joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x469053
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x29
lea eax, [esp + 0xc]
push eax
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xc0]
mov dword [esp + 0x2c], 0
call fcn.00429140
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
push 0x2a
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xcc]
mov dword [esp + 0x2c], 1
call fcn.00429140
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
mov edx, dword [esp + 0x30]
push edx
push 9
mov ecx, esi
mov byte [esi + 0x964], 0
call fcn.004029b0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4

Function at 0x4029b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.00431fb6

Function at 0x402ca0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402cb9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402cf4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402cf0
lea ebx, [ebx]
cmp esi, eax
jae 0x402cf4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402ce0
cmp esi, eax
jb 0x402cfa
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4037f0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x18
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403800
sub eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403814
push ebp
sub eax, edx
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push 0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403964
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push esi
push edi
lea ecx, [esp + 0x10]
push ecx
push str..UIF
push edx
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40387f
mov eax, dword [esp + 0x10]
push 0xe
push str.YingUnInstall2
push 1
push 0
push 0
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
push str.YingUnInstall2
push eax
call ebx
test eax, eax
jne 0x40395a
mov ecx, dword [esp + 0x10]
push 0xe
push str.Uninstall_File
push 1
push eax
push eax
push ecx
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push str.DefaultIcon
push eax
call ebx
test eax, eax
jne 0x4038d7
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x14]
push ebp
push ecx
push 1
push eax
push eax
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push str.Shell
push edx
call ebx
test eax, eax
jne 0x403953
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push str.Open
push ecx
call ebx
test eax, eax
jne 0x40394c
mov edx, dword [esp + 0x18]
push eax
push 0x473030
push 1
push eax
push eax
push edx
call esi
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push str.Command
push ecx
call ebx
test eax, eax
jne 0x403945
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push edx
push eax
push 2
push 0
push 0
push ecx
call esi
mov edx, dword [esp + 0x20]
push edx
call edi
mov eax, dword [esp + 0x18]
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
mov eax, dword [esp + 0x1c]
push eax
call edi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x18
ret
Function at 0x403970
Capabilities:
Check os version

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x403a4b
push 0x94
mov edi, 1
call fcn.004503e3
mov esi, eax
add esp, 4
test esi, esi
je 0x403abe
push 0x94
push 0
push esi
call fcn.004504b0
add esp, 0xc
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
jne 0x4039d5
push esi
lea edi, [eax + 1]
call fcn.00450306
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 5
jne 0x403a0c
cmp dword [esi + 8], 0
jne 0x4039f1
push esi
lea edi, [eax + 1]
call fcn.00450306
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 5
jne 0x403a0c
cmp dword [esi + 8], edi
jne 0x403a0c
push esi
lea edi, [eax + 2]
call fcn.00450306
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 6
jne 0x403ab5
cmp dword [esi + 8], 0
jne 0x403a2c
push esi
lea edi, [eax + 2]
call fcn.00450306
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 6
jne 0x403ab5
cmp dword [esi + 8], edi
jne 0x403ab5
push esi
lea edi, [eax + 3]
call fcn.00450306
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp al, 4
jae 0x403a54
pop edi
xor eax, eax
pop esi
ret
push 0x94
mov edi, 2
call fcn.004503e3
mov esi, eax
add esp, 4
test esi, esi
je 0x403abe
push 0x94
push 0
push esi
call fcn.004504b0
add esp, 0xc
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
jne 0x403ab5
cmp dword [esi + 8], 0xa
jne 0x403aa8
push esi
lea edi, [eax - 1]
call fcn.00450306
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 4
jne 0x403ab5
cmp dword [esi + 8], 0x5a
jne 0x403ab5
mov edi, eax
push esi
call fcn.00450306
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x403ad0
Capabilities:
Check os version

Disassembly:
push ebx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x403b2d
push esi
push 0x94
call fcn.004503e3
mov esi, eax
add esp, 4
test esi, esi
je 0x403b28
push 0x94
push 0
push esi
call fcn.004504b0
add esp, 0xc
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esi + 4], 6
jb 0x403b1f
cmp dword [esi + 8], 1
jb 0x403b1f
mov bl, 1
push esi
call fcn.00450306
add esp, 4
pop esi
mov al, bl
pop ebx
ret
mov al, bl
pop ebx
ret
Function at 0x403b40
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x491c04]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [esp + 0x28]
push ecx
push 0x64
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp byte [esp + 0x28], 0
mov dword [edi], 0
lea esi, [esp + 0x28]
je 0x403c1a
lea esp, [esp]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x403ba8
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x403bfe
movsx edx, byte [esi]
push edx
call fcn.0044fb27
add esp, 4
cmp eax, 0x41
je 0x403bfe
movsx eax, byte [esi]
push eax
call fcn.0044fb27
mov ecx, dword [edi]
mov edx, dword [esp + 0x10]
add esp, 4
mov byte [edx + ecx], al
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [edi]
shrd ecx, edx, 0x14
shr edx, 0x14
mov dword [ebx + eax*8], ecx
mov dword [ebx + eax*8 + 4], edx
inc dword [edi]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403c03
sub eax, edx
cmp byte [esi + eax + 1], cl
lea esi, [esi + eax + 1]
jne 0x403b90
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044f50d
mov esp, ebp
pop ebp
ret

Function at 0x4042c0
Capabilities:
Check os version

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x404319
push 0x94
call fcn.004503e3
mov esi, eax
add esp, 4
test esi, esi
je 0x404319
push 0x94
push 0
push esi
call fcn.004504b0
add esp, 0xc
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esi + 4], 6
push esi
jb 0x404311
call fcn.00450306
add esp, 4
mov al, 1
pop esi
ret
call fcn.00450306
add esp, 4
xor al, al
pop esi
ret

Function at 0x404670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4692e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
xor eax, eax
cmp byte [0x490143], al
je 0x4046bc
mov cl, 0x20
cmp byte [eax + 0x490143], cl
je 0x4046b5
inc eax
cmp byte [eax + 0x490143], 0
jne 0x4046a1
jmp 0x4046bc
mov byte [eax + 0x490143], 0
push 0x490143
lea ecx, [esp + 0x1c]
call fcn.00429050
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.00428fd0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0044f53d
add esp, 4
lea ecx, [esp + 0xc]
mov esi, eax
mov edi, edx
call fcn.00429130
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00429130
mov eax, esi
mov edx, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret
Function at 0x404ca0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x469428
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push eax
push edi
mov ecx, esi
mov dword [esp + 0x2c], 0
call fcn.00438ef6
push edi
mov ecx, esi
call fcn.00438ea3
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004325cc
mov edx, dword [esi + 0x20]
push 1
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], 0xffffffff
call fcn.00429130
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x404d90
Capabilities:
Create process on windows
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x469458
mov eax, dword fs:[0]
push eax
sub esp, 0x388
mov eax, dword [0x491c04]
xor eax, esp
mov dword [esp + 0x384], eax
push esi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x390]
mov dword fs:[0], eax
sub esp, 0xc
lea eax, [esp + 0x3ac]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
mov dword [esp + 0x3a8], 0
call fcn.00428fd0
lea esi, [esp + 0x28]
call fcn.004043b0
mov eax, dword [eax + 4]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, esi
call fcn.00429130
mov ecx, dword [esp + 0x3a4]
push ecx
lea edx, [esp + 0x70]
push 0x320
push edx
call fcn.0044fb53
push 0x44
lea eax, [esp + 0x38]
push 0
push eax
call fcn.004504b0
mov cx, word [esp + 0x3c4]
add esp, 0x18
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x20
push 1
push 0
mov word [esp + 0x74], cx
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x7c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x404e93
lea ecx, [esp + 0x3a0]
mov dword [esp + 0x398], 0xffffffff
call fcn.00429130
mov eax, 0xbeb95
jmp 0x404ecd
mov edx, dword [esp + 0xc]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, dword [esp + 8]
lea ecx, [esp + 0x3a0]
mov dword [esp + 0x398], 0xffffffff
call fcn.00429130
mov eax, esi
mov ecx, dword [esp + 0x390]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x384]
xor ecx, esp
call fcn.0044f50d
add esp, 0x394
ret
Function at 0x404f00
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x469498
mov eax, dword fs:[0]
push eax
sub esp, 0x70c
mov eax, dword [0x491c04]
xor eax, esp
mov dword [esp + 0x708], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x720]
mov dword fs:[0], eax
mov eax, dword [esp + 0x734]
push eax
lea ecx, [esp + 0x52c]
push 0x1f4
push ecx
call fcn.0044fb53
lea edx, [esp + 0x534]
push edx
lea eax, [esp + 0x344]
push 0x1f4
push eax
call fcn.0044fb53
lea eax, [esp + 0x34c]
add esp, 0x18
lea edx, [eax + 1]
xor ebx, ebx
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404f80
sub eax, edx
cmp eax, 4
jl 0x40506a
mov cx, word [esp + 0x334]
mov dl, byte [esp + 0x336]
push 0x473030
lea eax, [esp + 0x18]
push 0x12c
push eax
mov word [esp + 0x14c], cx
mov byte [esp + 0x14e], dl
mov byte [esp + 0x14f], bl
xor esi, esi
call fcn.0044fb53
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
cmp byte [esp + 0x337], bl
je 0x405041
lea edi, [esp + 0x337]
mov al, byte [edi]
cmp al, 0x5c
jne 0x405037
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x144]
push 0x1f4
push edx
mov byte [esp + esi + 0x20], bl
call fcn.0044fe1d
add esp, 0xc
push ebx
lea eax, [esp + 0x144]
push eax
call ebp
push 0x47317c
lea ecx, [esp + 0x144]
push 0x1f4
push ecx
call fcn.0044fe1d
add esp, 0xc
xor esi, esi
mov byte [esp + 0x14], bl
jmp 0x40503c
mov byte [esp + esi + 0x14], al
inc esi
inc edi
cmp byte [edi], bl
jne 0x404fe6
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x144]
push 0x1f4
push eax
mov byte [esp + esi + 0x20], bl
call fcn.0044fe1d
add esp, 0xc
push ebx
lea ecx, [esp + 0x144]
push ecx
call ebp
lea ecx, [esp + 0x730]
mov dword [esp + 0x728], 0xffffffff
call fcn.00429130
mov ecx, dword [esp + 0x720]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x708]
xor ecx, esp
call fcn.0044f50d
add esp, 0x718
ret
Function at 0x4050e0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4694d8
mov eax, dword fs:[0]
push eax
sub esp, 0x904
mov eax, dword [0x491c04]
xor eax, esp
mov dword [esp + 0x900], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x918]
mov dword fs:[0], eax
mov eax, dword [esp + 0x92c]
push eax
lea ecx, [esp + 0x724]
push 0x1f4
push ecx
call fcn.0044fb53
push 0x473264
lea edx, [esp + 0x730]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00450c07
add esp, 0x18
test eax, eax
jne 0x4052fa
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push 0x1e0
push edx
call fcn.004509fb
mov eax, dword [esp + 0x20]
push eax
call fcn.004509c7
add esp, 0x10
test eax, eax
jne 0x4052ed
mov edi, dword [esp + 0x14]
lea ebp, [esp + 0x18]
sub ebp, 2
xor ebx, ebx
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x405194
sub eax, edx
mov byte [eax + ebp], bl
mov ecx, 0x473030
lea eax, [esp + 0x18]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4051d0
cmp dl, bl
je 0x4051cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4051d0
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x4051b0
xor eax, eax
jmp 0x4051d5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4052c4
cmp byte [esp + 0x18], 0x5b
jne 0x4051f8
lea ecx, [esp + 0x18]
push ecx
call fcn.00403ea0
add esp, 4
mov edi, eax
jmp 0x4052c4
cmp byte [esp + 0x19], 0x22
mov esi, 1
je 0x40520c
inc esi
cmp byte [esp + esi + 0x18], 0x22
jne 0x405204
lea edx, [esi - 1]
push edx
lea eax, [esp + 0x1d]
push eax
lea ecx, [esp + 0x408]
push ecx
call fcn.00450530
lea eax, [esp + 0x24]
add esp, 0xc
mov byte [esp + esi + 0x3ff], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x405233
sub eax, edx
sub eax, esi
sub eax, 4
push eax
lea edx, [esp + esi + 0x1f]
push edx
lea eax, [esp + 0x214]
push eax
call fcn.00450530
lea eax, [esp + 0x24]
add esp, 0xc
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x405260
sub eax, ecx
lea ecx, [esp + 0x20c]
push ecx
push 0x473260
lea edx, [esp + 0x5fc]
sub eax, esi
push 0x12c
push edx
mov byte [esp + eax + 0x218], bl
call fcn.00450988
lea eax, [esp + 0x21c]
add esp, 0x10
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4052a0
sub eax, ecx
push eax
lea eax, [esp + 0x5f8]
push eax
push 1
push ebx
lea ecx, [esp + 0x410]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push 0x1e0
push eax
call fcn.004509fb
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004509c7
add esp, 0x10
test eax, eax
je 0x40518d
mov edx, dword [esp + 0x14]
push edx
call fcn.0045090c
add esp, 4
lea ecx, [esp + 0x928]
mov dword [esp + 0x920], 0xffffffff
call fcn.00429130
mov ecx, dword [esp + 0x918]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x900]
xor ecx, esp
call fcn.0044f50d
add esp, 0x910
ret
Function at 0x40e110
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46ab6b
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
push 0x20
call fcn.004315aa
add esp, 4
mov dword [esp + 0x14], eax
xor ebp, ebp
mov dword [esp + 0x54], ebp
cmp eax, ebp
je 0x40e15a
mov ecx, eax
call fcn.00429550
mov esi, eax
jmp 0x40e15c
xor esi, esi
push esi
push 9
push 1
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x2c], esp
push 0x16
push eax
mov dword [esp + 0x74], 0xffffffff
call fcn.0040fed0
add esp, 8
mov ecx, 0x4947c0
call fcn.0041d470
push 0x473030
lea ecx, [esp + 0x20]
call fcn.00428f60
cmp dword [esi + 0x1c], ebp
mov dword [esp + 0x54], 1
mov dword [esp + 0x14], ebp
jle 0x40e2a3
test ebp, ebp
jl 0x40e2d2
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esi + 0x10]
jge 0x40e2d2
mov eax, dword [esi + 0xc]
add eax, ebp
push eax
lea ecx, [esp + 0x20]
call fcn.00429140
sub esp, 0xc
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00428fd0
lea eax, [esp + 0x34]
push eax
call fcn.00405780
add esp, 0x10
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x58], 2
call fcn.00429140
lea ecx, [esp + 0x28]
mov byte [esp + 0x54], 1
call fcn.00429130
push 0x473430
lea ecx, [esp + 0x38]
push ecx
sub esp, 0xc
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.00428fd0
lea edi, [esp + 0x54]
call fcn.0040ced0
add esp, 0xc
mov ecx, eax
mov byte [esp + 0x5c], 3
call fcn.004292a0
mov ecx, eax
mov byte [esp + 0x58], 4
call fcn.004291c0
lea ecx, [esp + 0x34]
mov bl, al
mov byte [esp + 0x54], 3
call fcn.00429130
mov ecx, edi
mov byte [esp + 0x54], 1
call fcn.00429130
push 5
test bl, bl
je 0x40e27b
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x40e28e
mov ecx, dword [esp + 0x24]
push 0
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [esp + 0x14]
inc eax
add ebp, 0xc
cmp eax, dword [esi + 0x1c]
mov dword [esp + 0x14], eax
jl 0x40e1aa
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x54], 0xffffffff
call fcn.00429130
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
call fcn.0043a1fe
int3
Function at 0x415640
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
push esi
push eax
call fcn.00415550
mov esi, eax
test esi, esi
je 0x415730
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
call edi
push eax
call fcn.00415130
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
mov dword [esp + 0x18], eax
call ebp
push esi
call edi
test eax, eax
jne 0x415684
mov dword [esp + 0x10], eax
jmp 0x415699
cmp dword [eax], 0x28
jne 0x41568e
mov ebx, dword [eax + 4]
jmp 0x415692
movzx ebx, word [eax + 4]
push esi
call ebp
mov dword [esp + 0x10], ebx
push esi
call edi
test eax, eax
jne 0x4156a4
xor ebx, ebx
jmp 0x4156b5
cmp dword [eax], 0x28
jne 0x4156ae
mov ebx, dword [eax + 8]
jmp 0x4156b2
movzx ebx, word [eax + 6]
push esi
call ebp
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x24]
mov ebp, dword [sym.imp.GDI32.dll_SelectPalette]
mov dword [ecx], edx
mov ecx, dword [esp + 0x14]
push 0
mov dword [eax], ebx
mov edx, dword [edi + 4]
push ecx
push edx
call ebp
mov dword [esp + 0x18], eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push 0
push 0
push 0
push esi
push ebx
push ecx
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.004154b0
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 4]
push 1
push edx
push eax
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
test eax, eax
je 0x415730
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
pop esi
add esp, 0xc
ret

Function at 0x415940
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x164
mov eax, dword [0x491c04]
xor eax, esp
mov dword [esp + 0x160], eax
push esi
push 0
mov esi, ecx
call fcn.00416ff0
test eax, eax
je 0x41596a
lea ecx, [esi + 0x5c]
call fcn.0043e6ec
push 0x4001
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
push 0x474434
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
jne 0x4159af
push str.Cannot_retrieve_the_Handle_of_SystemImageList_
lea ecx, [esi + 0x58]
call fcn.00402b60
xor eax, eax
pop esi
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.0044f50d
add esp, 0x164
ret
push edi
lea edi, [esi + 0x5c]
push eax
mov ecx, edi
call fcn.0043e762
test eax, eax
jne 0x4159e5
push str.Cannot_Attach_SystemImageList_Handle
lea ecx, [esi + 0x58]
call fcn.00402b60
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.0044f50d
add esp, 0x164
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0
push edi
mov ecx, esi
call fcn.00417010
mov ecx, dword [esp + 0x168]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0044f50d
add esp, 0x164
ret
Function at 0x415a20
Capabilities:
Get disk information

Disassembly:
sub esp, 0x84
mov eax, dword [0x491c04]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
mov ebx, ecx
call fcn.00416fb0
lea eax, [esp + 4]
push eax
push 0x80
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x415a75
push str.Error_Getting_Logical_DriveStrings_
lea ecx, [ebx + 0x58]
call fcn.00402b60
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0044f50d
add esp, 0x84
ret
cmp byte [esp + 4], 0
push esi
lea esi, [esp + 8]
je 0x415acc
push edi
push esi
push 0xffff0000
mov ecx, ebx
call fcn.00415da0
push esi
mov ecx, ebx
mov edi, eax
call fcn.00416080
test eax, eax
je 0x415ab3
push 0xffff0002
push edi
push 0
push 0
push 0x47442e
mov ecx, ebx
call fcn.00416f30
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415ab8
sub eax, edx
cmp byte [esi + eax + 1], cl
lea esi, [esi + eax + 1]
jne 0x415a82
pop edi
mov ecx, dword [esp + 0x88]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0044f50d
add esp, 0x84
ret