joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e28
Capabilities:
Terminate process

Disassembly:
jmp 0x42bf19
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x42bf2a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00404a39
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x402f27
Capabilities:
Query environment variable

Disassembly:
jmp 0x45e499
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x45e4aa
pop esi
ret
push ebx
push edi
push esi
call fcn.0045e380
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403684
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45e4d2
push ebx
push esi
push edi
call fcn.004048a9
add esp, 0xc
push 0
call fcn.0040517d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x40492b
Capabilities:
Parse pe header

Disassembly:
jmp 0x41e601
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41e640
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41e640
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41e640
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41e640
cmp dword [ecx + 0x74], 0xe
jbe 0x41e640
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x45c286
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5deca0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x45c2d1
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0045c847
test al, al
jne 0x45c2cb
sub edx, 2
cmp edx, edi
jne 0x45c2b1
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x45c2f3
lea eax, [edi + 2]
cmp edx, eax
je 0x45c2f3
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0045be7f
add esp, 0x10
jmp 0x45c3ed
push esi
lea ecx, [ebp - 0x255]
call fcn.0045c847
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45c336
push dword [ebp - 0x25c]
jmp 0x45c2e3
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x45c373
cmp word [ebp - 0x226], 0
je 0x45c394
cmp word [ebp - 0x226], ax
jne 0x45c373
cmp word [ebp - 0x224], 0
je 0x45c394
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0045be7f
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x45c3e0
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x45c34d
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x45c3c8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x45c3ed
push 0x45b765
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040476e
add esp, 0x10
jmp 0x45c3bd
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004029e1
leave
ret
Function at 0x46e41b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x5e2c18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46e45b
cmp byte [ebx], 0xa
jne 0x46e45b
or byte [eax + edi + 0x28], 4
jmp 0x46e460
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x46e55e
mov al, byte [edx]
cmp al, 0x1a
je 0x46e540
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x46e48f
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x46e4b4
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x46e4be
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x46e471
jmp 0x46e55e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46e53b
cmp dword [ebp - 0xc], 0
je 0x46e53b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x5e2c18]
test byte [eax + edi + 0x28], 0x48
je 0x46e515
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x46e500
mov byte [esi], dl
jmp 0x46e511
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x5e2c18]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x46e55e
cmp byte [ebp - 1], 0xa
jne 0x46e524
cmp esi, ebx
jne 0x46e524
mov byte [esi], 0xa
jmp 0x46e55d
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401762
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x46e55e
mov byte [esi], 0xd
jmp 0x46e55d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x5e2c18]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x46e55a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x46e55e
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x46e5ba
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x5e2c18]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46e5fd
cmp word [esi], dx
jne 0x46e5fd
or byte [edi + eax + 0x28], 4
jmp 0x46e602
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x46e755
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x46e735
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x46e644
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x46e67a
cmp eax, edx
jae 0x46e686
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x46e61c
jmp 0x46e755
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46e731
cmp dword [ebp - 0x14], 0
je 0x46e731
mov eax, dword [ebx*4 + 0x5e2c18]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x46e709
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x46e6d2
mov word [esi], cx
jmp 0x46e705
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x5e2c18]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x5e2c18]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x5e2c18]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x46e755
pop ebx
cmp word [ebp - 4], bx
jne 0x46e71a
cmp esi, dword [ebp + 0xc]
jne 0x46e71a
mov word [esi], bx
jmp 0x46e752
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401762
add esp, 0x10
cmp word [ebp - 4], bx
je 0x46e755
push 0xd
jmp 0x46e74e
mov ecx, dword [ebx*4 + 0x5e2c18]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x46e74c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x46e755
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x402ec0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40d160
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
cmp byte [esi + 0xe4], 0xff
je 0x402f04
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov al, byte [ebp + 0xc]
xor ebx, ebx
cmp al, bl
mov dword [ebp - 0x14], 1
jne 0x402fc2
cmp dword [esi + 0x60], ebx
jne 0x402f39
mov ecx, esi
call fcn.00402c00
mov ecx, dword [esi + 0x68]
mov edx, dword [eax + 0x14]
cmp ecx, edx
je 0x402f40
push 0xffffffffffffff9a
mov ecx, esi
call fcn.00402780
jmp 0x402f40
mov dword [ebp - 0x14], 0xffffffff
mov ecx, esi
call fcn.00402c00
cmp word [eax + 0xe], 8
jne 0x402f57
lea edx, [esi + 0x28]
push edx
call fcn.00406f50
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x402fc2
lea eax, [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call sub.MFC42.DLL_CTime::GetTickCount
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
mov ecx, esi
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x11c], bl
call fcn.00402c00
mov ecx, eax
call fcn.00406ab0
mov edx, dword [eax]
lea eax, [ebp - 0x12c]
push eax
push edi
mov dword [ebp - 0x128], edx
call sub.MFC42.DLL_CFile::SetStatus
mov ecx, esi
call fcn.00402c00
mov ecx, dword [eax + 0x24]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x402fc2
mov dword [ebp - 0x14], 0xfffffffe
lea ecx, [esi + 0xe8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405560
lea ecx, [esi + 0x6c]
mov byte [esi + 0xe4], bl
call fcn.00404d60
mov ecx, esi
call fcn.00403d30
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403210
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x40d208
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_1
push 0x411278
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::TrimRight
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 8]
push ecx
push edx
call fcn.00403020
mov ecx, dword [esp + 0x24]
mov eax, dword [eax]
push ecx
push eax
mov byte [esp + 0x24], 1
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 0x10
or esi, 0xffffffff
test eax, eax
je 0x403292
mov edx, dword [esp + 0x1c]
push edx
call fcn.00403360
add esp, 4
cmp eax, esi
sete al
test al, al
jne 0x403292
xor bl, bl
jmp 0x403294
mov bl, 1
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call fcn.0040c754
test bl, bl
jne 0x403331
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00403020
mov eax, dword [eax]
mov byte [esp + 0x1c], 2
push eax
call fcn.00403210
add esp, 0xc
lea ecx, [esp + 8]
test al, al
sete bl
mov byte [esp + 0x14], 0
call fcn.0040c754
test bl, bl
je 0x403300
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call fcn.0040c754
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov edx, dword [esp + 0x1c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x403331
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call fcn.0040c754
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call fcn.0040c754
mov ecx, dword [esp + 0xc]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x403360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40d228
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov esi, dword [esp + 0x30]
push 0
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x4033e6
push esi
call fcn.00403430
add esp, 4
lea ecx, [esp + 4]
test al, al
mov dword [esp + 0x28], 0xffffffff
je 0x4033cf
call fcn.0040c8fe
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
call fcn.0040c8fe
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
lea ecx, [esp + 4]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov eax, dword [esp + 4]
push 0x10
lea ecx, [esp + 8]
call dword [eax + 0x40]
mov esi, eax
lea ecx, [esp + 4]
neg esi
sbb esi, esi
mov dword [esp + 0x28], 0xffffffff
and esi, 0xfffffffe
inc esi
call fcn.0040c8fe
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x403960
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
push ebx
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00403990
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
lea ecx, [esp + 8]
sete bl
call fcn.0040c754
mov al, bl
pop ebx
ret

Function at 0x403ac0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
mov ecx, dword [esi + 0x14]
push ecx
mov ecx, esi
call fcn.00403c10
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, ecx
mov ecx, dword [esi + 0x1c]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
mov dl, byte [esi + 0x1b]
mov byte [esp + 8], dl
mov eax, dword [esp + 8]
push eax
push ecx
mov ecx, esi
call fcn.00403c10
mov dword [esi + 0x1c], eax
pop esi
ret 4

Function at 0x4044d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40d4be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x34]
push esi
mov esi, ecx
test eax, eax
jne 0x404516
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0x18]
push edx
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ebx, 1
mov dword [esp + 8], ebx
mov eax, dword [eax]
mov dword [esp + 0x28], ebx
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
test bl, 1
mov dword [esp + 0x28], 3
je 0x40453d
and ebx, 0xfffffffe
lea ecx, [esp + 0x18]
mov dword [esp + 8], ebx
call fcn.0040c754
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00403020
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x38], 4
call fcn.004030f0
add esp, 0x10
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 5
call sub.MFC42.DLL_CString::CString
mov al, byte [esp + 0x34]
mov byte [esp + 0x28], 6
test al, al
je 0x40458e
push 0x411120
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CString::operator
jmp 0x4045a4
mov ecx, dword [esi + 0x4c]
lea edx, [esp + 0x38]
push ecx
push str._.3d
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
call sub.MFC42.DLL_operator_1
push 0x4112a8
push eax
lea eax, [esp + 0x3c]
mov byte [esp + 0x30], 7
push eax
call sub.MFC42.DLL_operator
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x38]
push ecx
push eax
push esi
mov byte [esp + 0x34], 8
call sub.MFC42.DLL_operator_1
or ebx, 2
mov dword [esp + 8], ebx
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 7
call fcn.0040c754
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 6
call fcn.0040c754
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 5
call fcn.0040c754
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.0040c754
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.0040c754
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.0040c754
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x404910
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x40d538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov ecx, dword [ecx + 0x1c]
lea edx, [esp + 4]
push ebx
push edx
mov eax, dword [ecx]
call dword [eax + 0x20]
mov eax, dword [eax]
mov dword [esp + 0x24], 0
push eax
lea eax, [esp + 8]
push eax
call fcn.00403990
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
lea ecx, [esp + 4]
sete bl
call fcn.0040c754
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0040c754
test bl, bl
pop ebx
je 0x4049a0
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x405010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40d5d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.004051b0
mov ecx, dword [esi + 0x2c]
mov dword [esi + 0x30], eax
push 0
push eax
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ecx]
call dword [edx + 0x30]
push 0
push 0x16
lea ecx, [esp + 0xc]
call fcn.00404d20
mov eax, dword [esi + 0x2c]
push 0x16
mov dword [esp + 0x1c], 0
mov ecx, dword [eax + 0x1c]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [ecx]
call dword [edx + 0x3c]
cmp eax, 0x16
je 0x405076
push 0xffffffffffffff9b
mov ecx, esi
call fcn.004052e0
mov eax, dword [esp + 8]
push edi
mov ecx, dword [eax]
mov dword [esi + 4], ecx
mov dx, word [eax + 4]
mov word [esi + 8], dx
mov cx, word [eax + 6]
mov word [esi + 0xa], cx
mov dx, word [eax + 8]
mov word [esi + 0xc], dx
mov cx, word [eax + 0xa]
mov word [esi + 0xe], cx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x10], edx
mov ecx, dword [eax + 0x10]
mov dword [esi + 0x14], ecx
mov di, word [eax + 0x14]
lea ecx, [esp + 8]
call fcn.00404d60
mov dx, word [esi + 8]
mov ecx, dword [esi + 0x2c]
push edx
call fcn.004049c0
mov ecx, dword [esi + 0x2c]
call fcn.00404070
test eax, eax
jne 0x4050ea
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x30]
add eax, edx
cmp ecx, eax
jae 0x4050ea
push 0xffffffffffffff9b
mov ecx, esi
call fcn.004052e0
test di, di
je 0x40511d
and edi, 0xffff
push 0
push edi
lea ecx, [esi + 0x18]
call fcn.00404d90
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x1c]
push edi
push eax
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ecx]
call dword [edx + 0x3c]
cmp eax, edi
je 0x40511d
push 0xffffffffffffff9b
mov ecx, esi
call fcn.004052e0
mov ecx, dword [esi + 0x2c]
call fcn.00404070
test eax, eax
pop edi
je 0x40512e
xor eax, eax
jmp 0x40513b
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
sub eax, edx
sub eax, ecx
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x40514b
cmp word [esi + 0xe], ax
jne 0x405156
cmp word [esi + 0xe], 0
jne 0x40515f
test eax, eax
je 0x40515f
push 0xffffffffffffff9b
mov ecx, esi
call fcn.004052e0
mov ecx, dword [esi + 0x2c]
xor eax, eax
mov ax, word [esi + 0xa]
mov byte [esi + 0x3c], 1
push eax
call fcn.00404090
mov eax, dword [esi + 0x10]
test eax, eax
je 0x405180
mov ecx, esi
call fcn.00405340
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.00404d50
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x406910
Capabilities:
Access peb ldr_data
Enumerate pe sections
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x40d7f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
push 0x2e
lea ecx, [esp + 0x1c]
call fcn.00404d20
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x30]
push 1
push 0x2e
push eax
mov ecx, edi
mov dword [esp + 0x34], 0
call fcn.00403ec0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
mov dx, word [eax + 4]
mov word [esi + 8], dx
mov cx, word [eax + 6]
mov word [esi + 0xa], cx
mov dx, word [eax + 8]
mov word [esi + 0xc], dx
mov cx, word [eax + 0xa]
mov word [esi + 0xe], cx
mov dx, word [eax + 0xc]
mov word [esi + 0x10], dx
mov cx, word [eax + 0xe]
mov word [esi + 0x12], cx
mov edx, dword [eax + 0x10]
mov dword [esi + 0x14], edx
mov ecx, dword [eax + 0x14]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [esi + 0x1c], edx
mov cx, word [eax + 0x20]
mov dx, word [eax + 0x22]
mov bx, word [eax + 0x1c]
mov bp, word [eax + 0x1e]
mov word [esp + 0x30], cx
mov word [esi + 0x20], dx
mov cx, word [eax + 0x24]
mov word [esi + 0x22], cx
mov edx, dword [eax + 0x26]
mov dword [esi + 0x24], edx
mov eax, dword [eax + 0x2a]
lea ecx, [esp + 0x14]
mov dword [esi + 0x28], eax
call fcn.00404d60
mov edx, dword [esi + 4]
mov ecx, 0x41130c
cmp edx, dword [ecx]
je 0x4069fc
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.00404d50
xor al, al
jmp 0x406a94
mov ecx, edi
call fcn.004042a0
and ebx, 0xffff
push 0
push ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x18], eax
call fcn.00404d90
mov ecx, dword [edi + 0x1c]
mov eax, dword [esi + 0x3c]
push ebx
push eax
mov edx, dword [ecx]
call dword [edx + 0x3c]
test bp, bp
je 0x406a4a
mov ebx, ebp
push 0
and ebx, 0xffff
lea ecx, [esi + 0x2c]
push ebx
call fcn.00404d90
mov ecx, dword [edi + 0x1c]
mov eax, dword [esi + 0x30]
push ebx
push eax
mov edx, dword [ecx]
call dword [edx + 0x3c]
mov ebx, dword [esp + 0x30]
test bx, bx
je 0x406a71
and ebx, 0xffff
push 0
push ebx
lea ecx, [esi + 0x44]
call fcn.00404d90
mov ecx, dword [edi + 0x1c]
mov esi, dword [esi + 0x48]
push ebx
push esi
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, edi
call fcn.004042a0
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
cmp eax, ecx
lea ecx, [esp + 0x14]
sete bl
call fcn.00404d50
mov al, bl
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x407580
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x40758f
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x411384]
test eax, eax
je 0x40759d
call fcn.00407520
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
cmp edx, 8
push ebx
not eax
jb 0x40769f
push edi
mov edi, edx
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x412850]
sub edx, 8
xor eax, ebx
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x412850]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x412850]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x412850]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x412850]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x412850]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x412850]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x412850]
xor eax, ecx
inc esi
dec edi
jne 0x4075b7
pop edi
test edx, edx
je 0x4076c1
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x412850]
xor eax, ecx
inc esi
dec edx
jne 0x4076a3
pop ebx
pop esi
not eax
ret 0xc