joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
cmp byte [ebx + 0x11], 0x6e
jne 0x4015df
push dword [esp + 0x20]
push ebx
push dword [esp + 0x20]
call fcn.00401040
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x4015d7
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_create_symbolic_link__s__n
call fcn.004023b0
add esp, 8
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret
push edi
push 0x427688
push dword [esp + 0x28]
call fcn.00403f90
mov edi, eax
add esp, 8
mov dword [esp + 0x14], edi
test edi, edi
jne 0x40161b
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_open_target_file__n
push str.fopen
call fcn.004024e0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov esi, dword [esp + 0x1c]
push ebp
push 0x4275a0
push esi
call fcn.00403f90
mov ebp, eax
add esp, 8
mov dword [esp + 0x14], ebp
test ebp, ebp
jne 0x401651
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.004023b0
add esp, 8
or edi, 0xffffffff
jmp 0x40178c
mov ecx, dword [ebx + 4]
xor eax, eax
add ecx, dword [esi + 0x1000]
push 0
adc eax, dword [esi + 0x1004]
push eax
push ecx
push ebp
call fcn.0040f1a6
add esp, 0x10
test eax, eax
jns 0x401691
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.004024e0
add esp, 0xc
or edi, 0xffffffff
jmp 0x401783
cmp byte [ebx + 0x10], 1
jne 0x4016ab
push 0
push edi
push ebx
push ebp
call fcn.004011e0
add esp, 0x10
mov edi, eax
jmp 0x401783
push 0x2000
xor edi, edi
call fcn.00412e89
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4016e0
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
push str.malloc
call fcn.004024e0
add esp, 0xc
or edi, 0xffffffff
jmp 0x401783
mov esi, dword [ebx + 0xc]
xor ebp, ebp
test esi, esi
je 0x401776
nop dword [eax]
test ebp, ebp
jb 0x401705
ja 0x4016fe
cmp esi, 0x2000
jbe 0x401705
mov edi, 0x2000
jmp 0x401707
mov edi, esi
push dword [esp + 0x14]
push 1
push edi
push eax
call fcn.0040ed82
add esp, 0x10
cmp eax, 1
jb 0x401759
push dword [esp + 0x18]
push 1
push edi
push dword [esp + 0x1c]
call fcn.0040f4a5
add esp, 0x10
cmp eax, 1
jb 0x401749
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebp, 0
jne 0x4016f0
jb 0x401745
test esi, esi
jne 0x4016f0
xor edi, edi
jmp 0x401772
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_write_data_chunk__n
push str.fwrite
jmp 0x401767
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.004024e0
add esp, 0xc
or edi, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call fcn.00412e6e
mov ebp, dword [esp + 0x18]
add esp, 4
push ebp
call fcn.0040eb21
add esp, 4
push dword [esp + 0x18]
call fcn.0040eb21
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4027e0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xc04
mov eax, dword [0x437040]
xor eax, esp
mov dword [esp + 0xc00], eax
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
lea eax, [esp + 4]
push 0x427a14
push eax
call fcn.00402930
add esp, 0xc
lea ecx, [esp + 0xc0c]
push ecx
push 0
push dword [esp + 0xc10]
mov ecx, 0x400
sub ecx, eax
push ecx
lea ecx, [esp + 0x10]
add eax, ecx
push eax
call fcn.00401030
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.00412de1
push 0x400
lea eax, [esp + 0x420]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00408660
add esp, 0x28
test eax, eax
je 0x402880
lea eax, [esp + 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0xc00]
xor ecx, esp
call fcn.0040b553
add esp, 0xc04
ret
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0xc00]
xor ecx, esp
call fcn.0040b553
add esp, 0xc04
ret

Function at 0x4028a0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x804
mov eax, dword [0x437040]
xor eax, esp
mov dword [esp + 0x800], eax
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
lea eax, [esp + 4]
push str.__d_
push eax
call fcn.00402380
add esp, 0xc
lea ecx, [esp + 0x80c]
push ecx
push 0
push dword [esp + 0x810]
mov ecx, 0x400
sub ecx, eax
push ecx
lea ecx, [esp + 0x10]
lea eax, [ecx + eax*2]
push eax
call fcn.00401030
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00412e22
add esp, 0x1c
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.0040b553
add esp, 0x804
ret
Function at 0x407270
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1004
call fcn.0040b890
mov eax, dword [0x437040]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebx
push esi
push edi
mov edi, dword [esp + 0x1018]
xor ebx, ebx
push 0x4275a0
push eax
call fcn.00403f90
mov esi, eax
add esp, 8
test esi, esi
je 0x4072cc
push 0x427688
push edi
call fcn.00403f90
add esp, 8
mov edi, eax
push esi
test edi, edi
jne 0x4072e7
call fcn.0040eb21
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0040b553
add esp, 0x1004
ret
call fcn.0040eb51
add esp, 4
test eax, eax
jne 0x407359
push esi
push 0x1000
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0040ed82
add esp, 0x10
test eax, eax
je 0x407340
push edi
push eax
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0040f4a5
add esp, 0x10
test eax, eax
je 0x40733d
push edi
call fcn.0040eb7d
add esp, 4
test eax, eax
jne 0x40733d
push esi
call fcn.0040eb51
add esp, 4
test eax, eax
je 0x4072f3
jmp 0x407359
push edi
jmp 0x40734e
push esi
call fcn.0040eb7d
add esp, 4
test eax, eax
je 0x407359
push esi
call fcn.00414d5b
add esp, 4
or ebx, 0xffffffff
push esi
call fcn.0040eb21
push edi
call fcn.0040eb21
mov ecx, dword [esp + 0x1014]
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b553
add esp, 0x1004
ret

Function at 0x407390
Capabilities:
Create directory

Disassembly:
mov eax, 0x3008
call fcn.0040b890
mov eax, dword [0x437040]
xor eax, esp
mov dword [esp + 0x3004], eax
mov eax, dword [esp + 0x300c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x301c]
mov ecx, esi
push edi
mov edi, dword [esp + 0x3024]
mov dword [esp + 0x10], eax
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4073d0
sub ecx, edx
mov edx, edi
lea ebx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x4073e0
sub edx, ebx
lea eax, [edx + 1]
add eax, ecx
cmp eax, 0x1000
jae 0x4074a1
push 0x5c
push esi
push str._s_c
lea eax, [esp + 0x20]
push 0x1000
push eax
call fcn.00401bc0
push 0x5c
push edi
mov ebp, eax
call fcn.0040c940
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x40749d
mov ebx, 0x1000
sub ebx, ebp
lea ebp, [esp + ebp + 0x14]
nop
push edi
mov eax, esi
sub eax, edi
push eax
push 0x429ff4
push ebx
push ebp
call fcn.00401bc0
lea eax, [esp + 0x28]
push eax
call fcn.00403f30
add esp, 0x18
test eax, eax
jne 0x407489
push 0x1000
lea eax, [esp + 0x1018]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00408660
mov eax, dword [esp + 0x1c]
add esp, 0xc
push dword [eax + 0x301c]
lea eax, [esp + 0x1018]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4074a1
lea eax, [esi + 1]
push 0x5c
push eax
call fcn.0040c940
mov esi, eax
add esp, 8
test esi, esi
jne 0x407430
xor eax, eax
jmp 0x4074a4
or eax, 0xffffffff
mov ecx, dword [esp + 0x3014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040b553
add esp, 0x3008
ret
Function at 0x4074c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push esi
xorps xmm0, xmm0
push 0x2000
movlpd qword [esp + 0x10], xmm0
call fcn.00412e89
mov esi, eax
add esp, 4
mov dword [esp + 8], esi
test esi, esi
jne 0x4074fb
push 0x2000
push str.LOADER:_failed_to_allocate_read_buffer___d_bytes___n
call fcn.004027e0
add esp, 8
jmp 0x407691
push ebx
mov ebx, dword [esp + 0x24]
push 2
push 0
push 0
push ebx
call fcn.0040f1a6
add esp, 0x10
test eax, eax
jns 0x407525
push str.LOADER:_failed_to_seek_to_the_end_of_the_file__n
call fcn.004027e0
add esp, 4
jmp 0x407690
push edi
push ebx
call fcn.00415402
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x30]
test edx, edx
ja 0x407551
jb 0x40753f
cmp edi, eax
jae 0x407551
push str.LOADER:_file_is_too_short_to_contain_magic_pattern__n
call fcn.004027e0
add esp, 4
jmp 0x40768f
push ebp
test edx, edx
jne 0x407571
cmp edi, 0x2000
jae 0x407571
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
jmp 0x40757e
mov ebp, edi
mov ebx, edx
add ebp, 0xffffe000
adc ebx, 0xffffffff
sub edi, ebp
mov dword [esp + 0x10], ebx
cmp edi, eax
jb 0x40768e
push 0
push ebx
push ebp
push dword [esp + 0x38]
call fcn.0040f1a6
add esp, 0x10
test eax, eax
js 0x40767f
push dword [esp + 0x2c]
push edi
push 1
push esi
call fcn.0040ed82
add esp, 0x10
cmp eax, edi
jne 0x40766f
mov eax, dword [esp + 0x34]
sub edi, eax
add edi, 1
je 0x407635
lea ebx, [esi - 1]
add ebx, edi
nop dword [eax]
mov esi, dword [esp + 0x30]
mov edx, ebx
sub eax, 4
jb 0x4075f1
nop dword [eax + eax]
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x4075f6
add edx, 4
add esi, 4
sub eax, 4
jae 0x4075e0
cmp eax, 0xfffffffc
je 0x407657
mov cl, byte [edx]
cmp cl, byte [esi]
jne 0x407623
cmp eax, 0xfffffffd
je 0x407657
mov cl, byte [edx + 1]
cmp cl, byte [esi + 1]
jne 0x407623
cmp eax, 0xfffffffe
je 0x407657
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
jne 0x407623
cmp eax, 0xffffffff
je 0x407657
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x407657
mov eax, dword [esp + 0x34]
dec ebx
sub edi, 1
jne 0x4075d0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, eax
mov edx, 0
add edi, ebp
adc edx, ebx
add edi, 0xffffffff
adc edx, 0xffffffff
test ebx, ebx
jne 0x407552
test ebp, ebp
je 0x40768e
jmp 0x407552
xor eax, eax
add edi, ebp
adc eax, dword [esp + 0x10]
add edi, 0xffffffff
mov dword [esp + 0x18], edi
adc eax, 0xffffffff
mov dword [esp + 0x1c], eax
jmp 0x40768e
push edi
push str.LOADER:_failed_to_read_chunk___zd_bytes___n
call fcn.004027e0
add esp, 8
jmp 0x40768e
push ebx
push ebp
push str.LOADER:_failed_to_seek_to_the_offset_0x_llX__n
call fcn.004027e0
add esp, 0xc
pop ebp
pop edi
pop ebx
push dword [esp + 8]
call fcn.00412e6e
mov eax, dword [esp + 0x10]
add esp, 4
mov edx, dword [esp + 0x10]
pop esi
add esp, 0x18
ret
Function at 0x407940
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x2254
call fcn.0040b890
mov eax, dword [0x437040]
xor eax, esp
mov dword [esp + 0x2250], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2260]
lea eax, [esp + 0x258]
push esi
push edi
push ebp
push 0x42a888
push 0x1000
push eax
call fcn.00402340
mov ebx, eax
add esp, 0x10
cmp ebx, 0x1000
jge 0x407b03
lea eax, [esp + 0x10]
mov esi, 0x1001
push eax
lea eax, [esp + 0x264]
sub esi, ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x407b03
mov edx, 0x42a894
lea ecx, [esp + 0x3c]
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4079e6
test ax, ax
je 0x4079e2
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4079e6
add ecx, 4
add edx, 4
test ax, ax
jne 0x4079c0
xor eax, eax
jmp 0x4079eb
sbb eax, eax
or eax, 1
test eax, eax
je 0x407ada
mov ecx, 0x42a898
lea eax, [esp + 0x3c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407a26
test dx, dx
je 0x407a22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407a26
add eax, 4
add ecx, 4
test dx, dx
jne 0x407a00
xor eax, eax
jmp 0x407a2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x407ada
lea eax, [esp + 0x3c]
push eax
push 0x42a8a0
lea eax, [esp + ebx*2 + 0x266]
push esi
push eax
call fcn.00402340
add esp, 0x10
cmp eax, esi
jge 0x407ada
mov eax, dword [esp + 0x10]
test al, 0x10
je 0x407ab3
test eax, 0x400
je 0x407a90
cmp dword [esp + 0x34], 0xa000000c
jne 0x407a90
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x407ada
lea eax, [esp + 0x260]
push eax
push str.LOADER:_failed_to_remove_directory_symbolic_link:__ls_n
jmp 0x407ad2
lea eax, [esp + 0x260]
push eax
call fcn.00407940
add esp, 4
test eax, eax
jns 0x407ada
lea eax, [esp + 0x260]
push eax
push str.LOADER:_failed_to_remove_directory:__ls_n
jmp 0x407ad2
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x407ada
lea eax, [esp + 0x260]
push eax
push str.LOADER:_failed_to_remove_file:__ls_n
call fcn.004028a0
add esp, 8
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4079b1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
dec eax
neg eax
sbb eax, eax
jmp 0x407b06
or eax, 0xffffffff
mov ecx, dword [esp + 0x2260]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040b553
add esp, 0x2254
ret
Function at 0x407c50
Capabilities:
Create directory
Get common file path

Disassembly:
mov eax, 0x2028
call fcn.0040b890
mov eax, dword [0x437040]
xor eax, esp
mov dword [esp + 0x2024], eax
push ebx
mov ebx, dword [esp + 0x2030]
push ebp
xor ebp, ebp
mov dword [esp + 8], ebx
push esi
push edi
cmp dword [ebx + 0x3020], ebp
je 0x407cf4
push 0x42a660
call fcn.00407e20
push dword [ebx + 0x3020]
mov ebp, eax
call fcn.004076b0
mov edi, eax
add esp, 8
test edi, edi
jne 0x407cb2
push ebp
call fcn.00412e6e
add esp, 4
or eax, 0xffffffff
jmp 0x407e07
push edi
push 0x42a664
call fcn.00415bbc
push edi
mov esi, eax
call fcn.00412e6e
add esp, 0xc
test esi, esi
je 0x407ce7
push str.LOADER:_failed_to_set_the_TMP_environment_variable._n
call fcn.00402470
push ebp
call fcn.00412e6e
add esp, 8
or eax, 0xffffffff
jmp 0x407e07
push str.LOADER:_successfully_resolved_the_specified_runtime_tmpdir_n
call fcn.004028a0
add esp, 4
lea eax, [esp + 0x34]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x34]
push eax
push str.LOADER:_attempting_to_create_temporary_application_directory_under__ls_n
call fcn.004028a0
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push str._MEI_d
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.00402310
add esp, 0x18
xor esi, esi
jmp 0x407d35
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.004163ea
add esp, 8
mov edi, eax
push dword [ebx + 0x301c]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407d6e
push edi
call fcn.00412e6e
inc esi
add esp, 4
or ebx, 0xffffffff
cmp esi, 5
jl 0x407d31
jmp 0x407da4
push 0x1000
lea eax, [ebx + 0x2012]
push eax
push edi
call fcn.004086e0
add esp, 0xc
test eax, eax
jne 0x407d99
push str.LOADER:_length_of_teporary_directory_path_exceeds_maximum_path_length__n
call fcn.00402470
add esp, 4
or ebx, 0xffffffff
jmp 0x407d9b
xor ebx, ebx
push edi
call fcn.00412e6e
add esp, 4
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x3020], 0
je 0x407e05
push 0
push 0
push 0x42a660
call fcn.00408660
test ebp, ebp
je 0x407def
push 0
push 0
push ebp
mov edi, eax
call fcn.00408660
mov esi, eax
push esi
push edi
call fcn.00415bbc
push edi
call fcn.00412e6e
push esi
call fcn.00412e6e
push ebp
call fcn.00412e6e
add esp, 0x2c
jmp 0x407e05
mov esi, eax
push 0x42a1a4
push esi
call fcn.00415bbc
push esi
call fcn.00412e6e
add esp, 0x18
mov eax, ebx
mov ecx, dword [esp + 0x2034]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040b553
add esp, 0x2028
ret
Function at 0x407e20
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x4004
call fcn.0040b890
mov eax, dword [0x437040]
xor eax, esp
mov dword [esp + 0x4000], eax
mov eax, dword [esp + 0x4008]
push 0
push 0
push eax
call fcn.00408660
add esp, 0xc
lea ecx, [esp]
push 0x1000
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 0x1000
jae 0x407eb3
test eax, eax
je 0x407eb3
push 0x1000
lea eax, [esp + 0x2004]
push eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, 0x1000
jae 0x407eb3
test eax, eax
je 0x407eb3
push 0
lea eax, [esp + 0x2004]
push 0
push eax
call fcn.004086e0
add esp, 0xc
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040b553
add esp, 0x4004
ret
mov ecx, dword [esp + 0x4000]
xor eax, eax
xor ecx, esp
call fcn.0040b553
add esp, 0x4004
ret

Function at 0x407f90
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x2068
call fcn.0040b890
mov eax, dword [0x437040]
xor eax, esp
mov dword [esp + 0x2064], eax
mov eax, dword [esp + 0x206c]
lea ecx, [esp + 0x64]
push 0x1000
push ecx
add eax, 8
push eax
call fcn.00408660
add esp, 0xc
push 1
push 0x407b20
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x407fe3
push str.LOADER:_failed_to_install_console_ctrl_handler__n
call fcn.004028a0
add esp, 4
push str.LOADER:_setting_up_to_run_child_n
call fcn.004028a0
add esp, 4
mov dword [esp + 4], 0xc
lea eax, [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 1
mov dword [esp + 0x24], 0
push 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x50], 0x101
mov word [esp + 0x54], ax
call fcn.00413338
push eax
call fcn.00417a5f
push eax
call fcn.00415fc4
xor ecx, ecx
cmp eax, 0xffffffff
push 1
cmove eax, ecx
mov dword [esp + 0x68], eax
call fcn.00413338
push eax
call fcn.00417a5f
push eax
call fcn.00415fc4
xor ecx, ecx
cmp eax, 0xffffffff
push 2
cmove eax, ecx
mov dword [esp + 0x78], eax
call fcn.00413338
push eax
call fcn.00417a5f
push eax
call fcn.00415fc4
xor ecx, ecx
cmp eax, 0xffffffff
push str.LOADER:_creating_child_process_n
cmove eax, ecx
mov dword [esp + 0x88], eax
call fcn.004028a0
add esp, 0x28
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
push 1
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40811b
push str.LOADER:_waiting_for_child_process_to_finish..._n
call fcn.004028a0
add esp, 4
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp]
mov ecx, dword [esp + 0x2064]
xor ecx, esp
call fcn.0040b553
add esp, 0x2068
ret
push str.Failed_to_create_child_process__n
push 0x42abc4
call fcn.00402700
mov ecx, dword [esp + 0x206c]
add esp, 8
xor ecx, esp
or eax, 0xffffffff
call fcn.0040b553
add esp, 0x2068
ret
Function at 0x4081a0
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x4010
call fcn.0040b890
mov eax, dword [0x437040]
xor eax, esp
mov dword [esp + 0x400c], eax
push ebx
push esi
mov esi, dword [esp + 0x401c]
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push ebx
mov dword [esp + 0x20], ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x4083b1
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4083b1
push 1
push eax
call fcn.00412e63
add esp, 8
mov dword [esp + 8], eax
test eax, eax
je 0x4083b1
push ebp
push edi
lea ecx, [esp + 0x14]
push ecx
push dword [esp + 0x18]
push eax
push ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x4083a2
push 0x1000
lea eax, [esp + 0x2020]
push eax
lea eax, [esi + 0x2012]
push eax
call fcn.00408660
add esp, 0xc
test eax, eax
je 0x4083a2
lea esi, [esp + 0x201c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x408257
mov ebp, dword [esp + 0x14]
sub esi, ecx
shr ebp, 2
xor ebx, ebx
push ebp
push str.LOADER:_found__d_loaded_DLLs..._n
sar esi, 1
call fcn.004028a0
add esp, 8
xor edi, edi
test ebp, ebp
je 0x4082c0
mov ecx, dword [esp + 0x10]
nop word [eax + eax]
push 0x1000
lea eax, [esp + 0x20]
push eax
push dword [ecx + edi*4]
push dword [esp + 0x24]
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
jne 0x408308
push str.LOADER:_could_not_resolve_DLLs_name___skipping__n
call fcn.004028a0
add esp, 4
mov ecx, dword [esp + 0x10]
inc edi
cmp edi, ebp
jl 0x408290
push ebx
push str.LOADER:_found__d_DLL_s__loaded_from_applications_temporary_directory__n
call fcn.004028a0
add esp, 8
test ebx, ebx
jle 0x4083a2
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
nop
push 0x1000
lea eax, [esp + 0x20]
push eax
push dword [edi]
push ebp
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
jne 0x408341
push str.LOADER:_could_not_resolve_DLLs_name__was_it_unloaded_____skipping__n
call fcn.004028a0
add esp, 4
jmp 0x408396
lea eax, [esp + 0x1c]
push eax
push str.LOADER:_loaded_DLL:__ls_n
call fcn.004028a0
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x202c]
push eax
call fcn.00415530
add esp, 0x14
test eax, eax
jne 0x4082b7
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + edi*4]
mov dword [ecx + ebx*4], eax
inc ebx
jmp 0x4082bb
lea eax, [esp + 0x1c]
push eax
push str.LOADER:_forcing_unload_of__ls_n
call fcn.004028a0
add esp, 8
mov esi, 1
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x408388
cmp esi, 0x20
jge 0x4083c8
lea eax, [esp + 0x1c]
push eax
push str.LOADER:_forcing_unload_of__ls_n
call fcn.004028a0
add esp, 8
inc esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x408364
push esi
push str.LOADER:_DLL_unloaded_after__d_attempt_s___n
call fcn.004028a0
add esp, 8
add edi, 4
sub ebx, 1
jne 0x4082e0
mov ebp, dword [esp + 0x10]
push ebp
call fcn.00412e6e
add esp, 4
pop edi
pop ebp
mov ecx, dword [esp + 0x4014]
pop esi
pop ebx
xor ecx, esp
call fcn.0040b553
add esp, 0x4010
ret
push esi
push str.LOADER:_giving_up_after__d_attempts__n
jmp 0x40838e
Function at 0x40c0ea
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40c129
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40c129
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c129
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40c129
cmp dword [ecx + 0x74], 0xe
jbe 0x40c129
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x413bf8
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x437040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x42f330
push esi
call fcn.0041c0ce
pop ecx
pop ecx
test eax, eax
jne 0x413c26
xor al, al
jmp 0x413ca3
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.00413939
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x413c60
push dword [ebp - 0x210]
call fcn.00412e6e
xor al, al
jmp 0x413ca1
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x413c66
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x413c86
push edx
call fcn.00413b2f
pop ecx
test al, al
je 0x413c51
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x413c94
mov bl, 1
push dword [ebp - 0x210]
call fcn.00412e6e
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040b553
leave
ret