joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012cd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
imul ecx, ecx, 0x106
cmp byte [ecx + 0x4032e0], 0
push ebx
lea ebx, [ecx + 0x4032e0]
push esi
push edi
mov dword [ebp - 4], edx
jne 0x40138a
mov esi, 0x4031c0
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll__mbsrchr]
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x40131f
lea eax, [ebp - 0x11c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x401341
mov eax, edi
sub eax, esi
push eax
lea eax, [ebp - 0x11c]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__mbsncpy]
lea eax, [ebp + edi - 0x11c]
add esp, 0xc
sub eax, esi
and byte [eax], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x11c]
push 0x403014
push eax
call esi
mov ecx, dword [ebp - 4]
call fcn.004012a6
push eax
lea eax, [ebp - 0x11c]
push eax
call esi
lea eax, [ebp - 0x11c]
push 0
push eax
call dword [sym.imp.MSVCRT.dll__access]
pop ecx
test eax, eax
pop ecx
jne 0x40138a
lea eax, [ebp - 0x11c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407b54
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x407c2f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 8]
mov eax, 0x407c44
call fcn.00409454
mov eax, dword [ebp - 8]
call fcn.00404664
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
je 0x407b96
mov eax, dword [0x40b16c]
add dword [eax], 0xa
mov ebx, 0xa
lea edx, [ebp - 0xc]
mov eax, 0x407c54
call fcn.00409454
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00407dcc
push dword [ebp - 0x10]
push 0x407c68
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404524
push 0
mov eax, dword [ebp - 4]
call fcn.00404664
push eax
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402b68
mov eax, dword [ebp - 0x14]
call fcn.00404664
push eax
call sub.kernel32.dll_CopyFileA
mov eax, 0x64
call fcn.00403150
cmp eax, 0x1e
jle 0x407c11
mov eax, 5
call fcn.00403150
mov edx, eax
shl edx, 0xa
mov eax, dword [ebp - 4]
call fcn.00408ad0
dec ebx
jne 0x407b9b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407c36
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404210
ret

Function at 0x408e20
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov eax, ebx
mov edx, 0x408f50
call fcn.00404240
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x408f32
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x408eba
dec ecx
jne 0x408f24
cmp eax, 4
jg 0x408e76
mov eax, ebx
mov edx, 0x408f60
call fcn.00404240
jmp 0x408f3e
cmp eax, 5
jne 0x408e90
test edx, edx
jne 0x408e90
mov eax, ebx
mov edx, 0x408f70
call fcn.00404240
jmp 0x408f3e
cmp eax, 5
jne 0x408ea9
dec edx
jne 0x408ea9
mov eax, ebx
mov edx, 0x408f80
call fcn.00404240
jmp 0x408f3e
mov eax, ebx
mov edx, 0x408f50
call fcn.00404240
jmp 0x408f3e
cmp eax, 4
jne 0x408ed1
test edx, edx
jne 0x408ed1
mov eax, ebx
mov edx, 0x408f90
call fcn.00404240
jmp 0x408f3e
cmp eax, 4
jne 0x408efe
cmp edx, 0xa
jne 0x408efe
cmp byte [esp + 0x15], 0x41
jne 0x408ef0
mov eax, ebx
mov edx, 0x408fa0
call fcn.00404240
jmp 0x408f3e
mov eax, ebx
mov edx, 0x408fb0
call fcn.00404240
jmp 0x408f3e
cmp eax, 4
jne 0x408f16
cmp edx, 0x5a
jne 0x408f16
mov eax, ebx
mov edx, 0x408fc0
call fcn.00404240
jmp 0x408f3e
mov eax, ebx
mov edx, 0x408f50
call fcn.00404240
jmp 0x408f3e
mov eax, ebx
mov edx, 0x408f50
call fcn.00404240
jmp 0x408f3e
mov eax, ebx
mov edx, 0x408f50
call fcn.00404240
add esp, 0x94
pop ebx
ret

Function at 0x408fc8
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
push ecx
mov ebx, eax
mov dword [esp], 2
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x408ffa
mov eax, dword [esp]
and eax, 2
cmp eax, 2
jne 0x408ffa
mov eax, ebx
mov edx, 0x409034
call fcn.00404240
mov dword [esp], 1
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x409028
mov eax, dword [esp]
and eax, 1
cmp eax, 1
jne 0x409028
mov eax, ebx
mov edx, 0x409040
call fcn.00404240
pop edx
pop ebx
ret
Function at 0x409208
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40925c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, bl
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404664
push eax
push 0x409268
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409263
lea eax, [ebp - 4]
call fcn.004041ec
ret

Function at 0x409304
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x409393
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x4093a8
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40939a
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret

Function at 0x4093ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40943b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x409450
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409442
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret

Function at 0x409454
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x4094e3
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x4094f8
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4094ea
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret
Function at 0x4094fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40958b
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x4095a0
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409592
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret
Function at 0x4040b0
Capabilities:
Encode data using xor

Disassembly:
wait
jo 0x4040f4
test byte [ebx], dl
invalid
mov word [edx], es
inc ecx
add byte [ebx], bh
sar byte [ebp + 0x18], 1
mov ecx, dword [0xa54102b8]
or eax, 0xa54102b8
mov eax, dword [0x5241c0c0]
fild dword [eax - 0x77]
or eax, 0x4102b8
mov dword [0x5002d5], eax
mov eax, dword [0x41bbac]
cmp ecx, dword [0xded010]
add eax, 0x138dbfc1
add dword [eax], eax
xor ecx, dword [ebx + 0x415cc80d]
add byte [ebx + 0x5e6c1b7], cl
push es
enter 0x415c, 0
mov esi, dword [edi + 0x605e6c1]
stosb byte es:[edi], al
mov ecx, dword [0xce41c9b0]
inc eax
inc ecx
pop esp
lodsb al, byte [esi]
add al, byte [ecx]
mov dword [0x4102b0], ecx
jns 0x4040fd
sub byte [eax], al
add byte [ecx + 0x6c5083], cl
add byte [ebx + 0x83010], cl
pop eax
mov dword [ebx - 0x51fff70d], edx
fild dword [esi]
mov ecx, dword [ebx + 0x8bb]
mov dword [esi + 4], ecx
ror byte [ebx + 0x838], 1
mov eax, dword [ebx + 0x73000830]
mov bl, 0x93
or byte [eax], al
jae 0x404129
xchg ebx, eax
xor al, 8
add byte [ecx], bl
sub ecx, eax
mov eax, dword [ebx + 0xb33c]
cmp al, 0xb3
add byte [eax], al
sbb eax, edx
repe cmpsd dword [esi], dword es:[edi]
jg 0x404193
jl 0x404172
cmp ecx, edi
pop ecx
add al, 0x33
leave
xor eax, eax
mov dword [esi - 0x6d], ecx
mov dword [esi - 1], eax
mov ecx, dword [ebx + 0x850]
mov eax, dword [ebx + 0x830]
mov ebx, dword [esi + 0x834]
sub ecx, eax
mov eax, dword [ebx + 0x854]
sbb eax, edx
cmp eax, edi
jg 0x4041c3
jl 0x4041bf
cmp ecx, edi
mov esi, 0x33c93304
shr dl, 0
sbb byte [ecx - 0x7474e3ba], cl
dec eax
wait
add byte [eax], al
mov eax, dword [ebx + 0x840]
mov ebp, ebp
inc esp
or byte [eax], al
add byte [esi - 0x38], ah
dec ebp
or dword [eax + ecx], 0
sbb eax, edx
cmp eax, edi
jg 0x4041f3
xor ecx, ecx
xor eax, eax
ljmp 0x8b1c:0x46891800
jl 0x4041ef
cmp ecx, edi
jae 0x40417f
xor eax, dword [ecx + 0x4e89c05e]
or byte [ecx - 0x3777f3ba], cl
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
mov al, cl
adc al, 0xd0
mov esi, 0x74c73b00
aaa
mov esi, dword [0x4147ac]
mov eax, esi
cdq
idiv ecx
fcom st(2)
imul ebp, dword [eax], 0xffffff8b
adc eax, 0xa9c074
stc
add edx, 0x40
push 0x7440e840
push edx
pop eax
adc eax, 0x40174d
mov eax, dword [0x40c0ed]
mov es, eax
lcall 0x40c1, 0x4a15ff50
add byte [ebx - 0x732aef3c], al
and al, 8
add byte [eax], al
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x6d000828], edi
mov ah, 0xbb
and byte [eax], cl
or dword [eax], eax
mov dword [ebx + 0x6e], edi
je 0x4042cf
pop eax
call fcn.00406600
and dword [eax - 0x76ffbef5], 0x15
movsb byte es:[edi], byte [esi]
or eax, dword [ecx]
mov edi, esp
cmp byte [eax], cl
add dh, bl
mov ecx, dword [0x410ba4]
adc ecx, dword [ebx + 0x83c]
mov esi, dword [ebx - 0x60]
or esp, dword [edi + 0x10]
mov dword [eax + esi - 0x5effff22], ecx
movsb byte es:[edi], byte [esi]
or eax, dword [ecx]
push ebx
mov dword [ebx + 0x834], eax
cdq
or al, 0xdc
push ds
inc esp
add esp, 4
pop edi
pop esi
pop ebx
outsd dx, dword [esi]
in eax, 0x5d
ret
call esi
cwde
les edx, [edi + ebx*8]
ret
Function at 0x408952
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
call fcn.0040897e
sub esp, 4
mov dword [esp], 0xe596d541
pop edi
add ecx, 0xebb27cb1
xor dword [edx], esi
add edx, 1
cmp edx, eax
jne fcn.00408952
sub ecx, edi
ret
Function at 0x402840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402859
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402894
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402890
lea ebx, [ebx]
cmp esi, eax
jae 0x402894
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402880
cmp esi, eax
jb 0x40289a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4031c0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x18
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4031d0
sub eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4031e4
push ebp
sub eax, edx
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push 0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403334
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push esi
push edi
lea ecx, [esp + 0x10]
push ecx
push str..UCIP
push edx
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40324f
mov eax, dword [esp + 0x10]
push 0xd
push str.YingUnInstall
push 1
push 0
push 0
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
push str.YingUnInstall
push eax
call ebx
test eax, eax
jne 0x40332a
mov ecx, dword [esp + 0x10]
push 0xe
push str.Uninstall_File
push 1
push eax
push eax
push ecx
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push str.DefaultIcon
push eax
call ebx
test eax, eax
jne 0x4032a7
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x14]
push ebp
push ecx
push 1
push eax
push eax
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push str.Shell
push edx
call ebx
test eax, eax
jne 0x403323
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push str.Open
push ecx
call ebx
test eax, eax
jne 0x40331c
mov edx, dword [esp + 0x18]
push eax
push 0x46dc1c
push 1
push eax
push eax
push edx
call esi
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push str.Command
push ecx
call ebx
test eax, eax
jne 0x403315
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push edx
push eax
push 2
push 0
push 0
push ecx
call esi
mov edx, dword [esp + 0x20]
push edx
call edi
mov eax, dword [esp + 0x18]
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
mov eax, dword [esp + 0x1c]
push eax
call edi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x18
ret
Function at 0x403340
Capabilities:
Check os version

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4033fc
push 0x94
mov edi, 1
call fcn.0044c0be
mov esi, eax
add esp, 4
test esi, esi
je 0x40346f
push 0x94
push 0
push esi
call fcn.0044c190
add esp, 0xc
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
jne 0x4033a5
push esi
lea edi, [eax + 1]
call fcn.0044bfe1
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 5
jne 0x4033dc
cmp dword [esi + 8], 0
jne 0x4033c1
push esi
lea edi, [eax + 1]
call fcn.0044bfe1
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 5
jne 0x4033dc
cmp dword [esi + 8], edi
jne 0x4033dc
push esi
lea edi, [eax + 2]
call fcn.0044bfe1
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 6
jne 0x403466
cmp dword [esi + 8], 0
jne 0x403466
push esi
lea edi, [eax + 2]
call fcn.0044bfe1
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp al, 4
jae 0x403405
pop edi
xor eax, eax
pop esi
ret
push 0x94
mov edi, 2
call fcn.0044c0be
mov esi, eax
add esp, 4
test esi, esi
je 0x40346f
push 0x94
push 0
push esi
call fcn.0044c190
add esp, 0xc
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
jne 0x403466
cmp dword [esi + 8], 0xa
jne 0x403459
push esi
lea edi, [eax - 1]
call fcn.0044bfe1
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 4
jne 0x403466
cmp dword [esi + 8], 0x5a
jne 0x403466
mov edi, eax
push esi
call fcn.0044bfe1
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x403480
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x48bb84]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [esp + 0x28]
push ecx
push 0x64
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp byte [esp + 0x28], 0
mov dword [edi], 0
lea esi, [esp + 0x28]
je 0x40355a
lea esp, [esp]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x4034e8
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x40353e
movsx edx, byte [esi]
push edx
call fcn.0044b8b2
add esp, 4
cmp eax, 0x41
je 0x40353e
movsx eax, byte [esi]
push eax
call fcn.0044b8b2
mov ecx, dword [edi]
mov edx, dword [esp + 0x10]
add esp, 4
mov byte [edx + ecx], al
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [edi]
shrd ecx, edx, 0x14
shr edx, 0x14
mov dword [ebx + eax*8], ecx
mov dword [ebx + eax*8 + 4], edx
inc dword [edi]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403543
sub eax, edx
cmp byte [esi + eax + 1], cl
lea esi, [esi + eax + 1]
jne 0x4034d0
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044b298
mov esp, ebp
pop ebp
ret
Function at 0x403ed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x465028
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x48bb84]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
xor eax, eax
cmp byte [0x48a0f3], al
je 0x403f1c
mov cl, 0x20
cmp byte [eax + 0x48a0f3], cl
je 0x403f15
inc eax
cmp byte [eax + 0x48a0f3], 0
jne 0x403f01
jmp 0x403f1c
mov byte [eax + 0x48a0f3], 0
push 0x48a0f3
lea ecx, [esp + 0x1c]
call fcn.00424fe0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.00424f60
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0044b2c8
add esp, 4
lea ecx, [esp + 0xc]
mov esi, eax
mov edi, edx
call fcn.004250c0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004250c0
mov eax, esi
mov edx, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret

Function at 0x4043c0
Capabilities:
Create process on windows
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x465168
mov eax, dword fs:[0]
push eax
sub esp, 0x388
mov eax, dword [0x48bb84]
xor eax, esp
mov dword [esp + 0x384], eax
push esi
mov eax, dword [0x48bb84]
xor eax, esp
push eax
lea eax, [esp + 0x390]
mov dword fs:[0], eax
sub esp, 0xc
lea eax, [esp + 0x3ac]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
mov dword [esp + 0x3a8], 0
call fcn.00424f60
lea esi, [esp + 0x28]
call fcn.00403b90
mov eax, dword [eax + 4]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, esi
call fcn.004250c0
mov ecx, dword [esp + 0x3a4]
push ecx
lea edx, [esp + 0x70]
push 0x320
push edx
call fcn.0044b8de
push 0x44
lea eax, [esp + 0x38]
push 0
push eax
call fcn.0044c190
mov cx, word [esp + 0x3c4]
add esp, 0x18
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x20
push 1
push 0
mov word [esp + 0x74], cx
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x7c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4044c3
lea ecx, [esp + 0x3a0]
mov dword [esp + 0x398], 0xffffffff
call fcn.004250c0
mov eax, 0xbeb95
jmp 0x4044fd
mov edx, dword [esp + 0xc]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, dword [esp + 8]
lea ecx, [esp + 0x3a0]
mov dword [esp + 0x398], 0xffffffff
call fcn.004250c0
mov eax, esi
mov ecx, dword [esp + 0x390]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x384]
xor ecx, esp
call fcn.0044b298
add esp, 0x394
ret
Function at 0x404530
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4651a8
mov eax, dword fs:[0]
push eax
sub esp, 0x70c
mov eax, dword [0x48bb84]
xor eax, esp
mov dword [esp + 0x708], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48bb84]
xor eax, esp
push eax
lea eax, [esp + 0x720]
mov dword fs:[0], eax
mov eax, dword [esp + 0x734]
push eax
lea ecx, [esp + 0x52c]
push 0x1f4
push ecx
call fcn.0044b8de
lea edx, [esp + 0x534]
push edx
lea eax, [esp + 0x344]
push 0x1f4
push eax
call fcn.0044b8de
lea eax, [esp + 0x34c]
add esp, 0x18
lea edx, [eax + 1]
xor ebx, ebx
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4045b0
sub eax, edx
cmp eax, 4
jl 0x40469a
mov cx, word [esp + 0x334]
mov dl, byte [esp + 0x336]
push 0x46dc1c
lea eax, [esp + 0x18]
push 0x12c
push eax
mov word [esp + 0x14c], cx
mov byte [esp + 0x14e], dl
mov byte [esp + 0x14f], bl
xor esi, esi
call fcn.0044b8de
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
cmp byte [esp + 0x337], bl
je 0x404671
lea edi, [esp + 0x337]
mov al, byte [edi]
cmp al, 0x5c
jne 0x404667
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x144]
push 0x1f4
push edx
mov byte [esp + esi + 0x20], bl
call fcn.0044bba8
add esp, 0xc
push ebx
lea eax, [esp + 0x144]
push eax
call ebp
push 0x46dd68
lea ecx, [esp + 0x144]
push 0x1f4
push ecx
call fcn.0044bba8
add esp, 0xc
xor esi, esi
mov byte [esp + 0x14], bl
jmp 0x40466c
mov byte [esp + esi + 0x14], al
inc esi
inc edi
cmp byte [edi], bl
jne 0x404616
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x144]
push 0x1f4
push eax
mov byte [esp + esi + 0x20], bl
call fcn.0044bba8
add esp, 0xc
push ebx
lea ecx, [esp + 0x144]
push ecx
call ebp
lea ecx, [esp + 0x730]
mov dword [esp + 0x728], 0xffffffff
call fcn.004250c0
mov ecx, dword [esp + 0x720]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x708]
xor ecx, esp
call fcn.0044b298
add esp, 0x718
ret