joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421ee0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x470ff0]
xor eax, ebp
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0042beb0
add esp, 4
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00429350
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x421f1f
xor al, al
jmp 0x4220d9
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00429450
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x421f4b
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004293f0
add esp, 4
xor al, al
jmp 0x4220d9
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x40], 0
jmp 0x421f61
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cdq
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2ac], edx
mov ecx, dword [ebp - 0x2ac]
cmp ecx, dword [ebp - 0xc]
ja 0x4220ca
jb 0x421f91
mov edx, dword [ebp - 0x2b0]
cmp edx, dword [ebp - 0x10]
jae 0x4220ca
push 0
push 0
push 0
push 0
push 0x100
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x1a0]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004294d0
add esp, 0x20
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x421fc6
jmp 0x4220ca
mov byte [ebp - 0x2a8], 0
push 0x103
push 0
lea eax, [ebp - 0x2a7]
push eax
call fcn.004322b0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2a8]
push edx
call fcn.00434330
add esp, 8
push 0x461f8c
lea eax, [ebp - 0x2a8]
push eax
call fcn.00434340
add esp, 8
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x2a8]
push edx
call fcn.00434340
add esp, 8
lea eax, [ebp - 0x148]
push eax
call fcn.00421e80
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x42205e
lea edx, [ebp - 0x2a8]
push edx
call fcn.00433a00
add esp, 4
mov byte [ebp + eax - 0x2a9], 0
push 0
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x422083
lea ecx, [ebp - 0x2a8]
push ecx
lea edx, [ebp - 0x1a0]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00421b40
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x422083
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x40]
add eax, 1
cdq
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b4], edx
mov edx, dword [ebp - 0x2b4]
cmp edx, dword [ebp - 0xc]
ja 0x4220c5
jb 0x4220ae
mov eax, dword [ebp - 0x2b8]
cmp eax, dword [ebp - 0x10]
jae 0x4220c5
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00429e50
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4220c5
jmp 0x4220ca
jmp 0x421f58
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004293f0
add esp, 4
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0x44]
xor ecx, ebp
call fcn.00432039
mov esp, ebp
pop ebp
ret
Function at 0x4244d0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x472594], 0
je 0x4244e9
call fcn.004241c0
mov dword [ebp - 0xc], eax
jmp 0x4244f0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [0x472598]
push ecx
mov edx, dword [0x4725a4]
push edx
mov eax, dword [0x4725a0]
push eax
mov ecx, dword [0x4725b8]
push ecx
call fcn.00423140
add esp, 0x10
mov edx, dword [0x4725a8]
add edx, 1
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004222f0
add esp, 8
push 1
push 0x4725c0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00422270
add esp, 0xc
mov dword [ebp - 8], 0x4725c0
mov eax, dword [0x472598]
cdq
mov ecx, 0x1fe
idiv ecx
add eax, 1
mov edx, dword [ebp - 8]
mov word [edx + 6], ax
mov eax, dword [0x4725a8]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004222f0
add esp, 8
push 1
push 0x4725c0
mov edx, dword [ebp + 8]
push edx
call fcn.004222b0
add esp, 0xc
mov eax, dword [0x4725a4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004222f0
add esp, 8
mov edx, dword [0x4725a0]
push edx
mov eax, dword [0x4725b8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004222b0
add esp, 0xc
cmp dword [0x472594], 0
je 0x4245f8
mov edx, dword [ebp - 4]
cmp edx, dword [0x472590]
jge 0x4245f8
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 1
je 0x4245f8
mov edx, dword [ebp + 8]
mov eax, dword [edx]
and eax, 2
jne 0x4245f8
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004222f0
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esp, ebp
pop ebp
ret
Function at 0x424a30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 2]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004222f0
add esp, 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 6]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x4725b4]
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, 0x200
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 0
je 0x424b8c
mov edx, dword [ebp - 4]
shl edx, 6
cmp dword [ebp - 8], edx
jbe 0x424a8f
mov eax, dword [ebp - 4]
shl eax, 6
mov dword [ebp - 0x24], eax
jmp 0x424a95
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
xor edx, edx
div dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x4725c0
cmp dword [ebp - 4], 0x200
jne 0x424ae3
mov edx, dword [ebp - 0x1c]
push edx
push 0x4725c0
mov eax, dword [ebp + 0x10]
push eax
call fcn.004389a4
add esp, 0xc
cmp eax, dword [ebp - 0x1c]
je 0x424ade
xor al, al
jmp 0x424b8e
jmp 0x424b69
mov dword [ebp - 0x18], 0
jmp 0x424afe
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jae 0x424b69
mov ecx, dword [ebp - 0x14]
sub ecx, 1
cmp dword [ebp - 0x18], ecx
jne 0x424b24
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x1fe
mov eax, dword [ebp - 0x1c]
sub eax, edx
mov dword [ebp - 0x28], eax
jmp 0x424b2b
mov dword [ebp - 0x28], 0x1fe
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
shl eax, 9
add eax, 0x4725c0
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004389a4
add esp, 0xc
cmp eax, dword [ebp - 0x20]
je 0x424b56
xor al, al
jmp 0x424b8e
mov edx, dword [ebp - 0x18]
shl edx, 9
mov ax, word [ebp - 0xc]
mov word [edx + 0x4727be], ax
jmp 0x424aec
mov ecx, dword [ebp - 0x14]
push ecx
push 0x4725c0
mov edx, dword [ebp + 8]
push edx
call fcn.004222b0
add esp, 0xc
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
jmp 0x424a6f
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x425a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x470ff0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 4], 0
jmp 0x425ac9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jge 0x425b78
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx*4]
movsx edx, byte [ecx]
cmp edx, 0x2d
je 0x425aeb
jmp 0x425b78
push str.__append
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + eax*4]
push edx
call fcn.00438090
add esp, 8
test eax, eax
je 0x425b21
push 0x462464
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + eax*4]
push edx
call fcn.00438090
add esp, 8
test eax, eax
jne 0x425b2a
xor al, al
jmp 0x425cc4
push str.__string
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + eax*4]
push edx
call fcn.00438090
add esp, 8
test eax, eax
je 0x425b60
push 0x462474
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + eax*4]
push edx
call fcn.00438090
add esp, 8
test eax, eax
jne 0x425b6c
mov dword [ebp - 0x218], 1
jmp 0x425b73
xor al, al
jmp 0x425cc4
jmp 0x425ac0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
lea eax, [edx + ecx*4]
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0xc], 2
jge 0x425b9a
xor al, al
jmp 0x425cc4
mov dword [ebp - 0x21c], 0
cmp dword [ebp - 0x218], 0
je 0x425bea
mov dword [ebp - 4], 1
jmp 0x425bbf
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jge 0x425be8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + eax*4]
push edx
mov eax, dword [ebp - 0x21c]
push eax
call fcn.00425710
add esp, 8
mov dword [ebp - 0x21c], eax
jmp 0x425bb6
jmp 0x425c60
push 0x462478
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
push edx
call fcn.004342b8
add esp, 8
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x425c14
xor al, al
jmp 0x425cc4
mov eax, dword [ebp - 0x214]
push eax
push 0x200
lea ecx, [ebp - 0x208]
push ecx
call fcn.0043911e
add esp, 0xc
test eax, eax
je 0x425c51
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp - 0x21c]
push eax
call fcn.00425710
add esp, 8
mov dword [ebp - 0x21c], eax
jmp 0x425c14
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.00433de2
add esp, 4
mov edx, dword [ebp - 0x21c]
mov byte [edx + 0x4725c0], 0
push 0x46247c
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
call fcn.004342b8
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x425c93
xor al, al
jmp 0x425cc4
mov edx, dword [ebp - 0x20c]
push edx
push 1
mov eax, dword [ebp - 0x21c]
add eax, 1
push eax
push 0x4725c0
call fcn.00433fc0
add esp, 0x10
mov ecx, dword [ebp - 0x20c]
push ecx
call fcn.00433de2
add esp, 4
mov al, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00432039
mov esp, ebp
pop ebp
ret
Function at 0x426600
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x470ff0]
xor eax, ebp
mov dword [ebp - 0xc], eax
movsx eax, byte [ebp + 8]
push eax
push 0x4626a4
lea ecx, [ebp - 0x24]
push ecx
call fcn.00434042
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x426650
or eax, 0xffffffff
jmp 0x426736
push 0
lea eax, [ebp - 8]
push eax
push 0xc
lea ecx, [ebp - 0x34]
push ecx
push 0
push 0
push 0x2d1080
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x42667b
or eax, 0xffffffff
jmp 0x426736
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
jmp 0x426697
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x14
jge 0x426733
mov edx, dword [ebp - 4]
push edx
push 0x4626ac
lea eax, [ebp - 0x24]
push eax
call fcn.00434042
add esp, 0xc
push 0
push 0xa0000000
push 3
push 0
push 3
mov ecx, dword [ebp + 0xc]
neg ecx
sbb ecx, ecx
and ecx, 0x40000000
or ecx, 0x80000000
push ecx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4266ec
jmp 0x42668e
push 0
lea eax, [ebp - 8]
push eax
push 0xc
lea ecx, [ebp - 0x40]
push ecx
push 0
push 0
push 0x2d1080
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x426724
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x40]
jne 0x426724
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x3c]
jne 0x426724
mov eax, dword [ebp - 0x28]
jmp 0x426736
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42668e
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00432039
mov esp, ebp
pop ebp
ret

Function at 0x426f40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
shl eax, 9
mov dword [ebp - 4], eax
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x426f76
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
je 0x426f7d
mov eax, 1
jmp 0x426f8e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x426fa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
shl eax, 9
mov dword [ebp - 4], eax
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x426fd6
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
je 0x426fdd
mov eax, 1
jmp 0x426fee
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x427030
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x470ff0]
xor eax, ebp
mov dword [ebp - 0x20], eax
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 2
je 0x4270d8
push 0
lea edx, [ebp - 0x1c]
push edx
push 0x28
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x700a0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x427087
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov cl, 9
call fcn.004323e0
jmp 0x42710a
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x18
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0x70000
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4270d1
mov ecx, dword [ebp - 0xc]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004323a0
mov ecx, dword [ebp - 8]
xor esi, esi
push esi
push ecx
push edx
push eax
call fcn.004323a0
jmp 0x42710a
or eax, 0xffffffff
jmp 0x42710a
lea edx, [ebp - 0x4c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffff
jne 0x4270f7
mov eax, dword [ebp - 0x50]
jmp 0x42710a
mov eax, dword [ebp - 0x50]
shr eax, 9
mov edx, dword [ebp - 0x4c]
shl edx, 0x17
or eax, edx
jmp 0x42710a
pop esi
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00432039
mov esp, ebp
pop ebp
ret
Function at 0x427120
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x470ff0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 2
jne 0x427141
xor eax, eax
jmp 0x427241
push 0
lea edx, [ebp - 4]
push edx
push 0xc
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0x2d1080
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x42716e
xor eax, eax
jmp 0x427241
push str..A:
lea eax, [ebp - 0x10]
push eax
call fcn.00434330
add esp, 8
mov byte [ebp - 0x11], 0x43
jmp 0x42718e
mov cl, byte [ebp - 0x11]
add cl, 1
mov byte [ebp - 0x11], cl
movsx edx, byte [ebp - 0x11]
cmp edx, 0x5a
jge 0x42723f
mov al, byte [ebp - 0x11]
mov byte [ebp - 0xc], al
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x4271c5
jmp 0x427185
push 0
lea edx, [ebp - 4]
push edx
push 0xc
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0x2d1080
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4271f8
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x2c]
jne 0x4271f8
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x28]
je 0x427204
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x427185
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
push 0
push 0x90018
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x42722c
mov eax, 1
jmp 0x427241
movsx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 0x30]
mov dword [ecx*4 + 0x47a4cc], edx
jmp 0x427185
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00432039
mov esp, ebp
pop ebp
ret

Function at 0x4272f0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea edx, [ebp - 8]
push edx
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x431da8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x47a8a0], 0
push esi
jne 0x431d16
call fcn.00431c2a
test eax, eax
je 0x431d59
mov eax, dword [0x47a8a0]
cmp eax, 1
jne 0x431d37
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x431d59
pop esi
ret
push eax
call dword [0x47a8a8]
test eax, eax
jne 0x431da1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x431d5d
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x47a8a0]
call dword [0x47a8a8]
mov edi, eax
test edi, edi
je 0x431d82
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x431d9e
mov edi, esi
add esi, 0xff0
push edi
push dword [0x47a8a0]
call dword [0x47a8a4]
add edi, 0x10
cmp edi, esi
jb 0x431d8a
mov eax, edi
pop edi
pop esi
ret
jmp 0x431d03

Function at 0x432039
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x470ff0]
jne 0x432043
repz ret
jmp fcn.0043aca7

Function at 0x45827a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043cec4
and dword [ebp - 4], 0
cmp dword [0x47b3f4], 0
mov ebx, eax
jne 0x45832b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4583dc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4583dc
push eax
call fcn.0043ce52
mov dword [esp], 0x46883c
push edi
mov dword [0x47b3f4], eax
call esi
push eax
call fcn.0043ce52
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47b3f8], eax
call esi
push eax
call fcn.0043ce52
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47b3fc], eax
call esi
push eax
call fcn.0043ce52
pop ecx
mov dword [0x47b404], eax
test eax, eax
je 0x45832b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043ce52
pop ecx
mov dword [0x47b400], eax
mov eax, dword [0x47b400]
cmp eax, ebx
je 0x458383
cmp dword [0x47b404], ebx
je 0x458383
push eax
call fcn.0043cecd
push dword [0x47b404]
mov esi, eax
call fcn.0043cecd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x458383
test edi, edi
je 0x458383
call esi
test eax, eax
je 0x45837a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45837a
test byte [ebp - 0xc], 1
jne 0x458383
or dword [ebp + 0x10], 0x200000
jmp 0x4583bc
mov eax, dword [0x47b3f8]
cmp eax, ebx
je 0x4583bc
push eax
call fcn.0043cecd
pop ecx
test eax, eax
je 0x4583bc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4583bc
mov eax, dword [0x47b3fc]
cmp eax, ebx
je 0x4583bc
push eax
call fcn.0043cecd
pop ecx
test eax, eax
je 0x4583bc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47b3f4]
call fcn.0043cecd
pop ecx
test eax, eax
je 0x4583dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4583de
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x53faa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa4000]
push edi
or ebp, 0xffffffff
jmp 0x53fac2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x53fac9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53fab8
mov eax, 1
add ebx, ebx
jne 0x53fadb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x53faec
jne 0x53fb0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53fb0b
dec eax
add ebx, ebx
jne 0x53faf8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x53fad0
add ebx, ebx
jne 0x53fb07
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x53fb5d
xor ecx, ecx
sub eax, 3
jb 0x53fb23
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53fb92
sar eax, 1
mov ebp, eax
jmp 0x53fb2e
add ebx, ebx
jne 0x53fb2e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53fafc
inc ecx
add ebx, ebx
jne 0x53fb3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53fafc
add ebx, ebx
jne 0x53fb49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x53fb3e
jne 0x53fb5a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x53fb3e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x53fb7c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x53fb6e
jmp 0x53fabe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x53fb7c
add edi, ecx
jmp 0x53fabe
pop esi
mov edi, esi
mov ecx, 0x31f1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x53fb9a
cmp byte [edi], 0x22
jne 0x53fb9a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x53fb9f
lea edi, [esi + 0x13c000]
mov eax, dword [edi]
or eax, eax
je 0x53fc17
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x143078]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1431a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x53fbcc
mov ecx, edi
jns 0x53fbfb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1431a8]
or eax, eax
je 0x53fc11
mov dword [ebx], eax
add ebx, 4
jmp 0x53fbe9
call dword [esi + 0x1431b8]
mov ebp, dword [esi + 0x1431ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x53fc4b
sub esp, 0xffffff80
jmp 0x46ae06
Function at 0x401100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x401122
pop edi
xor al, al
pop esi
ret
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
jne 0x401137
pop ebx
pop edi
xor al, al
pop esi
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401131
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x401131
mov edx, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, dword [esp + 0x20]
mov dword [eax], ebx
pop ebx
pop edi
mov al, 1
pop esi
ret