joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40299b
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
mov ebx, dword [esi]
cmp ebx, esi
je 0x4029fa
test edi, edi
jne 0x4029db
mov dword [esp], ebx
call fcn.00401ff3
test eax, eax
je 0x4029db
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x10], ebx
jmp 0x4029fa
cmp edi, 1
jne 0x4029f4
mov dword [esp], ebx
call fcn.004036fb
test eax, eax
je 0x4029f4
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x10], ebx
jmp 0x4029fa
mov ebx, dword [ebx]
cmp ebx, esi
jne 0x4029c3
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402ab1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, esi
add eax, dword [esi + 0x3c]
mov edi, esi
add edi, dword [eax + 0x78]
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004022e3
test eax, eax
jne 0x402b20
mov ebx, 0
cmp ebx, dword [edi + 0x18]
jae 0x402b3d
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004022e3
test eax, eax
je 0x402b37
lea eax, [ebx + ebx]
add eax, dword [edi + 0x24]
movzx eax, word [eax + esi]
shl eax, 2
add eax, dword [edi + 0x1c]
add esi, dword [eax + esi]
mov eax, esi
jmp 0x402b42
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x402afd
mov eax, 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4031e6
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
movzx ecx, ax
mov ebx, eax
shr ebx, 0x10
mov eax, 1
test esi, esi
je 0x4032fc
test edi, edi
je 0x4032f5
mov edx, edi
cmp edi, 0x15b0
jbe 0x403221
mov edx, 0x15b0
sub edi, edx
cmp edx, 0xf
jle 0x4032ba
movzx eax, byte [esi]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 1]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 2]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 3]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 4]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 5]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 6]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 7]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 8]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 9]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xa]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xb]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xc]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xd]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xe]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xf]
add ecx, eax
add ebx, ecx
add esi, 0x10
sub edx, 0x10
cmp edx, 0xf
jg 0x40322c
test edx, edx
je 0x4032c9
movzx eax, byte [esi]
add ecx, eax
inc esi
add ebx, ecx
dec edx
jne 0x4032be
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xfff1
sub ecx, edx
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul edx, edx, 0xfff1
sub ebx, edx
test edi, edi
jne 0x403212
mov eax, ebx
shl eax, 0x10
or eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404500
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x1c
push esi
push edi
push str.1003b_Update_Prg
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40452a
mov esi, 1
test edi, edi
je 0x404535
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
je 0x404557
push 0
push str.Notice
push str.Its_running_already_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x40
push 0
push 0x418d40
call fcn.00405440
mov eax, dword [esp + 0x3c]
push eax
push 0x40
push 0x418d40
call fcn.0040519b
add esp, 0x18
push 0xc0c0c0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, dword [esp + 0x28]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
push 0x418f10
push 0x67
push esi
mov dword [0x418ea0], eax
call edi
push 0x64
push 0x418ea8
push 0x6d
push esi
call edi
push esi
call fcn.00404470
mov ecx, dword [esp + 0x38]
push ecx
push esi
call fcn.00401620
add esp, 0xc
test eax, eax
je 0x40454d
call fcn.00401700
test eax, eax
jne 0x4045ee
push eax
push str.Notice
push str.Need_above_DirectX_8.0_version.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
mov edx, dword [0x418f0c]
push str.1003b_Auto_Patch
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
mov esi, eax
push 0
lea eax, [esp + 0x14]
push eax
call edi
test eax, eax
je 0x404666
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x404653
lea eax, [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call edi
test eax, eax
jne 0x404630
pop ebp
pop ebx
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0x1c
ret 0x10

Function at 0x404e58
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41788c]
jne 0x404e62
repz ret
jmp fcn.0040775c
Function at 0x40e154
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040714a
and dword [ebp - 4], 0
cmp dword [0x419990], 0
mov ebx, eax
jne 0x40e205
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40e2b6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x414860
push edi
call esi
test eax, eax
je 0x40e2b6
push eax
call fcn.004070d8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x419990], eax
call esi
push eax
call fcn.004070d8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x419994], eax
call esi
push eax
call fcn.004070d8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x419998], eax
call esi
push eax
call fcn.004070d8
pop ecx
mov dword [0x4199a0], eax
test eax, eax
je 0x40e205
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004070d8
pop ecx
mov dword [0x41999c], eax
mov eax, dword [0x41999c]
cmp eax, ebx
je 0x40e25d
cmp dword [0x4199a0], ebx
je 0x40e25d
push eax
call fcn.00407153
push dword [0x4199a0]
mov esi, eax
call fcn.00407153
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40e25d
test edi, edi
je 0x40e25d
call esi
test eax, eax
je 0x40e254
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40e254
test byte [ebp - 0xc], 1
jne 0x40e25d
or dword [ebp + 0x10], 0x200000
jmp 0x40e296
mov eax, dword [0x419994]
cmp eax, ebx
je 0x40e296
push eax
call fcn.00407153
pop ecx
test eax, eax
je 0x40e296
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40e296
mov eax, dword [0x419998]
cmp eax, ebx
je 0x40e296
push eax
call fcn.00407153
pop ecx
test eax, eax
je 0x40e296
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x419990]
call fcn.00407153
pop ecx
test eax, eax
je 0x40e2b6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40e2b8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4052b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 8], 0x9e81
mov dword [ebp - 0x54], 0xfd80
mov dword [ebp - 0x58], 0xfb60
mov dword [ebp - 0x5c], 0x9ca8
mov dword [ebp - 0x60], 0x72
mov dword [ebp - 0x28], 0xbe2b
mov dword [ebp - 0x64], 0x18fb
mov dword [ebp - 0x4c], 0xc8d1
mov dword [ebp - 0x3c], 0x1659e
mov dword [ebp - 0xc], 0xf701
mov dword [ebp - 0x1c], 0xad4
mov dword [ebp - 0x2c], 0xde54
mov dword [ebp - 0x10], 0x1784
mov dword [ebp - 0x68], 0x16362
mov dword [ebp - 0x50], 0x12909
mov dword [ebp - 0x14], 0x21d9
mov dword [ebp - 0x40], 0xc287
mov dword [ebp - 0x20], 0x1411f
mov dword [ebp - 0x48], 0x3648
mov dword [ebp - 0x30], 0x225f
mov dword [ebp - 0x34], 0x1204a
mov dword [ebp - 0x6c], 0x32e5
mov dword [ebp - 0x38], 0x481b
mov dword [ebp - 4], 0
jmp 0x405369
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0x12049
cmp dword [ebp - 4], ecx
jge 0x405382
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x405360
mov eax, dword [ebp - 0x38]
and eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x10]
jge 0x405396
mov dword [ebp - 0x18], 1
jmp 0x40539d
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x40]
sub ecx, dword [ebp + 8]
and ecx, dword [ebp - 0x18]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp + 8]
sub edx, 1
mov dword [ebp + 8], edx
cmp dword [ebp - 0x44], 0
je 0x40544b
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x1c]
jne 0x40544b
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x1c]
jne 0x40544b
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x30]
jne 0x40544b
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x1c]
jne 0x40544b
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x48]
jne 0x40544b
push 0xda0
push 0x1d26
push 0x98c2
push 0x11570
push 0x5f01
push 0xc9c1
push 0x11fae
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 0x1c
mov edx, dword [ebp - 0x4c]
cmp edx, dword [ebp - 0x20]
jge 0x405425
mov dword [ebp - 0x24], 1
jmp 0x40542c
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 0x10]
and eax, dword [ebp - 0x24]
and eax, dword [ebp - 0xc]
and eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 8]
xor ecx, dword [ebp + 0x14]
and eax, ecx
je 0x40544b
mov edx, dword [ebp + 0x10]
add edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x49d2
push eax
mov ecx, dword [ebp - 8]
sub ecx, 0x2d90
push ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x8398
push edx
mov eax, dword [ebp - 0x2c]
add eax, 0x1a8a
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x37d9
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x2163
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x1392d
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xd4f0
push ecx
call fcn.0041af30
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x40da70
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x58], 0x456
mov dword [ebp - 0x5c], 0x117a5
mov dword [ebp - 0x34], 0x2411
mov dword [ebp - 0x40], 0x4c20
mov dword [ebp - 0x2c], 0x25bd
mov dword [ebp - 0x60], 0xc658
mov dword [ebp - 0x64], 0xe71b
mov dword [ebp - 0x68], 0xf3b5
mov dword [ebp - 0x6c], 0xbf41
mov dword [ebp - 0x70], 0x4428
mov dword [ebp - 0x4c], 0xe945
mov dword [ebp - 4], 0x12796
mov dword [ebp - 0x74], 0x153a2
mov dword [ebp - 8], 0x2d24
mov dword [ebp - 0x54], 0x102df
mov dword [ebp - 0x48], 0x15d02
mov dword [ebp - 0x3c], 0x15cce
mov dword [ebp - 0x30], 0x17531
mov dword [ebp - 0x1c], 0x10ffb
mov dword [ebp - 0x18], 0x15965
mov dword [ebp - 0x38], 0x182ed
mov dword [ebp - 0x44], 0x7dd4
mov dword [ebp - 0x50], 0x1564
mov dword [ebp - 0xc], 0
jmp 0x40db29
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0x2410
cmp dword [ebp - 0xc], ecx
jge 0x40db42
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x40db20
mov dword [ebp - 0x10], 0
jmp 0x40db54
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x38]
sub ecx, 0x182ec
cmp dword [ebp - 0x10], ecx
jge 0x40dc6a
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp + 0x18]
jge 0x40db77
mov dword [ebp - 0x20], 1
jmp 0x40db7e
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x3c]
jge 0x40db8f
mov dword [ebp - 0x24], 1
jmp 0x40db96
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x24]
je 0x40dc65
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp + 0x10]
jne 0x40dc65
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 4]
jne 0x40dc65
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x48]
jne 0x40dc65
push 0x12666
push 0x1739e
push 0x16624
push 0x1102b
push 0x833e
push 0x15c56
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
add esp, 0x18
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x2c]
jge 0x40dc07
mov dword [ebp - 0x28], 1
jmp 0x40dc0e
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
or edx, dword [ebp - 0x28]
je 0x40dc65
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x10]
jne 0x40dc65
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x4c]
jne 0x40dc65
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x54]
jne 0x40dc65
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x30]
jne 0x40dc65
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
push 0x3bc1
push 0xbbf4
push 0x89c4
push 0x2007
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
add esp, 0x10
jmp 0x40db4b
mov dword [ebp - 0x14], 0
jmp 0x40dc7c
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
sub eax, 0x12796
cmp dword [ebp - 0x14], eax
jge 0x40dc94
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
jmp 0x40dc73
mov esp, ebp
pop ebp
ret
Function at 0x40e470
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 4], 0x44ff
mov dword [ebp - 0x2c], 0xfdaa
mov dword [ebp - 0x24], 0x17c23
mov dword [ebp - 0x30], 0x7b2
mov dword [ebp - 0x34], 0x10fa3
mov dword [ebp - 0x38], 0x17c81
mov dword [ebp - 0x3c], 0x11302
mov dword [ebp - 0x40], 0xe9db
mov dword [ebp - 0x44], 0x12e75
mov dword [ebp - 0x18], 0x55e6
mov dword [ebp - 0x48], 0x13f94
mov dword [ebp - 0x4c], 0x1ee3
mov dword [ebp - 0x14], 0xc45e
mov dword [ebp - 8], 0x16d51
mov dword [ebp - 0x1c], 0x1c13
mov dword [ebp - 0x20], 0x6508
mov dword [ebp - 0x28], 0xb5b7
mov dword [ebp - 0x50], 0x5ec3
mov dword [ebp - 0x54], 0xce3d
mov dword [ebp - 0x58], 0x569c
mov dword [ebp - 0x5c], 0xfba2
mov dword [ebp - 0x60], 0x16738
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x10]
jge 0x40e586
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp - 0x14]
jne 0x40e586
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x1c]
jne 0x40e586
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp + 8]
jne 0x40e586
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 0x1c]
jne 0x40e586
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x28]
jne 0x40e586
push 0xec91
push 0xd352
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
add esp, 8
mov edx, dword [ebp + 0x10]
add edx, 1
mov dword [ebp + 0x10], edx
mov esp, ebp
pop ebp
ret
Function at 0x414b20
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x10], 0xb300
mov dword [ebp - 0xc], 0x17815
mov dword [ebp - 0x54], 0x6864
mov dword [ebp - 0x58], 0xc576
mov dword [ebp - 0x40], 0xe433
mov dword [ebp - 0x5c], 0xa34
mov dword [ebp - 0x1c], 0x2a33
mov dword [ebp - 0x38], 0x11b52
mov dword [ebp - 0x14], 0xfde8
mov dword [ebp - 0x44], 0xc22e
mov dword [ebp - 0x60], 0x159f0
mov dword [ebp - 0x64], 0xebe0
mov dword [ebp - 0x18], 0xf837
mov dword [ebp - 0x4c], 0x123ff
mov dword [ebp - 0x34], 0x6061
mov dword [ebp - 0x30], 0xe138
mov dword [ebp - 0x68], 0x180f4
mov dword [ebp - 0x3c], 0x938b
mov dword [ebp - 0x2c], 0x172e7
mov dword [ebp - 0x6c], 0x5ca0
mov dword [ebp - 0x48], 0x10aa9
mov dword [ebp - 0x70], 0xb836
mov dword [ebp - 0x50], 0xb9f9
mov eax, dword [ebp + 0x20]
add eax, 1
mov dword [ebp + 0x20], eax
mov dword [ebp - 4], 0
jmp 0x414be2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x17814
cmp dword [ebp - 4], edx
jge 0x414bfb
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
jmp 0x414bd9
mov dword [ebp - 8], 0
jmp 0x414c0d
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x38]
sub edx, 0x11b51
cmp dword [ebp - 8], edx
jge 0x414d08
mov eax, dword [ebp + 0x24]
xor eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jge 0x414d03
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x14]
jne 0x414d03
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jne 0x414d03
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp - 0x18]
jne 0x414d03
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x40]
jne 0x414d03
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x2c]
jne 0x414d03
push 0x5fdf
push 0x129e
push 0x14bb5
push 0xc662
push 0xb4d
push 0x7122
call dword [sym.imp.KERNEL32.dll_GetSystemTimes]
add esp, 0x18
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x48]
jge 0x414ca2
mov dword [ebp - 0x28], 1
jmp 0x414ca9
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 0x18]
jge 0x414cba
mov dword [ebp - 0x20], 1
jmp 0x414cc1
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x4c]
cmp edx, dword [ebp + 8]
jge 0x414cd2
mov dword [ebp - 0x24], 1
jmp 0x414cd9
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x20]
and eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x28]
je 0x414cfd
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [ebp - 0x30]
jne 0x414cfd
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x30]
jne 0x414cfd
mov eax, dword [ebp - 0x34]
sub eax, 1
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
jmp 0x414c04
mov esp, ebp
pop ebp
ret
Function at 0x4159f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x58], 0xc64f
mov dword [ebp - 0x18], 0x1502b
mov dword [ebp - 0x4c], 0x7b30
mov dword [ebp - 0x40], 0xa57b
mov dword [ebp - 0x1c], 0x8497
mov dword [ebp - 0x20], 0x3bbb
mov dword [ebp - 0x5c], 0xf2dc
mov dword [ebp - 0x60], 0x1505e
mov dword [ebp - 0x64], 0x3d8b
mov dword [ebp - 0x44], 0xa1e8
mov dword [ebp - 0x10], 0xad2a
mov dword [ebp - 0x2c], 0xc1cf
mov dword [ebp - 0x68], 0x16b0
mov dword [ebp - 0x14], 0xbbbd
mov dword [ebp - 0x48], 0x13498
mov dword [ebp - 0x30], 0x1c77
mov dword [ebp - 0x24], 0xafa6
mov dword [ebp - 0x34], 0x12f1d
mov dword [ebp - 0x38], 0x11cad
mov dword [ebp - 0x6c], 0xd57e
mov dword [ebp - 0x3c], 0x13351
mov dword [ebp - 0x70], 0x1f27
mov dword [ebp - 0x74], 0x10785
mov dword [ebp - 0x78], 0x7fc0
mov dword [ebp - 4], 0
jmp 0x415ab0
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 0xe596
cmp dword [ebp - 4], ecx
jge 0x415ac9
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x415aa7
mov dword [ebp - 8], 0
jmp 0x415adb
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0x12f1c
cmp dword [ebp - 8], ecx
jge 0x415af4
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
jmp 0x415ad2
mov eax, dword [ebp - 0x10]
add eax, 0x293e
push eax
mov ecx, dword [ebp - 0x38]
sub ecx, 0x336a
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x26c4
push edx
mov eax, dword [ebp - 0x3c]
sub eax, 0x3a0c
push eax
mov ecx, dword [ebp - 0x40]
add ecx, 0x6319
push ecx
mov edx, dword [ebp - 0x24]
add edx, 0x5dd9
push edx
mov eax, dword [ebp - 0x24]
add eax, 0x7d62
push eax
call fcn.00403570
add esp, 0x1c
mov dword [ebp - 0xc], 0
jmp 0x415b51
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x44]
sub edx, 0xa1e7
cmp dword [ebp - 0xc], edx
jge 0x415bf6
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x10]
jge 0x415b74
mov dword [ebp - 0x28], 1
jmp 0x415b7b
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
xor edx, dword [ebp - 0x48]
and edx, dword [ebp - 0x28]
je 0x415bf1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x2c]
jne 0x415bf1
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x4c]
jne 0x415bf1
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x54]
jge 0x415bc5
mov eax, dword [ebp - 0x30]
sub eax, 1
mov dword [ebp - 0x30], eax
push 0xfefa
push 0x1e72
push 0x7c5e
push 0x146ef
push 0x171d9
push 0x4ea1
push 0x162b1
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
add esp, 0x1c
jmp 0x415b48
mov esp, ebp
pop ebp
ret
Function at 0x4341f6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x434235
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x434235
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x434235
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x434235
cmp dword [ecx + 0x74], 0xe
jbe 0x434235
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4408b4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4408f3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4408f3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4408f3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4408f3
cmp dword [ecx + 0x74], 0xe
jbe 0x4408f3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x460539
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046040d
Function at 0x461034
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x49ccc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x46107f
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004614d4
test al, al
jne 0x461079
sub edx, 2
cmp edx, edi
jne 0x46105f
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4610a1
lea eax, [edi + 2]
cmp edx, eax
je 0x4610a1
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00460cfb
add esp, 0x10
jmp 0x46119b
push esi
lea ecx, [ebp - 0x255]
call fcn.004614d4
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4610e4
push dword [ebp - 0x25c]
jmp 0x461091
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x461121
cmp word [ebp - 0x226], 0
je 0x461142
cmp word [ebp - 0x226], ax
jne 0x461121
cmp word [ebp - 0x224], 0
je 0x461142
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00460cfb
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x46118e
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4610fb
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x461176
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x46119b
push 0x46074b
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0046c2c0
add esp, 0x10
jmp 0x46116b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434769
leave
ret