joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4171e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb10
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x308]
mov byte [ebp - 0x308], 0
push eax
mov ebx, ecx
push 0x1ff
mov dword [ebp - 0xb10], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x417326
push esi
mov word [ebp - 0xb0b], 0x3a
lea esi, [ebp - 0x308]
push edi
mov edi, edi
mov al, byte [esi]
mov byte [ebp - 0xb0c], al
lea eax, [ebp - 0x108]
push 0x104
push eax
lea eax, [ebp - 0xb0c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x417280
lea edi, [ebp - 0x108]
lea ecx, [edi + 1]
mov edi, edi
mov al, byte [edi]
inc edi
test al, al
jne 0x417260
sub edi, ecx
lea eax, [ebp - 0x108]
push edi
push eax
push ebx
call fcn.00423977
add esp, 0xc
test eax, eax
je 0x41729c
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x417280
cmp byte [esi], al
jne 0x417230
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
mov ebx, esi
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4172a1
sub ebx, ecx
lea eax, [ebp - 0xb08]
push ebx
push esi
push eax
call fcn.00426df0
add esp, 0xc
cmp ebx, 0x800
jae 0x417335
lea edx, [ebp - 0xb08]
add edx, ebx
mov byte [edx], 0
cmp byte [edx - 1], 0x5c
je 0x4172eb
inc ebx
mov byte [edx], 0x5c
cmp ebx, 0x800
jae 0x417335
lea edx, [ebp - 0xb08]
add edx, ebx
mov byte [edx], 0
mov ebx, dword [ebp - 0xb10]
cmp byte [ebx + edi], 0x5c
lea ecx, [ebx + edi]
jne 0x4172fb
inc ecx
sub edx, ecx
lea ecx, [ecx]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x417300
lea ecx, [ebp - 0xb08]
mov eax, ecx
sub ebx, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ebx + ecx - 1], al
test al, al
jne 0x417317
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00422f38
mov esp, ebp
pop ebp
ret
call fcn.004249c3
int3

Function at 0x417340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x44498c
push ecx
xor edi, edi
call fcn.00425acb
mov esi, eax
add esp, 8
test esi, esi
je 0x4173f5
push 2
push edi
push esi
call fcn.00426372
push esi
call fcn.00426277
mov ebx, eax
add esp, 0x10
cmp ebx, 0x40
jbe 0x4173ec
push edi
push edi
push esi
call fcn.00426372
push esi
push 0x40
lea eax, [ebp - 0x48]
push 1
push eax
call fcn.00425ca5
add esp, 0x1c
cmp eax, 0x40
jne 0x4173ec
mov eax, 0x5a4d
cmp word [ebp - 0x48], ax
jne 0x4173ec
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + 0xf8]
cmp ebx, eax
jbe 0x4173ec
push edi
push ecx
push esi
call fcn.00426372
push esi
push 0xf8
lea eax, [ebp - 0x140]
push 1
push eax
call fcn.00425ca5
add esp, 0x1c
cmp eax, 0xf8
jne 0x4173ec
movzx edi, word [ebp - 0x13c]
push esi
call fcn.00426461
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422f38
mov esp, ebp
pop ebp
ret
Function at 0x4191b0
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
lea ecx, [ecx]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x4191d0
mov eax, dword [esi + 0x14]
mov ecx, 0x38
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
jb 0x419213
mov ecx, 0x78
sub ecx, eax
lea ebx, [esi + 0x5c]
push ecx
push ebx
mov ecx, esi
call fcn.004190e0
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.004190e0
lea ecx, [edi + 1]
mov edi, 4
lea edx, [esi + 6]
lea esp, [esp]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 4], al
movzx eax, byte [edx - 4]
mov byte [ecx - 3], al
movzx eax, byte [edx - 3]
mov byte [ecx - 2], al
dec edi
jne 0x419240
xor eax, eax
mov edi, esi
xorps xmm0, xmm0
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
mov dword [esi + 0x18], eax
xor ecx, ebp
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
movdqu xmmword [ebx], xmm0
pop edi
movdqu xmmword [ebx + 0x10], xmm0
pop esi
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx + 0x30], xmm0
mov byte [ebx], 0x80
pop ebx
call fcn.00422f38
mov esp, ebp
pop ebp
ret 4
Function at 0x419a80
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
xor esi, esi
mov eax, edx
push esi
push 0x80
push 3
push esi
push 3
push closesocket
push ecx
mov dword [ebp - 0xc], eax
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x419b5e
cmp edi, 0xffffffff
je 0x419b5e
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x500000
cmp ecx, eax
mov dword [ebp - 8], eax
sbb eax, eax
inc eax
je 0x419b5a
push 1
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push esi
push esi
push 1
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push esi
push dword [ebp - 8]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x1c], 0xc
push dword [ebp - 4]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push 2
push eax
push edi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x419b5a
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x419b4f
push dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, ebx
call fcn.004199d0
add esp, 4
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push edi
call ebx
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437640
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x58]
mov ebx, dword [ebp + 0xc]
push 0
push 0x43ed3d
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
call fcn.004018e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0
push 0x43ed3d
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004018e0
mov byte [ebp - 4], 1
mov byte [ebp - 0x5c], 0
test esi, esi
je 0x41b63e
call fcn.0041de20
lea eax, [ebp - 0x5c]
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.00401410
add esp, 4
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
push dword [ebp - 0x5c]
call fcn.00420650
add esp, 4
mov dword [0x46f14c], eax
test eax, eax
je 0x41b63e
push esi
lea ecx, [ebp - 0x40]
call fcn.00401690
mov esi, eax
cmp esi, 0x46dfb0
je 0x41b551
cmp dword [0x46dfc4], 0x10
jb 0x41b52b
push dword [0x46dfb0]
call fcn.004238d6
add esp, 4
push esi
mov ecx, 0x46dfb0
mov dword [0x46dfc4], 0xf
mov dword [0x46dfc0], 0
mov byte [0x46dfb0], 0
call fcn.004114f0
cmp dword [ebp - 0x2c], 0x10
jb 0x41b562
push dword [ebp - 0x40]
call fcn.004238d6
add esp, 4
push edi
lea ecx, [ebp - 0x40]
call fcn.00401690
mov esi, eax
cmp esi, 0x46df80
je 0x41b5b2
cmp dword [0x46df94], 0x10
jb 0x41b58c
push dword [0x46df80]
call fcn.004238d6
add esp, 4
push esi
mov ecx, 0x46df80
mov dword [0x46df94], 0xf
mov dword [0x46df90], 0
mov byte [0x46df80], 0
call fcn.004114f0
cmp dword [ebp - 0x2c], 0x10
jb 0x41b5c3
push dword [ebp - 0x40]
call fcn.004238d6
add esp, 4
push ebx
lea ecx, [ebp - 0x40]
call fcn.00401690
mov esi, eax
cmp esi, 0x46df98
je 0x41b613
cmp dword [0x46dfac], 0x10
jb 0x41b5ed
push dword [0x46df98]
call fcn.004238d6
add esp, 4
push esi
mov ecx, 0x46df98
mov dword [0x46dfac], 0xf
mov dword [0x46dfa8], 0
mov byte [0x46df98], 0
call fcn.004114f0
cmp dword [ebp - 0x2c], 0x10
jb 0x41b624
push dword [ebp - 0x40]
call fcn.004238d6
add esp, 4
push 0
push 0
push 0x41b320
call fcn.004251bf
add esp, 0xc
call fcn.00413340
xor esi, esi
jmp 0x41b641
or esi, 0xffffffff
cmp dword [ebp - 0x14], 0x10
jb 0x41b652
push dword [ebp - 0x28]
call fcn.004238d6
add esp, 4
cmp dword [ebp - 0x44], 0x10
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jb 0x41b675
push dword [ebp - 0x58]
call fcn.004238d6
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
Function at 0x41b7d0
Capabilities:
Enumerate process modules
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 4], edx
push eax
xor esi, esi
mov dword [ebp - 0x10], ecx
push esi
push esi
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, dword [sym.imp.PSAPI.DLL_EnumProcessModules]
push eax
call ebx
mov edi, dword [ebp - 8]
test edi, edi
jne 0x41b815
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push edi
call fcn.00423734
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x41b80b
lea ecx, [ebp - 8]
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x41b937
xor edi, edi
test dword [ebp - 8], 0xfffffffc
jbe 0x41b937
mov ebx, 0x5a4d
cmp esi, 2
jge 0x41b929
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ecx + edi*4]
mov edx, dword [edx]
test ecx, ecx
je 0x41b8b6
test edx, edx
je 0x41b8b6
cmp word [ecx], bx
jne 0x41b8b6
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x41b8b6
cmp edx, ecx
jbe 0x41b8b6
mov eax, dword [eax + ecx + 0x50]
mov ebx, dword [ebp - 4]
add eax, ecx
cmp edx, eax
jae 0x41b8b9
mov eax, dword [ebp - 0xc]
sub edx, ecx
push 0x18
push ebx
mov dword [ebx + 0x18], edx
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
test eax, eax
je 0x41b937
inc esi
jmp 0x41b8b9
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x41b915
test edx, edx
je 0x41b915
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x41b915
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x41b915
cmp edx, ecx
jbe 0x41b915
mov eax, dword [eax + ecx + 0x50]
add eax, ecx
cmp edx, eax
jae 0x41b915
push 0x18
lea eax, [ebx + 0x1c]
sub edx, ecx
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x34], edx
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
test eax, eax
je 0x41b937
inc esi
mov eax, dword [ebp - 8]
inc edi
shr eax, 2
mov ebx, 0x5a4d
cmp edi, eax
jb 0x41b852
or eax, 0xffffffff
xor ecx, ecx
cmp esi, 2
cmove eax, ecx
mov dword [ebp - 0x14], eax
push dword [ebp - 0xc]
call fcn.0042468a
mov eax, dword [ebp - 0x14]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c2f0
Capabilities:
Check mutex on windows
Create thread
Get system information on windows
Initialize winsock library
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x268
mov eax, dword [0x448458]
xor eax, esp
mov dword [esp + 0x264], eax
push 0x90
lea eax, [esp + 0x40]
mov dword [esp + 0x3c], 0
push 0
push eax
call fcn.0042d5f0
add esp, 0xc
mov dword [esp + 4], 0
xor eax, eax
xorps xmm0, xmm0
mov word [esp + 0x28], ax
mov dword [esp + 0x32], eax
push 0x18e
push eax
mov word [esp + 0x3e], ax
mov word [esp + 0xd8], ax
lea eax, [esp + 0xda]
push eax
movdqu xmmword [esp + 0x14], xmm0
movdqu xmmword [esp + 0x24], xmm0
movq qword [esp + 0x36], xmm0
call fcn.0042d5f0
add esp, 0xc
lea eax, [esp + 0xd0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x46f168
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push str.ECFF9F12_8AA4_40A4_97D0_3F646B800568
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
jne 0x41c3cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41c3fa
push str.SINGLETON_MUTEXT_ALREADY_EXSIT_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x3c]
mov dword [0x46f170], eax
mov eax, dword [esp + 0x40]
mov dword [0x46f164], eax
movzx eax, word [esp + 4]
mov dword [0x46f15c], eax
call fcn.0041f5d0
cmp eax, 0xffffffff
je 0x41c3e5
call fcn.0041bf90
push 0
push 0
push 0
push 0x41c2c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x41c465
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x264]
xor eax, eax
xor ecx, esp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
Function at 0x41d790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
mov dword [ebp - 0x12c], 0
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x110], 0
call fcn.0042d5f0
add esp, 0xc
mov dword [ebp - 0x130], 0x103
lea eax, [ebp - 0x12c]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41d80d
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push str.F0EAF288_9A5E_4B99_89A6_70D3FE4FFF1E
push dword [ebp - 0x12c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x12c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41d8f4
cmp byte [ebp - 0x110], 0
mov dword [ebp - 0x114], 0xf
mov dword [ebp - 0x118], esi
mov byte [ebp - 0x128], 0
jne 0x41d86a
xor ecx, ecx
jmp 0x41d87c
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41d873
sub ecx, edx
push ecx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x128]
call fcn.004018e0
lea eax, [ebp - 0x128]
cmp edi, eax
je 0x41d8c8
cmp dword [edi + 0x14], 0x10
jb 0x41d8a9
push dword [edi]
call fcn.004238d6
add esp, 4
lea eax, [ebp - 0x128]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov ecx, edi
push eax
mov byte [edi], 0
call fcn.004114f0
cmp dword [ebp - 0x114], 0x10
jb 0x41d8df
push dword [ebp - 0x128]
call fcn.004238d6
add esp, 4
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00422f38
mov esp, ebp
pop ebp
ret
Function at 0x41f090
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push edi
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 8]
test eax, eax
je 0x41f158
cmp eax, 0xffffffff
je 0x41f158
mov ecx, dword [0x46f22c]
mov esi, dword [ecx]
cmp esi, ecx
je 0x41f0db
lea ecx, [ecx]
cmp dword [esi + 0xc], eax
je 0x41f11a
mov esi, dword [esi]
cmp esi, ecx
jne 0x41f0d0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [0x46f22c]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0xc], 0
push dword [edi + 4]
push edi
call fcn.0041f200
mov edx, dword [0x46f230]
mov ecx, 0xaaaaaa9
sub ecx, edx
mov esi, eax
cmp ecx, 1
jae 0x41f149
jmp 0x41f162
cmp dword [esi + 0x14], 0
jne 0x41f158
cmp dword [esi + 8], edi
je 0x41f158
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x10]
cmp eax, 0x3e8
jae 0x41f158
mov dword [esi + 0x14], 1
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
inc edx
mov dword [0x46f230], edx
mov dword [edi + 4], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.00422edc
int3

Function at 0x41f5d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437b1b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x448458]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
call fcn.00423926
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x41f628
push 0
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0041f7b0
mov dword [esi], eax
jmp 0x41f62a
xor esi, esi
mov dword [0x46f258], esi
test esi, esi
jne 0x41f647
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x46f190], eax
test eax, eax
je 0x41f698
push 0x46f178
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0x41f2d0
call fcn.004251bf
add esp, 0xc
test eax, eax
jne 0x41f6c3
mov eax, dword [0x46f190]
test eax, eax
je 0x41f698
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x46f190], 0
mov esi, dword [0x46f258]
test esi, esi
je 0x41f6c3
mov ecx, esi
call fcn.0041f730
push dword [esi]
call fcn.004238d6
push esi
call fcn.004238d6
add esp, 8
mov dword [0x46f258], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41fad0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x370
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov dword [ebp - 0x36c], eax
mov edi, edx
mov eax, dword [ebp + 0x14]
push 0x13c
mov dword [ebp - 0x368], eax
lea eax, [ebp - 0x358]
push 0
push eax
mov dword [ebp - 0x370], edi
mov dword [ebp - 0x364], 0xffffffff
mov dword [ebp - 0x35c], 0
call fcn.0042d5f0
add esp, 0xc
mov byte [ebp - 0x114], 0
lea eax, [ebp - 0x113]
push 0x103
push 0
push eax
call fcn.0042d5f0
add esp, 0xc
lea eax, [ebp - 0x114]
push edi
push ebx
push str.__s_s
push 0x103
push eax
call fcn.00423a93
add esp, 0x14
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x360], eax
cmp eax, 0xffffffff
je 0x41fcd8
cmp dword [esi], 0
jne 0x41fcba
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp - 0x35c]
test al, 0x10
je 0x41fc18
test al, 2
jne 0x41fc18
test edi, edi
jle 0x41fc18
push 0x103
lea eax, [ebp - 0x21b]
mov byte [ebp - 0x21c], 0
push 0
push eax
call fcn.0042d5f0
add esp, 0xc
lea eax, [ebp - 0x330]
push eax
push ebx
push 0x444f74
lea eax, [ebp - 0x21c]
push 0x103
push eax
call fcn.00423a93
mov edx, dword [ebp - 0x370]
lea eax, [edi - 1]
add esp, 0x14
lea ecx, [ebp - 0x21c]
push dword [ebp + 0x18]
push dword [ebp - 0x368]
push eax
push esi
push dword [ebp - 0x36c]
call fcn.0041fad0
add esp, 0x14
test eax, eax
je 0x41fcaa
jmp 0x41fc32
push dword [ebp - 0x36c]
lea edx, [ebp - 0x330]
mov ecx, ebx
call fcn.0041fa00
add esp, 4
test eax, eax
jne 0x41fc8c
push 0x140
lea eax, [ebp - 0x35c]
push 0
push eax
call fcn.0042d5f0
add esp, 0xc
lea eax, [ebp - 0x35c]
push eax
push dword [ebp - 0x360]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x41fcb4
cmp dword [esi], 0
je 0x41fb96
mov eax, dword [ebp - 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x364]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x330]
push eax
push ebx
push 0x444f74
push dword [ebp + 0x18]
push dword [ebp - 0x368]
call fcn.00423a93
add esp, 0x14
mov dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x364]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422f38
mov esp, ebp
pop ebp
ret
Function at 0x41feb0
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1c], ecx
xor ebx, ebx
mov dword [ebp - 0x18], 0xffffffff
mov al, 0x41
mov dword [ebp - 0x14], 0
mov word [ebp - 7], 0x3a
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], al
lea esp, [esp]
mov byte [ebp - 8], al
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x41ff5e
cmp eax, 3
jne 0x41ff5e
push 0x244
push 1
call fcn.00423734
mov esi, eax
add esp, 8
test esi, esi
je 0x41ff5e
push 0xf
lea eax, [ebp - 8]
push eax
lea eax, [esi + 4]
push eax
call fcn.00424cf0
lea eax, [ebp - 8]
push eax
push 0x444f30
lea eax, [esi + 0x14]
push 0x1f
push eax
call fcn.00423a93
push 0x103
lea eax, [esi + 0x34]
push str.chrome.exe360se.exe360chrome.exetheworld.exe
push eax
call fcn.00424cf0
add esp, 0x28
lea eax, [ebp - 0x14]
mov dword [esi + 0x240], eax
test ebx, ebx
jne 0x41ff55
mov ebx, esi
jmp 0x41ff5a
mov eax, dword [ebp - 0xc]
mov dword [eax], esi
mov dword [ebp - 0xc], esi
inc edi
mov al, byte [ebp - 1]
inc al
mov byte [ebp - 1], al
cmp al, 0x5a
jle 0x41fee0
mov dword [ebp - 0x10], ebx
test edi, edi
jne 0x41ff7f
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push 4
push edi
call fcn.00423734
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x420015
xor edi, edi
mov esi, ebx
test ebx, ebx
je 0x41ffc8
mov ebx, eax
nop
push 0
push 0
push esi
push 0x41fcf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + edi*4], eax
test eax, eax
je 0x41ffbc
inc edi
mov esi, dword [esi]
test esi, esi
jne 0x41ffa0
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
push 0xffffffffffffffff
push 1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp dword [ebp - 0x14], 0
je 0x420015
mov eax, ebx
test ebx, ebx
je 0x41ffef
cmp dword [eax + 0x23c], 0
jne 0x41ffef
mov eax, dword [eax]
test eax, eax
jne 0x41ffe0
push 0x103
add eax, 0x138
push eax
push dword [ebp - 0x1c]
call fcn.00424cf0
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x18], 0
mov dword [eax], 2
xor esi, esi
test edi, edi
jle 0x420031
mov ebx, dword [ebp - 0xc]
mov edi, edi
push dword [ebx + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, edi
jl 0x420020
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x420046
mov esi, dword [ebx]
push ebx
call fcn.0042468a
add esp, 4
mov ebx, esi
test esi, esi
jne 0x420035
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret