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x44ad10
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x44ae6c
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00458230
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x471c20]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00456973
mov ecx, dword [esi*4 + 0x471c20]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x44ae65
cmp eax, dword [edi + ecx + 0x24]
jne 0x44ae65
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44ae65
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00456973
add esp, 0x14
test edx, edx
jl 0x44ae65
jg 0x44addb
test eax, eax
jb 0x44ae65
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x44ae65
jl 0x44adf5
cmp dword [ebp - 0x1008], eax
ja 0x44ae65
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x44ae13
test ebx, ebx
je 0x44ae4c
cmp ecx, edi
jae 0x44ae4c
mov al, byte [ecx]
cmp al, 0xd
jne 0x44ae2d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x44ae39
cmp byte [ecx + 1], 0xa
jne 0x44ae39
inc ecx
jmp 0x44ae39
movzx eax, al
movsx eax, byte [eax + 0x470f50]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x44ae13
cmp edx, ebx
jne 0x44ae13
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x44ae6a
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00440118
leave
ret
Function at 0x44cae6
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4707d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x4673c4
push esi
call fcn.00457158
pop ecx
pop ecx
test eax, eax
jne 0x44cb14
xor al, al
jmp 0x44cb91
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.0044c877
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x44cb4e
push dword [ebp - 0x210]
call fcn.0044db0c
xor al, al
jmp 0x44cb8f
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x44cb54
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x44cb74
push edx
call fcn.0044ca37
pop ecx
test al, al
je 0x44cb3f
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x44cb82
mov bl, 1
push dword [ebp - 0x210]
call fcn.0044db0c
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00440118
leave
ret

Function at 0x4523d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4523fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4523fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x45274d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x468eb4
push str.FlsAlloc
push 0x1e
call fcn.00452a30
mov esi, eax
add esp, 0x10
test esi, esi
je 0x452781
push dword [ebp + 8]
mov ecx, esi
call dword [0x46e44c]
call esi
jmp 0x452787
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4527cb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x468ed8
push str.FlsGetValue
push 0x20
call fcn.00452a30
mov esi, eax
add esp, 0x10
test esi, esi
je 0x452802
push dword [ebp + 8]
mov ecx, esi
call dword [0x46e44c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x457a0c
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4707d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x457a57
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00457b82
test al, al
jne 0x457a51
sub edx, 2
cmp edx, edi
jne 0x457a37
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x457a79
lea eax, [edi + 2]
cmp edx, eax
je 0x457a79
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00457958
add esp, 0x10
jmp 0x457b73
push esi
lea ecx, [ebp - 0x255]
call fcn.00457b82
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x457abc
push dword [ebp - 0x25c]
jmp 0x457a69
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x457af9
cmp word [ebp - 0x226], 0
je 0x457b1a
cmp word [ebp - 0x226], ax
jne 0x457af9
cmp word [ebp - 0x224], 0
je 0x457b1a
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00457958
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x457b66
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x457ad3
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x457b4e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x457b73
push 0x457ba6
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004604e0
add esp, 0x10
jmp 0x457b43
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00440118
leave
ret