joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x407ef8
nop
mov ecx, 0x48d07922
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section._RDATA
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x119b4392
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x403580
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, dword [0x4ac4dc]
mov ecx, dword [0x4a93e4]
sub esp, 0xc2c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x40366f
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x4ac4dc], 0x959
jne 0x403655
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
lea eax, [esp + 0x1c]
push eax
push 0
call esi
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea edx, [esp + 0x43c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call esi
push 0
push 0x402ca0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov eax, dword [esp + 0x14]
push eax
call fcn.004033d0
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x4035c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc2c
ret
Function at 0x40721c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f238]
jne 0x407226
repz ret
jmp fcn.0040c525

Function at 0x40d01f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a738
and dword [ebp - 4], 0
cmp dword [0x442278], 0
mov ebx, eax
jne 0x40d0d0
push 0x4024a4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d181
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402498
push edi
call esi
test eax, eax
je 0x40d181
push eax
call fcn.0040a6c6
mov dword [esp], 0x402488
push edi
mov dword [0x442278], eax
call esi
push eax
call fcn.0040a6c6
mov dword [esp], 0x402474
push edi
mov dword [0x44227c], eax
call esi
push eax
call fcn.0040a6c6
mov dword [esp], 0x402458
push edi
mov dword [0x442280], eax
call esi
push eax
call fcn.0040a6c6
pop ecx
mov dword [0x442288], eax
test eax, eax
je 0x40d0d0
push 0x402440
push edi
call esi
push eax
call fcn.0040a6c6
pop ecx
mov dword [0x442284], eax
mov eax, dword [0x442284]
cmp eax, ebx
je 0x40d128
cmp dword [0x442288], ebx
je 0x40d128
push eax
call fcn.0040a741
push dword [0x442288]
mov esi, eax
call fcn.0040a741
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d128
test edi, edi
je 0x40d128
call esi
test eax, eax
je 0x40d11f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d11f
test byte [ebp - 0xc], 1
jne 0x40d128
or dword [ebp + 0x10], 0x200000
jmp 0x40d161
mov eax, dword [0x44227c]
cmp eax, ebx
je 0x40d161
push eax
call fcn.0040a741
pop ecx
test eax, eax
je 0x40d161
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d161
mov eax, dword [0x442280]
cmp eax, ebx
je 0x40d161
push eax
call fcn.0040a741
pop ecx
test eax, eax
je 0x40d161
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x442278]
call fcn.0040a741
pop ecx
test eax, eax
je 0x40d181
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d183
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401950
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
push edi
mov eax, dword [0x55c92c]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0xbc], 0
mov ecx, dword [0x55c92c]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x88], 0x6ecf8
push 0
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
movzx edx, ax
cmp edx, dword [ebp - 0x10c]
jne 0x401a00
push 0
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
movzx esi, ax
add esi, 0x40ce6
mov edi, dword [ebp - 0x10c]
and edi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
mov ebx, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
add ebx, eax
and edi, ebx
or esi, edi
mov eax, esi
xor ecx, ecx
mov edx, 0x3a8cb
sub edx, dword [ebp - 0x70]
mov esi, 0
sbb esi, dword [ebp - 0x6c]
or eax, edx
or ecx, esi
or eax, 0x1668f
mov byte [ebp - 0x81], al
jmp 0x401a3d
movzx esi, byte [ebp - 0x81]
and esi, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
or esi, eax
or esi, 0x1f283
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax - 0x1c41]
and edx, 0x1bc9a
or esi, edx
mov dword [ebp - 0x10c], esi
movzx ebx, word [ebp - 0xac]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax + 0xe2ac]
and edx, 0x42b07
or ebx, edx
mov esi, dword [ebp - 0x10c]
add esi, 0x759b8
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add eax, 0x2982c
and esi, eax
or ebx, esi
mov byte [ebp - 0x81], bl
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
add eax, dword [ebp - 0x10c]
mov esi, eax
xor edi, edi
add esi, dword [ebp - 0x70]
adc edi, dword [ebp - 0x6c]
add esi, 0x4c2b3
adc edi, 0
movzx eax, byte [ebp - 0x81]
cdq
add esi, eax
adc edi, edx
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor edx, edx
add esi, eax
adc edi, edx
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
add esi, eax
adc edi, ecx
or esi, 0x37e39
or esi, 0x64164
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
add eax, 0x59243
xor edx, edx
or esi, eax
or edi, edx
mov dword [ebp - 0x10c], esi
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
sub eax, 0x56070
movzx ecx, byte [ebp - 0x81]
sub eax, ecx
sub eax, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], eax
mov esi, 0x27ff7
sub esi, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
add esi, dword [ebp - 0x10c]
add eax, esi
and eax, 0x1873a
mov dword [ebp - 0x10c], eax
mov edx, 0xa864
mov word [ebp - 0xac], dx
mov ax, word [ebp - 0xac]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x4034a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
xor eax, eax
mov word [ebp - 0xac], ax
mov dword [ebp - 0x10c], 0x7c34b
mov dword [ebp - 0xbc], 0x6c1bf
mov ecx, 1
test ecx, ecx
je 0x403525
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
lea esi, [esi + eax - 0x78b6a]
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
add esi, eax
or esi, 0x348f7
mov dword [ebp - 0x10c], esi
jmp 0x403537
mov edx, dword [ebp - 0x10c]
add edx, 0x70ac
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
and eax, dword [ebp - 0x10c]
or eax, 0x8624
mov byte [ebp - 0x81], al
mov ecx, dword [ebp - 0x10c]
and ecx, 0x46c11
or ecx, 0x323ac
mov dword [ebp - 0x10c], ecx
mov ax, word [ebp - 0xac]
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403580
Capabilities:
Create directory
Get disk information
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov eax, dword [0x55c92c]
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x81], 0x43
movzx ecx, byte [0x55c8eb]
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0x144], 0x49158
movzx edx, byte [ebp - 0x81]
add edx, 0x5ddb6
movzx eax, word [ebp - 0xac]
sub edx, eax
and edx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], edx
mov ecx, 0x60d32
sub ecx, dword [ebp - 0x10c]
add ecx, 0x39302
sub ecx, dword [ebp - 0x10c]
movzx edx, byte [ebp - 0x81]
add ecx, edx
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0x61778
jne 0x403618
mov dword [ebp - 0x70], 0x9d7c
mov dword [ebp - 0x6c], 0
jmp 0x40364f
movzx esi, byte [ebp - 0x81]
and esi, 0x4a7db
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatA]
sub edi, eax
or esi, edi
mov dword [ebp - 0x10c], esi
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp dword [ebp - 0x10c], eax
je 0x40367f
movzx esi, byte [ebp - 0x81]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, eax
je 0x40367f
movzx eax, byte [ebp - 0x81]
cmp dword [ebp - 0x10c], eax
jne 0x4036af
mov esi, dword [ebp - 0x10c]
sub esi, 0x27616
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
mov ecx, eax
shl esi, cl
xor ecx, ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], ecx
jmp 0x403719
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
add eax, 0x62dec
sub eax, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx + 0x2db6c]
mov ecx, dword [ebp - 0x10c]
add ecx, 0x9814
shl eax, cl
and esi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeExW]
mov edi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
add edi, eax
and esi, edi
and esi, 0x52277
mov dword [ebp - 0x10c], esi
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomA]
movzx ecx, ax
and ecx, 0x64352
or ecx, 0x77a97
mov dword [ebp - 0x10c], ecx
mov ax, word [ebp - 0xac]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x404060
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
add esi, dword [ebp - 0x10c]
add esi, dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
add esi, eax
xor eax, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
mov ax, word [ebp - 0xac]
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4050c0
Capabilities:
Create mailslot
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
mov dword [ebp - 0x70], 0x2d48e
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x10c], 0x26527
movzx esi, byte [ebp - 0x81]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventA]
add esi, eax
sub esi, dword [ebp - 0x10c]
xor edi, edi
movzx eax, word [ebp - 0xac]
cdq
mov ebx, eax
add ebx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
adc eax, edx
sub ebx, 0x78d09
sbb eax, 0
mov ecx, dword [ebp - 0x10c]
xor edx, edx
sub ebx, ecx
sbb eax, edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x14c], eax
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
xor ecx, ecx
add ebx, eax
mov eax, dword [ebp - 0x14c]
adc eax, ecx
add ebx, 0x38f75
adc eax, 0
push 0
mov dword [ebp - 0x150], eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
add ebx, eax
mov eax, dword [ebp - 0x150]
adc eax, edx
sub ebx, 0x27ee4
sbb eax, 0
and esi, ebx
and edi, eax
movzx eax, byte [ebp - 0x81]
cdq
and esi, eax
and edi, edx
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
and esi, eax
and edi, ecx
mov dword [ebp - 0x10c], esi
movzx esi, word [ebp - 0xac]
and esi, 0x35025
movzx edx, word [ebp - 0xac]
mov eax, dword [ebp - 0x10c]
lea ecx, [eax + edx + 0x4f93f]
and esi, ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
sub eax, 0x543ff
and esi, eax
movzx edx, byte [ebp - 0x81]
or esi, edx
mov dword [ebp - 0x10c], esi
mov eax, 0xf066
mov word [ebp - 0xac], ax
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
movzx eax, word [ebp - 0xac]
sub edx, eax
and ecx, edx
mov dword [ebp - 0x10c], ecx
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x3eb20
and ecx, dword [ebp - 0x10c]
mov edx, 0x1ecd0
sub edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
add edx, 0x47632
and ecx, edx
and ecx, 0xa3bdd
mov dword [ebp - 0x10c], ecx
movzx eax, word [ebp - 0xac]
mov esi, dword [ebp - 0x10c]
sub esi, eax
add esi, 0x2b4c3
or esi, dword [ebp - 0x10c]
mov edi, 0x11cc0
sub edi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
add ebx, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
add eax, 0x17d24
mov ecx, eax
shr ebx, cl
and edi, ebx
or esi, edi
mov dword [ebp - 0x10c], esi
mov esi, dword [ebp - 0x10c]
movzx ecx, byte [ebp - 0x81]
sub esi, ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
add esi, eax
mov dword [ebp - 0x10c], esi
mov ax, word [ebp - 0xac]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x405a80
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0x2cb27
movzx esi, byte [ebp - 0x81]
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
sub esi, eax
xor ecx, ecx
mov edi, dword [ebp - 0x70]
add edi, 0x42582
mov ebx, dword [ebp - 0x6c]
adc ebx, 0
movzx eax, word [ebp - 0xac]
cdq
add edi, eax
adc ebx, edx
or esi, edi
or ecx, ebx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], ecx
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405ae0
Capabilities:
Create mailslot
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov dword [ebp - 0x10c], 0xe880
mov eax, dword [ebp - 0x10c]
add eax, 0x3ad68
and eax, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
movzx ecx, word [ebp - 0xac]
sub eax, ecx
and eax, 0x3c63a
movzx edx, byte [ebp - 0x81]
sub edx, 0x6e910
or eax, edx
xor ecx, ecx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ecx
cmp dword [ebp - 0x10c], 0xfdc7
jne 0x405b84
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
add eax, 0x416ef
or eax, 0x1df53
mov edx, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + edx - 0x3ac5a]
sub edx, dword [ebp - 0x10c]
or eax, edx
mov dword [ebp - 0x10c], eax
jmp 0x405ba4
mov eax, 0xefe9c
sub eax, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
and eax, ecx
or eax, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
add eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx - 0xb0c5]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x2da12
je 0x405be3
xor ecx, ecx
jne 0x405bf3
cmp dword [ebp - 0x10c], 0x20b00
je 0x405bf3
xor edx, edx
je 0x405c51
movzx esi, word [ebp - 0xac]
add esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
add esi, dword [ebp - 0x10c]
add eax, esi
and eax, dword [ebp - 0x10c]
movzx ecx, byte [ebp - 0x81]
movzx edx, byte [ebp - 0x81]
sub ecx, edx
and eax, ecx
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea ecx, [edx + ecx + 0x5e697]
add ecx, dword [ebp - 0x10c]
and eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x405cae
movzx esi, word [ebp - 0xac]
and esi, dword [ebp - 0x10c]
and esi, 0x14a92
mov edx, dword [ebp - 0x10c]
add edx, 0x2b763
or esi, edx
movzx eax, word [ebp - 0xac]
add eax, dword [ebp - 0x10c]
or esi, eax
movzx edi, word [ebp - 0xac]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
sub edi, eax
movzx ecx, word [ebp - 0xac]
sub edi, ecx
add edi, 0x13e62
or esi, edi
mov word [ebp - 0xac], si
movzx edx, word [ebp - 0xac]
add edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea esi, [eax + edx + 0x4d812]
sub esi, dword [ebp - 0x10c]
movzx edi, word [ebp - 0xac]
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomA]
movzx ecx, ax
and edi, ecx
or esi, edi
mov dword [ebp - 0x10c], esi
movzx esi, byte [ebp - 0x81]
add esi, dword [ebp - 0x10c]
and esi, 0x141a4
movzx edi, byte [ebp - 0x81]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
lea edx, [edi + eax + 0xbb1]
and esi, edx
mov dword [ebp - 0x10c], esi
mov ax, word [ebp - 0xac]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406370
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
mov dword [ebp - 0x10c], 0x6824e
mov eax, 0xf303
mov word [ebp - 0xac], ax
mov dword [ebp - 0xbc], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
add esi, dword [ebp - 0x10c]
movzx ecx, byte [ebp - 0x81]
add esi, ecx
and esi, 0x4e42d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
sub eax, dword [ebp - 0x10c]
and esi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
and esi, eax
or esi, 0xfff7cd06
or esi, 0x20ab7
mov dword [ebp - 0x10c], esi
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x406400
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
mov ax, word [0x55c92c]
mov word [ebp - 0xac], ax
xor ecx, ecx
jne 0x406444
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
cmp eax, dword [ebp - 0x10c]
je 0x406444
movzx edx, word [ebp - 0xac]
cmp edx, dword [ebp - 0x10c]
jne 0x406493
push 0
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
lea eax, [esi + eax + 0xadf75]
movzx ecx, word [ebp - 0xac]
sub eax, ecx
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx - 0x30228]
sub eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
or eax, 0x20c2
or eax, 0x46e5e
mov dword [ebp - 0x10c], eax
jmp 0x4064f9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea ecx, [edx + ecx - 0x51418]
or eax, ecx
mov edx, 0x22e3c
sub edx, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
sub ecx, 0x7407e
movzx esi, byte [ebp - 0x81]
sub ecx, esi
xor edx, ecx
or eax, edx
movzx edx, byte [ebp - 0x81]
or eax, edx
mov ecx, dword [ebp - 0x10c]
add ecx, 0x23f54
or eax, ecx
mov word [ebp - 0xac], ax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x415bd0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
push edi
mov ax, word [0x55c92c]
mov word [ebp - 0xac], ax
mov ecx, dword [0x55c92c]
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0xbc], 0x288d8
mov edx, dword [ebp - 0x10c]
cmp edx, dword [ebp - 0x10c]
je 0x415c27
movzx eax, byte [ebp - 0x81]
cmp eax, 0x2fa76
jne 0x415c88
cmp dword [ebp - 0x10c], 0x1aa95
jne 0x415c88
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
movzx ecx, byte [ebp - 0x81]
and eax, ecx
or eax, 0x757b7
xor edx, edx
mov ecx, dword [ebp - 0x70]
add ecx, 0x4f8e4
mov esi, dword [ebp - 0x6c]
adc esi, 0
mov edi, dword [ebp - 0x10c]
xor ebx, ebx
add ecx, edi
adc esi, ebx
or eax, ecx
or edx, esi
movzx ecx, byte [ebp - 0x81]
add ecx, dword [ebp - 0x10c]
xor esi, esi
or eax, ecx
or edx, esi
mov word [ebp - 0xac], ax
jmp 0x415cca
mov esi, dword [ebp - 0x10c]
add esi, 0x1f0a0
sub esi, dword [ebp - 0x10c]
add esi, 0x4e86f
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
mov edi, dword [ebp - 0x10c]
sub edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add edi, eax
or esi, edi
mov dword [ebp - 0x10c], esi
movzx edx, word [ebp - 0xac]
sub edx, 0x5e070
and edx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418440
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
mov dword [ebp - 0x10c], 0
mov eax, dword [0x55c950]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
add eax, 0x77bf0
and eax, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
or eax, ecx
mov edx, dword [ebp - 0x10c]
add edx, 0x7678b
or eax, edx
mov dword [ebp - 0x10c], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax - 0xa2a07]
and esi, edx
mov dword [ebp - 0x10c], esi
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
pop esi
mov esp, ebp
pop ebp
ret 0x18