joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f8f0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42dc10
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x443854]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
nop
nop
nop
push 0x43de08
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x14], 0x68a053
call fcn.00415194
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x24]
push eax
call edi
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
call edi
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
call edi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.0040fe50
push dword [ebp - 0x28]
fstp qword [ebp - 0x3c]
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0040fe50
push dword [ebp - 0x20]
fstp qword [ebp - 0x34]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0040fe50
movsd xmm2, qword [ebp - 0x34]
add esp, 0x30
movsd xmm3, qword [ebp - 0x3c]
movaps xmm0, xmm2
addsd xmm0, xmm3
fstp qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x2c]
comisd xmm0, xmm1
jbe 0x40fa01
movaps xmm0, xmm1
addsd xmm0, xmm2
comisd xmm0, xmm3
jbe 0x40fa01
addsd xmm1, xmm3
comisd xmm1, xmm2
jbe 0x40fa01
mov eax, 0x40f9ed
ret
mov eax, 0x40fa07
ret

Function at 0x40fa20
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42dc30
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x443854]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
nop
nop
nop
push 0x440da0
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x3ea04274
push eax
mov dword [ebp - 0x5c], 1
call fcn.00415194
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
shrd ecx, eax, 0x14
shr eax, 0x14
cmp ecx, 0x2000
mov eax, 0x40fab2
setae byte [ebp - 0x55]
ret
Function at 0x40fbc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42dca0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x443854]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x43de08
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x30], 0x76981
call fcn.00415194
nop
nop
nop
push str.C:UsersPublicDesktop_
lea ecx, [ebp - 0x2c]
call fcn.00409050
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40fc4f
nop
nop
nop
lea ecx, [ebp - 0x2c]
call fcn.00409b40
mov eax, 0x40fc4b
ret
lea ecx, [ebp - 0x2c]
call fcn.00409b40
mov eax, 0x40fc5d
ret

Function at 0x4255a7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00425255

Function at 0x40118c
Capabilities:
Encode data using xor

Disassembly:
push 0x40122c
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], cl
pop ds
or byte [edi], bh
mov bl, 0xfb
sub byte [edx + edi*4 + 0x64], cl
out dx, al
pushal
dec eax
mov es, word [edi - 0x31]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sub eax, 0x30303043
sub eax, 0x6463626a
imul edi, dword [eax + 0x64], 0x6f656c79
outsd dx, dword gs:[esi]
add byte [ebp + 0x23], bh
xor ch, byte [esi]
add byte [eax], al
add byte [eax], al
push eax
add byte [eax], al
add byte [edi - 0x4692f58d], bl
mov fs, word [ecx + 0x48]
mov bl, 0x79
xchg edi, eax
pop es
xchg ebp, eax
pushfd
lodsb al, byte [esi]
lodsd eax, dword [esi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sbb byte [ebx], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add cl, dl
inc ecx
add al, byte [eax]
add byte [eax], al
add byte [eax], al
js 0x4011d1
inc eax
add byte [eax + eax], cl
add byte [esi + 0x42], dl
xor eax, 0x2a263621
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or al, byte [eax]
or dword [eax + eax], eax
add byte [eax], al
add byte [eax], al
add al, dl
xor byte [eax], al
adc byte [eax + eax*2], 0
div eax
xor byte [eax], al
add bh, bh
invalid
Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x4010a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x4010a8
mov eax, esi
pop esi
ret

Function at 0x40123b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x1f
jmp 0x401255
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x40152e
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 8]
je 0x401272
mov byte [ebp - 1], 1
jmp 0x401276
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
mov dword [ebp - 0x18], 0x7f
cmp dword [ebp - 0x18], 0x1e4b
jle 0x4012f5
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 0xc]
je 0x401308
mov byte [ebp - 2], 1
jmp 0x40130c
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 4], al
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
and eax, ecx
je 0x401324
and dword [ebp - 0x14], 0
jmp 0x401331
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
or eax, ecx
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 0x14]
mov byte [ebp - 5], al
mov dword [ebp - 0x1c], 0xaa3
cmp dword [ebp - 0x1c], 0x237f
jle 0x40143b
cmp al, 0xa6
mov eax, ebp
jge 0x40133e
fld dword [ecx + 0x45]
pop ds
mov dword [0x80f43672], eax
ror dword [0x4a9f4c73], 0xbd
arpl cx, sp
lcall 0x5bcb, 0x42a8c334
cmp dword [edi + 0x1d94f7d], esi
pop es
psrlw mm3, mm4
and ah, byte [esi + 0x6404de5b]
shrd dword [ecx + ebp*4 + 0x59], ebx, 6
inc eax
aad 0xf8
push ds
iretd
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x1cb
cmp dword [ebp - 0x20], 0x1e0d
jle 0x40151f
mov dh, byte [edx + 0x30]
mov word [esi*4 - 0x4bf3a843], es
popal
sar dword [edi - 0x522095d7], 1
xor byte [eax + 0x6ad6cc47], dh
add eax, 0x20fb0184
retf
movzx eax, byte [ebp - 5]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x40124e
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x40a59c
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x40a602
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x40a5e8
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x40a5e0
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40a5e6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x40a600
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0x1cd4
push 0
push dword [ebp - 0x14]
call fcn.00412538
add esp, 0xc
jmp 0x40a610
push 0x6ada
push 0
call fcn.0040f1f8
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40b15c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x40b1db
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40b1c3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x40b1b5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x40b1c1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x40b1d9
push 0x4d53
push 0
push 0
push 0x35aa
call fcn.0040a48f
add esp, 0x10
jmp 0x40b213
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x40b205
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0
push dword [ebp - 0x28]
call fcn.00421904
pop ecx
pop ecx
jmp 0x40b213
push 0
push 0x2a43
call fcn.0040b106
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40f961
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x40fa05
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40f9fb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x40f9dd
mov byte [ebp - 1], 0
push 0x2f3f
push 0x7a12
push 0x420d
push 0x3853
lea eax, [ebp - 1]
push eax
push 1
push 0x1657
push 1
push 1
push 0xa49
push 1
call fcn.0040f522
add esp, 0x2c
jmp 0x40f9f9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x40f9f9
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x40fa03
push 0
call fcn.004107b7
pop ecx
jmp 0x40fa33
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
push 0
push 0x1c8
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x2c]
call fcn.004092c4
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x411ffe
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x412071
lea eax, [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x412035
push 1
call fcn.004121d6
pop ecx
jmp 0x41206c
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x412055
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x41206c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4121d2
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x41217f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x412175
mov dword [ebp - 0x48], 0x7dfa860b
mov dword [ebp - 0x34], 0x1c7bf0b9
mov dword [ebp - 0x58], 0xdba33992
mov dword [ebp - 0x78], 0xfffffff8
mov dword [ebp - 0x7c], 0xffffffff
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x74], 0xfffffff8
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x5c], 0xfffffff9
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x68], 0x15362daa
mov dword [ebp - 0x70], 0xa35ca420
mov dword [ebp - 4], 0
jmp 0x41210f
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x412125
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x84], 1
jmp 0x412108
mov dword [ebp - 4], 0
jmp 0x412135
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x412148
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x54], 0xfff6
jmp 0x41212e
push 1
push 1
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
call fcn.0041300c
add esp, 0x14
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x54]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x54], eax
jmp 0x41217d
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x4121d2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4121a6
push 0
push 0x1e1b
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
jmp 0x4121d2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4121d2
push 0
push 1
push 0x621
push 0x4952
call fcn.0040af22
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x414f94
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x414fb8
push 0
push 0x6515
push 1
call fcn.00419504
add esp, 0xc
jmp 0x415046
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x414ff5
push 0x16da
push 0x1753
push 0
push 0x5b13
call fcn.0041176c
add esp, 0x10
jmp 0x415046
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41503e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c]
add eax, dword [ecx]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x415046
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x415216
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4152c4
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41526d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41525e
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x41526b
push 0xd29
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4152bf
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4152b7
mov byte [ebp - 1], 0
push 0x3834
push 1
push 0x70ee
push 1
push 1
lea eax, [ebp - 1]
push eax
push 0
push 0x5713
push 1
push 0x224f
push 0x47fb
push 0x643f
call fcn.0041f665
add esp, 0x30
jmp 0x4152bf
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4153cc
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4153a9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x41532b
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x4153a7
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 1
jmp 0x41534d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x4153a7
mov dword [ebp - 0x48], 0xbf25cbd9
mov byte [ebp - 2], 0
lea eax, [ebp - 2]
push eax
push 0x4a1a
push 0
call fcn.00418900
add esp, 0xc
push 0x2a90
push 0x2ba
push 0x2b2d
push 0x5aed
push 0x205b
push 1
push 0x3863
push 0
push 1
lea eax, [ebp - 0x48]
push eax
push 1
call fcn.0040f522
add esp, 0x2c
jmp 0x415342
jmp 0x4153cc
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
push 1
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push 0
push 0x625e
call fcn.00408b12
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x41b24d
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x41b3b5
lea eax, [ebp + 0x34]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x41b31c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41b2f5
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x41b2f3
push 0xd16
push 0x1637
push 0
push 0x462
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x41b317
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x41b3b3
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x41b378
mov byte [ebp - 1], 0
push 1
lea eax, [ebp - 1]
push eax
push 0x472d
push 0x5f70
push 0x562c
push 1
push 1
push 0x2687
push 0x185d
push 1
push 0x7377
push 1
call fcn.0040dc88
add esp, 0x30
jmp 0x41b3b3
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x64], eax
push 0
mov eax, dword [ebp - 0x5c]
push dword [eax]
push dword [ebp - 0x64]
mov eax, dword [ebp - 0x6c]
push dword [eax]
call fcn.0041d0d8
add esp, 0x10
jmp 0x41b3f9
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
movzx eax, byte [eax]
test eax, eax
je 0x41b3eb
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x84], eax
push dword [ebp - 0x84]
push 1
push 0x4fad
call fcn.00412538
add esp, 0xc
jmp 0x41b3f9
push 0x4915
push 0
call fcn.0041eb4c
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41f665
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x41f6b0
mov eax, dword [ebp + 0x34]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 0x50fa
push dword [ebp - 4]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push dword [ebp - 0xc]
push 0x66af
push 0x4184
push 1
call fcn.0041f7de
add esp, 0x1c
jmp 0x41f7da
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41f762
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41f737
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x41f735
push 0xd16
push 0x1637
push 0
push 0x462
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x41f760
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x41f760
push 0
push 1
push 0x5b8a
push 1
call fcn.0041ea34
add esp, 0x10
jmp 0x41f7da
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x41f7ad
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
jmp 0x41f7da
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
movzx eax, byte [eax]
test eax, eax
je 0x41f7da
push 0x1d7c
push 0x159
push 0x1d2
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esp, ebp
pop ebp
ret