joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ced
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
xor edx, edx
mov dword [ebp - 4], edi
push 0xc
mov esi, edx
mov ecx, edx
mov ebx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
movzx eax, word [ebx + 4]
mov dword [ebp - 0xc], eax
pop ebx
test eax, eax
je 0x407d64
mov eax, dword [edi + 0x18]
mov edi, dword [ebp + 8]
cmp dword [eax], edi
mov edi, dword [ebp - 4]
jne 0x407d5c
cmp dword [ebp + 0xc], edx
je 0x407d4b
cmp dword [edi + 0x20], edx
je 0x407d4b
test byte [eax + 4], 1
jne 0x407d5c
imul esi, ecx, 0xc
lea edi, [ebp - 0x20]
add esi, dword [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x407d6e
mov esi, eax
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
test byte [eax + 4], 1
jne 0x407d64
inc ecx
add eax, ebx
cmp ecx, dword [ebp - 0xc]
jb 0x407d23
mov eax, edx
test esi, esi
je 0x407e2f
cmp dword [ebp + 0xc], edx
je 0x407d7b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], edx
jne 0x407d7e
push 8
pop ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebx + eax]
test al, 4
je 0x407d91
and ecx, 0xffffcfff
test al, 2
je 0x407d9b
and ecx, 0xfffff3ff
test al, 1
je 0x407da5
and ecx, 0xfffffcff
test al, 8
je 0x407db4
and ecx, 0xc0ffffff
mov dword [ebp - 0xc], edx
jmp 0x407dba
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x20], edx
je 0x407e2d
mov ebx, ecx
mov edi, ecx
shr ebx, 0xc
mov esi, ecx
shr edi, 0xa
mov eax, ebx
shr esi, 8
or eax, edi
or eax, esi
test al, 3
jne 0x407de5
test ecx, 0x3f000000
jne 0x407de5
test cl, 2
je 0x407e2d
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, ecx
mov edx, dword [ebp - 8]
shr eax, 0x1e
mov dword [edx + 8], eax
mov eax, ecx
shr eax, 0x18
and al, 0x3f
shr ecx, 1
mov byte [edx + 4], al
and ecx, 1
mov eax, edx
mov dword [eax + 0x14], ecx
and ebx, 3
je 0x407e16
mov dword [eax], ebx
jmp 0x407e26
and edi, 3
je 0x407e1f
mov dword [eax], edi
jmp 0x407e26
and esi, 3
je 0x407e26
mov dword [eax], esi
xor eax, eax
inc eax
xor edx, edx
jmp 0x407e2f
mov eax, edx
mov edi, dword [ebp - 0x10]
mov esi, edx
mov ecx, dword [ebp - 4]
movzx edi, word [edi + 6]
mov ecx, dword [ecx + 0x1c]
test edi, edi
je 0x407e56
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x407e53
inc esi
add ecx, 0x10
cmp esi, edi
jb 0x407e45
jmp 0x407e56
xor edx, edx
inc edx
mov ecx, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov dword [ecx + 0x10], edx
leave
ret 8
Function at 0x408d99
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x10]
test esi, esi
je 0x408f5d
mov ax, word [edi + 2]
xor ecx, ecx
mov word [ebp - 0x20], ax
add esi, 0xa
mov al, byte [edi + 4]
mov bh, cl
mov byte [ebp - 0x1e], al
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x18], ax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], bh
jmp 0x408e06
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push dword [ebp + 8]
call fcn.004085a8
test eax, eax
js 0x408ee3
lea eax, [ebp - 0x20]
mov ecx, edi
je 0x408eba
push dword [ebp - 8]
push eax
call fcn.00408d0a
mov esi, eax
push dword [edi + 0x14]
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea ecx, [ebp - 0x20]
call fcn.004086fc
mov bl, al
test bl, bl
jne 0x408dda
mov esi, dword [ebp - 8]
mov dword [edi + 0x14], esi
xor edx, edx
test bh, bh
jne 0x408e4b
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
and dword [ebp - 0x14], edx
mov word [ebp - 0x18], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], eax
call fcn.0040860f
mov edx, eax
mov ax, word [edi + 6]
lea ecx, [ebp - 0x34]
and dword [ebp - 0x28], 0
mov word [ebp - 0x34], ax
mov al, byte [edi + 8]
mov byte [ebp - 0x32], al
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov word [ebp - 0x2c], ax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
call fcn.0040860f
mov ebx, dword [edi + 0x18]
add eax, edx
mov dword [ebp - 0xc], eax
mov edx, ebx
mov eax, dword [edi + 0x14]
sub edx, eax
cmp eax, ebx
sbb ecx, ecx
and ecx, edx
mov edx, dword [ebp - 0xc]
cmp ecx, edx
jb 0x408f5d
sub ebx, edx
lea ecx, [edx + esi]
sub ebx, esi
sub eax, esi
je 0x408f14
test ecx, ecx
jne 0x408ef3
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
mov dword [eax], 0x16
call sub.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo
jmp 0x408f14
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 8]
push eax
call fcn.00408bd9
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x408edc
mov al, 1
jmp 0x408f5f
mov bh, 1
mov byte [ebp - 1], bh
jmp 0x408ee6
mov dword [ebp - 8], esi
test bl, bl
jne 0x408e24
jmp 0x408e21
test esi, esi
je 0x408ea7
cmp ebx, eax
jae 0x408f09
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
mov dword [eax], 0x22
jmp 0x408eb3
push eax
push esi
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
mov eax, dword [edi + 0x14]
add eax, dword [ebp - 0xc]
cmp byte [ebp - 1], 0
mov dword [edi + 0x14], eax
jne 0x408f32
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00408633
jmp 0x408f45
cmp byte [ebp - 0x1e], 0
je 0x408f45
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
inc eax
push eax
call fcn.004085cf
push dword [edi + 0x14]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00408633
mov byte [edi + 0x20], 1
jmp 0x408ed5
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x40ae88
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
mov dword [0x424e84], 0x41d0e0
push eax
push 0xd
push 0x400
mov dword [0x424e8c], 0xc
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [ebp - 4], 0x31
jne 0x40aedc
mov eax, 0x3e8
mov dword [0x424e50], 0xa006
mov dword [0x424e70], eax
mov dword [0x424e78], eax
mov eax, 0x2ee
jmp 0x40aefa
mov eax, 0x9c4
mov dword [0x424e50], 0xa00a
mov dword [0x424e70], eax
mov dword [0x424e78], eax
mov eax, 0x7d0
mov dword [0x424e74], eax
mov dword [0x424e6c], eax
leave
ret

Function at 0x40b0a5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x424210]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [0x424ec0]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b120
push 0
lea eax, [ebp - 0x408]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jle 0x40b119
mov edx, dword [ebp - 0x408]
test edx, edx
je 0x40b119
lea ecx, [ebp - 0x404]
call fcn.0040afe4
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00421870
leave
ret
Function at 0x40d9af
Capabilities:
Open clipboard

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
push dword [0x425e0c]
mov esi, ecx
call dword [sym.imp.USER32.dll_GetMenu]
mov edi, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0xb0
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 4]
xor ebx, ebx
cmp eax, dword [ebp - 0xc]
sete bl
push ebx
push 0x300
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push ebx
push 0x301
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push ebx
push 0x303
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push ebx
push 0x1c
xor ebx, ebx
inc ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40da68
push ebx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
xor ecx, ecx
cmp dword [ebp - 8], ecx
sete cl
push ecx
push 0x302
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0
push 0xe
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
neg eax
sbb esi, esi
not esi
and esi, ebx
push esi
push 0x15
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push esi
push 0x16
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push esi
push 0x1d
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor ebx, ebx
cmp dword [0x425bf0], ebx
push 1
push edi
setne bl
call dword [sym.imp.USER32.dll_GetSubMenu]
push ebx
push 0x18
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0
push 0xc6
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
test eax, eax
sete cl
push ecx
push 0x10
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov esi, dword [0x425bf0]
neg esi
push 2
sbb esi, esi
push edi
and esi, 8
call dword [sym.imp.USER32.dll_GetSubMenu]
push esi
push 0x20
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 3
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ecx, dword [0x425bfc]
neg ecx
sbb ecx, ecx
and ecx, 8
push ecx
push 0x1b
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push ecx
push ecx
push 1
mov ecx, 0x424dc0
call fcn.0040e4ae
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fb9e
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x424210]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
inc esi
cmp ecx, esi
jne 0x40fbdf
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0x10
lea ecx, [ebp - 0x24]
movzx eax, ax
push ecx
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40fbf3
test dword [ebp - 0x16], 0x800
jne 0x40fbf5
jmp 0x40fbf3
cmp ecx, 6
je 0x40fbf5
cmp ecx, 0x17
je 0x40fbf5
cmp ecx, 0xa
je 0x40fbf5
cmp ecx, 8
je 0x40fbf5
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00421870
leave
ret

Function at 0x40fc04
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
mov eax, dword [0x424210]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
push edi
push 0x294
lea eax, [esp + 0x184]
mov edi, ecx
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
xor ebx, ebx
inc ebx
mov esi, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x10
lea eax, [esp + 0x24]
mov dword [esp + 0x10], ebx
push eax
push 0x58
mov ebx, 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40fc9b
test dword [esp + 0x2e], 0x800
je 0x40fc9b
push 2
lea eax, [esp + 0x10]
push eax
push 0x20001009
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0xc]
call fcn.0040fb9e
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x10
add esi, 0x11
push 0x50
lea eax, [esp + 0xe4]
push eax
push 0
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0x50
lea eax, [esp + 0x44]
push eax
push 0
lea eax, [esp + 0x1c]
push eax
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov ebx, 0x401ff8
mov esi, 0x14a
test edi, edi
je 0x40fce8
push ebx
mov edx, esi
lea ecx, [esp + 0x184]
call fcn.00406489
lea eax, [esp + 0x40]
mov edx, esi
push eax
lea ecx, [esp + 0x184]
call fcn.00406489
push 0x402000
mov edx, esi
lea ecx, [esp + 0x184]
call fcn.00406489
lea eax, [esp + 0xe0]
mov edx, esi
push eax
lea ecx, [esp + 0x184]
call fcn.00406489
test edi, edi
je 0x40fd37
push ebx
mov edx, esi
lea ecx, [esp + 0x184]
call fcn.00406489
lea eax, [esp + 0x180]
push eax
push 1
push 0xc2
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, edi
call fcn.0041ebcc
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00421870
mov esp, ebp
pop ebp
ret

Function at 0x40fd6e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x40fd9a
sub esi, edx
mov ax, word [edx]
movzx ecx, byte [edx + 1]
shl ax, 8
xor cx, ax
mov word [esi + edx], cx
lea edx, [edx + 2]
sub edi, 1
jne 0x40fd80
pop edi
pop esi
pop ebp
ret 4
Function at 0x40fda0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x10], 0
mov eax, edx
mov ecx, dword [0x424e30]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jne 0x40fdc4
xor eax, eax
inc eax
jmp 0x40fe4d
push esi
lea esi, [eax - 0xfde9]
neg esi
lea ecx, [ebp - 0x10]
sbb esi, esi
and esi, ecx
xor ecx, ecx
push esi
push ecx
push ecx
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
test eax, eax
je 0x40fe4c
push edi
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x40fe0e
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x40fe4b
push esi
push 0
push dword [ebp - 4]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
je 0x40fe42
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop edi
pop esi
leave
ret 0xc

Function at 0x40fe9c
Capabilities:
Get graphical window text

Disassembly:
cmp dword [0x425bf0], 0
je 0x40fed5
cmp dword [0x4259b8], 0
je 0x40feb8
mov ecx, 0x50200104
jmp fcn.0041c472
push dword [0x425984]
push dword [0x425980]
push 0xb1
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
ret
Function at 0x41112d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], ebx
mov eax, ebx
mov dword [ebp - 0x10], eax
mov esi, edx
mov dword [ebp - 4], ebx
push 4
pop edi
mov dword [ebp - 0x14], edi
test ecx, ecx
je 0x411179
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411176
cmp dword [ebp - 0xc], edi
je 0x4111ae
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x402088
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4111ae
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4111b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov word [esi], ax
mov eax, dword [ebp + 0x10]
lea edi, [eax + eax]
mov dword [ebp - 8], edi
test ecx, ecx
je 0x4111f7
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4111f7
cmp dword [ebp - 4], 1
je 0x411204
push edi
push dword [ebp + 8]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
pop edi
pop esi
leave
ret 0xc
Function at 0x41dbee
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebx + 4], ecx
mov dword [ebx], 0x401084
mov eax, dword [edx]
mov dword [ebx + 8], eax
mov dword [edx], ecx
mov byte [ebx + 0xc], cl
push ecx
lea ecx, [ebp - 4]
call fcn.0040e232
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push esi
push 0x404f6c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x41dc90
mov edx, dword [ebp - 4]
test edx, edx
je 0x41dc9f
mov edi, edx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, si
jne 0x41dc41
sub edi, ecx
lea ecx, [ebp - 8]
sar edi, 1
lea eax, [edi + 9]
push eax
call fcn.0040fae3
mov esi, dword [ebp - 8]
push 0x40264c
push 9
pop edx
lea ecx, [esi + edi*2]
call fcn.00406454
test eax, eax
js 0x41dc85
lea eax, [ebp - 8]
lea ecx, [ebx + 4]
cmp ecx, eax
je 0x41dc85
push esi
call fcn.0040e232
xor esi, esi
test esi, esi
je 0x41dc90
push esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
cmp dword [ebp - 4], 0
je 0x41dc9f
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x41e1d3
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
call fcn.0041e2a1
test al, al
je 0x41e29c
mov eax, dword [edi + 4]
xor ebx, ebx
mov esi, eax
mov dword [ebp - 4], eax
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x41e1fa
sub esi, ecx
xor edx, edx
sar esi, 1
lea ecx, [ebp - 8]
add esi, 0x10
push esi
call fcn.0040fae3
push 0x4026d4
push dword [ebp - 4]
push 0x4026f4
push esi
mov esi, dword [ebp - 8]
push esi
call fcn.004064f7
add esp, 0x14
test eax, eax
js 0x41e28f
push ebx
push 0x82
push 2
push ebx
push ebx
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x41e28f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x41e28f
push ebx
push ebx
push 0xe
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [eax*2 + 2]
cmp ebx, dword [ebp - 0xc]
ja 0x41e28f
jb 0x41e28d
cmp eax, dword [ebp - 0x10]
ja 0x41e28f
mov bl, 1
test esi, esi
je 0x41e29a
push esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41e2a1
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
push ebx
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41e2c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41e2c3
mov bl, 1
mov al, bl
pop ebx
ret
Function at 0x41e907
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [0x424108], 4
push esi
push edi
mov esi, edx
mov edi, ecx
jbe 0x41ea51
push 0x2000
push 0
mov ecx, 0x424108
call fcn.00406004
test al, al
je 0x41ea51
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov ax, word [edi + 0x20]
mov word [ebp - 2], ax
mov ax, word [edi + 0x1e]
mov word [ebp - 4], ax
mov ax, word [edi + 0x1c]
mov word [ebp - 6], ax
mov ax, word [edi + 0x1a]
mov word [ebp - 8], ax
mov ax, word [edi + 0x18]
mov word [ebp - 0xa], ax
mov ax, word [edi + 0x16]
mov word [ebp - 0xc], ax
mov ax, word [edi + 0x14]
mov word [ebp - 0xe], ax
mov ax, word [edi + 0x12]
mov word [ebp - 0x10], ax
mov ax, word [edi + 0x10]
mov word [ebp - 0x12], ax
mov ax, word [edi + 0xe]
mov word [ebp - 0x14], ax
mov ax, word [edi + 0xc]
mov word [ebp - 0x16], ax
mov ax, word [edi + 0xa]
mov word [ebp - 0x18], ax
mov ax, word [edi + 8]
mov word [ebp - 0x1a], ax
mov ax, word [edi + 6]
mov word [ebp - 0x1c], ax
mov ax, word [edi + 4]
mov word [ebp - 0x1e], ax
mov ax, word [edi + 2]
mov word [ebp - 0x20], ax
mov ax, word [edi]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
add dword [0x4259b0], 1
push eax
lea eax, [ebp - 0x30]
adc dword [0x4259b4], 0
push eax
lea eax, [ebp - 2]
mov dword [ebp - 0x30], esi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x34], 0x4259b0
push eax
lea eax, [ebp - 6]
mov dword [ebp - 0x38], 0x42599c
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x12]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x16]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1e]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x22]
mov edx, 0x4051c7
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push ecx
push ecx
call fcn.00405cec
push 8
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop edi
pop esi
leave
ret 8

Function at 0x41ff4e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41ffbb
xor ebx, ebx
test eax, 0x4000
je 0x41ff90
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_DecryptFileW]
test eax, eax
jne 0x41ff90
mov ecx, dword [ebp + 4]
mov edx, 0xd6
push 0x404c3c
call fcn.00406fad
jmp 0x41ffbd
cmp word [edi], bx
je 0x41ffbb
mov edx, edi
mov ecx, esi
call fcn.0041f72d
mov esi, eax
test esi, esi
jns 0x41ffbb
mov ecx, dword [ebp + 4]
mov edx, 0xdc
push esi
push 0x404c3c
call fcn.00406f90
mov eax, esi
jmp 0x41ffbd
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x421aaa
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x421ae7
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x421ae0
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x421aec
add edx, 0x28
cmp edx, esi
jne 0x421ad1
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x421ae9