joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cd32
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a4
push esi
push edi
push 0x2c
push 6
push dword [ebp + 8]
lea eax, [ebp - 0x94]
push eax
call fcn.00406477
add esp, 0x10
push 0x10
mov esi, eax
pop ecx
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
xor edi, edi
cmp esi, edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
jne 0x40cd77
push 3
pop eax
jmp 0x40cef6
cmp dword [ebp - 0x48], edi
mov dword [ebp - 0x14], edi
je 0x40cd9f
push 0x23
push edi
push dword [ebp - 0x48]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, edi
je 0x40cd9f
mov word [eax], di
add eax, 2
push eax
call fcn.00403470
pop ecx
mov dword [ebp - 0x14], eax
push ebx
push edi
lea eax, [ebp - 0x29c]
push eax
mov ebx, 0x104
push ebx
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x40ce72
lea eax, [ebp - 0x29c]
mov dword [ebp - 8], eax
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x40327c
push 1
push edi
push 0x40328c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, edi
jne 0x40ceed
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x4032ac
push eax
call dword [ecx]
mov esi, eax
cmp esi, edi
jne 0x40cee4
mov eax, dword [ebp - 0x54]
cmp word [eax], 0x21
jne 0x40ce25
add eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
push dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
push dword [ebp - 0x14]
mov eax, dword [ebp - 4]
push dword [ebp - 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
push dword [ebp - 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov esi, dword [ebp - 0x40]
cmp esi, edi
je 0x40ce86
cmp word [esi], di
je 0x40ce86
push esi
call fcn.0040366a
test eax, eax
pop ecx
je 0x40ce86
push esi
jmp 0x40ce97
push esi
call fcn.0040366a
test eax, eax
pop ecx
jne 0x40cdc8
push 3
pop eax
jmp 0x40cef5
push dword [ebp - 8]
call fcn.00403623
cmp eax, dword [ebp - 8]
pop ecx
je 0x40cea0
push dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
push 0x402ab4
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
push dword [ebp - 0xc]
lea eax, [ebp - 0x4a4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push dword [ebp - 0xc]
call fcn.00403692
mov eax, dword [ebp - 0x10]
pop ecx
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x4a4]
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40cefa
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x120
push esi
push edi
push 0x2c
push 2
push dword [ebp + 0x7c]
lea eax, [ebp - 0xac]
push eax
call fcn.00406477
add esp, 0x10
push 0x10
mov esi, eax
pop ecx
lea edi, [ebp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x34]
xor eax, eax
cmp ecx, eax
je 0x40cf35
cmp word [ecx], ax
jne 0x40cf49
mov edx, dword [ebp + 0x38]
cmp edx, eax
je 0x40cfdc
cmp word [edx], ax
je 0x40cfdc
cmp ecx, eax
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
je 0x40cf99
cmp word [ecx], ax
je 0x40cf99
push 0x9e
push eax
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call edi
push eax
lea eax, [ebp - 0x6c]
push 0x4019e0
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x34]
call ebx
xor eax, eax
mov ecx, dword [ebp + 0x38]
cmp ecx, eax
je 0x40cfd7
cmp word [ecx], ax
je 0x40cfd7
push 0x9e
push eax
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 1
call edi
push eax
lea eax, [ebp - 0x6c]
push 0x4019e0
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x38]
call ebx
xor eax, eax
pop ebx
jmp 0x40cfdf
xor eax, eax
inc eax
pop edi
pop esi
add ebp, 0x74
leave
ret

Function at 0x40d062
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 8]
cmp word [ebp], 0x5c
push edi
jne 0x40d0bc
add ebp, 2
push ebp
call fcn.00406343
xor edi, edi
cmp eax, edi
pop ecx
je 0x40d0a2
cmp word [eax], di
je 0x40d0a2
push eax
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x40d0b7
push edi
push edi
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x40d127
mov eax, dword [0x41c898]
cmp eax, edi
je 0x40d0b7
push edi
push edi
push 0x10
push dword [eax + 0x4d0]
jmp 0x40d095
xor eax, eax
inc eax
jmp 0x40d127
push ebx
mov dword [esp + 0x10], 1
xor edi, edi
push esi
push ebp
call fcn.00406abb
mov ebx, eax
cmp ebx, edi
pop ecx
je 0x40d121
push ebx
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x40d117
push 0x402204
call fcn.00409bd6
test eax, eax
pop ecx
push edi
push esi
je 0x40d102
call fcn.00404ec2
pop ecx
pop ecx
jmp 0x40d108
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40d110
mov dword [esp + 0x14], edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
jbe 0x40d121
cmp word [ebp], di
jne 0x40d0c8
mov eax, dword [esp + 0x14]
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x40d4cc
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
push edi
je 0x40d513
cmp byte [ebp + 8], 0
jne 0x40d513
push 0x402ad8
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040d1e6
test eax, eax
pop ecx
jne 0x40d513
push 0x2710
call fcn.00409c3e
pop ecx
lea eax, [ebp + 0xc]
push eax
mov ebx, 0x7d0
push ebx
push esi
push esi
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push 0x11
mov edi, 0xffff
push edi
call esi
lea eax, [ebp + 0xc]
push eax
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x16
push edi
call esi
push 0x1f4
call fcn.00409c3e
mov dword [esp], 0x402ae0
call fcn.00409bd6
test eax, eax
pop ecx
je 0x40d5a2
movzx eax, byte [ebp + 8]
sub eax, ebx
je 0x40d58c
dec eax
je 0x40d588
dec eax
je 0x40d57e
dec eax
je 0x40d573
dec eax
jne 0x40d594
push 1
push ebx
jmp 0x40d577
push 1
push 1
call sub.KERNEL32.dll_SetSystemPowerState
jmp 0x40d594
push ebx
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x40d594
push 1
jmp 0x40d58e
push 2
call fcn.00404e8e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
neg eax
jmp 0x40d5a5
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d92c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40d998
cmp word [esi], 0
je 0x40d998
push dword [ebp + 0xc]
push esi
push dword [0x41d42c]
call dword [sym.imp.SHELL32.dll_ExtractIconW]
test eax, eax
jne 0x40d99a
and dword [ebp - 0x2b4], eax
push 0x2b0
push eax
lea eax, [ebp - 0x2b0]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100
push 0x2b4
lea eax, [ebp - 0x2b4]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x40d998
mov eax, dword [ebp - 0x2b4]
jmp 0x40d99a
xor eax, eax
pop esi
leave
ret
Function at 0x40d9da
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 0xc], 0x111
mov dword [ebp - 0xc], esi
jne 0x40da22
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x41c89c]
imul eax, eax, 0x368
lea eax, [eax + ecx + 0x150]
cmp eax, esi
je 0x40db27
cmp word [eax], si
je 0x40db27
push eax
call fcn.00418ea0
pop ecx
jmp 0x40db27
cmp dword [0x41c750], esi
mov dword [ebp - 8], esi
jl 0x40db27
push ebx
push edi
xor edi, edi
mov eax, dword [0x41c89c]
mov ebx, dword [ebp + 8]
add eax, edi
cmp dword [eax + 0x360], ebx
jne 0x40db0d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [eax + 0x364]
call dword [sym.imp.USER32.dll_CallWindowProcW]
cmp dword [ebp + 0xc], 0xf
mov dword [ebp - 0xc], eax
jne 0x40dae2
mov eax, dword [0x41c89c]
add eax, edi
cmp dword [eax + 0x358], esi
je 0x40db0d
mov esi, dword [eax + 0xc]
push ebx
sub esi, 6
call fcn.0040d99d
test eax, eax
pop ecx
je 0x40da9f
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov byte [ebp - 1], 1
jl 0x40daa3
mov byte [ebp - 1], 0
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [0x41c89c]
push 3
push 0
push 0
push esi
mov ebx, eax
movzx eax, byte [ebp - 1]
push esi
push dword [edi + ecx + 0x358]
lea ecx, [eax + 3]
push ecx
add eax, 6
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawIconEx]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
xor esi, esi
jmp 0x40db0d
cmp dword [ebp + 0xc], 0x100
jne 0x40db0d
cmp dword [ebp + 0x10], 0xd
jne 0x40db0d
mov eax, dword [0x41c89c]
lea eax, [edi + eax + 0x150]
cmp eax, esi
je 0x40db0d
cmp word [eax], si
je 0x40db0d
push eax
call fcn.00418ea0
pop ecx
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add edi, 0x368
cmp eax, dword [0x41c750]
jle 0x40da35
pop edi
pop ebx
mov eax, dword [ebp - 0xc]
pop esi
leave
ret 0x10

Function at 0x40db2f
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x41c8ac]
push esi
mov esi, dword [esp + 0xc]
imul esi, esi, 0x364
push edi
push 0x50
lea eax, [esi + eax + 0xb0]
push eax
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor edi, edi
push edi
push edi
push 0xf0
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x41c8ac]
push edi
push edi
push dword [esp + 0x18]
mov dword [esi + ecx + 0x35c], eax
push 4
call fcn.00407b34
mov eax, dword [0x41c8ac]
lea eax, [esi + eax + 0x150]
add esp, 0x10
cmp eax, edi
je 0x40dba0
cmp word [eax], di
je 0x40dba0
push eax
call fcn.00418ea0
pop ecx
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x40f30f
Capabilities:
Find taskbar

Disassembly:
push esi
push edi
xor edi, edi
push edi
push 0x402bcc
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x40f351
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
push 0x402bb0
push edi
push eax
call esi
cmp eax, edi
je 0x40f351
push edi
push 0x402b9c
push edi
push eax
call esi
cmp eax, edi
je 0x40f351
push edi
push 0x402b7c
push edi
push eax
call esi
jmp 0x40f353
xor eax, eax
pop edi
pop esi
ret
Function at 0x40fcad
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb04
push ebx
push esi
push edi
push 0x2c
push 3
push dword [ebp + 8]
lea eax, [ebp - 0x94]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00406477
push 0x10
pop ecx
mov esi, eax
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x4c]
call fcn.00403470
mov esi, 0x206
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x4a2]
push ebx
push eax
mov word [ebp - 0x4a4], bx
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x29a]
push ebx
push eax
mov word [ebp - 0x29c], bx
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0x2c
push dword [ebp - 0x54]
lea eax, [ebp - 0x4a4]
push eax
call esi
mov edi, dword [ebp - 0x50]
push edi
lea eax, [ebp - 0x29c]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
push 0x2a
push ebx
push edi
call esi
test eax, eax
jne 0x40fda9
push 0x3f
push ebx
push edi
call esi
test eax, eax
jne 0x40fda9
lea eax, [ebp - 0x29c]
push eax
call fcn.00403642
test eax, eax
pop ecx
je 0x40fd7e
cmp dword [ebp - 8], ebx
push ebx
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4a4]
push eax
jne 0x40fd96
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
jmp 0x40fd9e
cmp dword [ebp - 8], ebx
je 0x40fe93
push ebx
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.0040fc6c
add esp, 0xc
movzx eax, al
mov dword [ebp - 4], eax
jmp 0x40fe93
lea eax, [ebp - 0x29c]
push eax
call fcn.00406409
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00406409
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x6f4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x40fe93
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, 0x401e64
lea eax, [ebp - 0x6c8]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0xb04]
push edi
push eax
call esi
lea eax, [ebp - 0x6c8]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x8fc]
push edi
push eax
call esi
add esp, 0x20
test byte [ebp - 0x6f4], 0x10
je 0x40fe52
cmp dword [ebp - 8], ebx
je 0x40fe72
lea eax, [ebp - 0x6c8]
push eax
call fcn.00405358
test eax, eax
pop ecx
jne 0x40fe72
push 1
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x8fc]
push eax
call fcn.0040fc6c
add esp, 0xc
jmp 0x40fe6c
cmp dword [ebp - 8], ebx
push ebx
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x8fc]
push eax
jne 0x40fe48
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
movzx eax, al
add dword [ebp - 4], eax
lea eax, [ebp - 0x6f4]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40fdee
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
cmp dword [ebp - 4], ebx
pop edi
pop esi
sete al
pop ebx
leave
ret
Function at 0x40fea0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
push ebx
push esi
push edi
push 0x2c
push 3
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push eax
call fcn.00406477
add esp, 0x10
push 0x10
mov esi, eax
pop ecx
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x48]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
je 0x40fef0
cmp word [eax], bx
je 0x40fef0
push eax
call fcn.00403470
neg eax
sbb eax, eax
neg eax
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x44]
cmp eax, ebx
je 0x40ff0c
cmp word [eax], bx
je 0x40ff0c
push eax
call fcn.00403470
neg eax
sbb eax, eax
neg eax
pop ecx
mov dword [ebp - 0xc], eax
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0x402d78
push 0x402d00
mov edi, SysReAllocString
push edi
call esi
mov word [ebp - 0x49c], bx
mov ebx, 0x206
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x49a]
push 0
push eax
call sub.MSVCRT.dll_memset
push 0x402cdc
push 0x402088
lea eax, [ebp - 0x49c]
push 0x402118
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0x402cb0
lea eax, [ebp - 0x49c]
push eax
push edi
call esi
or dword [ebp - 4], eax
and word [ebp - 0x294], 0
push ebx
lea eax, [ebp - 0x292]
push 0
push eax
call sub.MSVCRT.dll_memset
mov ebx, dword [ebp - 0x4c]
add esp, 0xc
test ebx, ebx
je 0x40ffcd
cmp word [ebx], 0
je 0x40ffcd
push ebx
call fcn.00403642
pop ecx
test eax, eax
push ebx
lea eax, [ebp - 0x294]
je 0x40ffd8
push 0x402c9c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40ffdf
push 0x402c84
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [ebp - 0x294]
push eax
push 1
push 0x402c6c
push 0x402c18
push edi
call esi
or dword [ebp - 4], eax
push 0x1388
push 0x401f64
call fcn.0040722d
pop ecx
pop ecx
xor eax, eax
cmp dword [ebp - 4], eax
pop edi
pop esi
setne al
pop ebx
leave
ret
Function at 0x4110c6
Capabilities:
Enumerate files on windows
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1260
call fcn.004196e0
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x2c
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], 1
mov dword [eax], ebx
call esi
cmp eax, ebx
je 0x41122f
mov word [eax], bx
push edi
inc eax
inc eax
push 0x2c
push eax
mov dword [ebp - 0x10], eax
call esi
mov edi, eax
cmp edi, ebx
je 0x41122e
mov word [edi], bx
inc edi
push 0x2c
inc edi
push edi
call esi
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x41122e
mov word [ebx], 1
inc ebx
push edi
inc ebx
call fcn.00403470
mov edi, eax
mov dword [esp], 0xffe
lea eax, [ebp - 0x125e]
push esi
push eax
mov word [ebp - 0x1260], si
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push dword [ebp + 8]
mov dword [ebp - 8], eax
call fcn.00403623
cmp dword [ebp - 8], 0xffffffff
pop ecx
je 0x41122e
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], 1
xor eax, eax
test byte [ebp - 0x260], 0x10
je 0x4111aa
cmp dword [ebp + 0x14], eax
je 0x4111b1
lea eax, [ebp - 0x234]
push eax
call fcn.00405358
neg eax
sbb eax, eax
pop ecx
inc eax
jmp 0x4111b1
cmp dword [ebp + 0x14], 0
sete al
test eax, eax
je 0x411202
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1260]
push 0x401e64
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x1260]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push ebx
call fcn.00418ea0
or dword [ebp - 4], eax
inc dword [ebp - 0xc]
inc dword [esi]
test edi, edi
mov eax, dword [esi]
pop ecx
jle 0x411202
cmp dword [ebp - 0xc], edi
jg 0x41121c
cmp eax, edi
jge 0x41121c
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x411186
jmp 0x411225
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x411236
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1420
call fcn.004196e0
push ebx
push esi
xor ebx, ebx
push edi
xor ecx, ecx
xor edi, edi
xor esi, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
inc ecx
mov eax, dword [ebp + 8]
movzx eax, word [eax]
cmp ax, 0x21
jne 0x411265
mov edi, ecx
jmp 0x411278
cmp ax, 0x5c
jne 0x41126f
mov esi, ecx
jmp 0x411278
cmp ax, 0x40
jne 0x41127e
mov dword [ebp - 0xc], ecx
add dword [ebp + 8], 2
jmp 0x411255
push 0xffe
lea eax, [ebp - 0x141e]
push ebx
push eax
mov word [ebp - 0x1420], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp esi, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
je 0x411405
mov esi, 0x206
push esi
lea eax, [ebp - 0x216]
push ebx
push eax
mov word [ebp - 0x218], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp edi, ebx
je 0x4113ac
push esi
lea eax, [ebp - 0x41e]
push ebx
push eax
mov word [ebp - 0x420], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp word [ebp - 0x218], bx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [ebp - 0x420]
lea esi, [ebp - 0x218]
je 0x41132d
movzx eax, word [ebp - 0x218]
mov word [edi], ax
inc edi
push esi
inc edi
call ebx
lea esi, [esi + eax*2 + 2]
movzx eax, word [esi]
test ax, ax
jne 0x411319
lea eax, [ebp - 0x420]
push eax
call ebx
mov ebx, eax
test ebx, ebx
jle 0x411432
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edi, [ebp + ebx*2 - 0x422]
mov ax, word [edi]
and word [ebp - 0x141e], 0
mov word [ebp - 0x1420], ax
push 0x402da4
lea eax, [ebp - 0x1420]
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x1420]
push eax
call esi
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1420]
push eax
call fcn.004110c6
or dword [ebp - 4], eax
add esp, 0x10
cmp dword [ebp - 8], 0
jne 0x411432
dec ebx
dec edi
dec edi
test ebx, ebx
jg 0x41134d
jmp 0x411432
cmp word [ebp - 0x218], bx
lea esi, [ebp - 0x218]
je 0x411432
push dword [ebp + 8]
lea eax, [ebp - 0x1420]
push esi
push 0x402118
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1420]
push eax
call fcn.004110c6
or dword [ebp - 4], eax
add esp, 0x20
cmp dword [ebp - 8], ebx
jne 0x411432
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x4113bb
jmp 0x411432
push dword [ebp + 8]
lea eax, [ebp - 0x1420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1420]
push eax
call fcn.004110c6
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41143a
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push esi
push edi
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
xor edi, edi
inc edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push dword [ebp + 8]
mov esi, eax
call fcn.00403623
cmp esi, 0xffffffff
pop ecx
je 0x4114c9
test byte [ebp - 0x250], 0x10
jne 0x41149f
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x458]
push 0x401e64
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceW]
add edi, eax
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x411468
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
leave
ret

Function at 0x4114d4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call sub.MSVCRT.dll_memset
mov edi, dword [ebp + 8]
add esp, 0xc
cmp word [edi], 0x5c
mov dword [ebp - 4], 2
jne 0x4115c9
push 0x2c
push edi
mov dword [ebp + 8], ebx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x41153e
mov word [esi], bx
inc esi
inc esi
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [esi]
cmp ax, bx
je 0x41153e
movzx eax, ax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x414]
push eax
inc edi
push 0x104
inc edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x414], bx
lea esi, [ebp - 0x414]
je 0x411610
mov ax, word [ebp + 8]
cmp word [esi], ax
jb 0x4115b7
push edi
push esi
lea eax, [ebp - 0x20c]
push 0x402db8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0040366a
add esp, 0x14
test eax, eax
je 0x4115b7
push 0x402dac
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0041143a
pop ecx
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x411565
jmp 0x411610
push edi
call fcn.0040366a
test eax, eax
pop ecx
je 0x4115e0
push 0x402dac
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call fcn.00403623
push edi
call fcn.0040366a
test eax, eax
pop ecx
pop ecx
je 0x411610
lea eax, [ebp - 0x20c]
push eax
call fcn.0041143a
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret