joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, 0x6d
imul edi
rcr edx, 0x3c
ror ebx, 0x78
and ebx, 0x3b
sub eax, 0xb0
rol eax, 0x5a
bswap edx
rol edx, 0xa7
add edx, 0xd0
imul eax
bswap edx
add eax, 0x9b
and eax, 0x9c
dec edi
add ebx, 0x85
sub ebx, 0x6b
sbb eax, 0x62
not edi
and esi, 0xa
sbb esi, 0xbb
inc esi
add edi, 0xbd
neg eax
imul esi
imul edi
imul ebx
inc edi
dec ebx
inc edx
dec edx
bswap edx
add ebx, 0xc9
rol edx, 0x6c
neg edi
inc eax
rcr eax, 0xfe
sub ebx, 0x59
imul esi
imul edi
neg esi
not eax
dec edi
sbb ebx, 0x6d
imul edx
sbb ebx, 0x71
rcl edi, 0x25
ror eax, 0x9e
sub esi, 0x7d
dec eax
xor ecx, ecx
xor edi, edi
bswap ebx
dec esi
bswap eax
neg eax
imul edx
dec edx
rol ebx, 0x49
and edi, 0xbb
rcl ebx, 0xb9
sub ebx, 0x82
not edi
imul eax
neg edi
or eax, 3
inc esi
dec esi
sub ebx, 0xc7
add eax, 0xe7
neg eax
not edi
or edx, 0xdd
imul ebx
rcl edx, 0xf2
and edi, 0xda
rcr eax, 0xf6
sub edx, 0x4a
ror ebx, 0x43
add ebx, 0x14
bswap esi
or edi, 0xb5
rcl eax, 0x2d
and esi, 0x30
imul edi
neg eax
rol ebx, 0xf8
bswap edi
and eax, 0xd0
dec eax
bswap ebx
mov eax, 0xeb
ror esi, 0xc3
ror esi, 0x1d
dec edx
sbb eax, 0xa0
dec edi
mov esi, 0x9b
or ebx, 0xa1
not ebx
add edi, 0x6b
not edi
mov ecx, dword [ebp + 0xc]
sbb eax, 0x9d
neg esi
mov edi, 0x64
sbb eax, 0xa5
sbb ebx, 0xc0
and esi, 0xfb
ror esi, 0xf4
rcl esi, 0x2b
add edx, 0x2c
sub edx, 0x2f
rcr ebx, 0x4e
dec eax
neg ebx
sbb eax, 0xfa
rol esi, 0xbd
rol eax, 0x15
or eax, 0x3f
neg eax
inc edi
rcr esi, 0xc8
inc esi
sbb eax, 0xb4
inc edi
and ebx, 0x86
ror esi, 0x91
inc esi
not edx
imul edi
not edi
not ebx
rcr edx, 0x9d
mov edx, 1
bswap edi
sub edi, 0xdc
not esi
imul ebx
rcl edx, 0x84
rol edx, 0xb9
dec ebx
imul edx
inc ebx
rol edi, 0xb1
neg eax
rcr edi, 0xeb
not edi
and edx, 0x8e
neg edx
mov eax, 0xf
sbb edi, 0x48
inc esi
mov edi, dword [ebp + 8]
mov eax, ebx
xor ebx, ebx
mov esi, eax
not byte [edi]
xor esi, esi
mov eax, ebx
xor ebx, eax
xor esi, eax
xor eax, ebx
xor eax, eax
mov eax, ebx
mov eax, ebx
mov esi, ebx
add byte [edi], 0x87
xor esi, ebx
mov ebx, eax
mov esi, eax
mov ebx, ebx
mov eax, esi
mov eax, esi
mov ebx, eax
mov ebx, eax
xor ebx, ebx
sub byte [edi], 0x54
xor esi, esi
xor eax, ebx
mov eax, esi
mov eax, eax
xor esi, ebx
mov eax, esi
xor esi, eax
xor esi, ebx
xor ebx, eax
imul byte [edi]
inc edi
loop 0x4013ec
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407885
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410400]
jne 0x40788f
repz ret
jmp fcn.00409c20
Function at 0x407ef5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406ca5
and dword [ebp - 4], 0
cmp dword [0x411590], 0
mov ebx, eax
jne 0x407fa6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408057
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408057
push eax
call fcn.00406c33
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x411590], eax
call esi
push eax
call fcn.00406c33
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x411594], eax
call esi
push eax
call fcn.00406c33
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x411598], eax
call esi
push eax
call fcn.00406c33
pop ecx
mov dword [0x4115a0], eax
test eax, eax
je 0x407fa6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406c33
pop ecx
mov dword [0x41159c], eax
mov eax, dword [0x41159c]
cmp eax, ebx
je 0x407ffe
cmp dword [0x4115a0], ebx
je 0x407ffe
push eax
call fcn.00406cae
push dword [0x4115a0]
mov esi, eax
call fcn.00406cae
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407ffe
test edi, edi
je 0x407ffe
call esi
test eax, eax
je 0x407ff5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407ff5
test byte [ebp - 0xc], 1
jne 0x407ffe
or dword [ebp + 0x10], 0x200000
jmp 0x408037
mov eax, dword [0x411594]
cmp eax, ebx
je 0x408037
push eax
call fcn.00406cae
pop ecx
test eax, eax
je 0x408037
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408037
mov eax, dword [0x411598]
cmp eax, ebx
je 0x408037
push eax
call fcn.00406cae
pop ecx
test eax, eax
je 0x408037
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x411590]
call fcn.00406cae
pop ecx
test eax, eax
je 0x408057
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408059
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401b40
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x18]
sub esp, 0x68
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x3c], 0x473640
mov dword [ebp - 0x38], 0x4b4abc
mov dword [ebp - 0x30], 0x401c47
mov dword [ebp - 0x2c], esp
mov dword [esp], eax
call fcn.0047f180
cmp byte [0x4be020], 0
je 0x401be0
cmp dword [0x4b7020], 0x42c
je 0x401be0
cmp byte [0x4b7010], 1
je 0x401be0
mov dword [esp + 8], 0
mov eax, dword [0x4be040]
mov dword [esp + 4], 0
mov dword [ebp - 0x50], 0xffffffff
mov dword [esp], eax
call sub.ADVAPI32.DLL_StartServiceA
sub esp, 0xc
test eax, eax
jne 0x401bf8
mov dword [esp + 4], 0x401ae0
mov dword [esp], 2
call fcn.0042ca00
mov edx, 0x42c
mov dword [0x4b7020], edx
lea eax, [ebp - 0x54]
mov dword [esp], eax
call fcn.0047f230
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 4], 0x401b19
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov dword [ebp - 0x50], 0xffffffff
call fcn.00456350
mov dword [esp], 2
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [ebp - 0x50], 1
call fcn.0042c9b0
mov dword [ebp - 0x50], 0xffffffff
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00456470
mov byte [0x4b7010], 1
jmp 0x401be0

Function at 0x404fa7
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x84
mov ebx, 0x4bdbbc
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x74]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xd55f4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x64]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x84]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x28], eax
mov dword [esp + 8], 0x104
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x28]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.00404ede
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x40512d
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.00404f36
mov byte [ebp - 0x2d], al
ror dword [ebx - 0x49f02bbb], cl
add byte [eax], bh
inc ebp
invalid
je 0x4050cf
mov eax, dword [ebp - 0x2c]
add eax, 1
movzx eax, byte [eax]
Function at 0x409d00
Capabilities:
Get common file path

Disassembly:
push ebp
mov eax, 0x473640
mov ebp, esp
push edi
mov edi, 0xffffffff
push esi
mov esi, 3
push ebx
sub esp, 0x18c
mov dword [ebp - 0x15c], eax
mov eax, 0x4b4c7c
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x154], eax
mov eax, 0x409f88
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x174]
mov dword [esp], eax
mov dword [ebp - 0x14c], esp
call fcn.0047f180
cmp dword [0x4cfdd0], 0x404
lea edx, [ebp - 0x178]
mov dword [esp + 8], edx
mov dword [esp], 0
sete al
mov dword [ebp - 0x170], edi
test al, 1
setne al
movzx eax, al
dec eax
and eax, 0xffffffeb
add eax, 0x17
mov dword [esp + 4], eax
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
sub esp, 0xc
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x178]
mov dword [esp], eax
call sub.SHELL32.DLL_SHGetPathFromIDListA
sub esp, 8
lea edx, [ebp - 0x128]
lea eax, [ebp - 0x138]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00456350
mov dword [ebp - 0x170], esi
lea edx, [ebp - 0x138]
mov dword [esp], edx
call fcn.00457590
mov dword [esp + 4], eax
mov dword [esp], 0x409c80
call fcn.00433d70
mov eax, dword [ebp - 0x138]
mov ebx, dword [eax + 0xc]
test ebx, ebx
jne 0x409ee0
mov dword [esp + 4], 2
lea eax, [ebp - 0x178]
mov dword [esp + 8], eax
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov eax, dword [ebp - 0x178]
sub esp, 0xc
lea edx, [ebp - 0x128]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.SHELL32.DLL_SHGetPathFromIDListA
sub esp, 8
lea eax, [ebp - 0x128]
lea edx, [ebp - 0x148]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00456350
mov eax, dword [ebp - 0x148]
inc dword [eax]
mov eax, dword [ebp - 0x138]
mov edx, eax
mov dword [ebp - 0x17c], eax
mov eax, dword [eax]
dec eax
mov dword [edx], eax
test eax, eax
jne 0x409e8f
mov dword [esp], edx
mov ecx, 2
mov dword [ebp - 0x170], ecx
call fcn.00456230
mov eax, dword [ebp - 0x17c]
mov dword [esp], eax
call fcn.00475b80
mov eax, dword [ebp - 0x148]
mov edx, 3
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x148]
mov dword [esp], eax
call fcn.00456470
lea eax, [ebp - 0x138]
mov dword [esp], eax
call fcn.00457590
mov dword [esp + 4], eax
mov dword [esp], 0x409cc0
call fcn.00433d70
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 4], 0x409cf2
lea edx, [ebp - 0x148]
mov eax, 3
mov dword [esp], edx
mov dword [ebp - 0x170], eax
call fcn.00456350
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
lea eax, [ebp - 0x138]
mov dword [esp], eax
mov eax, 1
mov dword [ebp - 0x170], eax
call fcn.004579f0
lea eax, [ebp - 0x148]
mov dword [esp], eax
mov eax, 3
mov dword [ebp - 0x170], eax
call fcn.00456470
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x138]
mov dword [esp], eax
call fcn.00409420
lea eax, [ebp - 0x138]
mov edi, 0xffffffff
mov dword [esp], eax
mov dword [ebp - 0x170], edi
call fcn.00456470
lea eax, [ebp - 0x174]
mov dword [esp], eax
call fcn.0047f230
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40a080
Capabilities:
Get common file path

Disassembly:
push ebp
mov eax, 0x473640
mov ebp, esp
push edi
mov edi, 0x4b4c86
push esi
mov esi, 0x40a217
push ebx
sub esp, 0x17c
mov ebx, 0xffffffff
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x164]
mov dword [esp], eax
mov dword [ebp - 0x13c], esp
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x140], esi
call fcn.0047f180
cmp dword [0x4cfdd0], 0x404
lea edx, [ebp - 0x168]
mov dword [esp + 8], edx
mov dword [esp], 0
sete al
mov dword [ebp - 0x160], ebx
test al, 1
setne al
movzx eax, al
lea eax, [eax + eax*8 + 0x10]
mov dword [esp + 4], eax
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
sub esp, 0xc
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
call sub.SHELL32.DLL_SHGetPathFromIDListA
sub esp, 8
lea edx, [ebp - 0x128]
mov dword [esp + 4], edx
mov dword [esp], 0x40a000
call fcn.00433d70
cmp byte [ebp - 0x128], 0
je 0x40a1c0
lea edx, [ebp - 0x128]
mov ecx, 0xffffffff
lea eax, [ebp - 0x138]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [ebp - 0x160], ecx
call fcn.00456350
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x138]
mov dword [esp], edx
mov edx, 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x160], edx
mov dword [esp + 4], eax
call fcn.00409420
lea eax, [ebp - 0x138]
mov dword [esp], eax
mov eax, 0xffffffff
mov dword [ebp - 0x160], eax
call fcn.00456470
lea eax, [ebp - 0x164]
mov dword [esp], eax
call fcn.0047f230
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x10
lea eax, [ebp - 0x168]
mov dword [esp + 8], eax
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov eax, dword [ebp - 0x168]
sub esp, 0xc
lea edx, [ebp - 0x128]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.SHELL32.DLL_SHGetPathFromIDListA
sub esp, 8
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
mov dword [esp], 0x40a040
call fcn.00433d70
jmp 0x40a145
Function at 0x40a7b0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x18]
push edi
push esi
push ebx
sub esp, 0x9c
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x74]
mov dword [esp], eax
mov dword [ebp - 0x5c], 0x473640
mov dword [ebp - 0x58], 0x4b4ca4
mov dword [ebp - 0x50], 0x40a986
mov dword [ebp - 0x4c], esp
call fcn.0047f180
mov dword [esp + 4], 0x40a774
lea edx, [ebp - 0x48]
mov dword [esp], edx
mov dword [ebp - 0x70], 0xffffffff
call fcn.00456350
mov dword [ebp - 0x70], 3
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x38]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00433740
mov dword [ebp - 0x70], 2
sub esp, 4
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
lea edx, [ebp - 0x28]
mov dword [esp], edx
call fcn.00410db0
mov eax, dword [ebp - 0x28]
sub esp, 4
inc dword [eax]
mov eax, dword [0x4be3d0]
mov edx, eax
mov dword [ebp - 0x78], eax
mov eax, dword [eax]
dec eax
mov dword [edx], eax
test eax, eax
jne 0x40a869
mov dword [esp], edx
mov dword [ebp - 0x70], 1
call fcn.00456230
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call fcn.00475b80
mov dword [ebp - 0x70], 2
mov eax, dword [ebp - 0x28]
mov dword [0x4be3d0], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00456470
mov dword [ebp - 0x70], 3
lea eax, [ebp - 0x38]
mov dword [esp], eax
call fcn.00456470
mov dword [ebp - 0x70], 0xffffffff
lea eax, [ebp - 0x48]
mov dword [esp], eax
call fcn.00456470
mov dword [esp + 8], 0x40a780
mov dword [esp + 4], 0x40a785
mov dword [esp], 0
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 0x80], eax
sub esp, 0xc
test eax, eax
je 0x40a9e6
mov dword [esp], 0
mov edx, dword [ebp - 0x80]
mov dword [ebp - 0x70], 0xffffffff
mov dword [esp + 4], edx
call sub.KERNEL32.DLL_LoadResource
sub esp, 8
mov dword [esp], eax
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0x84], eax
sub esp, 4
mov eax, dword [ebp - 0x80]
mov dword [esp], 0
mov dword [esp + 4], eax
call sub.KERNEL32.DLL_SizeofResource
mov dword [ebp - 0x88], eax
sub esp, 8
mov dword [esp], 0x4be3d0
call fcn.00457590
mov dword [esp], eax
mov dword [esp + 4], 0x40a791
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x8c], eax
test eax, eax
je 0x40a973
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x84]
mov dword [esp + 4], 1
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov edx, dword [ebp - 0x8c]
mov dword [esp], edx
call sub.msvcrt.dll_fclose
lea eax, [ebp - 0x74]
mov dword [esp], eax
call fcn.0047f230
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x40a794
call fcn.0040c710
inc ebx
jns 0x40aa5c
ja 0x40aa60
outsb dx, byte [esi]
add byte [ebx + 0x79], al
ja 0x40aa67
outsb dx, byte [esi]
and byte [edx + 0x61], al
jae 0x40aa6c
and byte [ebx + 0x68], dl
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax + 0x26748d], dl
add byte [ebp - 0x38b98b40], al
inc esp
and al, 4
test eax, 0x458d0040
fmul dword [ecx + 0x45c72404]
add byte [ebp + 0x489d845], cl
and al, 0xc7
inc ebp
mov al, 0xff
invalid
Function at 0x40c860
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x40
mov esi, dword [ebp + 8]
mov dword [esp], 0x40c830
call sub.KERNEL32.DLL_LoadLibraryA
sub esp, 4
test eax, eax
je 0x40c930
mov dword [esp + 4], 0x40c83d
mov dword [esp], eax
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ebx, eax
test eax, eax
je 0x40c930
mov dword [esp], esi
call fcn.00457590
mov dword [esp], eax
lea edx, [ebp - 0x10]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x18]
mov dword [esp + 8], edx
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
call ebx
sub esp, 0x10
test eax, eax
je 0x40c930
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov eax, ecx
mov edx, ebx
shl eax, 2
shld edx, ecx, 2
add eax, ecx
mov ecx, eax
adc edx, ebx
mov ebx, edx
shl ecx, 2
shld ebx, eax, 2
add ecx, eax
mov eax, dword [ebp - 0x18]
adc ebx, edx
mov edx, dword [ebp - 0x14]
shld ebx, ecx, 2
shl ecx, 2
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp], ecx
mov dword [esp + 4], ebx
call fcn.0047fb80
mov edx, 0x64
sub edx, eax
lea esi, [esi]
lea edi, [edi]
lea esp, [ebp - 8]
mov eax, edx
pop ebx
pop esi
pop ebp
ret
mov dword [esp], esi
call fcn.00457590
cmp byte [eax + 1], 0x3a
je 0x40c942
xor edx, edx
jmp 0x40c920
mov dword [esp], esi
call fcn.00457590
movzx eax, byte [eax]
mov byte [ebp - 0x23], 0x3a
mov byte [ebp - 0x22], 0x5c
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x24], al
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [ebp - 0x24]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
sub esp, 0x14
xor edx, edx
test eax, eax
je 0x40c920
mov eax, dword [ebp - 0x2c]
xor edx, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
div dword [ebp - 0x28]
jmp 0x40c90d
Function at 0x40e940
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x4be410
mov dword [esp + 8], 0x40e8f0
mov dword [0x4be410], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [0x4be414], eax
lea eax, [ebp - 4]
mov dword [esp + 0x14], eax
call sub.KERNEL32.DLL_CreateThread
sub esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x412340
Capabilities:
Terminate process

Disassembly:
push dword [0x4bdc1c]
push esi
call ebp
mov dword [esp + 0x18], eax
xor eax, eax
push eax
push eax
push eax
push 1
push dword [0x4bdbd4]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
call eax
test eax, eax
je 0x41246e
xor ecx, ecx
push ecx
push dword [0x4bdbc8]
push ecx
push ecx
push dword [0x4bdbe8]
push eax
mov eax, dword [esp + 0x38]
call eax
mov esi, eax
test esi, esi
je 0x41246e
lea eax, [esp + 0x10]
push eax
push dword [0x4bdc20]
mov ecx, dword [esp + 0x20]
push ebx
push esi
call ecx
test eax, eax
je 0x41246e
cmp dword [esp + 0x10], 0
jbe 0x4123cb
add edi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push dword [0x4bdc20]
mov eax, dword [esp + 0x20]
inc esp
and al, 0x20
push edi
push esi
call eax
test eax, eax
jne 0x4123a9
cmp edi, ebx
je 0x41246e
mov edx, dword [ebx]
xor ecx, ecx
mov eax, dword [0x4bdc10]
mov eax, dword [eax + ecx]
add eax, edx
mov dword [ecx + edi], eax
add ecx, 4
cmp ecx, 0x20
jl 0x4123d7
push edi
push dword [esp + 0x28]
sub bh, bh
aad 0x8b
clc

Function at 0x4123f0
Capabilities:
Terminate process

Disassembly:
sub bh, bh
aad 0x8b
clc
test edi, edi
je 0x41246e
mov esi, dword [0x4bdbf8]
lea eax, [esp + 0x14]
push eax
push dword [0x4bdc24]
push 0x4000
push esi
call edi
mov ecx, dword [0x4bdc08]
lea edx, [esi + 8]
add ecx, dword [esp + 0x28]
mov ebx, 0xffe
mov eax, dword [ecx + 4]
sub ecx, esi
mov dword [esp + 0x28], eax
mov eax, dword [ecx + edx]
add eax, dword [esp + 0x28]
mov dword [edx], eax
lea edx, [edx + 4]
sub ebx, 1
jne 0x41242d
mov eax, dword [0x4bdc04]
mov dword [esi + 8], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push 0x4000
push esi
call edi
mov eax, dword [0x4bdbdc]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x4bdbdc]
add ecx, esi
add esi, eax
push esi
call ecx
pop ecx
push 0x10
push dword [0x4bdc18]
push dword [0x4bdc00]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x413cb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x4be548
mov dword [esp + 8], 0x413c60
mov dword [0x4be548], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [0x4be54c], eax
lea eax, [ebp - 4]
mov dword [esp + 0x14], eax
call sub.KERNEL32.DLL_CreateThread
sub esp, 0x18
mov esp, ebp
pop ebp
ret