joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x485321
jmp dword [ecx*4 + 0x485390]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret

Function at 0x485520
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ea080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0049606f
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x485584
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x485584
lea edx, [ebp - 0x108]
push edx
call dword [0x4ea044]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ef91
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0048ef91
mov esp, ebp
pop ebp
ret

Function at 0x4855a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00485520

Function at 0x489780
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1ec]
test esi, esi
jne 0x48979b
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.00468dd0
push edx
push eax
call fcn.00468e00
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1e0], 0
je 0x4897e8
mov eax, dword [ebx + 0x12c]
mov ecx, dword [ebx + 0x128]
push eax
push ecx
call fcn.00468dd0
push edx
push eax
call fcn.00468e00
mov ecx, dword [edi + 0x1e0]
sub ecx, eax
add esp, 0x10
mov eax, ecx
cmp esi, ecx
jge 0x4897ea
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x48a780
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x48a7b3
push 0x2e
push esi
call fcn.00494660
add esp, 8
test eax, eax
je 0x48a7b1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x48a7c0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x48a7f3
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x48c830
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x48c852
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x48c846
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x48c882
cmp dword [esi + 8], 0
jne 0x48c875
mov ecx, dword [eax + 8]
push 0x4c7d44
push ecx
call fcn.00490052
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x48c875
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.00490e04
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x48c8a4
mov eax, dword [esi + 8]
test eax, eax
je 0x48c89e
push eax
call fcn.0048fd51
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x48d6a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x4ea038]
mov edi, eax
add esp, 4
test edi, edi
jne 0x48d6cb
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x48d712
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x48d715
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x48d776
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x48d740
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x48d7af
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push str.6lower
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x4c42bf
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x48d780
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48ef91
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ea080]
jne 0x48ef9b
repz ret
jmp fcn.00497f9d

Function at 0x49f92f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x49f956
call fcn.00494236
mov dword [eax], esi
call fcn.00494223
push 0x16
pop esi
mov dword [eax], esi
call fcn.0049822d
mov eax, esi
jmp 0x49f9ab
test dword [ebp + 0xc], 0xfffffff9
jne 0x49f93c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x49f983
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00494249
pop ecx
call fcn.00494223
mov eax, dword [eax]
jmp 0x49f9ab
test al, 0x10
jne 0x49f9a9
test al, 1
je 0x49f9a9
test byte [ebp + 0xc], 2
je 0x49f9a9
call fcn.00494236
mov dword [eax], 5
call fcn.00494223
mov dword [eax], 0xd
jmp 0x49f97a
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4a745d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ea080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00497998
and dword [ebp - 0x14], 0
cmp dword [0x4ed3f4], 0
mov dword [ebp - 0x18], eax
jne 0x4a7510
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4a75b8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4c6eb8
push ebx
call edi
test eax, eax
je 0x4a75b8
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4ed3f4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4ed3f8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4ed3fc], eax
call edi
push eax
call esi
mov dword [0x4ed404], eax
test eax, eax
je 0x4a7510
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4ed400], eax
mov eax, dword [0x4ed400]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4a7569
cmp dword [0x4ed404], ecx
je 0x4a7569
push eax
call esi
push dword [0x4ed404]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4a7569
test ebx, ebx
je 0x4a7569
call edi
test eax, eax
je 0x4a7560
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4a7560
test byte [ebp - 8], 1
jne 0x4a7569
or dword [ebp + 0x10], 0x200000
jmp 0x4a759c
mov eax, dword [0x4ed3f8]
cmp eax, dword [ebp - 0x18]
je 0x4a759c
push eax
call esi
test eax, eax
je 0x4a759c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4a759c
mov eax, dword [0x4ed3fc]
cmp eax, dword [ebp - 0x18]
je 0x4a759c
push eax
call esi
test eax, eax
je 0x4a759c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4ed3f4]
call esi
test eax, eax
je 0x4a75b8
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4a75ba
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ef91
leave
ret
Function at 0x4019c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x424084]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
lea ecx, [ebp - 0x120]
push 0
push ecx
call fcn.00415410
add esp, 0xc
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x11c], 5
jne 0x401a3d
mov ecx, dword [ebp - 0x118]
cmp ecx, 1
je 0x401a38
cmp ecx, 2
jne 0x401a3d
cmp byte [ebp - 6], 1
jne 0x401a3d
cmp word [ebp - 0x144], 9
jne 0x401a3d
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ecd0
mov esp, ebp
pop ebp
ret
Function at 0x401a50
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x424084]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x401c1b
xor eax, eax
cmp ax, word [esi]
je 0x401c1b
push 0x24c
push eax
lea ecx, [ebp - 0x668]
push ecx
mov dword [ebp - 0x66c], eax
call fcn.00415410
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x41a]
push eax
mov word [ebp - 0x41c], dx
call fcn.00415410
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x212]
push edx
mov word [ebp - 0x214], cx
call fcn.00415410
add esp, 0xc
push esi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x5c
je 0x401b0c
push esi
lea ecx, [ebp - 0x214]
push 0x420774
push ecx
mov edx, 0x103
call fcn.00404da0
add esp, 0xc
jmp 0x401b26
push 0x103
push esi
lea edx, [ebp - 0x214]
push 0x104
push edx
call fcn.0040f526
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x41c]
push str._s.
push ecx
mov edx, 0x103
call fcn.00404da0
add esp, 0xc
lea edx, [ebp - 0x66c]
push edx
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401c1b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x420788
lea ecx, [ebp - 0x640]
push ecx
call esi
test eax, eax
je 0x401be3
push 0x42078c
lea edx, [ebp - 0x640]
push edx
call esi
test eax, eax
je 0x401be3
lea eax, [ebp - 0x640]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x41c]
push str._s_s
push edx
mov edx, 0x103
call fcn.00404da0
add esp, 0x10
test byte [ebp - 0x66c], 0x10
je 0x401bd6
lea eax, [ebp - 0x41c]
push eax
call fcn.00401a50
add esp, 4
jmp 0x401be3
lea ecx, [ebp - 0x41c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x66c]
push edx
push edi
call ebx
test eax, eax
jne 0x401b71
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040ecd0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040ecd0
mov esp, ebp
pop ebp
ret
Function at 0x401c30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d501
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x424084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ebx
mov eax, 1
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], cx
push 0x2002
mov dword [ebp - 0x10], eax
call fcn.0040f458
push 0x2002
mov edi, eax
push ebx
push edi
call fcn.00415410
mov eax, dword [ebp + 8]
add esp, 0x10
cmp dword [ebp + 0x1c], 8
jae 0x401ca3
lea eax, [ebp + 8]
push 0x1000
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test ebx, ebx
jne 0x401ccb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x401d37
push ebx
mov eax, 0x420730
jmp 0x401d32
cmp ebx, 0x1000
jbe 0x401d19
lea edx, [ebx + ebx]
push edx
push edi
call fcn.0040f3ab
mov edi, eax
add esp, 8
test edi, edi
jne 0x401cee
push eax
mov eax, 0x420730
jmp 0x401d32
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x401cfa
lea eax, [ebp + 8]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x401d0f
push eax
mov eax, 0x420730
jmp 0x401d32
push esi
mov eax, edi
call fcn.00401400
jmp 0x401d37
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401d20
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.00401890
push edi
call fcn.0040f4ec
add esp, 4
cmp dword [ebp + 0x1c], 8
jb 0x401d52
mov eax, dword [ebp + 8]
push eax
call fcn.0040ecdf
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401d70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d77d
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x424084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x1c
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, esp
mov dword [ebp - 0x23c], ebx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x240], esp
mov word [esi], ax
push 7
mov eax, str.appdata
mov dword [ebp - 0x244], edi
call fcn.00401890
mov ecx, edi
call fcn.00401c30
add esp, 0x1c
mov dword [ebp - 4], ebx
xor ecx, ecx
push 4
mov eax, str.XY_
lea esi, [ebp - 0x238]
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], ebx
mov word [ebp - 0x238], cx
call fcn.00401890
mov dword [ebp - 4], 1
cmp dword [edi + 0x10], ebx
jne 0x401e67
lea edx, [ebp - 0x21c]
push edx
push ebx
push ebx
push 5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401e40
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
mov esi, edi
call fcn.00401890
push ebx
lea eax, [ebp - 0x238]
push eax
jmp 0x401e6f
push ebx
lea ecx, [ebp - 0x238]
push ecx
or eax, 0xffffffff
mov esi, edi
call fcn.004044a0
mov esi, 8
cmp dword [edi + 0x14], esi
jb 0x401e87
mov eax, dword [edi]
jmp 0x401e89
mov eax, edi
push ebx
push eax
call fcn.0040f8de
add esp, 8
test eax, eax
je 0x401eaa
cmp dword [edi + 0x14], esi
jb 0x401ea0
mov eax, dword [edi]
jmp 0x401ea2
mov eax, edi
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp dword [ebp - 0x224], esi
jb 0x401ec1
mov edx, dword [ebp - 0x238]
push edx
call fcn.0040ecdf
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ecd0
mov esp, ebp
pop ebp
ret
Function at 0x402090
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x424084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, dword [ebx]
mov edi, eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x238], edi
cmp esi, eax
je 0x4020e4
mov ecx, eax
sub ecx, eax
sar ecx, 2
lea edi, [ecx*4]
push edi
push eax
push esi
call fcn.0040ef10
add esp, 0xc
add edi, esi
mov dword [ebx + 4], edi
mov edi, dword [ebp - 0x238]
push 0x22c
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.00415410
add esp, 0xc
lea ecx, [ebp - 0x230]
push ecx
push edi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40226d
lea ebx, [ebx]
push 0x22c
call fcn.0040f458
mov edx, eax
mov ecx, 0x8b
lea esi, [ebp - 0x230]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x234]
add esp, 4
mov dword [ebp - 0x234], edx
cmp ecx, eax
jae 0x4021b2
mov esi, dword [ebx]
cmp esi, ecx
ja 0x4021b2
mov edi, ecx
mov ecx, dword [ebx + 8]
sub edi, esi
sar edi, 2
cmp eax, ecx
jne 0x4021a2
sub eax, esi
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x402263
sub ecx, esi
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x4021a2
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x402192
xor ecx, ecx
jmp 0x402194
add ecx, edx
cmp ecx, eax
jae 0x40219a
mov ecx, eax
push ecx
mov esi, ebx
call fcn.00404740
mov eax, dword [ebx + 4]
test eax, eax
je 0x402207
mov edx, dword [ebx]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x402207
mov ecx, dword [ebx + 8]
cmp eax, ecx
jne 0x4021fe
mov esi, dword [ebx]
sub eax, esi
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x402263
sub ecx, esi
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x4021fe
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x4021e8
xor ecx, ecx
jmp 0x4021ea
add ecx, edx
cmp ecx, eax
jae 0x4021f0
mov ecx, eax
push ecx
mov esi, ebx
call fcn.00404740
mov edx, dword [ebp - 0x234]
mov eax, dword [ebx + 4]
test eax, eax
je 0x402207
mov dword [eax], edx
add dword [ebx + 4], 4
push 0x22c
lea edx, [ebp - 0x230]
push 0
push edx
call fcn.00415410
mov esi, dword [ebp - 0x238]
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402120
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ecd0
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call fcn.0040ec0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
cmp eax, 0x12
je 0x402248
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0040ecd0
mov esp, ebp
pop ebp
ret
Function at 0x402660
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x424084]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x42]
push ecx
mov word [ebp - 0x44], ax
call fcn.00415410
add esp, 0xc
call fcn.004019c0
test eax, eax
jne 0x4026a5
movzx ecx, word [eax + 0x420768]
mov word [ebp + eax - 0x44], cx
add eax, 2
test cx, cx
jne 0x402691
push 0x3c
lea edx, [ebp - 0x80]
push 0
push edx
call fcn.00415410
add esp, 0xc
lea ecx, [ebp - 0x80]
lea eax, [ebp - 0x44]
push ecx
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x440
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x402707
cmp dword [ebp - 0x48], 0
je 0x402707
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ecd0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0040ecd0
mov esp, ebp
pop ebp
ret
Function at 0x403330
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d418
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x424084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
push ecx
mov ecx, edi
call fcn.00404200
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
push 0
mov dword [eax + 8], eax
push 0
mov dword [edi + 8], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.0040ecc5
mov esi, eax
add esp, 4
lea eax, [ebx + 1]
push eax
push 0
push esi
call fcn.00415410
add esp, 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x40346e
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x40]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x40346e
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
xor ebx, ebx
push ebx
push 0x400
push edx
push eax
call fcn.00419bb0
push ebx
push 0x400
push edx
push eax
call fcn.00419bb0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
fild qword [ebp - 0x38]
fstp dword [ebp - 0x30]
fld dword [ebp - 0x30]
fcomp qword [0x421100]
fnstsw ax
test ah, 0x41
jne 0x40346e
mov eax, esi
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403430
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.00405da0
lea edx, [ebp - 0x2c]
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.00403e00
fld dword [ebp - 0x30]
fstp dword [eax]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0x10
jb 0x40346e
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0040ecdf
add esp, 4
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403473
sub eax, edx
cmp byte [esi + eax + 1], cl
lea esi, [esi + eax + 1]
jne 0x4033b1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ecd0
mov esp, ebp
pop ebp
ret

Function at 0x4034b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x424084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00415410
add esp, 0xc
push 1
push 0x10
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, eax
cmp edi, 1
jne 0x40352d
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
jmp 0x403510
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403510
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
call fcn.00401890
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040ecd0
mov esp, ebp
pop ebp
ret