joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4063a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x467536
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x487bb0]
xor eax, esp
mov dword [esp + 0x448], eax
mov eax, dword [0x487bb0]
xor eax, esp
push eax
lea eax, [esp + 0x450]
mov dword fs:[0], eax
push 0x208
lea eax, [esp + 0x248]
push 0
push eax
call fcn.0044fe60
push 0x208
lea ecx, [esp + 0x4c]
push 0
push ecx
call fcn.0044fe60
mov eax, dword [0x486e58]
add esp, 0x18
cmp dword [0x486e6c], 8
jae 0x406412
mov eax, 0x486e58
push str.ADSafe.exe
push eax
lea edx, [esp + 0x24c]
push 0x46c8b4
push edx
call fcn.00401040
lea eax, [esp + 0x254]
push eax
call fcn.00423030
add esp, 0x14
test eax, eax
je 0x4064fa
push 0
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4064fa
lea edx, [esp + 0x20]
push 9
push edx
call fcn.00424560
add esp, 8
cmp dword [0x4890b0], 0
mov dword [esp + 0x458], 0
je 0x4064b4
lea eax, [esp + 4]
push 0x1b
push eax
call fcn.00424560
add esp, 8
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x464], 1
call fcn.004034a0
lea ecx, [esp + 4]
mov byte [esp + 0x458], 0
call fcn.004021f0
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x4064c3
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x40]
push ecx
mov edx, ecx
push 0x46d358
push edx
call fcn.00401040
push 1
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x25c]
push ecx
call fcn.00404f70
add esp, 0x1c
test eax, eax
jne 0x4064fe
lea ecx, [esp + 0x20]
call fcn.004021f0
xor eax, eax
jmp 0x40651e
lea edx, [esp + 0x3c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00401120
add esp, 8
lea ecx, [esp + 0x20]
call fcn.004021f0
mov eax, 1
mov ecx, dword [esp + 0x450]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.0044ffb3
add esp, 0x458
ret
Function at 0x408a00
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x46783b
mov eax, dword fs:[0]
push eax
sub esp, 0x88c
mov eax, dword [0x487bb0]
xor eax, esp
mov dword [esp + 0x888], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487bb0]
xor eax, esp
push eax
lea eax, [esp + 0x8a0]
mov dword fs:[0], eax
mov esi, dword [esp + 0x8b0]
mov ebp, dword [esp + 0x8b4]
push 0x208
xor edi, edi
lea eax, [esp + 0x288]
push edi
push eax
call fcn.0044fe60
push 0x208
lea ecx, [esp + 0x6a4]
push edi
push ecx
call fcn.0044fe60
add esp, 0x18
push esi
lea edx, [esp + 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x46d948
lea eax, [esp + 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x408bf9
lea ebx, [edi + 7]
lea esp, [esp]
test byte [esp + 0x34], 0x10
je 0x408afd
cmp word [esp + 0x60], 0x2e
je 0x408afd
lea eax, [esp + 0x60]
push eax
push esi
lea ecx, [esp + 0x69c]
push 0x46c8b4
push ecx
call fcn.00401040
lea edx, [esp + 0x6a4]
push ebp
push edx
call fcn.00408a00
add esp, 0x18
jmp 0x408bd6
push 0x46d944
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x408bd6
push 0x46d93c
lea ecx, [esp + 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x408bd6
push 0x208
lea edx, [esp + 0x490]
push edi
push edx
call fcn.0044fe60
lea eax, [esp + 0x6c]
push eax
push esi
lea ecx, [esp + 0x4a0]
push 0x46c8b4
push ecx
call fcn.00401040
add esp, 0x1c
xor edx, edx
lea eax, [esp + 0x48c]
mov word [esp + 0x1c], dx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x408b74
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x490]
push eax
lea ecx, [esp + 0x20]
call fcn.00403680
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
mov dword [esp + 0x8ac], edi
call fcn.00407e00
cmp dword [esp + 0x30], 8
mov dword [esp + 0x8a8], 0xffffffff
jb 0x408bc7
mov edx, dword [esp + 0x1c]
push edx
call fcn.0044fc16
add esp, 4
xor eax, eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], ax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408ac0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x8a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x888]
xor ecx, esp
call fcn.0044ffb3
add esp, 0x898
ret
Function at 0x409530
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x40958c
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
Function at 0x40e130
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0xffffffffffffffff
push 0x467e38
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x487bb0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x40e190
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._d_r_n
call fcn.004520e4
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4
push edi
push edi
push edi
push 3
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jl 0x40e24f
lea eax, [esp + 0x14]
push eax
push 0x47a46c
push 1
push edi
push 0x47a53c
mov dword [esp + 0x28], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jl 0x40e24f
push str.ROOT_CIMV2
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], edi
call fcn.0040d200
mov eax, dword [eax]
mov dword [esp + 0x24], edi
cmp eax, edi
je 0x40e1ed
mov ecx, dword [eax]
jmp 0x40e1ef
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
lea esi, [esp + 0x10]
push esi
push edi
push edi
push edi
push edi
push edi
push edi
push ecx
push eax
mov eax, dword [edx + 0xc]
call eax
lea ecx, [esp + 0x18]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.0040d300
cmp esi, edi
jl 0x40e243
mov eax, dword [esp + 0x10]
push edi
push edi
push 3
push 3
push edi
push edi
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jge 0x40e26c
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov ecx, ebx
call fcn.0040d350
test eax, eax
je 0x40e286
mov edi, 1
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4
Function at 0x40e3b0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x487bb0]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push edi
mov edi, dword [esp + 0x23c]
xor ebx, ebx
test edi, edi
jne 0x40e3ec
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0044ffb3
add esp, 0x230
ret
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40e41b
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x40e435
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0044ffb3
add esp, 0x230
ret
lea ecx, [esp + 0x30]
push edi
push ecx
call fcn.00450540
add esp, 8
test eax, eax
je 0x40e458
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40e435
jmp 0x40e45c
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x238]
pop esi
pop edi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0044ffb3
add esp, 0x230
ret
Function at 0x40e730
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x20
mov eax, dword [0x487bb0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
lea eax, [esp + 4]
push edi
push eax
call fcn.0040e6b0
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 4
push str._________________________________
call esi
mov eax, dword [esp + 0xc]
mov edi, 0x10
cmp dword [esp + 0x20], edi
jae 0x40e76d
lea eax, [esp + 0xc]
push eax
call esi
push str._________________________________
call esi
cmp dword [esp + 0x1c], 0
je 0x40e859
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x20], edi
jae 0x40e790
lea eax, [esp + 0xc]
push 0xd
push str.VBOX_HARDDISK
push eax
call fcn.004658a1
add esp, 0xc
test eax, eax
jne 0x40e7cd
cmp dword [esp + 0x20], edi
jb 0x40e7b7
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0044fc16
add esp, 4
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0044ffb3
add esp, 0x20
ret
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x20], edi
jae 0x40e7db
lea eax, [esp + 0xc]
push 0xa
push str.Virtual_HD
push eax
call fcn.004658a1
add esp, 0xc
test eax, eax
jne 0x40e818
cmp dword [esp + 0x20], edi
jb 0x40e7b7
mov edx, dword [esp + 0xc]
push edx
call fcn.0044fc16
add esp, 4
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0044ffb3
add esp, 0x20
ret
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x20], edi
jae 0x40e826
lea eax, [esp + 0xc]
push 6
push str.VMware
push eax
call fcn.004658a1
add esp, 0xc
test eax, eax
jne 0x40e859
lea ecx, [esp + 8]
call fcn.00402160
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0044ffb3
add esp, 0x20
ret
call fcn.0040e480
test eax, eax
je 0x40e88f
cmp dword [esp + 0x20], edi
jb 0x40e7b7
mov eax, dword [esp + 0xc]
push eax
call fcn.0044fc16
add esp, 4
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0044ffb3
add esp, 0x20
ret
cmp dword [esp + 0x20], edi
jb 0x40e8a2
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0044fc16
add esp, 4
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0044ffb3
add esp, 0x20
ret
Function at 0x40e8c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x467f12
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x487bb0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
mov eax, dword [0x487bb0]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
mov esi, dword [esp + 0x154]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x18], esi
mov byte [esi + 4], bl
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x150], ebx
mov dword [esp + 0x14], 1
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x40e9c3
push 0x103
lea ecx, [esp + 0x41]
push ebx
push ecx
mov byte [esp + 0x48], bl
call fcn.0044fe60
movzx edx, byte [esp + 0x37]
movzx eax, byte [esp + 0x36]
movzx ecx, byte [esp + 0x35]
push edx
movzx edx, byte [esp + 0x38]
push eax
movzx eax, byte [esp + 0x3b]
push ecx
movzx ecx, byte [esp + 0x3e]
push edx
movzx edx, byte [esp + 0x41]
push eax
movzx eax, byte [esp + 0x44]
push ecx
movzx ecx, word [esp + 0x46]
push edx
movzx edx, word [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
push ecx
push edx
push eax
lea ecx, [esp + 0x74]
push str._08X_04X_04x_02X_02X_02X_02X_02X_02X_02X_02X
push ecx
call fcn.0044ff2b
lea eax, [esp + 0x7c]
add esp, 0x40
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e9a8
sub eax, edx
push eax
lea edx, [esp + 0x40]
push edx
mov ecx, esi
call fcn.004035a0
jmp 0x40ea53
push ebx
mov byte [esp + 0x30], 0x30
mov byte [esp + 0x31], 0x31
mov byte [esp + 0x32], 0x32
mov byte [esp + 0x33], 0x33
mov byte [esp + 0x34], 0x34
mov byte [esp + 0x35], 0x35
mov byte [esp + 0x36], 0x36
mov byte [esp + 0x37], 0x37
mov byte [esp + 0x38], 0x38
mov byte [esp + 0x39], 0x39
mov byte [esp + 0x3a], 0x61
mov byte [esp + 0x3b], 0x62
mov byte [esp + 0x3c], 0x63
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x3e], 0x65
mov byte [esp + 0x3f], 0x66
call fcn.0044feda
push eax
call fcn.00450de1
add esp, 8
mov edi, 0x20
call fcn.00450df3
and eax, 0x8000000f
jns 0x40ea38
dec eax
or eax, 0xfffffff0
inc eax
mov al, byte [esp + eax + 0x2c]
mov byte [esp + 0x14], al
mov ecx, dword [esp + 0x14]
push ecx
push 1
mov ecx, esi
call fcn.00403210
sub edi, 1
jne 0x40ea27
mov eax, esi
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.0044ffb3
add esp, 0x140
ret
Function at 0x40ec10
Capabilities:
Get mac address on windows

Disassembly:
push 0xffffffffffffffff
push 0x467f99
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x487bb0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487bb0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], ecx
mov byte [edi + 4], bl
mov dword [esp + 0x40], ebx
mov dword [esp + 0x1c], 1
call fcn.0040ab60
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x1c], ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x40ed85
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00451432
mov edx, dword [esp + 0x18]
push edx
mov ebp, eax
push ebx
push ebp
call fcn.0044fe60
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push ebp
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, ebx
jne 0x40ed78
mov esi, ebp
cmp ebp, ebx
je 0x40ed85
xor eax, eax
mov byte [esp + 0x24], bl
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
movzx ecx, byte [esi + 0x199]
movzx edx, byte [esi + 0x198]
movzx eax, byte [esi + 0x197]
push ecx
movzx ecx, byte [esi + 0x196]
push edx
movzx edx, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push ecx
push edx
push eax
lea ecx, [esp + 0x3c]
push str._02x_02x_02x_02x_02x_02x
push ecx
call fcn.004015d0
lea edx, [esp + 0x44]
push str.000000000000
push edx
call fcn.004536fc
add esp, 0x28
test eax, eax
jne 0x40ed35
mov esi, dword [esi]
cmp esi, ebx
jne 0x40ecc6
jmp 0x40ed78
lea edx, [esi + 8]
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ed40
sub eax, esi
push eax
push edx
mov ecx, edi
call fcn.004035a0
lea eax, [esp + 0x24]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ed60
mov ecx, dword [esp + 0x18]
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004035a0
cmp ebp, ebx
je 0x40ed85
push ebp
call fcn.00451355
add esp, 4
mov ecx, dword [esp + 0x18]
cmp dword [ecx + 0x14], ebx
jne 0x40ed9a
push 0xc
push str.FFFFFFFFFFFD
call fcn.004035a0
cmp dword [edi + 0x14], ebx
jne 0x40edad
push 0x20
push str.FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
mov ecx, edi
call fcn.004035a0
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0044ffb3
add esp, 0x30
ret
Function at 0x413d30
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x4688e8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x487bb0]
xor eax, esp
mov dword [esp + 0x54], eax
push ebp
push esi
push edi
mov eax, dword [0x487bb0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x7c]
mov esi, dword [esp + 0x78]
mov ebp, dword [esp + 0x80]
xor eax, eax
mov word [esp + 0x4c], ax
mov eax, ecx
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
lea edi, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x413d90
sub eax, edi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x50]
call fcn.00403680
push 1
push 0
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x54]
mov dword [esp + 0x7c], 0
mov dword [esp + 0x1c], 0x3a
call fcn.00401a00
mov edi, 8
cmp eax, 0xffffffff
je 0x413eb5
inc eax
push eax
push 0
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x54]
call fcn.004044a0
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x44], edi
jae 0x413dfa
lea eax, [esp + 0x30]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x413ea2
mov edx, dword [esp + 0x14]
fild dword [esp + 0x14]
test edx, edx
jge 0x413e2a
fadd qword [0x46e870]
mov eax, dword [esp + 0x18]
fmul qword [0x46e868]
fild dword [esp + 0x18]
test eax, eax
jge 0x413e42
fadd qword [0x46e870]
fmul qword [0x46e860]
sub esp, 8
faddp st(1)
fstp qword [esp]
push str._.1f
push ebp
call fcn.00401040
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
add esp, 0x10
mov dword [esi], ecx
mov dword [esi + 4], edx
cmp dword [esp + 0x44], edi
jb 0x413e7e
mov eax, dword [esp + 0x30]
push eax
call fcn.0044fc16
add esp, 4
xor ecx, ecx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], cx
cmp dword [esp + 0x60], edi
jb 0x413ed1
mov edx, dword [esp + 0x4c]
push edx
jmp 0x413ec9
cmp dword [esp + 0x44], edi
jb 0x413eb5
mov eax, dword [esp + 0x30]
push eax
call fcn.0044fc16
add esp, 4
xor eax, eax
xor ecx, ecx
mov dword [esi], ecx
mov dword [esi + 4], eax
cmp dword [esp + 0x60], edi
jb 0x413ed1
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0044fc16
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.0044ffb3
add esp, 0x64
ret 0xc
Function at 0x415540
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x408c30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00427079
pop esi
pop ecx
ret 0x10

Function at 0x415750
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x487bb0]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
push 0x98
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0044fe60
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x4157bd
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x4157bd
xor al, al
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0044ffb3
add esp, 0xa0
ret
cmp dword [esp + 8], 5
jne 0x415812
cmp dword [esp + 0xc], 1
jne 0x415812
lea eax, [esp + 0x18]
push 0x46ed18
push eax
call fcn.00452410
add esp, 8
test eax, eax
jne 0x4157f7
lea ecx, [esp + 0x18]
push 0x46e2e8
push ecx
call fcn.00452410
add esp, 8
test eax, eax
je 0x415812
mov eax, 1
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0044ffb3
add esp, 0xa0
ret
mov ecx, dword [esp + 0xa0]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0044ffb3
add esp, 0xa0
ret

Function at 0x415830
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push 0x46ed1c
push eax
call fcn.00452a19
mov esi, eax
add esp, 8
test esi, esi
je 0x41588b
mov ecx, dword [esp + 0xc]
push edi
push 0
push ecx
push esi
call fcn.004528d0
push esi
push 1
lea edx, [esp + 0x1c]
push 4
push edx
mov dword [esp + 0x24], 0
call fcn.00452829
push esi
mov edi, eax
call fcn.0045250d
add esp, 0x20
cmp edi, 1
pop edi
jne 0x41588b
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov al, 1
pop esi
pop ecx
ret
xor al, al
pop esi
pop ecx
ret
Function at 0x415890
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xfffffffffffffffe
push 0x47eb98
push 0x452b00
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x487bb0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
xor ebx, ebx
mov byte [ebp], bl
push 0x103
push ebx
lea eax, [ebp + 1]
push eax
call fcn.0044fe60
add esp, 0xc
push ebx
push 0x25
lea ecx, [ebp]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x415903
xor al, al
jmp 0x41597b
mov dword [ebp - 0x1c], 5
push str._sfc_os.dll
push 0x104
lea edx, [ebp]
push edx
call fcn.00452a83
add esp, 0xc
test eax, eax
jne 0x4158ff
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x415973
push 5
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x41596c
mov dword [ebp - 4], ebx
push 0xffffffffffffffff
push edi
push ebx
call eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x41596c
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
cmp dword [ebp - 0x1c], eax
sete al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.0044ffb3
add ebp, 0x108
mov esp, ebp
pop ebp
ret

Function at 0x4159a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebp
push esi
xor ebp, ebp
push ebp
push ebp
push 3
push ebp
push ebp
push 0xc0000000
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4159d9
push ebp
push ebp
push 3
push ebp
push 1
push 0xc0000000
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x415a1d
mov eax, dword [esp + 0x18]
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x415a11
mov ecx, dword [esp + 0x1c]
push 0
lea edx, [esp + 0x10]
push edx
push 4
lea eax, [esp + 0x1c]
push eax
push esi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, eax
cmp esi, 0xffffffff
je 0x415a1d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
test ebp, ebp
pop ebp
setne al
pop ebx
add esp, 8
ret