joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100012b0
Capabilities:
Access peb ldr_data
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x100144b3
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1001a040]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebp, ebp
mov dword [edi + 4], ebp
mov dword [edi], vtable.CCoreManage.0
mov dword [edi + 0xc], ebp
lea eax, [edi + 0x10]
push eax
mov dword [esp + 0x20], ebp
call fcn.10003760
lea ebx, [edi + 0x30]
mov dword [ebx], ebp
lea eax, [edi + 0x40]
push eax
mov byte [esp + 0x20], 2
call fcn.10003760
push str.2B99178A_21A2_4176_8D32_81DA708CFD0A_Event
push 1
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x7c], eax
mov dword [edi + 0x80], ebp
mov dword [edi + 0x84], ebp
mov eax, dword [esp + 0x28]
mov byte [esp + 0x1c], 4
mov cx, word [esp + 0x2c]
push 0x80
mov dword [edi + 8], eax
mov word [edi + 0x38], cx
mov dword [edi + 0x78], ebp
call fcn.10008c27
add esp, 4
cmp eax, ebp
je 0x10001356
mov esi, eax
call fcn.10007b30
jmp 0x10001358
xor eax, eax
mov dword [edi + 0x34], eax
mov dword [eax + 0x20], edi
mov esi, dword [edi + 0x34]
mov dword [esp + 0x2c], esi
cmp esi, ebp
je 0x10001371
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
mov byte [esp + 0x1c], 5
mov eax, dword [edi + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push ebx
push eax
call edx
test eax, eax
jne 0x100013dc
mov ebx, dword [ebx]
cmp ebx, ebp
je 0x100013dc
mov eax, dword [ebx]
mov ecx, dword [eax + 0x14]
push esi
push ebx
call ecx
lea edx, [edi + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push str.2B99178A_21A2_4176_8D32_81DA708CFD0A_FileMap
push ebp
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [edi + 0x80], eax
cmp eax, ebp
je 0x100013c9
push ebp
push ebp
push ebp
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0x84], eax
mov byte [esp + 0x1c], 4
cmp esi, ebp
je 0x100013ed
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
jmp 0x100013ed
mov byte [esp + 0x1c], 4
cmp esi, ebp
je 0x100013ed
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x100019d5
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xa68
mov eax, dword [0x1001a040]
xor eax, esp
mov dword [esp + 0xa64], eax
mov eax, dword [esp + 0xa6c]
add eax, 0xfffffffe
push esi
push edi
cmp eax, 3
ja case.default.0x100019b9
jmp dword [eax*4 + 0x10001ad0]
mov esi, str._op:9
jmp 0x100019da
mov esi, str._op:8
jmp 0x100019da
mov esi, str._op:6
jmp 0x100019da
mov esi, str._op:7
push 0x104
lea eax, [esp + 0x64]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.Update.exe
lea ecx, [esp + 0x64]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x272]
push eax
mov word [esp + 0x274], dx
call fcn.10009900
push esi
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x27c]
push str.__s___s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x40
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.10009900
add esp, 0x28
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
mov ecx, 5
mov word [esp + 0x64], cx
push 0
lea ecx, [esp + 0x288]
push ecx
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x10001a9c
mov edx, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 8]
push eax
call edi
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xa64]
xor ecx, esp
call fcn.100089b0
add esp, 0xa68
ret
mov ecx, dword [esp + 0xa6c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.100089b0
add esp, 0xa68
ret
Function at 0x10004630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10004647
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10004678
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x10004674
cmp esi, eax
jae 0x10004678
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x10004664
cmp esi, eax
jb 0x1000467e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x10004940
Capabilities:
Query service status

Disassembly:
sub esp, 0x24
push ebp
mov ebp, dword [esp + 0x30]
push edi
push 0x20000
push 0
push 0
mov byte [ebp], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1000496f
pop edi
mov eax, 0x80004005
pop ebp
add esp, 0x24
ret 8
push esi
push 4
push str.KuaiZipDrive
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x100049b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
cmp eax, 0x424
jne 0x100049a3
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret 8
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
mov eax, 0x80004005
pop ebp
add esp, 0x24
ret 8
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
push 0x24
lea ecx, [esp + 0x14]
push ecx
push 0
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10004a18
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
pop edi
mov eax, 0x80004005
pop ebp
add esp, 0x24
ret 8
cmp dword [esp + 0x10], 4
jne 0x10004a23
mov byte [ebp], 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret 8
Function at 0x10004d90
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x210
mov eax, dword [0x1001a040]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x10004dd7
mov eax, 0x80004005
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.100089b0
add esp, 0x210
ret 4
push edi
push 0xf01ff
push str.KuaiZipDrive
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x10004dfd
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x10004ee1
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
push esi
lea eax, [esp + 0x10]
push eax
push 0
push 0
push edi
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0x10]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10004e45
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
push esi
push edi
call ebp
test eax, eax
jne 0x10004e5b
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebx
call esi
mov eax, 0x80004005
jmp 0x10004edf
call fcn.10005160
mov ecx, dword [esi + 0xc]
add ecx, 8
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10004eca
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x1e]
push eax
mov word [esp + 0x20], dx
call fcn.10009900
push 0
call fcn.1000904f
mov ecx, dword [esi + 0xc]
push edx
push eax
add ecx, 8
push ecx
push str._s__d
lea edx, [esp + 0x34]
call fcn.10005380
mov eax, dword [esi + 0xc]
add esp, 0x20
lea edx, [esp + 0x14]
push edx
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 4
push 0
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebx
call esi
xor eax, eax
pop esi
pop ebp
mov ecx, dword [esp + 0x214]
pop edi
pop ebx
xor ecx, esp
call fcn.100089b0
add esp, 0x210
ret 4
Function at 0x10005160
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
sub esp, 0x30
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebp
push 0xf003f
push 0
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
jne 0x10005195
pop esi
mov eax, 0x80004005
pop ebp
add esp, 0x30
ret
push edi
push 0x2c
push str.KuaiZipDrive
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x100051bd
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, 0x80004005
pop ebp
add esp, 0x30
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea eax, [esp + 0x10]
push eax
push 0x24
lea ecx, [esp + 0x24]
push ecx
push 0
push edi
call ebx
test eax, eax
je 0x100052a3
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x10005287
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, 3
jne 0x10005230
mov edx, dword [esp + 0x34]
push edx
call esi
lea eax, [esp + 0x10]
push eax
push 0x24
lea ecx, [esp + 0x24]
push ecx
push 0
push edi
call ebx
test eax, eax
je 0x100052a3
cmp dword [esp + 0x20], 1
je 0x10005287
call ebp
sub eax, dword [esp + 0x14]
cmp eax, 0x3a98
ja 0x100052a3
cmp dword [esp + 0x20], 3
je 0x100051f5
lea edx, [esp + 0x1c]
push edx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10005247
lea esi, [eax + 1]
jmp 0x10005289
cmp dword [esp + 0x20], 1
je 0x10005287
mov edi, edi
mov eax, dword [esp + 0x34]
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x24
lea edx, [esp + 0x24]
push edx
push 0
push edi
call ebx
test eax, eax
je 0x100052a3
cmp dword [esp + 0x20], 1
je 0x10005287
call ebp
sub eax, dword [esp + 0x14]
cmp eax, 0x3a98
ja 0x100052a3
cmp dword [esp + 0x20], 1
jne 0x10005250
xor esi, esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
mov eax, dword [esp + 0x18]
push eax
call edi
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x30
ret
mov esi, 0x80004005
jmp 0x10005289

Function at 0x100052b0
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
push esi
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push str.SYSTEMCurrentControlSet_servicesKuaiZipDrive_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1000532d
mov ecx, dword [esp + 4]
push str.DeleteFlag
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x100052f6
mov esi, 0x80004005
mov eax, dword [esp + 4]
push 4
lea edx, [esp + 0xc]
push edx
push 4
push 0
push str.Start
push eax
mov dword [esp + 0x20], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10005322
mov esi, 0x80004005
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x10005640
Capabilities:
Read file via mapping

Disassembly:
push str.2B99178A_21A2_4176_8D32_81DA708CFD0A_FileMap
push 0x19644
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x1000567d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10005680
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
xor eax, eax
ret
mov ecx, dword [esi + 4]
push 0
push 0
push 0
push 6
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
je 0x1000567d
push 0x19644
push 0
push eax
call fcn.10009900
add esp, 0xc
mov eax, 1
ret

Function at 0x100058a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10014423
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1001a040]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov dword [edi + 4], ebx
mov dword [edi], vtable.CMountManage.0
mov dword [edi + 8], ebx
lea eax, [edi + 0xc]
push eax
mov dword [esp + 0x1c], ebx
call fcn.10003760
mov dword [edi + 0x2c], ebx
lea eax, [edi + 0x30]
push eax
mov byte [esp + 0x1c], 2
call fcn.10003760
push str.2B99178A_21A2_4176_8D32_81DA708CFD0A_Event
push 1
push ebx
push ebx
lea esi, [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [edi + 0x50]
push ecx
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.10005640
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x10005de0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x100142ca
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1001a040]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
mov dword [eax], 0
test edi, edi
je 0x10005fdb
cmp word [edi], 0
je 0x10005fdb
mov esi, dword [esp + 0x34]
test esi, esi
je 0x10005fdb
cmp word [esi], 0
je 0x10005fdb
lea ecx, [esp + 0x34]
push ecx
mov ecx, edi
call fcn.10002fa0
mov eax, 7
lea ecx, [esp + 0x18]
lea edx, [esp + 0x34]
mov dword [esp + 0x24], 0
call fcn.10006860
mov byte [esp + 0x24], 1
mov eax, dword [eax]
push str.http:__
mov ebx, 1
push eax
mov dword [esp + 0x18], ebx
call fcn.100093de
add esp, 8
test eax, eax
je 0x10005ec1
lea eax, [ebx + 5]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x34]
call fcn.10006860
mov dword [esp + 0x24], 2
mov ebx, 3
push eax
mov ecx, str.ftp:__
mov dword [esp + 0x14], ebx
call fcn.10006830
mov byte [esp + 0x30], 1
test eax, eax
jne 0x10005ec6
mov byte [esp + 0x30], 0
test bl, 2
je 0x10005ed7
lea eax, [esp + 0x14]
and ebx, 0xfffffffd
call fcn.10003660
test bl, 1
je 0x10005ee5
lea eax, [esp + 0x18]
call fcn.10003660
cmp byte [esp + 0x30], 0
je 0x10005efb
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10005fd2
movzx eax, word [esi]
mov ecx, 0x5c
cmp ax, cx
jne 0x10005f58
cmp word [esi + 2], cx
jne 0x10005f58
cmp word [esi + 4], cx
je 0x10005f58
push esi
push edi
call fcn.1000926c
add esp, 8
test eax, eax
je 0x10005f2e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x10005f38
mov edx, dword [esp + 0x38]
mov dword [edx], 1
lea eax, [esp + 0x34]
call fcn.10003660
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 0x10
cmp ax, 0x41
jb 0x10005fd2
mov edx, 0x5a
cmp dx, ax
jae 0x10005f6e
cmp ax, 0x61
jb 0x10005fd2
mov edx, 0x7a
cmp dx, ax
jb 0x10005fd2
cmp word [esi + 2], 0x3a
jne 0x10005fd2
movzx eax, word [esi + 4]
cmp ax, cx
je 0x10005f8e
cmp ax, 0x2f
jne 0x10005fd2
push esi
push edi
call fcn.1000926c
add esp, 8
test eax, eax
je 0x10005fa8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x10005f38
mov eax, dword [esp + 0x38]
mov dword [eax], 1
lea eax, [esp + 0x34]
call fcn.10003660
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 0x10
lea eax, [esp + 0x34]
call fcn.10003660
mov eax, 0x80070057
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 0x10
Function at 0x10008090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10013fc8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1001a040]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
cmp dword [esi + 0xc], eax
jne 0x100080d6
mov eax, 0x80004001
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
mov edi, dword [esp + 0x20]
cmp edi, eax
jne 0x100080f7
mov eax, 0x80070057
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
cmp dword [esi + 0x14], eax
jne 0x10008115
mov eax, 0x80004005
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov eax, dword [esi + 0xc]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
add esi, 0x30
push esi
push edi
push eax
mov eax, dword [ecx + 4]
call eax
mov ecx, dword [esp + 0x1c]
push ecx
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8

Function at 0x100083a0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x228
mov eax, dword [0x1001a040]
xor eax, esp
mov dword [esp + 0x220], eax
push edi
xor edi, edi
cmp dword [esi + 0x38], 2
jne 0x100083d5
xor eax, eax
pop edi
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.100089b0
add esp, 0x228
ret
mov edx, dword [esi + 0x34]
mov dword [esi + 0x38], edi
mov ecx, dword [0x10017120]
mov eax, dword [0x1001711c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov ax, word [edx]
lea ecx, [esp + 8]
push ecx
mov word [esp + 0xc], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, 3
je 0x10008447
sub eax, 2
je 0x10008428
mov edi, 0x80004005
mov eax, edi
pop edi
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.100089b0
add esp, 0x228
ret
mov dword [esi + 0x38], 4
mov eax, edi
pop edi
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.100089b0
add esp, 0x228
ret
push 0x208
lea eax, [esp + 0x16]
xor edx, edx
push edi
push eax
mov word [esp + 0x1c], dx
call fcn.10009900
add esp, 0xc
push 0x105
lea ecx, [esp + 0x14]
push ecx
push edi
push edi
push edi
push edi
push edi
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [esp + 0x224]
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 5
mov dword [esi + 0x38], eax
mov eax, edi
pop edi
xor ecx, esp
call fcn.100089b0
add esp, 0x228
ret

Function at 0x100089b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001a040]
jne 0x100089ba
repz ret
jmp fcn.1000a0aa
Function at 0x10011703
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000ac49
and dword [ebp - 4], 0
cmp dword [0x1001bd30], 0
mov ebx, eax
jne 0x100117b4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10011865
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10011865
push eax
call fcn.1000abd7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1001bd30], eax
call esi
push eax
call fcn.1000abd7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1001bd34], eax
call esi
push eax
call fcn.1000abd7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1001bd38], eax
call esi
push eax
call fcn.1000abd7
pop ecx
mov dword [0x1001bd40], eax
test eax, eax
je 0x100117b4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000abd7
pop ecx
mov dword [0x1001bd3c], eax
mov eax, dword [0x1001bd3c]
cmp eax, ebx
je 0x1001180c
cmp dword [0x1001bd40], ebx
je 0x1001180c
push eax
call fcn.1000ac52
push dword [0x1001bd40]
mov esi, eax
call fcn.1000ac52
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001180c
test edi, edi
je 0x1001180c
call esi
test eax, eax
je 0x10011803
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10011803
test byte [ebp - 0xc], 1
jne 0x1001180c
or dword [ebp + 0x10], 0x200000
jmp 0x10011845
mov eax, dword [0x1001bd34]
cmp eax, ebx
je 0x10011845
push eax
call fcn.1000ac52
pop ecx
test eax, eax
je 0x10011845
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10011845
mov eax, dword [0x1001bd38]
cmp eax, ebx
je 0x10011845
push eax
call fcn.1000ac52
pop ecx
test eax, eax
je 0x10011845
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1001bd30]
call fcn.1000ac52
pop ecx
test eax, eax
je 0x10011865
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10011867
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403f64
Capabilities:
Contain obfuscated stackstrings

Disassembly:
outsb dx, byte [esi]
movzx eax, word [edi + 6]
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.00403d50
std
invalid
push dword [eax]
pop ebp
mov edi, 0x478b6663
push es
cmp ax, bx
jbe 0x403faa
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x403fa4
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x403f95
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00403d50
stosb byte es:[edi], al
sal esi, 0x74
lea eax, [ebp - 0x58]
push eax
call fcn.00403d60
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00403d15
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40403e
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00403d50
sub edx, dword [edx + 0x458d14a6]
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x405dc8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00403d60
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00403d15
add esp, 0xc
mov dword [ebp - 0x37c], eax

Function at 0x405ef4
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
and al, 0x54
call fcn.00403d50
dec esp
cld
push edx
mov ax, word fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x405f14
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00403d50
salc
add eax, 0xf88b92b3
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00403d50
and eax, 0x494a324c
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x405f3d
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x405f3d
call fcn.00403d50
rcl dword [esp]
dec byte [ebx - 0x20fcdba6]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00403d50
fist dword [edx + edi*8 + 0x875ff4a]
push dword [ebp + 4]