joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401550
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40625f
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x40a040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push str.ollydbg.exe
lea ecx, [ebp - 0x2ac]
movq qword [ebp - 0x1c], xmm0
call fcn.00403a00
push str.wireshark.exe
lea ecx, [ebp - 0x294]
mov dword [ebp - 4], 0
call fcn.00403a00
push str.x32dbg.exe
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 1
call fcn.00403a00
push str.x64dbg.exe
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 2
call fcn.00403a00
lea ebx, [ebp - 0x24c]
mov dword [ebp - 4], 3
lea edi, [ebp - 0x2ac]
mov dword [ebp - 0x1c], 0
mov ecx, ebx
mov dword [ebp - 0x18], 0
sub ecx, edi
mov dword [ebp - 0x14], 0
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x401699
cmp eax, 0xaaaaaaa
ja 0x40176e
lea esi, [eax + eax*2]
shl esi, 3
test esi, esi
jne 0x401634
xor eax, eax
jmp 0x401670
cmp esi, 0x1000
jb 0x401667
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x401773
push eax
call fcn.004051da
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x401661
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x401670
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push esi
call fcn.004051da
add esp, 4
add esi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24c], esi
push esi
push eax
mov edx, ebx
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00404bd0
add esp, 8
mov dword [ebp - 0x18], eax
push 0x4039a0
push 4
push 0x18
lea eax, [ebp - 0x2ac]
mov byte [ebp - 4], 6
push eax
call fcn.0040520a
push 0
push 2
mov dword [ebp - 0x248], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x24c], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x40172a
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
cmp esi, edi
je 0x401712
nop
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x4016fa
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x224]
push eax
call ebx
add esp, 8
test eax, eax
je 0x40175e
add esi, 0x18
cmp esi, edi
jne 0x4016f0
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x4016e5
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
lea ecx, [ebp - 0x1c]
call fcn.00403df0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004051cc
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x401738
call fcn.004048a0
call fcn.004010d0
int3
Function at 0x4034c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x40a040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0xffff
movzx eax, bx
mov dword [ebp - 0x34], eax
mov esi, ecx
cmp di, bx
jne 0x4034fd
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004051cc
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x403537
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x403537
dec dword [edx]
mov ax, bx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004051cc
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x403607
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ecx], eax
jne 0x403564
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x403597
push dword [esi + 0x4c]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
add esp, 8
movzx ecx, bx
cmp ax, di
cmove ecx, edi
pop edi
pop esi
mov ax, cx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004051cc
mov esp, ebp
pop ebp
ret 4
movzx eax, bx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
sub eax, 0
je 0x4035d6
sub eax, 1
je 0x4035d6
sub eax, 2
jne 0x403607
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x40356f
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x4035f4
push dword [esi + 0x4c]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x403607
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x30], ecx
movzx eax, ax
mov byte [esi + 0x3e], 1
cmovne edi, eax
mov ecx, dword [ebp - 4]
mov ax, di
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004051cc
mov esp, ebp
pop ebp
ret 4
Function at 0x403d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x40a040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x403dd4
cmp byte [esi + 0x3e], 0
je 0x403dd4
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x403dc2
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x403d89
sub eax, 1
je 0x403d8d
sub eax, 2
jne 0x403dc2
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004051cc
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x403dab
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x403dc2
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004051cc
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004051cc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004051cc
mov esp, ebp
pop ebp
ret

Function at 0x405bf9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405c38
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405c38
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405c38
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405c38
cmp dword [ecx + 0x74], 0xe
jbe 0x405c38
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4266a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4267c5
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004264a8
mov esi, eax
mov eax, dword [0x517e48]
cmp byte [eax], 0
je 0x42676d
mov eax, dword [0x517c04]
call fcn.004076f8
call fcn.00406f78
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x426670]
call fcn.0040bed0
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4267e0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4267a9
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x517bbc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x51b624]
call fcn.0040c2c0
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4267cc
lea eax, [ebp - 4]
mov edx, dword [0x426670]
call fcn.0040bff4
ret
Function at 0x480438
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x480440
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4b755c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b75fa
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4b75be
cmp byte [ebx + 0x11], 0
jne 0x4b75be
cmp byte [ebx + 0x24], 0
jne 0x4b75be
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b75df
lea edx, [ebp - 4]
mov eax, dword [0x517df4]
call fcn.0040edd0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48fdb4]
call fcn.00426810
call fcn.004092b4
jmp 0x4b75df
lea edx, [ebp - 8]
mov eax, dword [0x517df4]
call fcn.0040edd0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x48fdb4]
call fcn.00426810
call fcn.004092b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7601
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409c98
ret

Function at 0x4b7e14
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b7e62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b73dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b7e7b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b7e84
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b73dc
dec esi
jne 0x4b7ea6
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4d9e68
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004d8cac
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040a748
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004d8e94
test al, al
jne 0x4d9ed0
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x517d3c]
mov dl, 1
mov eax, dword [0x4d7a78]
call fcn.00426a14
call fcn.004092b4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4d9edc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040a748
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.004d8e94
test al, al
jne 0x4d9f3d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x517f88]
mov dl, 1
mov eax, dword [0x4d7a78]
call fcn.00426a14
call fcn.004092b4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004d8cdc
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5025e4
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x502603
add edx, 3
sar edx, 2
test edx, edx
jle 0x502711
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x502638
je 0x50267b
sub ecx, 0x2b
je 0x502671
sub ecx, 4
je 0x502676
dec ecx
sub ecx, 0xa
jb 0x502663
jmp 0x50267e
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x50264a
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x502655
jmp 0x50267e
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x50267e
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x50267e
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x50267e
mov byte [eax], 0x3e
jmp 0x50267e
mov byte [eax], 0x3f
jmp 0x50267e
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x50261b
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x5026cf
cmp byte [esp + 7], 0xff
jne 0x5026cf
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x502706
cmp dl, 0xff
je 0x502706
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x502612
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x504dac
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
mov edx, ecx
dec edx
test edx, edx
jb 0x504dc7
inc edx
xor eax, eax
movzx ecx, byte [edi + eax]
xor byte [esi + eax], cl
inc eax
dec edx
jne 0x504dbc
pop edi
pop esi
ret

Function at 0x508b48
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x508b5d
or edx, 0x200
test eax, 0x20000000
je 0x508b90
test eax, 0x40000000
je 0x508b7c
test eax, 0x80000000
je 0x508b77
or edx, 0x40
jmp 0x508bb7
or edx, 0x20
jmp 0x508bb7
test eax, 0x80000000
je 0x508b8b
or edx, 0x80
jmp 0x508bb7
or edx, 0x10
jmp 0x508bb7
test eax, 0x40000000
je 0x508ba8
test eax, 0x80000000
je 0x508ba3
or edx, 4
jmp 0x508bb7
or edx, 2
jmp 0x508bb7
test eax, 0x80000000
je 0x508bb4
or edx, 8
jmp 0x508bb7
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x50a1e4
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov esi, edx
lea edi, [esp + 0xc]
push ecx
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call fcn.0050a34c
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
movzx eax, word [eax + 6]
push eax
mov eax, 0x51e2f4
mov ecx, 1
mov edx, dword [0x509f24]
call fcn.0040bed0
add esp, 4
mov eax, dword [esp + 4]
mov eax, dword [eax]
movzx edi, word [eax + 6]
dec edi
test edi, edi
jl 0x50a33f
inc edi
xor esi, esi
mov eax, dword [esp + 8]
cmp dword [eax + 0x10], 0
jne 0x50a2b8
mov ebp, dword [esp + 0x44]
test ebp, ebp
jle 0x50a2a9
push 0x40
push 0x1000
push ebp
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
call fcn.00508b04
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov eax, dword [0x51e2f4]
mov dword [eax + esi*8], ebx
mov eax, dword [0x51e2f4]
mov dword [eax + esi*8 + 4], ebp
mov eax, dword [esp + 8]
mov dword [eax + 8], ebx
mov edx, ebp
mov eax, ebx
xor ecx, ecx
call fcn.0040775c
push 0
push 0x28
lea eax, [esp + 0x10]
call fcn.00509c0c
jmp 0x50a337
push 0x40
push 0x1000
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
call fcn.00508b04
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov eax, dword [0x51e2f4]
mov dword [eax + esi*8], ebx
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x10]
mov edx, dword [0x51e2f4]
mov dword [edx + esi*8 + 4], eax
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 8]
call fcn.00508b04
mov edx, dword [esp + 8]
mov edx, dword [edx + 0x10]
mov ecx, ebx
xchg edx, ecx
call fcn.00406fc8
mov eax, dword [esp + 8]
mov dword [eax + 8], ebx
push 0
push 0x28
lea eax, [esp + 0x10]
call fcn.00509c0c
inc esi
dec edi
jne 0x50a24d
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x403660
Capabilities:
Get disk information

Disassembly:
sub esp, 0x830
mov eax, dword [esp + 0x834]
mov ecx, dword [eax]
push ebx
mov ebx, dword [0x4375bc]
push ebp
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [0x4375b8]
xor ebp, ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x38], 0x9e3779b9
call fcn.00403630
mov eax, dword [0x4375c0]
mov edx, dword [0x4375c4]
add dword [esp + 0x14], 0x23f
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], 0x20
mov dword [esp + 0x24], 2
add dword [esp + 0x24], 3
mov eax, dword [0x2ae563c]
shl ecx, 4
add ecx, dword [esp + 0x3c]
mov dword [esp + 0x10], ecx
cmp eax, 0xfa9
jne 0x4036f0
mov dword [0x2ae5638], 0xedeb2e40
jmp 0x4036fd
cmp eax, 0x3eb
jne 0x4036fd
mov dword [0x2ae2544], ebp
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
shr eax, 5
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x18]
mov dword [0x2ae5634], 0xf4ea3dee
call fcn.00403640
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor dword [esp + 0x18], eax
cmp dword [0x2ae563c], 0x213
jne 0x40377c
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea ecx, [esp + 0x40]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
sub esi, dword [esp + 0x18]
lea ecx, [esp + 0x10]
mov eax, esi
mov dword [esp + 0x34], esi
call fcn.00403620
add dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x14]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
nop
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov edx, esi
shr edx, 5
add edx, ebx
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
cmp dword [0x2ae563c], 0x121
jne 0x4037dc
push ebp
push ebp
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
mov ecx, dword [esp + 0x10]
xor ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
mov dword [esp + 0x10], ecx
call fcn.00403650
mov eax, dword [esp + 0x38]
sub dword [esp + 0x14], eax
sub dword [esp + 0x2c], 1
mov ecx, dword [esp + 0x28]
jne 0x4036c0
mov eax, dword [esp + 0x844]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x830
ret 4
Function at 0x4076b1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436800]
jne 0x4076bb
repz ret
jmp fcn.0040e1fc

Function at 0x410773
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040bcaa
and dword [ebp - 4], 0
cmp dword [0x43acb8], 0
mov ebx, eax
jne 0x410824
push 0x402c3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4108d5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c30
push edi
call esi
test eax, eax
je 0x4108d5
push eax
call fcn.0040bc38
mov dword [esp], 0x402c20
push edi
mov dword [0x43acb8], eax
call esi
push eax
call fcn.0040bc38
mov dword [esp], 0x402c0c
push edi
mov dword [0x43acbc], eax
call esi
push eax
call fcn.0040bc38
mov dword [esp], 0x402bf0
push edi
mov dword [0x43acc0], eax
call esi
push eax
call fcn.0040bc38
pop ecx
mov dword [0x43acc8], eax
test eax, eax
je 0x410824
push 0x402bd8
push edi
call esi
push eax
call fcn.0040bc38
pop ecx
mov dword [0x43acc4], eax
mov eax, dword [0x43acc4]
cmp eax, ebx
je 0x41087c
cmp dword [0x43acc8], ebx
je 0x41087c
push eax
call fcn.0040bcb3
push dword [0x43acc8]
mov esi, eax
call fcn.0040bcb3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41087c
test edi, edi
je 0x41087c
call esi
test eax, eax
je 0x410873
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410873
test byte [ebp - 0xc], 1
jne 0x41087c
or dword [ebp + 0x10], 0x200000
jmp 0x4108b5
mov eax, dword [0x43acbc]
cmp eax, ebx
je 0x4108b5
push eax
call fcn.0040bcb3
pop ecx
test eax, eax
je 0x4108b5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4108b5
mov eax, dword [0x43acc0]
cmp eax, ebx
je 0x4108b5
push eax
call fcn.0040bcb3
pop ecx
test eax, eax
je 0x4108b5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43acb8]
call fcn.0040bcb3
pop ecx
test eax, eax
je 0x4108d5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4108d7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret