joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426b00
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x544900]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426c70
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x426c00
cmp cl, 1
je 0x426b92
cmp cl, 2
jne 0x426c59
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042c090
nop
nop
lea eax, [0x528e20]
mov dword [esp], eax
call fcn.00409470
mov eax, dword [0x528dc4]
sub eax, dword [0x528da8]
nop
mov dword [0x528dc4], eax
mov eax, dword [0x528db4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x528db4], ecx
nop
lea eax, [0x528e20]
mov dword [esp], eax
call fcn.00409670
jmp 0x426c55
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00412bc0
nop
nop
lea eax, [0x528e20]
mov dword [esp], eax
call fcn.00409470
mov eax, dword [0x528d9c]
sub eax, dword [0x528d80]
nop
mov dword [0x528d9c], eax
mov eax, dword [0x528d8c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x528d8c], ecx
nop
lea eax, [0x528e20]
mov dword [esp], eax
call fcn.00409670
jmp 0x426c55
cmp cl, 3
jne 0x426c0b
mov byte [eax + 8], 1
jmp 0x426c55
cmp cl, 4
jne 0x426c59
nop
nop
lea eax, [0x528e20]
mov dword [esp], eax
call fcn.00409470
mov eax, dword [0x528e14]
sub eax, dword [0x528df8]
nop
mov dword [0x528e14], eax
mov eax, dword [0x528e04]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x528e04], ecx
nop
nop
lea eax, [0x528e20]
mov dword [esp], eax
call fcn.00409670
add esp, 0x14
ret
lea eax, [0x49b1bc]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00434320
nop
call fcn.0045ca90
jmp fcn.00426b00
Function at 0x44e0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x544900]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44e25a
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x44e250
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x44e13a
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x44e13a
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x44e14d
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x44e227
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x44e21b
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x44e212
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x44e1a0
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x44e1e3
mov eax, 1
cmp eax, ecx
ja 0x44e1d7
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.0045df60
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x44e20d
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x44e1dc
mov ecx, dword [esp + 0xc]
jmp 0x44e1a5
call fcn.0045df00
xor eax, eax
mov ecx, eax
call fcn.0045def0
call fcn.0045df60
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x44e24b
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x44e220
mov ecx, dword [esp + 0x18]
jmp 0x44e152
call fcn.0045df00
xor eax, eax
mov ecx, eax
call fcn.0045def0
nop
call fcn.0045ca90
jmp fcn.0044e0e0
Function at 0x452260
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x544900]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x452363
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov ecx, dword [0x544900]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0xf0], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00452990
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x48bae0]
mov dword [esp], ecx
call fcn.0040b620
mov eax, dword [esp + 4]
mov dword [eax], 0xffffffff
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax + 4], ecx
lea ecx, [0x528edc]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 2
mov dword [esp + 0xc], 2
call fcn.00451b70
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00450fc0
add esp, 0x28
ret
call fcn.0045ca90
jmp fcn.00452260

Function at 0x455570
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x544900]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45560b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x544900]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045e037
lea ecx, [0x455620]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0045c9a0
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0045ca90
jmp fcn.00455570
Function at 0x45aca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x544900]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45ae00
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x18], ecx
nop
mov dword [esp], ecx
call fcn.00409470
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x45ade9
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call fcn.0042e7f0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
call fcn.0042eed0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
call fcn.0042eed0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
test ecx, ecx
je 0x45ad70
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call fcn.0044ec50
mov eax, dword [0x5449d0]
test eax, eax
jne 0x45ad57
mov eax, dword [esp + 0x20]
jmp 0x45ad65
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
call fcn.0045de90
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x45ada7
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call fcn.0044ec50
mov eax, dword [0x5449d0]
test eax, eax
jne 0x45ad92
mov eax, dword [esp + 0x20]
jmp 0x45ada0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x78]
call fcn.0045de90
mov dword [edi], ecx
mov dword [eax + 0x78], 0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409670
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45adcd
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.0042ecb0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x45ade5
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.0042ecb0
add esp, 0x1c
ret
lea eax, [0x49f52c]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00434320
nop
call fcn.0045ca90
jmp fcn.0045aca0
Function at 0x45dd40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x544ac0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45c4cb
je 0x45c51e
cmp ebx, 0x20
jbe 0x45c524
cmp ebx, 0x40
jbe 0x45c56a
jmp 0x45c60b
test ebx, ebx
je 0x45c514
add eax, 0x10
test ax, 0xff0
je 0x45c500
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4b7c80]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4b7d80]
jmp 0x45c4e8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45c4e8
pxor xmm1, xmmword [0x544ad0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x544ad0]
pxor xmm2, xmmword [0x544ae0]
pxor xmm3, xmmword [0x544af0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x544ad0]
pxor xmm2, xmmword [0x544ae0]
pxor xmm3, xmmword [0x544af0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45c66a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x5447e6], 0
je 0x45dd5a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45c490
jmp fcn.00408080
Function at 0x45dd60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x544900]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x402edc
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00408080
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045ca90
jmp 0x402ea0
cmp byte [0x5447e6], 0
je 0x45dd7b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45c490
jmp 0x402ea0

Function at 0x45ebd0
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x45ebea
mov ecx, 0x14
jmp 0x45ebf3
shl ecx, 2
add ecx, 0xe10
mov dword [0x544900], ecx
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x414d3e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x414d4d
pop dword [ebp - 0x10]
mov eax, 0x721470f2
add eax, 0x8e2cdc5b
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xa869242f
sub dword [ebp - 0x20], 0x5a16dee4
mov dword [ebp - 0x1c], 0x2df9982d
sub dword [ebp - 0x1c], 0xfbc64be8
mov dword [ebp - 0x18], 0x23c6458f
sub dword [ebp - 0x18], 0xd77a0161
mov dword [ebp - 0x14], 0xabc332fa
add dword [ebp - 0x14], 0x543ccd06
lea eax, [ebp - 0x20]
push eax
mov eax, 0xd54a4905
sub eax, 0xd5081891
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x8d9f5940
sub dword [ebp - 0x20], 0x192cefea
mov dword [ebp - 0x1c], 0x44d0f82
add dword [ebp - 0x1c], 0x3d1f51f3
mov dword [ebp - 0x18], 0x6f7e9122
sub dword [ebp - 0x18], 0xc0f24b6
mov dword [ebp - 0x14], 0xee67f0c5
sub dword [ebp - 0x14], 0xee67f0c5
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x185b4cf7
sub eax, 0x18191bd3
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3a2a6
push 0
call eax
mov ecx, 0x39a8
mov ebx, eax
mov edi, 0x6bbc759
add edi, 0xf9877ca7
add edi, dword [ebp - 0x10]
mov edx, 0x6459e07
sub dword [ebp - 8], 0xfb108fe2
mov esi, dword [edi]
xor dword [ebp - 8], 0x8da9cf8f
sub esi, edx
xor dword [ebp - 0xc], 0xdc9f7f2
mov dword [ebx], esi
sub dword [ebp - 4], ebx
add ebx, 0x92854b71
add ebx, 0x6d7ab493
add edi, 4
loop 0x414e63
add eax, 0xd973
xor ebx, ebx
add ebx, eax
add eax, 0xec0bfde5
add eax, 0x13f40220
mov ecx, 0xf5e84173
sub ecx, 0xf5a84173
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
invalid
and eax, 0x75b3ca4e
daa
dec esi
xor al, 0x70
mov byte [edi - 0x5b], 0xf2
mov word [edi], gs
pop ds
xchg byte [edi], ch
jne 0x4153bd
invalid
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x5df23e3d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x7cf83e42
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4016de
Capabilities:
Delete file
Move file

Disassembly:
xor eax, eax
push eax
call fcn.0041cbe0
mov edx, dword [esp + 8]
lea ecx, [esp]
call fcn.00411060
push 4
push 0
push dword [esp + 8]
call sub.KERNEL32.dll_MoveFileExW
xor eax, eax
push dword [esp]
call fcn.0041cd30
add esp, 4
ret 4
Function at 0x407351
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.0041cbe0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 8]
call fcn.00411f60
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x4073ca
mov edx, dword [esp]
mov ebp, dword [edx]
mov edx, dword [ebp + 0xc]
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cc40
lea eax, [esp + 0xc]
push eax
call fcn.0041cca0
push dword [esp + 8]
push 1
push 0
call sub.KERNEL32.dll_CreateMutexW
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
jne 0x4073ca
push 0xb7
call sub.KERNEL32.dll_ExitProcess
xor eax, eax
push dword [esp + 8]
call fcn.0041cd30
add esp, 0xc
pop ebx
pop ebp
ret 4

Function at 0x407dd2
Capabilities:
Get disk size

Disassembly:
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x407dd8
call fcn.0041cbe0
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.00411060
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 4]
call fcn.00411060
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0xc]
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
and eax, eax
je 0x407ef4
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push dword [esp + 0xc]
call fcn.00412160
call fcn.0041cb70
mov edx, 0x42034a
mov ecx, dword [esp]
push ecx
call fcn.00411190
pop ecx
add ecx, eax
call fcn.004111d0
je 0x407e7b
push dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
pop dword [esp + 0x10]
jmp 0x407eef
mov edx, 0x420346
mov ecx, dword [esp]
push ecx
call fcn.00411190
pop ecx
add ecx, eax
call fcn.004111d0
je 0x407ea5
push dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
pop dword [esp + 0x10]
jmp 0x407eef
mov edx, 0x42034e
mov ecx, dword [esp]
push ecx
call fcn.00411190
pop ecx
add ecx, eax
call fcn.004111d0
je 0x407edf
push dword [esp + 0x20]
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
mov edx, dword [eax]
sub dword [esp], edx
mov edx, dword [eax + 4]
sbb dword [esp + 4], edx
pop dword [esp + 0x10]
pop dword [esp + 0x10]
jmp 0x407eef
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
call fcn.004111c0
lea eax, [esp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x407f03
push edx
push dword [esp + 8]
call fcn.0041cd30
push dword [esp + 4]
call fcn.0041cd30
pop edx
add esp, 0x20
pop ebx
ret 8
Function at 0x40aab8
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40aabf
call fcn.0041cbe0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x10c]
call fcn.00411f60
mov dword [esp + 4], eax
push dword [ebp + 0x110]
call fcn.00411f60
push edx
push eax
fild qword [esp]
fstp qword [esp]
pop dword [esp + 0xc]
pop dword [esp + 0xc]
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x40abbf
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push 0x104
call fcn.00411dd0
lea eax, [esp + 0x14]
push eax
call fcn.0041cca0
push 0x104
push dword [esp + 0x14]
call sub.KERNEL32.dll_GetSystemDirectoryW
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push 1
push 1
mov eax, 0x420028
push eax
mov eax, str.WindowsSystem32
push eax
push dword [esp + 0x28]
call fcn.00411a60
lea eax, [esp + 0x18]
push eax
call fcn.0041cca0
mov eax, 0x42034a
push eax
push dword [esp + 0x18]
call fcn.00407dd2
push edx
push eax
pop dword [esp + 0x1c]
pop dword [esp + 0x1c]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
pop edx
mov dword [esp - 8], eax
mov dword [esp - 4], edx
fild qword [esp - 8]
fld qword [esp + 8]
fcompp
fnstsw ax
test ah, 0x41
jne 0x40abbf
call fcn.00403250
xor eax, eax
push dword [esp + 0x14]
call fcn.0041cd30
push dword [esp + 0x10]
call fcn.0041cd30
add esp, 0x20
pop ebx
pop ebp
ret 4

Function at 0x40ba3c
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.0041cbe0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x48]
call fcn.00411f60
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x40baa1
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x4c]
call fcn.00411f60
mov dword [esp + 8], eax
push 0
call sub.KERNEL32.dll_GetDriveTypeW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
cmp ebx, dword [esp + 8]
jne 0x40ba97
jmp 0x40baa3
push 0
call sub.KERNEL32.dll_ExitProcess
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
ret 4
Function at 0x40dbdf
Capabilities:
Query environment variable

Disassembly:
xor eax, eax
push eax
push eax
call fcn.0041cbe0
push dword [esp + 0x10]
call fcn.004111c0
mov edx, dword [esp + 0xc]
lea ecx, [esp]
call fcn.00411060
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push 0x104
call fcn.00411dd0
lea eax, [esp + 8]
push eax
call fcn.0041cca0
push 0x104
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
and eax, eax
je 0x40dc59
mov edx, dword [esp + 4]
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cc40
pop eax
push eax
call fcn.00411190
pop edx
add eax, edx
jmp 0x40dc82
mov edx, 0x420028
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cc40
pop eax
push eax
call fcn.00411190
pop edx
add eax, edx
jmp 0x40dc82
push dword [esp + 4]
call fcn.0041cd30
push dword [esp]
call fcn.0041cd30
add esp, 8
ret 4

Function at 0x40e1e0
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
call fcn.0041cbe0
push dword [esp + 8]
call fcn.0041c5f0
push eax
call fcn.0041c7b0
mov dword [0x422b64], eax
push dword [esp + 8]
call fcn.0041c5f0
push eax
push dword [0x422b64]
push dword [esp + 0x10]
call fcn.0041c610
push 0
push 0
push 0
lea eax, [0x401411]
push eax
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [esp], eax
push 0xffffffff
push dword [esp + 4]
call sub.KERNEL32.dll_WaitForSingleObject
xor eax, eax
add esp, 4
ret 4
Function at 0x411646
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x4116de
push edi
push 0x423638
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x422c98]
test edi, edi
je 0x4116b2
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4116ab
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x422c98
call fcn.0041c198
pop ecx
pop ecx
jmp 0x4116ad
mov edi, dword [edi]
test edi, edi
jne 0x411682
pop ebx
mov eax, dword [0x422130]
mov esi, eax
inc eax
push 0x10
push 0x422c98
mov dword [0x422130], eax
call fcn.0041c1d8
pop ecx
pop ecx
push 0x423638
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x411781
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.004115fa
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0x423638
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x422c98]
jmp 0x4117b2
cmp dword [esi + 0xc], edi
je 0x4117b8
mov esi, dword [esi]
test esi, esi
jne 0x4117ab
jmp 0x4117d0
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x422c98
call fcn.0041c198
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4