joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47af20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x47af3c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4aa988]
push eax
push esi
mov ecx, edi
call fcn.0047b480
cmp byte [edi], 0
je 0x47af6f
test eax, eax
jne 0x47af77
mov edx, dword [esp + 0x1c]
push eax
push edx
push edi
call fcn.0047b050
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x47b018
test esi, esi
je 0x47aff2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.00401420
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x47afd5
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x47afd5
push 1
push 0x8000012f
call fcn.00401420
add esp, 8
push esi
call edi
test eax, eax
jne 0x47afb0
mov edx, dword [0x4aa988]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47afee
push 1
push eax
call fcn.00401420
add esp, 8
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x47b032
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
je 0x47b018
mov ecx, dword [0x4aa988]
push ecx
push eax
mov ecx, edi
call fcn.0047b480
test eax, eax
jne 0x47af2f
cmp byte [edi], 0
je 0x47b032
mov edx, dword [esp + 0x1c]
push 0
push edx
push edi
call fcn.0047b050
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x1c]
push eax
mov ecx, edi
call fcn.0047b250
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x47b050
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e68
call fcn.00494780
mov eax, dword [esp + 0x8e74]
push ebx
push ebp
mov ebp, dword [esp + 0x8e74]
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x47b074
mov dword [eax], edi
cmp dword [ebp + 8], edi
je 0x47b214
mov cl, 1
mov eax, ebp
call fcn.0047b3f0
test eax, eax
je 0x47b23a
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4aa988]
push eax
push esi
mov ecx, ebp
call fcn.0047b480
test eax, eax
setne cl
mov byte [esp + 0x17], cl
test cl, cl
jne 0x47b0ba
xor eax, eax
mov dword [0x4af258], eax
jmp 0x47b0bf
mov eax, dword [0x4af258]
cmp byte [esp + 0x8e80], 0
mov dword [esp + 0xc44], edi
mov dword [esp + 0xc48], edi
mov dword [esp + 0xc4c], edi
mov dword [esp + 0xc58], edi
mov dword [esp + 0xc64], edi
mov dword [esp + 0xc68], edi
je 0x47b0ff
mov byte [esp + 0xc41], 0
test cl, cl
je 0x47b107
mov byte [esp + 0xc41], 1
mov edx, dword [0x4af254]
mov ecx, 0x49b8ad
mov dword [esp + 0x824], ecx
mov dword [esp + 0x82c], ecx
mov dword [esp + 0x830], ecx
mov ecx, dword [0x4aa988]
cmp eax, edi
mov dword [esp + 0x828], edi
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xc50], edx
mov dword [esp + 0xc54], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x83c], ebp
mov dword [esp + 0x18], 0x10
setg bl
cmp byte [esp + 0x17], 0
je 0x47b18a
xor ecx, ecx
test eax, eax
jle 0x47b17a
lea ecx, [ecx]
cmp dword [edx + ecx*4], esi
je 0x47b18a
inc ecx
cmp ecx, eax
jl 0x47b170
cmp eax, 0x1f4
jge 0x47b18a
mov dword [edx + eax*4], esi
inc eax
mov dword [0x4af258], eax
lea edx, [esp + 0x18]
push edx
push 0x479750
mov dword [esp + 0xc5c], eax
call edi
mov eax, dword [esp + 0xc48]
test eax, eax
jne 0x47b1bb
test bl, bl
je 0x47b226
mov edx, dword [0x4af254]
mov dword [0x4af258], eax
xor bl, bl
jmp 0x47b160
call fcn.00478fc0
mov ecx, dword [0x4af258]
mov edx, dword [esp + 0xc48]
mov esi, dword [0x4af254]
xor eax, eax
test ecx, ecx
jle 0x47b1ea
lea esp, [esp]
cmp dword [esi + eax*4], edx
je 0x47b1fc
inc eax
cmp eax, ecx
jl 0x47b1e0
cmp ecx, 0x1f4
jge 0x47b1fc
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4af258], ecx
mov eax, dword [0x4aa988]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
jle 0x47b214
push 1
push eax
call fcn.00401420
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 0xc
mov ecx, dword [esp + 0x8e84]
test ecx, ecx
je 0x47b23a
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47b23a
mov dword [ecx], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x8e68
ret 0xc
Function at 0x47b250
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e68
call fcn.00494780
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x47b3d0
xor cl, cl
mov eax, edi
call fcn.0047b3f0
test eax, eax
jne 0x47b285
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4aa988]
push eax
push ebp
mov ecx, edi
call fcn.0047b480
test eax, eax
je 0x47b2a8
xor eax, eax
mov dword [0x4af258], eax
jmp 0x47b2ad
mov eax, dword [0x4af258]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x824], 0x49b8ad
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc64], ebx
mov dword [esp + 0xc68], ebx
cmp byte [esp + 0x8e7c], bl
je 0x47b2f3
mov byte [esp + 0xc41], bl
cmp eax, ebx
je 0x47b2fb
mov byte [esp + 0xc41], 1
mov ecx, dword [0x4af254]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xc54], eax
lea eax, [esp + 0x18]
push eax
push 0x47b550
mov dword [esp + 0xc58], ecx
mov dword [esp + 0xc60], edx
call esi
mov eax, dword [esp + 0xc48]
cmp eax, ebx
je 0x47b3a8
lea ecx, [esp + 0x10]
push ecx
push 0x479f90
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x47b365
mov edx, dword [esp + 0xc48]
call fcn.0047ab70
mov dword [esp + 0xc48], esi
mov eax, dword [esp + 0xc48]
call fcn.00478fc0
mov edx, dword [esp + 0xc48]
call fcn.0047ab70
mov edx, dword [0x4aa988]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47b3d0
push 1
push eax
call fcn.00401420
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
mov eax, dword [0x4af258]
cmp eax, ebx
je 0x47b3d0
cmp eax, 1
setg al
mov dword [0x4af258], ebx
cmp al, bl
je 0x47b3d0
mov edx, ebp
call fcn.0047ab70
push ebx
mov ecx, edi
call fcn.0047b250
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8e68
ret 4
Function at 0x48ee74
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a9b30]
jne 0x48ee7e
repz ret
jmp fcn.00493927

Function at 0x491ab1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a9b30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048c052
and dword [ebp - 0x14], 0
cmp dword [0x4acb0c], 0
mov dword [ebp - 0x18], eax
jne 0x491b64
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x491c0c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x491c0c
mov esi, dword [fcn.00488080]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4acb0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4acb10], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4acb14], eax
call edi
push eax
call esi
mov dword [0x4acb1c], eax
test eax, eax
je 0x491b64
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4acb18], eax
mov eax, dword [0x4acb18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00488084]
cmp eax, ecx
je 0x491bbd
cmp dword [0x4acb1c], ecx
je 0x491bbd
push eax
call esi
push dword [0x4acb1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x491bbd
test ebx, ebx
je 0x491bbd
call edi
test eax, eax
je 0x491bb4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x491bb4
test byte [ebp - 8], 1
jne 0x491bbd
or dword [ebp + 0x10], 0x200000
jmp 0x491bf0
mov eax, dword [0x4acb10]
cmp eax, dword [ebp - 0x18]
je 0x491bf0
push eax
call esi
test eax, eax
je 0x491bf0
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x491bf0
mov eax, dword [0x4acb14]
cmp eax, dword [ebp - 0x18]
je 0x491bf0
push eax
call esi
test eax, eax
je 0x491bf0
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4acb0c]
call esi
test eax, eax
je 0x491c0c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x491c0e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ee74
leave
ret
Function at 0x4010b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010c9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401104
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401100
lea ebx, [ebx]
cmp esi, eax
jae 0x401104
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4010f0
cmp esi, eax
jb 0x40110a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4104e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx

Function at 0x41053c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.004101b4
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.004101ef
push edi
mov ecx, 0x458d94d2
rcl byte [ebp + ecx*4 + 0x5d88e845], cl
invalid
push eax

Function at 0x410554
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.004101b4
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.004101ef
push edi
mov ecx, 0x458d94d2
rcl byte [ebp + ecx*4 + 0x5d88e845], cl
invalid
push eax

Function at 0x41055d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rcl byte [ebp + ecx*4 + 0x5d88e845], cl
call 0xe99e8db0
mov byte [ebp - 0x17], bl

Function at 0x410930
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4108c6
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4108e4
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x410942
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x410929
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x410932
or byte [eax + ecx], 2
or byte [edx], al
cmp dword [ebp + 0x10], ebx
je 0x41093c
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x41091e
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4108a8
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x41098f
dec eax
je 0x410986
sub eax, 3
je 0x41097d
mov dword [ebp - 4], 0x40
jmp 0x4109ac
mov dword [ebp - 4], 4
jmp 0x410992
mov dword [ebp - 4], 0x20
jmp 0x410992
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4109de
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x41095e
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004101ef
int 0x2b
js 0x410a1b
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x4109ea
push 0x8000
push ebx
push esi
call dword [ebp - 8]
invalid
Function at 0x41239e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x4123b3
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.004101ef
push es
sti
outsd dx, dword [esi]
xchg edx, eax
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.004101ef
add esi, dword [esi + 0x13]
int3

Function at 0x4146cf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x798], 0xb3
mov byte [ebp - 0x797], 0x8c
mov byte [ebp - 0x796], 0x80
mov byte [ebp - 0x795], 0x81
mov byte [ebp - 0x794], 0x9d
mov byte [ebp - 0x793], 0x8a
mov byte [ebp - 0x792], 0x9c
mov byte [ebp - 0x791], 0xc1
mov byte [ebp - 0x790], 0x8b
mov byte [ebp - 0x78f], 0x83
mov byte [ebp - 0x78e], 0x83
mov byte [ebp - 0x78d], 0xef
call fcn.004101ef
invalid
inc dword [ecx - 0x5c]
mov eax, dword [0x429770]
cmp eax, 0xffffffff
je 0x4146ef
push eax
push dword [0x42c550]
call fcn.00414620
pop ecx
call eax
or dword [0x429770], 0xffffffff
mov eax, dword [0x429774]
cmp eax, 0xffffffff
je 0x414707
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
or dword [0x429774], 0xffffffff
jmp 0x411e44
Function at 0x41ad5a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00414617
and dword [ebp - 4], 0
cmp dword [0x42cbc4], 0
mov ebx, eax
jne 0x41ae0b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41aebc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41aebc
push eax
call fcn.004145a5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42cbc4], eax
call esi
push eax
call fcn.004145a5
mov dword [esp], 0x42363c
push edi
mov dword [0x42cbc8], eax
call esi
push eax
call fcn.004145a5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42cbcc], eax
call esi
push eax
call fcn.004145a5
pop ecx
mov dword [0x42cbd4], eax
test eax, eax
je 0x41ae0b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004145a5
pop ecx
mov dword [0x42cbd0], eax
mov eax, dword [0x42cbd0]
cmp eax, ebx
je 0x41ae63
cmp dword [0x42cbd4], ebx
je 0x41ae63
push eax
call fcn.00414620
push dword [0x42cbd4]
mov esi, eax
call fcn.00414620
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41ae63
test edi, edi
je 0x41ae63
call esi
test eax, eax
je 0x41ae5a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41ae5a
test byte [ebp - 0xc], 1
jne 0x41ae63
or dword [ebp + 0x10], 0x200000
jmp 0x41ae9c
mov eax, dword [0x42cbc8]
cmp eax, ebx
je 0x41ae9c
push eax
call fcn.00414620
pop ecx
test eax, eax
je 0x41ae9c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41ae9c
mov eax, dword [0x42cbcc]
cmp eax, ebx
je 0x41ae9c
push eax
call fcn.00414620
pop ecx
test eax, eax
je 0x41ae9c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42cbc4]
call fcn.00414620
pop ecx
test eax, eax
je 0x41aebc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41aebe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x41111b]
shl eax, 2
mov dword [0x41111f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00406990
pop edx
call fcn.00405d2c
call fcn.00406994
push 0
call fcn.00407640
pop ecx
push 0x4110c4
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x411123], eax
push 0
jmp fcn.0040e224

Function at 0x406684
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x407a8c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x407aab
mov eax, dword [0x41217c]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x407ab8
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x407ae5
je 0x407af7
sub ecx, 0x100
je 0x407b05
sub ecx, 0x100
je 0x407b0c
sub ecx, 0x100
je 0x407afe
jmp 0x407b13
sub ecx, 0x600
je 0x407b0c
sub ecx, 0x100
je 0x407af7
jmp 0x407b13
mov edi, 1
jmp 0x407b18
mov edi, 2
jmp 0x407b18
mov edi, 4
jmp 0x407b18
mov edi, 5
jmp 0x407b18
mov edi, 3
test byte [ebp + 0xd], 1
je 0x407b3f
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x411be8]
test al, 0x80
je 0x407b38
mov ebx, 0x80
jmp 0x407b51
mov ebx, 1
jmp 0x407b51
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x407b51
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x407b63
je 0x407b6c
dec eax
je 0x407b75
jmp 0x407b7e
mov dword [ebp - 4], 0x80000000
jmp 0x407b8d
mov dword [ebp - 4], 0x40000000
jmp 0x407b8d
mov dword [ebp - 4], 0xc0000000
jmp 0x407b8d
push 1
call fcn.00408e9c
pop ecx
mov ebx, eax
jmp 0x407c7d
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x407ba9
sub eax, 0x10
je 0x407bb0
sub eax, 0x10
je 0x407bb9
sub eax, 0x10
je 0x407bc2
jmp 0x407bc2
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x407bc9
mov dword [ebp - 8], 1
jmp 0x407bc9
mov dword [ebp - 8], 2
jmp 0x407bc9
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x407c36
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x407c2b
test byte [ebp + 0xd], 1
je 0x407c26
mov ebx, 0x50
jmp 0x407c2b
mov ebx, 2
push ebx
call fcn.00408e9c
pop ecx
mov ebx, eax
jmp 0x407c7d
mov edi, esi
push edi
call fcn.004079fc
pop ecx
test eax, eax
je 0x407c4a
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x407c56
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00408be0
add esp, 8
mov ebx, eax
inc eax
jne 0x407c7d
push 4
call fcn.00408e9c
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408998
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.00405c3c
pop ecx
mov ebx, eax
test eax, eax
jne 0x4089bc
xor eax, eax
jmp 0x408a65
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x4089dd
cmp esi, 0x104
jb 0x4089e8
push ebx
call fcn.00405c4c
pop ecx
xor eax, eax
jmp 0x408a65
cmp byte [ebx + 1], 0x3a
jne 0x408a18
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x408a18
push ebx
call fcn.00405c4c
pop ecx
xor eax, eax
jmp 0x408a65
inc esi
test edi, edi
je 0x408a5b
cmp esi, dword [ebp + 0x10]
jbe 0x408a2d
push ebx
call fcn.00405c4c
pop ecx
xor eax, eax
jmp 0x408a65
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.00405c4c
pop ecx
mov eax, edi
jmp 0x408a65
push esi
push ebx
call fcn.00405c5c
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x408aa0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x408ae5
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
je 0x408ad4
cmp eax, dword [ebp + 0x10]
jle 0x408b6e
mov dword [0x413054], 8
xor eax, eax
jmp 0x408bd9
cmp dword [0x4143c0], 1
jne 0x408b2a
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0x408b6e
xor eax, eax
jmp 0x408bd9
call sub.KERNEL32.DLL_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x408b6a
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
jmp 0x408b6e
xor eax, eax
jmp 0x408bd9
lea edx, [ebp - 0x10c]
push edx
call fcn.00406b08
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0x408b8e
mov dword [0x413054], 0x22
xor eax, eax
jmp 0x408bd9
test edi, edi
jne 0x408bb0
mov edx, dword [ebp + 0x10]
push edx
call fcn.00405c3c
pop ecx
mov edi, eax
test eax, eax
jne 0x408bb0
mov dword [0x413054], 8
xor eax, eax
jmp 0x408bd9
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ca04
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x40ca66
call fcn.0040c9b4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00406b08
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00406b08
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x40cac4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x41305c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40cb9e
cmp dword [0x413058], 0
jne 0x40cb9e
cmp dword [0x4132a0], 0
je 0x40cb58
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0040c8b4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40cb3e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0040c8b4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40cb3e
lea ebx, [ebp - 0x84]
jmp 0x40cb3f
inc ebx
call fcn.0040ca80
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x40cbd9
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x413060
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00406b08
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x413063
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x40cbd9
cmp dword [0x413058], 0
je 0x40cbb8
cmp dword [0x413058], 0xffffffff
je 0x40cbd9
push esi
call dword [0x413058]
pop ecx
mov eax, dword [0x41305c]
test eax, eax
je 0x40cbd9
cmp dword [0x41305c], 0xffffffff
je 0x40cbd9
cmp byte [eax], 0
je 0x40cbd9
push esi
push eax
call fcn.0040ca04
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret