joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010a0
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x424648
push 0x67
push edi
call esi
push 0x64
push 0x424580
push 0x6d
push edi
call esi
mov eax, edi
call fcn.00401290
mov eax, dword [ebp + 0x10]
mov edx, 0x425150
sub edx, eax
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4010f0
call fcn.00403830
mov dword [0x423070], eax
mov ecx, 0x41dc68
mov eax, 0x425150
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401139
test dx, dx
je 0x401135
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401139
add eax, 4
add ecx, 4
test dx, dx
jne 0x401113
xor eax, eax
jmp 0x40113e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401158
call fcn.00401c70
test eax, eax
je 0x401158
call fcn.00403bf0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call fcn.00401320
add esp, 4
test eax, eax
jne 0x40117b
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.0040a982
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.0040f8c0
mov eax, dword [0x424d98]
add esp, 0xc
test eax, eax
jbe 0x4011cd
cmp word [0x424d9c], 0
jbe 0x4011cd
push eax
mov esi, 0x42360c
call fcn.004037b0
mov dx, word [0x424d9c]
add esp, 4
mov word [0x42361c], dx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov eax, edx
xor edx, edx
shr eax, 6
mov ecx, 0x3e8
div ecx
push edx
push 0x41dc70
mov edx, 0x425360
call fcn.00402fe0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
call fcn.00402d00
lea esi, [esp + 8]
call fcn.00403000
push 0x41dc88
mov edx, esi
push 0x104
push edx
call fcn.0040a9bd
add esp, 0xc
push 0x425360
mov eax, esi
push 0x104
push eax
call fcn.0040a9bd
add esp, 0xc
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40126d
push 0x1f4
call edi
push 1
push 0
push 0x41de30
mov edx, esi
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1388
call edi
call fcn.00402a60
call fcn.00403bf0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401ba0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push 0x41dd14
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0
call fcn.0040ac04
add esp, 0xc
test eax, eax
je 0x401bc4
xor eax, eax
pop ecx
ret
mov edx, dword [esp]
push ebx
push ebp
push esi
push edi
push 2
push 0
push edx
call fcn.0040ace1
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040af03
mov ecx, dword [esp + 0x20]
push 0
push 0
push ecx
mov esi, eax
call fcn.0040ace1
mov edx, dword [esp + 0x38]
lea ebp, [esi + edx]
push ebp
call fcn.0040afc0
mov edi, eax
mov eax, dword [esp + 0x30]
push eax
push 1
push esi
push edi
call fcn.0040b32a
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0040b3be
mov eax, dword [esp + 0x50]
lea ebx, [edi + esi]
call fcn.00403b60
mov edx, dword [esp + 0x4c]
push 0x41dd1c
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.0040ac04
add esp, 0x40
test eax, eax
je 0x401c45
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x10]
push ecx
push 1
push ebp
push edi
call fcn.0040b59c
mov edx, dword [esp + 0x20]
push edx
call fcn.0040b3be
add esp, 0x14
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4027c0
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
push ebx
mov edi, eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4027f1
mov eax, ebx
call fcn.00403930
cmp eax, edi
jne 0x4027f1
lea eax, [esi + 1]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 0x200000
call fcn.0040afc0
mov ebp, eax
mov eax, dword [esp + 0x28]
add esp, 4
push ebp
push eax
lea edx, [esp + 0x1c]
mov ecx, edi
mov dword [esp + 0x1c], 0x200000
call fcn.00405d50
add esp, 8
test eax, eax
je 0x4028bc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040aa3a
add esp, 4
call fcn.0040aa4c
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x420010]
fmul qword [0x420030]
fadd qword [0x420028]
call fcn.004178c0
mov esi, dword [esp + 0x14]
lea ebx, [esi + ebp]
mov edi, eax
call fcn.00403b60
add edi, esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
call fcn.0040a910
mov esi, eax
cmp esi, 0xffffffff
je 0x4028ba
push ebx
lea ecx, [esp + 0x1c]
push ecx
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [esp + 0x18]
cmp eax, edi
jne 0x402899
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
jne 0x4028ba
push ebp
mov esi, ebx
call fcn.0040b61e
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor esi, esi
push ebp
call fcn.0040b61e
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x402e00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x434
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x42c], eax
mov eax, dword [esp + 0x43c]
push ebx
push ebp
mov ebp, dword [esp + 0x440]
push esi
push edi
push eax
mov ecx, ebp
call fcn.0040a030
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x402fbf
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x32]
push edx
mov word [esp + 0x34], cx
call fcn.0040f8c0
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x23a]
push ecx
mov word [esp + 0x23c], ax
call fcn.0040f8c0
add esp, 0xc
lea esi, [esp + 0x28]
call fcn.00403000
push 0x41dc88
mov edx, esi
push 0x104
push edx
call fcn.0040a9bd
xor eax, eax
lea ebx, [esp + 0x20]
add esp, 0xc
mov byte [esp + 0x14], 0
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
mov esi, 0x424720
sub ebx, 0x424824
cmp word [esi], 0
je 0x402f37
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x234]
push 0x104
push ecx
call fcn.0040aa6e
add esp, 0xc
push esi
lea edx, [esp + 0x234]
push 0x104
push edx
call fcn.0040a9bd
lea eax, [esp + 0x23c]
add esp, 0xc
push eax
lea edi, [esp + 0x18]
call fcn.004053e0
add esp, 4
test eax, eax
je 0x402f37
mov ecx, 0x14
lea eax, [esi + 0x104]
lea ecx, [ecx]
mov edx, dword [ebx + eax]
cmp edx, dword [eax]
jne 0x402f37
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x402f20
xor eax, eax
mov word [esi], ax
add esi, 0x118
sub ebx, 0x118
cmp esi, 0x424c98
jl 0x402ec4
mov edi, dword [esp + 0x44c]
mov esi, 0x424720
jmp 0x402f60
cmp word [esi], 0
je 0x402f7e
mov ecx, dword [esi + 0x100]
mov dword [0x424714], ecx
push edi
push ebp
mov ecx, esi
call fcn.0040a240
add esp, 8
add esi, 0x118
cmp esi, 0x424c98
jl 0x402f60
push 0x425360
lea edx, [esp + 0x2c]
push 0x104
push edx
call fcn.0040a9bd
add esp, 0xc
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402fbb
mov dword [esp + 0x10], 2
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a982
add esp, 0x434
ret
Function at 0x4030a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebx, 1
push esi
mov esi, eax
or eax, 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x70], eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebx
call fcn.0040aa4c
sub esi, dword [esp + 0x80]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
mov dword [esp + 0x10], esi
fmul qword [0x420010]
fild dword [esp + 0x10]
fmulp st(1)
fiadd dword [esp + 0x80]
call fcn.004178c0
mov ebp, eax
xor esi, esi
xor edi, edi
test ebp, ebp
jle 0x4031e0
jmp 0x403170
call fcn.0040aa4c
mov dword [esp + 0x80], eax
fild dword [esp + 0x80]
fmul qword [0x420010]
fmul qword [0x420020]
fadd qword [0x420018]
call fcn.004178c0
mov ecx, eax
mov eax, dword [esp + ecx*4 + 0x14]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jle 0x4031c8
jmp 0x4031b0
add ecx, ebx
cmp ecx, 0x1a
jne 0x4031b9
xor ecx, ecx
mov eax, dword [esp + ecx*4 + 0x14]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jg 0x4031b0
add esi, dword [esp + ecx*4 + 0x14]
mov eax, dword [esp + 0x84]
add ecx, 0x61
mov word [eax + edi*2], cx
add edi, ebx
cmp edi, ebp
jl 0x403170
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret

Function at 0x4031f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x41ddf8
mov edi, eax
push 0x83
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x403263
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
mov eax, dword [esp + 0x14]
push esi
mov dword [eax], esi
call fcn.0040b8c1
push esi
mov edi, eax
push 0
push edi
call fcn.0040f8c0
push esi
push ebp
push edi
call fcn.00410450
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4033f0
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
push ebx
push ebp
push esi
mov esi, edx
mov dword [esp + 0x18], eax
xor eax, eax
xor edx, edx
push 0x288
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], 0xffffffff
mov word [esp + 0x28], dx
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov word [esp + 0x46], ax
xor ebx, ebx
call fcn.0040afc0
mov ebp, eax
add esp, 4
lea eax, [esp + 0x10]
push eax
push ebp
mov dword [esp + 0x18], 0x288
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x403483
push ebp
call fcn.0040b61e
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040afc0
add esp, 8
mov ebp, eax
lea edx, [esp + 0x10]
push edx
push ebp
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x403567
mov eax, ebp
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x403567
push edi
jmp 0x4034b4
mov eax, dword [esp + 0x18]
inc dword [esp + 0x10]
test esi, esi
je 0x4034cf
mov ecx, dword [eax + 0x194]
mov dword [esi], ecx
mov dx, word [eax + 0x198]
mov word [esi + 4], dx
lea edi, [eax + 0x1ac]
test edi, edi
je 0x403554
lea esp, [esp]
lea edx, [edi + 4]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4034e8
sub eax, esi
mov ecx, eax
cmp ecx, 0x10
jle 0x4034fd
mov ecx, 0x10
xor eax, eax
test ecx, ecx
jl 0x40351d
cmp eax, ecx
jne 0x40350e
xor esi, esi
mov word [esp + eax*2 + 0x28], si
movsx si, byte [edx + eax]
mov word [esp + eax*2 + 0x28], si
inc eax
cmp eax, ecx
jle 0x403505
lea eax, [esp + 0x28]
push eax
call fcn.00403630
add esp, 4
test eax, eax
je 0x403545
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + ebx*4]
lea ecx, [esp + 0x28]
push ecx
push 0x10
push eax
call fcn.0040aa6e
add esp, 0xc
mov edi, dword [edi]
inc ebx
test edi, edi
jne 0x4034e0
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
test ebx, ebx
jg 0x403566
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4034b0
pop edi
mov ecx, dword [esp + 0x1c]
mov dword [ecx], ebx
test ebp, ebp
je 0x40357a
push ebp
call fcn.0040b61e
add esp, 4
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a982
add esp, 0x3c
ret
Function at 0x403830
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x118
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0040f8c0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x403909
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x4038d5
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4038ae
cmp word [esp + 0x118], 4
jb 0x403909
mov esi, 1
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040a982
add esp, 0x120
ret
cmp eax, 2
jae 0x4038b8
cmp eax, 1
jne 0x403909
mov esi, 3
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040a982
add esp, 0x120
ret
cmp eax, 6
jne 0x403909
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4038ff
mov esi, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040a982
add esp, 0x120
ret
cmp eax, 1
jne 0x403909
mov esi, 5
mov ecx, dword [esp + 0x120]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040a982
add esp, 0x120
ret

Function at 0x403930
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push closesocket
or edi, 0xffffffff
push eax
or ebx, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, edi
jne 0x403962
or eax, edi
or edx, edi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
jne 0x40397b
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
add esp, 0x10
ret

Function at 0x403ac0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.0040f8c0
add esp, 0xc
cmp dword [0x423070], 3
jne 0x403b20
push 0x104
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41dc88
lea eax, [esp + 4]
push 0x104
push eax
call fcn.0040a9bd
add esp, 0xc
jmp 0x403b2f
lea ecx, [esp]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea edx, [esp + 4]
push edx
push 0x41dca8
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esp + 0x218]
add esp, 0x10
xor ecx, esp
call fcn.0040a982
add esp, 0x20c
ret
Function at 0x403bf0
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x314
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x310], eax
lea eax, [esp + 4]
push eax
push 0x104
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x41de60
lea ecx, [esp + 8]
push 0x104
push ecx
call fcn.0040bf5b
add esp, 0xc
push 0x104
lea edx, [esp + 0x10c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0x210]
push 0x104
push ecx
call fcn.0040bcd6
lea edx, [esp + 0x218]
push 0x5c
push edx
call fcn.0040bf10
add esp, 0x14
test eax, eax
je 0x403c7b
mov byte [eax], 0
push ebx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403d77
mov eax, 0x423620
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403cb0
sub eax, edx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403cc7
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x10]
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403ce0
sub eax, esi
lea edx, [eax + ecx*2]
add edx, ecx
lea edi, [edx + edi + 0x32]
push edi
call fcn.0040b8c1
push edi
mov esi, eax
push 0
push esi
call fcn.0040f8c0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x22c]
push ecx
lea edx, [esp + 0x12c]
push edx
mov eax, edx
push eax
push 0x423620
push edi
push esi
call fcn.0040bf3d
mov eax, esi
add esp, 0x2c
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403d30
push 0
sub eax, ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
push 0x41de6c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test esi, esi
je 0x403d75
push esi
call fcn.0040b6ac
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x314]
pop ebx
xor ecx, esp
call fcn.0040a982
add esp, 0x314
ret

Function at 0x403d90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
xor ecx, ecx
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp], eax
cmp esi, 0xffffffff
je 0x403de1
mov eax, dword [esp + 0x1c]
mov ecx, 0x200
mul ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], edx
lea edx, [esp + 4]
push edx
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
push 0x400
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0x18
ret
Function at 0x403fc0
Capabilities:
Get disk information via ioctl

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ebp, ebp
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], ebp
je 0x4040de
push 0xc00
call fcn.0040b8c1
mov ecx, dword [esp + 0x28]
add esp, 4
push ebx
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0xc00
push esi
push ebx
push ebx
push 0x70050
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4040d1
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x38]
test eax, eax
jl 0x404039
jg 0x40402d
test ecx, ecx
jbe 0x404039
mov ebx, dword [esi + 0x40]
mov ebp, dword [esi + 0x44]
mov edx, ecx
mov edi, eax
jmp 0x40403d
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0xcc]
cmp eax, edi
mov ecx, dword [esi + 0xc8]
jl 0x404067
jg 0x404053
cmp ecx, edx
jbe 0x404067
mov ebx, dword [esi + 0xd0]
mov ebp, dword [esi + 0xd4]
mov dword [esp + 0x18], ecx
mov edi, eax
mov edx, ecx
mov eax, dword [esi + 0x15c]
cmp eax, edi
mov ecx, dword [esi + 0x158]
jl 0x404091
jg 0x40407d
cmp ecx, edx
jbe 0x404091
mov ebx, dword [esi + 0x160]
mov ebp, dword [esi + 0x164]
mov dword [esp + 0x18], ecx
mov edi, eax
mov edx, ecx
mov eax, dword [esi + 0x1ec]
cmp eax, edi
mov ecx, dword [esi + 0x1e8]
jl 0x4040bb
jg 0x4040a7
cmp ecx, edx
jbe 0x4040bb
mov ebx, dword [esi + 0x1f0]
mov ebp, dword [esi + 0x1f4]
mov dword [esp + 0x18], ecx
mov edi, eax
mov edx, ecx
push 0
add ebx, edx
push 0x200
adc ebp, edi
push ebp
push ebx
call fcn.00417790
mov dword [esp + 0x10], eax
test esi, esi
je 0x4040de
push esi
call fcn.0040b6ac
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x4041f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.0040f8c0
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx eax, word [esp + 8]
sub eax, 0x41
push eax
lea ebx, [esp + 8]
call fcn.00403eb0
mov ebx, dword [esp + 8]
add esp, 4
call fcn.00403df0
cmp eax, 0xffffffff
jne 0x404272
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040a982
add esp, 0x218
ret
push esi
call fcn.00404120
mov ecx, dword [esp + 0x218]
add esp, 4
pop ebx
xor ecx, esp
call fcn.0040a982
add esp, 0x218
ret
Function at 0x4053e0
Capabilities:
Hash data using sha1
Read file on windows

Disassembly:
mov eax, 0x1068
call fcn.00415980
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x1064], eax
mov eax, dword [esp + 0x106c]
push ebx
push ebp
push 0x41dd14
push eax
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x14], ebx
xor ebp, ebp
call fcn.0040ac04
mov eax, dword [esp + 0x14]
add esp, 0xc
cmp eax, ebx
jne 0x40544b
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
pop ebp
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
pop ebx
mov ecx, dword [esp + 0x1064]
xor ecx, esp
call fcn.0040a982
add esp, 0x1068
ret
push esi
push 2
push ebx
push eax
call fcn.0040ace1
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0040af03
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
mov dword [esp + 0x2c], eax
call fcn.0040ace1
mov eax, dword [esp + 0x28]
push eax
push 0x1000
lea ecx, [esp + 0x94]
push 1
push ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], 0x67452301
mov dword [esp + 0x4c], 0xefcdab89
mov dword [esp + 0x50], 0x98badcfe
mov dword [esp + 0x54], 0x10325476
mov dword [esp + 0x58], 0xc3d2e1f0
call fcn.0040b32a
mov esi, eax
add esp, 0x2c
cmp esi, ebx
jbe 0x4054f6
lea edx, [esp + 0x70]
push esi
push edx
lea ebx, [esp + 0x1c]
call fcn.00405250
mov eax, dword [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x80]
push 1
push ecx
add ebp, esi
call fcn.0040b32a
mov esi, eax
add esp, 0x18
test esi, esi
ja 0x4054c1
xor ebx, ebx
push edi
lea esi, [esp + 0x18]
call fcn.004052f0
mov edx, dword [esp + 0x10]
push edx
call fcn.0040b3be
add esp, 8
pop esi
cmp ebp, dword [esp + 0xc]
jb 0x405424
mov ecx, dword [esp + 0x106c]
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040a982
add esp, 0x1068
ret