joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fc7d8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4fc88f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404110
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4fc81a
call fcn.004037b8
jmp 0x4fc896
mov eax, ebx
call fcn.00402714
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00404110
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x4fc843
call fcn.004037b8
jmp 0x4fc896
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4fc8a0
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x4fc864
call fcn.004037b8
jmp 0x4fc896
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc896
mov eax, dword [ebp - 8]
call fcn.0040272c
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fcaec
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fcb54
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00402c1c
test ebx, ebx
jne 0x4fcb29
mov word [ebp - 2], 0
lea ebx, [ebp - 2]
or esi, 0x4008
push esi
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push ebx
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fcb60
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fcde4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
push 0x4fcf48
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4fcf3e
xor eax, eax
push ebp
push 0x4fcf37
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x4fcf54
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x4fcf54
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, esi
call fcn.0042150c
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, edi
call fcn.0042150c
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, esi
call fcn.0042150c
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, edi
call fcn.0042150c
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x5295dc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fcf3e
cmp dword [ebp - 4], 0
je 0x4fcf36
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x502d14
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x502d1c
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x502e7f
push dword fs:[eax]
mov dword fs:[eax], esp
test dl, dl
je 0x502d7d
lea edx, [ebp - 8]
mov eax, dword [0x52979c]
call fcn.00405b80
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.005005b8
cmp ebx, 1
jbe 0x502db4
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x502e98
call fcn.00409a84
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00403f54
jmp 0x502db4
lea eax, [ebp - 4]
mov edx, 0x502ea8
call fcn.00403d64
cmp ebx, 1
jbe 0x502db4
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x502eb8
call fcn.00409a84
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.00403f54
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
call fcn.00403f98
mov eax, dword [ebp - 0x1c]
call fcn.00404110
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x502e47
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
jne 0x502dec
mov bl, 1
jmp 0x502e57
push 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040b5cc
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x529aa8]
call fcn.00405b80
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.005005b8
mov eax, dword [ebp - 0x28]
mov ecx, 1
pop edx
call fcn.004fdd30
mov eax, dword [ebp - 0x20]
mov cx, word [0x502ebc]
xor edx, edx
call fcn.0044b7d8
mov bl, 2
jmp 0x502e57
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp - 4]
call fcn.00403d20
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x502e86
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.00403cf0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403cf0
ret

Function at 0x5034e8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov ebx, ecx
mov esi, eax
xor eax, eax
push ebp
push 0x503582
push dword fs:[eax]
mov dword fs:[eax], esp
test edx, 0x40000000
jne 0x503534
lea edx, [ebp - 0x164]
mov eax, dword [0x529aa4]
call fcn.00405b80
mov eax, dword [ebp - 0x164]
mov edx, ebx
call fcn.005005b8
jmp 0x503569
push 0x408
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push esi
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x503562
mov eax, ebx
lea edx, [ebp - 0x50]
mov ecx, 0x50
call fcn.00403efc
jmp 0x503569
mov eax, ebx
call fcn.00403ccc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503589
lea eax, [ebp - 0x164]
call fcn.00403ccc
ret
Function at 0x503f94
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], ebx
mov ebx, ecx
test ebx, ebx
js 0x503fc7
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x503fc0
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404100
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 8]
mov edx, dword [0x4010a4]
call fcn.00404700
xor eax, eax
push ebp
push 0x504155
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x50411d
inc eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 4]
push 0x50417c
push dword [esi]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.0040400c
mov eax, dword [ebp - 0x158]
call fcn.00404110
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x504111
mov eax, dword [ebp - 0x154]
test al, 0x10
jne 0x5040f6
test al, 2
jne 0x5040f6
xor eax, eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0x50417c
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00403efc
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.0040400c
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x10]
call fcn.004fc950
call fcn.0040e11c
test al, al
je 0x5040b4
or edi, 0xffffffff
jmp 0x5040c3
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.004fcaec
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.004fc8b4
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00403efc
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax]
mov ecx, edi
mov edi, dword [eax]
call dword [edi + 0x38]
lea eax, [ebp - 0x154]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x504049
push ebx
call sub.kernel32.dll_FindClose_1
add esi, 4
dec dword [ebp - 0x14]
jne 0x50400c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50415c
lea eax, [ebp - 0x164]
mov edx, 4
call fcn.00403cf0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x4010a4]
call fcn.004045e0
lea eax, [ebp - 4]
call fcn.00403ccc
ret

Function at 0x5052ac
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x50532e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x700f0037
lea edx, [ebp - 8]
mov eax, ebx
call fcn.005053b4
mov eax, dword [ebp - 8]
call fcn.0050308c
test al, al
je 0x5052ff
mov eax, dword [ebp - 8]
call fcn.00404110
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x5052ff
and dword [ebp - 4], 0xfffbffff
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 0xc]
push eax
push 1
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x388]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505335
lea eax, [ebp - 8]
call fcn.00403ccc
ret
Function at 0x505354
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x14], 0
jne 0x50539f
push 0x208
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, ebx
call fcn.00505288
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x50539f
lea eax, [esp + 0xc]
call fcn.00409330
mov ecx, eax
lea edx, [esp + 0xc]
lea eax, [ebx + 0x14]
call fcn.00403db4
mov eax, esi
mov edx, dword [ebx + 0x14]
call fcn.00403d20
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x508e98
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404100
xor eax, eax
push ebp
push 0x508ef7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffd
sub eax, 2
jb 0x508ecf
dec eax
jne 0x508ee1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
mov bx, 0xffb5
call fcn.0040315c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x508efe
lea eax, [ebp - 4]
call fcn.00403ccc
ret

Function at 0x508f04
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x508fb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x370], 0
jne 0x508f52
push 0x465
mov eax, dword [ebp - 4]
call fcn.0042b300
mov ecx, eax
mov dl, 1
mov eax, dword [0x505548]
call fcn.005055b4
mov edx, dword [ebp - 4]
mov dword [edx + 0x370], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
call fcn.00505a74
lea eax, [ebp - 8]
mov edx, 0x508fc8
call fcn.00403d64
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x508f9d
test bl, 1
je 0x508f96
lea eax, [ebp - 8]
call fcn.0040411c
lea edx, [esi + 0x41]
mov byte [eax], dl
push ebp
mov eax, dword [ebp - 8]
call fcn.00508e98
pop ecx
shr ebx, 1
inc esi
test ebx, ebx
jne 0x508f7a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x508fba
lea eax, [ebp - 8]
call fcn.00403ccc
ret
Function at 0x509b20
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404100
xor eax, eax
push ebp
push 0x509c3e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x509c11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
or eax, 1
push eax
call sub.kernel32.dll_SetErrorMode
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x509bee
test byte [ebp - 0x14c], 0x10
jne 0x509bd1
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403efc
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00408a18
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x509b94
push ebx
call sub.kernel32.dll_FindClose_1
mov byte [ebp - 5], 1
jmp 0x509bfa
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509c18
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x50e9fc
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, eax
mov al, byte [ebx + 4]
sub al, 1
jb 0x50ea0a
je 0x50ea0f
jmp 0x50ea34
mov eax, dword [ebx + 8]
pop ebx
ret
cmp dword [ebx + 8], 0
jne 0x50ea2f
lea eax, [ebx + 8]
push eax
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
mov eax, dword [0x529a34]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 8]
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x51b120
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404100
xor eax, eax
push ebp
push 0x51b1ac
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x51b18f
mov eax, ebx
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.00403efc
jmp 0x51b196
mov eax, ebx
call fcn.00403ccc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b1b3
lea eax, [ebp - 4]
call fcn.00403ccc
ret
Function at 0x51b1b8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x51b291
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov ebx, 0x43
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403e74
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x51b2a8
call fcn.00403f98
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
je 0x51b20d
cmp eax, 2
jne 0x51b23a
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0051b120
mov eax, dword [ebp - 0xc]
mov edx, 0x51b2b4
call fcn.0040405c
jne 0x51b23a
lea eax, [edi + 0x470]
mov edx, dword [ebp - 4]
call fcn.00403d20
or esi, 0xffffffff
jmp 0x51b240
inc ebx
cmp ebx, 0x5b
jne 0x51b1db
neg esi
sbb eax, eax
neg eax
test al, al
jne 0x51b276
call fcn.00402934
test eax, eax
jle 0x51b276
lea edx, [ebp - 0x10]
mov eax, 1
call fcn.00402994
cmp dword [ebp - 0x10], 0
je 0x51b276
lea edx, [edi + 0x470]
mov eax, 1
call fcn.00402994
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b298
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403cf0
ret
Function at 0x407b4c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
sub esp, 4
fnstcw word [esp + 2]
fnstcw word [esp]
or word [esp], 0xf00
fldcw word [esp]
mov word [esp], cx
fld1
test dword [eax + 4], 0x80000000
je 0x407b1e
push dword [eax + 4]
push dword [eax]
and dword [esp + 4], 0x7fffffff
push 0x7fffffff
push 0xffffffff
fild qword [esp + 8]
fild qword [esp]
fadd st(2)
faddp st(1)
add esp, 0x10
jmp 0x407b20
fild qword [eax]
fild word [esp]
fld st(1)
dec esi
fprem
fistp word [esp]
fdiv st(1), st(0)
mov al, byte [esp]
add al, 0x30
cmp al, 0x3a
jb 0x407b38
add al, 7
mov byte [esi], al
fld st(1)
fcom st(3)
wait
fnstsw ax
sahf
jae 0x407b25
fldcw word [esp + 2]
add esp, 4
ffree st(3)
ffree st(2)
ffree st(1)
ffree st(0)
pop ecx
sub ecx, esi
sub edx, ecx
jbe 0x407b6a
sub esi, edx
mov al, 0x30
add ecx, edx
jmp 0x407b65
mov byte [edx + esi], al
dec edx
jne 0x407b62
mov byte [esi], al
ret

Function at 0x407b70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, esp
sub esp, 0x20
xor ecx, ecx
push eax
xor edx, edx
lea eax, [ebp + 8]
call fcn.00407aa0
mov edx, esi
pop eax
call fcn.0040456c
add esp, 0x20
pop esi
pop ebp
ret 8
Function at 0x41a9d8
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x30
push 0
push 0
dec ecx
jne 0x41a8bd
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41aac4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41aae0
lea eax, [ebp - 0x160]
mov edx, ebx
call fcn.004046e0
push dword [ebp - 0x160]
push 0x41aaec
lea eax, [ebp - 0x164]
mov edx, esi
call fcn.004046e0
push dword [ebp - 0x164]
lea eax, [ebp - 0x15c]
mov edx, 4
call fcn.00404800
mov edx, dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
mov ecx, 0xff
call fcn.00404718
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403074
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], di
lea eax, [ebp - 0x168]
mov edx, 0x41aaf0
call fcn.00404674
mov eax, dword [ebp - 0x168]
push eax
lea eax, [ebp - 0x16c]
mov edx, 0x41ab00
call fcn.00404674
mov eax, dword [ebp - 0x16c]
pop edx
call fcn.00417bc4
lea eax, [ebp - 0x170]
mov edx, 0x41ab08
call fcn.00404674
mov eax, dword [ebp - 0x170]
push eax
lea eax, [ebp - 0x174]
mov edx, 0x41ab00
call fcn.00404674
mov eax, dword [ebp - 0x174]
pop edx
call fcn.00417bc4
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x180]
mov edx, ebx
call fcn.004046e0
mov eax, dword [ebp - 0x180]
lea edx, [ebp - 0x17c]
call fcn.0040801c
mov eax, dword [ebp - 0x17c]
call fcn.00404940
mov edx, eax
lea eax, [ebp - 0x178]
call fcn.00404d14
mov eax, dword [ebp - 0x178]
call fcn.00404d90
push eax
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x188]
lea edx, [ebp - 0x158]
call fcn.004046e0
mov eax, dword [ebp - 0x188]
call fcn.00404940
mov edx, eax
lea eax, [ebp - 0x184]
call fcn.00404d14
mov eax, dword [ebp - 0x184]
call fcn.00404d90
push eax
push 0
mov eax, dword [0x429670]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp byte [ebp - 1], 0
je 0x41aa75
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41aacb
lea eax, [ebp - 0x188]
call fcn.0040447c
lea eax, [ebp - 0x184]
call fcn.00404c00
lea eax, [ebp - 0x180]
mov edx, 2
call fcn.004044a0
lea eax, [ebp - 0x178]
call fcn.00404c00
lea eax, [ebp - 0x174]
mov edx, 7
call fcn.004044a0
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401500
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x401526
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4015ba
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401575
cmp eax, 0x40
je 0x401575
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401519
cmp eax, 0x40
je 0x401519
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x401519
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]

Function at 0x401830
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call sym.___main
call sym._GetCommandLineA_0
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._GetStartupInfoA_4
sub esp, 4
test ebx, ebx
je 0x4018d0
movzx edx, byte [ebx]
cmp dl, 9
je 0x401914
cmp dl, 0x20
je 0x401914
cmp dl, 0x22
je 0x4018b4
cmp dl, 9
mov eax, edx
je 0x4018c8
cmp dl, 0x20
je 0x401920
test dl, dl
lea esi, [esi]
jne 0x4018a2
jmp 0x4018d0
cmp al, 0x20
je 0x401920
test al, al
nop
je 0x4018d0
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x401894
jmp 0x4018c8
cmp al, 0x22
je 0x4018be
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x4018b0
cmp al, 0x22
jne 0x4018c8
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x401920
cmp al, 9
je 0x401920
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x4018df
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 1
jmp 0x401861
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x401920
cmp al, 0x20
jne 0x4018d0
nop
jmp 0x401920