joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41792c
Capabilities:
Create process on windows
Self delete
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x417934
push ebx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x417b17
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
call fcn.0040469c
lea edx, [ebp - 0x20]
mov al, 1
call fcn.00414a3c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
mov ecx, 0x417b2c
call fcn.004049a8
lea eax, [ebp - 0x18]
mov edx, 0x417b44
call fcn.00404734
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404734
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00414864
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004148c4
cmp byte [ebp - 1], 0
je 0x417a08
push 0
push 0
xor ecx, ecx
mov edx, 0x417b50
mov eax, dword [ebp - 8]
call fcn.00416a54
lea eax, [ebp - 0x18]
call fcn.0040469c
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00408b10
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0xc]
call fcn.00404734
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.00408b10
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
call fcn.00404734
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
call fcn.00408b10
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
call fcn.00404734
mov eax, dword [ebp - 8]
call fcn.004088f4
push dword [ebp - 0x1c]
push 0x417b60
push 0x417b70
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404a1c
push dword [ebp - 0x1c]
push 0x417b7c
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push 0x417b70
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404a1c
push dword [ebp - 0x1c]
push 0x417b8c
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push 0x417ba0
push 0x417b70
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404a1c
test bl, bl
je 0x417a94
push dword [ebp - 0x1c]
push 0x417bb4
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x417b70
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404a1c
push dword [ebp - 0x1c]
push 0x417b7c
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0x417b70
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404a1c
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.00414a3c
mov eax, dword [ebp - 0x30]
call fcn.00404b5c
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
cmp dword [ebp - 0x1c], 0
je 0x417ae6
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.00416a54
cmp dword [ebp - 0x1c], 0
je 0x417afc
push 0
mov eax, dword [ebp - 8]
call fcn.00404b5c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417b1e
lea eax, [ebp - 0x30]
mov edx, 0xb
call fcn.004046c0
ret
Function at 0x417bb8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x417d85
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
cmp dword [ebp - 4], 0
je 0x417d62
xor eax, eax
push ebp
push 0x417d58
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404bbc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00407f98
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov ecx, 0x417da0
call fcn.004049a8
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
add al, 0xbf
sub al, 0x1a
jae 0x417d4e
mov eax, dword [ebp - 0x10]
call fcn.00404b5c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x417d4e
push 0x417dac
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx]
call fcn.00404884
push dword [ebp - 0x1c]
push 0x417dbc
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404a1c
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 0x10]
call fcn.00404b5c
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, dword [0x436f6c]
mov edx, 0x417dc8
call fcn.00404d78
mov edx, dword [ebp - 0x10]
call fcn.00404d78
mov dl, 0x20
call fcn.004031e4
mov edx, ebx
call fcn.0040327c
call fcn.004032e4
mov eax, ebx
cdq
cmp edx, 0
jne 0x417cef
cmp eax, 0xffffffff
jne 0x417cef
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, dword [0x436f6c]
mov edx, 0x417ddc
call fcn.00404d78
mov edx, dword [ebp - 0x10]
call fcn.00404d78
mov dl, 0x20
call fcn.004031e4
mov edx, ebx
call fcn.0040327c
call fcn.004032e4
mov eax, ebx
cdq
cmp edx, 0
jne 0x417d24
cmp eax, 0xffffffff
je 0x417d4e
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0x2d4808
push ebx
call sub.kernel32.dll_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x417d62
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417d8c
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004046c0
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x4183c8
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 7
add esp, 0xfffff004
push eax
dec eax
jne 0x4183d1
mov eax, dword [ebp - 4]
add esp, 0xfffffabc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x7548], ebx
mov dword [ebp - 0x7544], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4184f2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push esi
call sub.kernel32.dll_PeekNamedPipe
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x41842c
cmp dword [ebp - 0xc], 0
ja 0x418430
xor eax, eax
jmp 0x418432
mov al, 1
mov ebx, eax
test bl, bl
je 0x4184d4
push 0
lea eax, [ebp - 8]
push eax
push 0x7530
lea eax, [ebp - 0x753d]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4184d4
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x753d], 0
lea eax, [ebp - 0x753d]
push eax
lea eax, [ebp - 0x753d]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x7544]
lea edx, [ebp - 0x753d]
mov ecx, 0x7531
call fcn.0040490c
mov edx, dword [ebp - 0x7544]
mov eax, edi
call fcn.00404964
cmp word [ebp + 0xa], 0
je 0x4184cb
lea eax, [ebp - 0x7548]
lea edx, [ebp - 0x753d]
mov ecx, 0x7531
call fcn.0040490c
mov edx, dword [ebp - 0x7548]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4184f9
lea eax, [ebp - 0x7548]
mov edx, 2
call fcn.004046c0
ret
Function at 0x419550
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x419609
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
call fcn.00414668
test al, al
je 0x419590
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004188e0
mov esi, eax
jmp 0x4195b9
call fcn.00414644
test al, al
je 0x4195aa
mov ecx, ebx
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.00418d64
mov esi, eax
jmp 0x4195b9
mov ecx, ebx
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.00418b04
mov esi, eax
test esi, esi
je 0x4195f3
mov dl, 1
mov eax, dword [0x419344]
call fcn.00403a1c
mov ebx, eax
mov eax, ebx
call fcn.0041939c
mov dword [ebx + 0x2ef0], esi
push ebx
push 0x419514
call sub.user32.dll_EnumWindows
mov eax, ebx
call fcn.004194d8
mov edi, eax
mov eax, ebx
call fcn.00403a4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419610
lea eax, [ebp - 4]
call fcn.0040469c
ret

Function at 0x41975c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x419839
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
call fcn.00414644
test al, al
je 0x41979b
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00419078
mov ebx, eax
jmp 0x4197a9
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00418b04
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x436f6c]
mov edx, 0x419850
call fcn.00404d78
call fcn.00405708
mov edx, 0x419860
call fcn.00404d78
push eax
mov eax, dword [ebp - 4]
call fcn.0040868c
mov edx, eax
pop eax
call fcn.00403234
mov edx, 0x419874
call fcn.00404d78
mov edx, dword [ebp - 4]
call fcn.00404d78
mov dl, 0x3c
call fcn.004031e4
call fcn.004032e4
test ebx, ebx
je 0x419823
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419840
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x41ff0c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee4
mov ebp, ecx
mov edi, edx
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
push eax
push 0
mov esi, dword [ebx + 4]
mov eax, esi
call fcn.00405948
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.0041feac
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fstp qword [esp]
wait
push edi
push 1
mov esi, dword [ebx + 8]
mov eax, esi
call fcn.00405948
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.0041feac
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fstp qword [esp + 8]
wait
mov eax, dword [ebx + 4]
cmp dword [eax], 0
je 0x41ffd6
fld qword [esp]
fcomp dword [0x41ffec]
fnstsw ax
sahf
je 0x41ffd6
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x14]
cmp eax, 0x1f4
jbe 0x41ffd6
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x14], eax
fld qword [esp]
fdiv dword [0x41fff0]
fdivr qword [esp + 8]
fdiv dword [0x41fff4]
fstp qword [esp + 0x10]
wait
fld qword [esp + 0x10]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea ecx, [esp + 0x28]
mov edx, 2
xor eax, eax
call fcn.00403404
lea edx, [esp + 0x1c]
lea eax, [ebx + 0x10]
call fcn.00404900
mov eax, ebp
mov edx, dword [ebx + 0x10]
call fcn.004046f0
add esp, 0x11c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x425410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x4255a3
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402a48
mov eax, 0x1869f
call fcn.00402f80
mov edx, dword [ebp - 8]
call fcn.004081ac
mov eax, dword [ebp - 4]
call fcn.0040495c
mov ebx, eax
test ebx, ebx
jle 0x42547b
mov esi, 1
lea eax, [ebp - 4]
call fcn.00404bb4
sub byte [eax + esi - 1], 0x32
inc esi
dec ebx
jne 0x42546a
lea eax, [ebp - 0x10]
call fcn.0040469c
lea eax, [ebp - 0x18]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404bbc
mov eax, dword [ebp - 0x18]
call fcn.004153d0
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00404884
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00404964
lea eax, [ebp - 4]
mov ecx, 2
mov edx, 1
call fcn.00404bfc
cmp dword [ebp - 4], 0
jne 0x425483
mov eax, dword [ebp - 0x10]
call fcn.0040495c
mov edi, eax
cmp edi, 4
jle 0x425580
mov eax, dword [ebp - 0x10]
mov al, byte [eax + edi - 2]
mov byte [ebp - 0xa], al
xor eax, eax
mov ebx, edi
test ebx, ebx
jle 0x42550a
mov esi, 1
mov edx, edi
dec edx
cmp esi, edx
je 0x425506
mov edx, dword [ebp - 0x10]
add al, byte [edx + esi - 1]
inc esi
dec ebx
jne 0x4254f8
cmp al, byte [ebp - 0xa]
jne 0x425580
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + edi - 1]
xor al, dl
mov byte [ebp - 9], al
mov ebx, edi
dec ebx
sub ebx, 2
jl 0x425548
inc ebx
mov esi, 2
lea eax, [ebp - 0x10]
call fcn.00404bb4
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + esi - 1]
xor dl, byte [ebp - 9]
mov byte [eax + esi - 1], dl
inc esi
dec ebx
jne 0x42552e
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 1]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 2]
mov esi, eax
and esi, 0xff
add esi, 3
inc esi
and eax, 0xff
sub edi, eax
xor eax, eax
mov al, dl
sub edi, eax
sub edi, 4
mov eax, dword [ebp - 8]
push eax
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.00404bbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4255aa
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004046c0
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x4255b4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x425681
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x4255eb
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00408508
mov esi, eax
push 0
push 0
xor edx, edx
mov eax, esi
call fcn.00416750
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.0040858c
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.0040858c
cmp byte [ebp - 5], 0x4d
jne 0x42565e
cmp byte [ebp - 6], 0x5a
jne 0x42565e
push 0
push pe_nt_image_headers32
xor edx, edx
mov eax, esi
call fcn.00416750
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.0040858c
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.0040858c
cmp byte [ebp - 5], 0x50
jne 0x42565e
cmp byte [ebp - 6], 0x45
jne 0x42565e
mov bl, 1
cmp dword [ebp - 4], 0
je 0x42566b
mov eax, esi
call fcn.0040861c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425688
lea eax, [ebp - 4]
call fcn.0040469c
ret

Function at 0x425834
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x4258b8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404bbc
mov eax, dword [ebp - 0x18]
call fcn.00404b5c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x42589a
mov ebx, dword [ebp - 8]
imul ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4258bf
lea eax, [ebp - 0x18]
call fcn.0040469c
lea eax, [ebp - 4]
call fcn.0040469c
ret

Function at 0x42a720
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, ecx
mov edi, edx
mov dword [esp], eax
xor ebp, ebp
test esi, esi
jbe 0x42a7ab
mov ebx, 1
mov eax, esi
xor edx, edx
push edx
push eax
push 0
push 0x10000
call fcn.00412228
mov dword [esp + 4], eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, edi
call fcn.00404bb4
lea eax, [eax + ebx - 1]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x42a778
or ebp, 0xffffffff
add ebx, dword [esp + 8]
sub esi, dword [esp + 8]
xor eax, eax
call fcn.004131ac
cmp ebp, 0xffffffff
je 0x42a797
mov eax, dword [edi]
call fcn.0040495c
cmp ebx, eax
jle 0x42a739
mov eax, dword [edi]
call fcn.0040495c
cmp ebx, eax
jle 0x42a7ab
mov eax, dword [edi]
call fcn.0040495c
mov ebp, eax
mov eax, ebp
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42b5ec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x42b7cf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x436e78], 0
jne 0x42b79d
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x38
call fcn.00402f60
mov bl, 0x43
lea esi, [ebp - 0x50]
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404884
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x18]
mov ecx, 0x42b7e8
call fcn.004049a8
mov eax, dword [ebp - 0x18]
call fcn.00404b5c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x42b706
lea eax, [ebp - 0x10]
mov ecx, 0x42b7f4
mov edx, dword [ebp - 0x18]
call fcn.004049a8
mov eax, dword [ebp - 0x10]
call fcn.0040869c
test al, al
je 0x42b6b8
push dword [ebp - 0x10]
push 0x42b804
push 0
push 0x2710
push 0
push 0x186a0
lea eax, [ebp - 0x58]
call fcn.00412700
push dword [ebp - 0x58]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404a1c
mov eax, dword [ebp - 0x10]
call fcn.004086c0
lea eax, [ebp - 0x14]
mov ecx, 0x42b814
mov edx, dword [ebp - 0x10]
call fcn.004049a8
push 0
push 0
xor ecx, ecx
mov edx, 0x42b828
mov eax, dword [ebp - 0x14]
call fcn.00416a54
mov eax, dword [ebp - 0x14]
call fcn.0040868c
test al, al
je 0x42b6fa
mov eax, dword [ebp - 0x10]
call fcn.00416dec
fstp qword [esi]
wait
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.004176ec
inc ebx
add esi, 8
cmp bl, 0x46
jne 0x42b63d
lea edx, [ebp - 0x60]
mov al, 1
call fcn.00414a3c
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00407f98
mov eax, dword [ebp - 0x5c]
mov dl, byte [eax]
mov byte [ebp - 9], dl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov bl, 0x43
lea ecx, [ebp - 0x50]
fld qword [ecx]
fcomp qword [ebp - 8]
fnstsw ax
sahf
jbe 0x42b755
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov byte [ebp - 9], bl
inc ebx
add ecx, 8
cmp bl, 0x46
jne 0x42b73d
cmp dl, byte [ebp - 9]
je 0x42b79d
lea eax, [ebp - 0x64]
mov dl, byte [ebp - 9]
call fcn.00404884
mov edx, dword [ebp - 0x64]
mov eax, 0x436e78
mov ecx, 0x42b834
call fcn.004049a8
mov eax, dword [0x436e78]
call fcn.0040869c
test al, al
je 0x42b79d
mov eax, 0x436e78
mov edx, 0x42b804
call fcn.00404964
cmp dword [0x436e78], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b7d6
lea eax, [ebp - 0x64]
mov edx, 5
call fcn.004046c0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004046c0
ret
Function at 0x42e138
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x42e1c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402f60
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], si
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404b5c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x42e1af
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e1cc
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x431c9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x431d98
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x431dac
call fcn.00421c08
mov eax, dword [0x43702c]
cmp dword [eax], 0
jg 0x431d73
lea eax, [ebp - 0xc]
call fcn.0042c7c8
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x431dd8
call fcn.004049a8
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004029a4
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00408a14
push dword [ebp - 0x10]
lea edx, [ebp - 0x18]
mov eax, dword [0x436fa8]
mov eax, dword [eax]
call fcn.00425ef0
push dword [ebp - 0x18]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404a1c
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x431e00
call fcn.004049a8
mov eax, dword [ebp - 0x1c]
call fcn.00421c08
push 0
mov eax, dword [ebp - 8]
call fcn.00404b5c
push eax
call sub.kernel32.dll_WinExec
push 0
push 0x3e8
xor eax, eax
call fcn.00413234
mov eax, 0x431e18
call fcn.00421c08
push 0
push 0
push 2
mov eax, dword [0x436f38]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
mov eax, 0x431e3c
call fcn.00421c08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431d9f
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004046c0
ret
Function at 0x432d64
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x432eff
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00414864
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x425350]
call fcn.00425b34
call fcn.004262f0
mov dword [ebp - 0xc], eax
mov ebx, 0x46
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x432db9
add ebx, 0x34
mov esi, 0x14
mov edi, 0x154
mov dword [ebp - 8], 0x12
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x438660]
push eax
push 0
mov edx, 0x432f10
mov eax, 0x432f14
mov ecx, 0x50000000
call fcn.00406ecc
mov edx, dword [0x4370cc]
mov dword [edx], eax
mov ebx, 0x46
mov esi, 0x26
mov edi, 0x188
mov dword [ebp - 8], 0xd
push 0x50000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x438660]
push eax
push 0
mov edx, 0x432f1c
xor ecx, ecx
xor eax, eax
call fcn.00406e74
mov edx, dword [0x436fd0]
mov dword [edx], eax
mov ebx, 0x1a0
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x432e58
mov ebx, 0x46
mov esi, 0x14
mov edi, 0x2e
mov dword [ebp - 8], 0xd
push 0x40000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x438660]
push eax
push 0
mov edx, 0x432f1c
xor ecx, ecx
xor eax, eax
call fcn.00406e74
mov edx, dword [0x436f58]
mov dword [edx], eax
push 0
push 0x3e8
push 1
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetTimer
mov edx, dword [0x436f90]
mov dword [edx], eax
push 0x432f30
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff5
call sub.gdi32.dll_CreateFontA
push 0
push eax
push 0x30
mov eax, dword [0x4370cc]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432f06
lea eax, [ebp - 0x10]
call fcn.0040469c
ret