joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f504
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4269f2
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f553
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f572
mov ecx, edx
add ecx, ebx
jmp 0x41f572
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f572
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f5e4
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f5cd
test esi, esi
jbe 0x41f5e4
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f5bf
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f5e4
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f59c
jmp 0x41f5e4
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f5e4
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4269f9
ret
Function at 0x420750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x427d6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x42078b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4207a4
lea eax, [ebp - 0x10]
mov edx, dword [0x44573c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x4207b7
lea eax, [ebp - 0x10]
mov edx, dword [0x44573c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4207c3
adc edx, 0
mov edx, dword [edx*4 + 0x444538]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x42093d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420930
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420930
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x4208ce
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x4208ce
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4208ce
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4208ce
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420930
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420930
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420955
inc ebx
cmp ebx, 0x19
jne 0x42077d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427d72
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x406523
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43f2c4], 0
push esi
jne 0x40655a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406534
mov dword [ecx*4 + 0x43f2c0], eax
inc ecx
cmp ecx, 0x100
jl 0x40652f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40658b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43f2c0]
xor eax, esi
inc ecx
dec edx
jne 0x40656d
pop edi
not eax
pop esi
ret 0xc

Function at 0x401113
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push 0
push dword [ebp + 8]
push 0
push 0x8000040
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40115b
push 0
push 0
push 0
push 0xf001f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x401176
push 0x40
push 0x101000
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401197
push 0
push 0
push 0x40119c
push 0x40119c
push 0x80030008
call fcn.004010a1
add esp, 0x14
mov eax, dword [ebp - 4]
leave
ret
Function at 0x403600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x415020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403698
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403678
xor eax, eax
push ebp
push 0x403671
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4036b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403678
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x415020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x415020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404264
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x416044], 0
je 0x4042c5
cmp word [0x416218], 0xd7b2
jne 0x40428d
cmp dword [0x416220], 0
jbe 0x40428d
mov eax, 0x416214
call dword [0x416230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41506c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4042ec
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41502c], 0
jne 0x4042e1
push 0
push 0x415064
push 0x41506c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404420
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004029e4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x416045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4043e8
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x405ef4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405f5a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004046dc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040308c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405f44
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f61
lea eax, [ebp - 0x10]
call fcn.0040446c
ret

Function at 0x4079f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404908
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x407a09
test al, 0x10
jne 0x407a0d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40a454
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a48d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040455c
jmp 0x40a496
mov eax, ebx
mov edx, esi
call fcn.004044c0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a4a0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a4c1
mov al, byte [esp]
jmp 0x40a4c3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ab58
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a9c0
mov eax, dword [0x415514]
cmp byte [eax], 0
je 0x40abd4
mov eax, dword [0x415428]
call fcn.00402f8c
call fcn.00402b24
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407c90
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40ac1c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ac0a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x415404]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x416660]
call fcn.0040539c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40b988
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b9ec
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004046dc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004076e8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b9f3
lea eax, [ebp - 0xc]
call fcn.0040446c
ret

Function at 0x413678
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004134d0
dec esi
jne 0x41369a
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x413e34
Capabilities:
Connect pipe
Create pipe
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov esi, eax
xor eax, eax
push ebp
push 0x413fe0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0x2000
push 0
push 0xff
push 6
push 1
push 0x413ff0
call sub.kernel32.dll_CreateNamedPipeA
mov edi, eax
mov dword [esi + 0x408], edi
cmp edi, 0xffffffff
jne 0x413e82
call fcn.0040c0a0
push 0
mov eax, dword [esi + 0x408]
push eax
call sub.kernel32.dll_ConnectNamedPipe
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x413fb9
cmp byte [esi + 0x414], 0
je 0x413ec4
mov eax, dword [esi + 0x408]
push eax
call sub.kernel32.dll_DisconnectNamedPipe
mov eax, dword [esi + 0x408]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x413fca
push 0
lea eax, [ebp - 0xc]
push eax
push 0x2000
lea eax, [esi + 4]
push eax
mov eax, dword [esi + 0x408]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x413f9c
cmp dword [ebp - 0xc], 0
jbe 0x413f9c
mov ecx, dword [ebp - 0xc]
dec ecx
lea edx, [esi + 4]
lea eax, [esi + 0x404]
call fcn.0040455c
lea edx, [ebp - 0x14]
mov eax, dword [esi + 0x404]
call fcn.0040733c
mov edx, dword [ebp - 0x14]
mov eax, dword [esi + 0x40c]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x413f46
mov eax, dword [esi + 0x40c]
push eax
mov ecx, dword [esi + 0x404]
mov dl, 1
mov eax, dword [0x413904]
call fcn.004140e4
mov dword [ebp - 0x10], eax
jmp 0x413f57
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x40c]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push esi
mov ecx, dword [esi + 0x408]
mov dl, 1
mov eax, dword [0x4139e8]
call fcn.00413a64
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x410]
call fcn.00410d1c
mov edx, dword [ebp - 4]
call fcn.004109c4
mov eax, dword [esi + 0x410]
call fcn.00410d30
mov eax, dword [ebp - 4]
call fcn.00413678
jmp 0x413e52
mov eax, dword [esi + 0x408]
push eax
call sub.kernel32.dll_DisconnectNamedPipe
mov eax, dword [esi + 0x408]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x413e52
mov eax, dword [esi + 0x408]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x413e52
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413fe7
lea eax, [ebp - 0x14]
call fcn.0040446c
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x43b63e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
sub esi, esi
inc ecx
mov ecx, 0x6e1d8ac3
call fcn.0043b682
or esi, esi
sub esi, 1
xor dword [ebx], edx
inc esi
inc ebx
add esi, 0xe0fa38c9
sub ecx, 0xfe1f97b6
add esi, 1
cmp ebx, eax
jne fcn.0043b63e
add esi, 1
inc esi
and ecx, esi
ret
Function at 0x4098c1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a344]
jne 0x4098cb
repz ret
jmp fcn.0040e3ec

Function at 0x41261c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040c1e2
and dword [ebp - 0x14], 0
cmp dword [0x43fc2c], 0
mov dword [ebp - 0x18], eax
jne 0x4126cf
push 0x403754
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x412777
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403748
push ebx
call edi
test eax, eax
je 0x412777
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403738
push ebx
mov dword [0x43fc2c], eax
call edi
push eax
call esi
push 0x403724
push ebx
mov dword [0x43fc30], eax
call edi
push eax
call esi
push 0x403708
push ebx
mov dword [0x43fc34], eax
call edi
push eax
call esi
mov dword [0x43fc3c], eax
test eax, eax
je 0x4126cf
push 0x4036f0
push ebx
call edi
push eax
call esi
mov dword [0x43fc38], eax
mov eax, dword [0x43fc38]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x412728
cmp dword [0x43fc3c], ecx
je 0x412728
push eax
call esi
push dword [0x43fc3c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x412728
test ebx, ebx
je 0x412728
call edi
test eax, eax
je 0x41271f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41271f
test byte [ebp - 8], 1
jne 0x412728
or dword [ebp + 0x10], 0x200000
jmp 0x41275b
mov eax, dword [0x43fc30]
cmp eax, dword [ebp - 0x18]
je 0x41275b
push eax
call esi
test eax, eax
je 0x41275b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41275b
mov eax, dword [0x43fc34]
cmp eax, dword [ebp - 0x18]
je 0x41275b
push eax
call esi
test eax, eax
je 0x41275b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43fc2c]
call esi
test eax, eax
je 0x412777
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x412779
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004098c1
leave
ret
Function at 0x4145d0
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1400
call fcn.00413bf0
cmp dword [0x7dfd84], 0x37
jne 0x414653
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x403f58
call edi
push 0
lea eax, [esp + 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40401c
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push 0x404048
call edi
push 0
lea edx, [esp + 0xc08]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
pop edi
mov eax, dword [0x7e0968]
mov edx, dword [0x7dcde4]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1400
ret
Function at 0x4014a0
Capabilities:
Get disk size

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69202d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x75d580]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
mov esi, 7
xor eax, eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], esi
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
mov eax, edx
mov dword [ebp - 0x48], edx
cmp dword [edx + 0x14], esi
jbe 0x40150e
mov eax, dword [edx]
mov dword [ebp - 0x48], eax
mov edi, dword [edx + 0x10]
test edi, edi
je 0x401525
mov ecx, edi
cmp word [eax], 0x3a
je 0x401567
add eax, 2
sub ecx, 1
jne 0x401517
xorps xmm1, xmm1
movss dword [ebp - 0x48], xmm1
cmp esi, 7
jbe 0x401681
mov edx, dword [ebp - 0x2c]
lea ecx, [esi*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401672
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4016a2
jmp 0x401672
test eax, eax
je 0x401525
sub eax, dword [ebp - 0x48]
sar eax, 1
cmp eax, 0xffffffff
je 0x401525
inc eax
mov dword [ebp - 0x34], 0
cmp edi, eax
mov dword [ebp - 0x30], 0
xorps xmm0, xmm0
cmovb eax, edi
cmp dword [edx + 0x14], 7
movups xmmword [ebp - 0x44], xmm0
jbe 0x401598
mov edx, dword [edx]
push eax
push edx
lea ecx, [ebp - 0x44]
call fcn.00402060
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x4015dc
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4015d2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4016a2
push ecx
push edx
call fcn.0048a4f6
add esp, 8
movups xmm1, xmmword [ebp - 0x44]
lea ecx, [ebp - 0x2c]
movq xmm0, qword [ebp - 0x34]
movd eax, xmm1
movq qword [ebp - 0x1c], xmm0
cmp dword [ebp - 0x18], 7
movups xmmword [ebp - 0x2c], xmm1
cmova ecx, eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x401667
mov eax, dword [ebp - 0x4c]
xorps xmm0, xmm0
mov esi, dword [ebp - 0x18]
cvtsi2sd xmm0, eax
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x737670]
mov eax, dword [ebp - 0x50]
cvtpd2ps xmm1, xmm0
xorps xmm0, xmm0
mulss xmm1, dword [0x737620]
cvtsi2sd xmm0, eax
shr eax, 0x1f
mulss xmm1, dword [0x737650]
addsd xmm0, qword [eax*8 + 0x737670]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x737608]
addss xmm1, xmm0
jmp 0x401528
mov esi, dword [ebp - 0x18]
xorps xmm1, xmm1
jmp 0x401528
push ecx
push edx
call fcn.0048a4f6
movss xmm1, dword [ebp - 0x48]
add esp, 8
movaps xmm0, xmm1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048a267
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00543627
int3
Function at 0x404780
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69215d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x75d580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], 0
call fcn.00407510
lea eax, [ebp - 0x2c]
push eax
push 0x404740
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x2c]
cmp ecx, 7
jbe 0x40480b
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404801
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404871
push ecx
push edx
call fcn.0048a4f6
add esp, 8
mov ecx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp ecx, 7
jbe 0x404855
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40484b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404871
push ecx
push edx
call fcn.0048a4f6
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a267
mov esp, ebp
pop ebp
ret
call fcn.00543627
int3