joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100016b0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x101204cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
sub eax, 0
je 0x100017ab
sub eax, 1
jne 0x100017bf
cmp byte [0x101220c8], al
jne 0x10001736
lea eax, [ebp - 0x108]
mov byte [0x101220c8], 1
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x108]
push eax
push str._sDataWorld1
push eax
call fcn.100017f0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10001736
push 0x98400
push 0x10088008
lea ecx, [ebp - 0x109]
call fcn.10003880
mov eax, dword [ebp + 8]
push str.UniKeyHookDllFileMap
push 0x8a0
push 0
push 4
push 0
push 0xffffffffffffffff
mov dword [0x10121dd4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x10001770
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10024f49
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
xor ebx, ebx
cmp eax, 0xb7
push 2
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x10121dd0], eax
test eax, eax
je 0x1000175c
test ebx, ebx
je 0x100017a4
mov dword [eax], 0
jmp 0x100017bf
call fcn.10001210
jmp 0x100017bf
push dword [0x10121dd0]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.10024f49
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10007c40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, ecx
push edi
push 0x10
call esi
push 0x14
movzx edi, ax
call esi
movzx eax, ax
test edi, 0x8000
je 0x10007ca3
test al, 1
jne 0x10007ca7
xor esi, esi
mov dl, byte [ebp + 8]
mov eax, dword [ebx + 0xd4]
mov edi, dword [ebx + 0xe4]
movzx ecx, dl
mov eax, dword [eax + ecx*4]
shr eax, 5
and eax, 0xf
mov cl, byte [eax + edi - 1]
mov eax, dword [0x10121dd0]
mov byte [ebp + 0xb], cl
cmp dword [eax + 0x89c], 0
je 0x10007cb9
cmp dl, 0x7b
jne 0x10007cae
mov cl, byte [edi]
jmp 0x10007cb6
test al, 1
jne 0x10007c68
mov esi, 1
jmp 0x10007c6a
cmp dl, 0x7d
jne 0x10007cb9
mov cl, byte [edi + 1]
mov byte [ebp + 0xb], cl
mov eax, dword [ebx]
mov dword [ebx + 0xf0], 0
test eax, eax
jle 0x10007d00
mov al, byte [eax + ebx + 3]
cmp al, cl
jne 0x10007d00
mov byte [0x101220ec], al
mov eax, dword [ebx]
pop edi
pop esi
mov byte [eax + ebx + 3], dl
mov eax, dword [ebx + 0xf0]
mov byte [eax + ebx + 0xf8], dl
inc dword [ebx + 0xf0]
mov dword [ebx + 0xf4], 1
pop ebx
pop ebp
ret 4
mov dword [ebx + 0xf4], 0
mov byte [ebx + 0xf8], cl
inc dword [ebx + 0xf0]
cmp dword [ebx], 0x28
jne 0x10007d4a
push 0x14
lea eax, [ebx + 0x18]
push eax
lea eax, [ebx + 4]
push eax
call fcn.10027d90
mov eax, dword [ebx]
add eax, 0xfffffff7
push 0x50
lea eax, [ebx + eax*4]
push eax
lea eax, [ebx + 0x2c]
push eax
call fcn.10027d90
mov cl, byte [ebp + 0xb]
add esp, 0x18
mov dword [ebx], 0x14
mov eax, dword [ebx]
pop edi
mov dword [ebx + eax*4 + 0x2c], esi
mov eax, dword [ebx]
pop esi
mov byte [eax + ebx + 4], cl
inc dword [ebx]
pop ebx
pop ebp
ret 4

Function at 0x1005a088
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10059c8d

Function at 0x10061cbe
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10061498

Function at 0x10061cc9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100616d3

Function at 0x1006dffa
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006dd81

Function at 0x10009c4b
Capabilities:
Write file on windows

Disassembly:
int 0xb5
fsub st(3), st(0)
out dx, eax
push dword [ebx]
retf 0x2573
inc dword [ebx + 0x5650eee6]
lea eax, [ebp - 0x5404]
jo 0x10009cb0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10009c7f
mov eax, dword [ebp - 0x1c0b]
add dword [ebx + 0x44], eax
cmp eax, esi
jb 0x10009c83
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x1c10]
cmp ecx, edx
jb 0x10009c04
jmp 0x10009c87
call dword [0x1008d005]
or byte [eax], dl
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
wait
ret
clc
mov ecx, dword [ebp + 0xc]
mov eax, ecx
mov edx, dword [ebp + 0x10]
and ecx, 0x2f
sar eax, 6
imul ecx, ecx, 0x38
push ebx
push esi
mov eax, dword [eax*4 + 0x10015090]
mov esi, dword [ebp + 8]
jne 0x10009cd6
push edi
stosd dword es:[edi], eax
dec byte [ebx - 0x74e7f7bc]
dec ebp
xor al, 0x89
test esp, esi
jmp 0x10009ccc
Function at 0x4018b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402620
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402620
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401910
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406074]
test esi, esi
jle 0x401a30
mov eax, dword [0x406078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401944
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4019c7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401930
mov dword [esp], ebx
call fcn.00402300
mov edi, eax
test eax, eax
je 0x401a57
mov eax, dword [0x406078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402440
mov edx, dword [0x406078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401a37
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4019c0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4019d0
add dword [0x406074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x406078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4019c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004018b0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40194e
mov eax, dword [0x406078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004018b0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004018b0
lea esi, [esi]
nop
Function at 0x401f70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406088]
sub esp, 4
test ebx, ebx
je 0x401fc5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401fbe
test esi, esi
je 0x401fbe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401fa0
mov dword [esp], 0x406090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402300
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402325
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402330
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402325
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402378
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40236e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40237a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402360
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4013f4
Capabilities:
Get storage device properties

Disassembly:
push ebp
push ebx
mov edx, 0x10
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4013fb
call fcn.00403a40
mov edx, dword [esp + 0x4c]
lea ecx, [esp]
call fcn.00402000
push dword [esp]
mov edx, 0x43001e
pop ecx
call fcn.00402180
je 0x401433
xor eax, eax
movsx eax, al
jmp 0x401573
push 0
push 0
push 3
push 0
push 3
push 0
push dword [esp + 0x18]
call sub.KERNEL32.dll_CreateFileA
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 0xffffffff
je 0x401567
lea ebp, [esp + 0x10]
mov dword [ebp], 8
mov dword [ebp + 4], 0
mov dword [esp + 8], 0
push 0
lea eax, [esp + 0xc]
push eax
push 0xc
lea eax, [esp + 0x28]
push eax
push 0xc
lea eax, [esp + 0x24]
push eax
push 0x2d1400
push dword [esp + 0x20]
call sub.KERNEL32.dll_DeviceIoControl
and eax, eax
je 0x4014c5
mov ebx, dword [esp + 8]
cmp ebx, 0xc
jne 0x4014c5
mov eax, 1
jmp 0x4014c7
xor eax, eax
and eax, eax
je 0x4014e4
lea ebp, [esp + 0x1c]
movsx ebx, byte [ebp + 8]
cmp ebx, 1
jne 0x4014e4
movsx ebx, byte [esp + 0xc]
inc ebx
push ebx
pop eax
mov byte [esp + 0xc], al
lea ebp, [esp + 0x28]
mov dword [ebp], 7
mov dword [ebp + 4], 0
mov dword [esp + 8], 0
push 0
lea eax, [esp + 0xc]
push eax
push 0xc
lea eax, [esp + 0x40]
push eax
push 0xc
lea eax, [esp + 0x3c]
push eax
push 0x2d1400
push dword [esp + 0x20]
call sub.KERNEL32.dll_DeviceIoControl
and eax, eax
je 0x40153e
mov ebx, dword [esp + 8]
cmp ebx, 0xc
jne 0x40153e
mov eax, 1
jmp 0x401540
xor eax, eax
and eax, eax
je 0x40155e
lea ebp, [esp + 0x34]
movsx ebx, byte [ebp + 8]
and ebx, ebx
jne 0x40155e
movsx ebx, byte [esp + 0xc]
add ebx, 2
push ebx
pop eax
mov byte [esp + 0xc], al
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
movsx eax, byte [esp + 0xc]
movsx eax, al
jmp 0x401573
push dword [esp]
call fcn.00403aa0
add esp, 0x40
pop ebx
pop ebp
ret 4

Function at 0x4026ee
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x402743
push dword [esp + 0x10]
push 0x40266d
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x43106c]
test esi, esi
je 0x40279c
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x40273b
cmp byte [esi + 0x10], 0
je 0x40273b
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x402717
jmp 0x40279c
mov esi, dword [0x43106c]
test esi, esi
je 0x40279c
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x402795
cmp byte [esi + 0x11], 0
je 0x402771
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x402788
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x43106c
call fcn.00403897
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x402750
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x402d68
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x402df2
cmp dword [ebp + 0xc], edi
je 0x402df2
push esi
push 0x28
push 8
push dword [0x431040]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 8]
mov esi, eax
or dword [esi + 4], 0xffffffff
mov dword [esi], edi
call sub.MSVCRT.dll__strdup
push dword [ebp + 0xc]
mov dword [esi + 8], eax
call sub.MSVCRT.dll__strdup
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
pop ecx
pop ecx
test al, 1
je 0x402de1
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x402ef6
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x402dd9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, esi
jmp 0x402df1
push esi
call fcn.00402f47
jmp 0x402df0
push esi
call fcn.00402e0b
push esi
mov edi, eax
call fcn.00402f47
pop ecx
pop ecx
pop esi
mov eax, edi
pop edi
pop ebp
ret 0xc

Function at 0x402e0b
Capabilities:
Delete file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov eax, dword [esi + 8]
mov ebp, dword [esi + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebp
call fcn.00403eb0
mov edi, eax
test edi, edi
je 0x402edb
push dword [esp + 0x18]
call fcn.00428a30
push ebx
push pe_nt_image_headers32
push 2
push ebx
push 1
push 0xc0000000
push ebp
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x402ecb
test byte [esi + 0x1c], 2
mov dword [esi + 0x10], ebp
jne 0x402e74
push 1
push 0x34
push edi
call fcn.00403f40
add esp, 0xc
push dword [esp + 0x18]
push 0x2712
push edi
call fcn.00403f40
push 0x402f05
push 0x4e2b
push edi
call fcn.00403f40
push esi
push 0x2711
push edi
call fcn.00403f40
push edi
call fcn.00403f30
add esp, 0x28
test eax, eax
jne 0x402eb6
xor ebx, ebx
mov dword [esi + 4], 0xfffffffe
inc ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x402ecb
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esp + 0x18]
call fcn.00428a20
push edi
call fcn.00403e90
pop ecx
cmp dword [esi + 4], 0xfffffffe
je 0x402eee
cmp dword [esi + 4], 0xfffffffc
je 0x402eee
mov dword [esi + 4], 0xfffffffd
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x403056
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push edi
xor edi, edi
inc edi
cmp dword [0x431084], 0
jne 0x403082
push 0x402fa5
push 0x10
push 0x2c
mov dword [0x431084], edi
call fcn.00403779
mov dword [0x431080], eax
cmp word [0x431078], 0
jne 0x40311e
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
test eax, eax
jne 0x4030ad
mov word [0x431078], di
jmp 0x4030b5
xor eax, eax
mov word [0x431078], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x431094], eax
test eax, eax
je 0x40311e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x429018
push eax
call esi
push 0x429024
push dword [0x431094]
mov dword [0x431088], eax
call esi
push str.getnameinfo
push dword [0x431094]
mov dword [0x43108c], eax
call esi
cmp dword [0x431088], 0
mov dword [0x431090], eax
pop esi
je 0x40311e
cmp dword [0x43108c], 0
je 0x40311e
test eax, eax
je 0x40311e
mov dword [0x43107c], edi
movsx eax, word [0x431078]
pop edi
add esp, 0x190
ret

Function at 0x40314e
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
lea eax, [ebp - 0x64]
push esi
push 0x40
push 0
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
cmp esi, 6
jne 0x40317c
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
jmp 0x4031d7
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x4031d5
sub esi, 0
je 0x4031cd
dec esi
je 0x4031c5
dec esi
je 0x4031bd
dec esi
je 0x4031b5
dec esi
je 0x4031ad
dec esi
jne 0x4031d5
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
jmp 0x4031d9
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
jmp 0x4031d9
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
jmp 0x4031d9
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
jmp 0x4031d9
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
jmp 0x4031d9
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
jmp 0x4031d9
xor eax, eax
xor edx, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x403227
Capabilities:
Check os version

Disassembly:
sub esp, 0x24c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x94
push eax
mov esi, 0xc8
xor ebx, ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40337f
mov eax, dword [esp + 0x20]
dec eax
je 0x403362
dec eax
jne 0x40337f
lea eax, [esp + 0x140]
xor ebp, ebp
push eax
call fcn.004031e0
pop ecx
test eax, eax
je 0x403293
mov ebx, dword [esp + 0x144]
mov edi, dword [esp + 0x148]
cmp byte [esp + 0x25a], 1
jmp 0x4032c0
lea eax, [esp + 0xa4]
mov dword [esp + 0xa4], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4032c5
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp byte [esp + 0x13e], 1
jne 0x4032c5
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x40335e
dec ebx
je 0x40335a
dec ebx
je 0x403339
dec ebx
je 0x4032f3
sub ebx, 4
jne 0x40337f
test edi, edi
jne 0x40337f
push 0x6e
jmp 0x40337e
sub edi, 0
je 0x40332b
dec edi
je 0x40331d
dec edi
je 0x40330f
dec edi
jne 0x40337f
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x40337f
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x40337f
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x40337f
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x40337f
sub edi, 0
je 0x403356
dec edi
je 0x403352
dec edi
jne 0x40337f
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x40337f
push 0x3c
jmp 0x40337e
push 0x32
jmp 0x40337e
push 0x14
jmp 0x40337e
push 5
jmp 0x40337e
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40337c
cmp eax, 0xa
je 0x403378
cmp eax, 0x5a
jne 0x40337f
push 0x28
jmp 0x40337e
push 0x1e
jmp 0x40337e
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret
Function at 0x403424
Capabilities:
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x248
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x4034ae
cmp byte [eax], 0
je 0x4034ae
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
mov byte [ebp - 4], 0
push eax
call sub.MSVCRT.dll_strlen
mov ecx, eax
add esp, 0x10
lea eax, [ebp + ecx - 0x109]
cmp ecx, 2
je 0x403478
cmp ecx, 3
jne 0x4034ba
cmp byte [ebp - 0x107], 0x3a
jne 0x4034ba
cmp ecx, 2
jne 0x403499
lea eax, [ebp - 0x108]
push 0x429070
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x4034ae
push 0xfffffffffffffffe
pop edi
mov eax, edi
mov edx, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov cl, byte [eax]
cmp cl, 0x5c
je 0x4034c6
cmp cl, 0x2f
jne 0x4034cc
mov byte [eax], 0
dec eax
jmp 0x4034ba
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, esi
je 0x403509
test byte [ebp - 0x248], 0x10
je 0x4034f2
push 0xfffffffffffffffe
pop edi
jmp 0x403500
mov esi, dword [ebp - 0x22c]
xor edi, edi
or edi, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4034ae
mov cl, byte [ebp - 0x108]
mov al, byte [ebp - 0x107]
cmp cl, 0x5c
jne 0x40351e
cmp al, 0x5c
je 0x403527
cmp cl, 0x2e
jne 0x4034ae
cmp al, cl
jne 0x4034ae
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, esi
je 0x403499
test al, 0x10
je 0x4034ae
jmp 0x4034ab

Function at 0x403549
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x4035ba
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
mov byte [ebp - 4], 0
push eax
call sub.MSVCRT.dll_strlen
lea ecx, [ebp - 0x108]
add esp, 0x10
add eax, ecx
jmp 0x40359c
mov cl, byte [eax - 1]
cmp cl, 0x20
je 0x40359b
cmp cl, 0x5c
je 0x40359b
cmp cl, 0x2f
jne 0x4035a6
dec eax
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x403589
mov byte [eax], 0
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x4035bc
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x403634
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x40364a
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0x4310a4]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x403681
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
push 8
push dword [0x431040]
mov dword [0x4310a8], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x4310a8]
call ebx
mov eax, dword [0x4310a4]
mov edi, eax
add eax, esi
push eax
push dword [0x4310a8]
mov dword [0x4310a4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x431040]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x4310a8]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x4036c1
test ebx, ebx
je 0x4036e2
push 0x14
push 0x4310a0
call fcn.00403868
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x4036e2
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x4039d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x430140]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x403c00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x430140]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x403c3e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x403c3e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x403c40
xor eax, eax
mov esp, ebp
pop ebp
ret 4