joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403680
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x1c
mov edx, dword [esp + 0x20]
push ebx
push ebp
push edi
push 0x40
push 0x1000
xor edi, edi
lea eax, [esp + 0x28]
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
mov ebx, 0x40a120
push edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x38], 0x1000
xor ebp, ebp
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], edi
sub ebx, section..text1
call sub.ntoskrnl.exe_ZwAllocateVirtualMemory
test eax, eax
je 0x4036d8
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
mov eax, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x10]
cmp eax, edi
je 0x40370a
lea edx, [eax + 2]
jmp 0x4036f0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4036f0
sub eax, edx
sar eax, 1
lea ebp, [eax + eax + 2]
lea eax, [ebx + esi]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x38]
test eax, eax
je 0x403731
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403715
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
lea edi, [ebx + ebp]
mov dword [esp + 0x14], ecx
add edi, esi
push 0x4d6c7431
push 0x2c
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ecx, eax
test ecx, ecx
je 0x403762
mov edx, dword [esp + 0x10]
mov eax, dword [0x40c330]
push edx
push eax
mov eax, dword [esp + 0x38]
mov esi, ecx
call fcn.00402360
mov dword [esp + 0x1c], eax
jmp 0x40376a
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx + 0x18]
mov esi, dword [esp + 0x10]
lea eax, [ecx + ebx]
add eax, dword [esp + 0x14]
add eax, ebp
add eax, esi
test al, 3
je 0x403789
inc eax
test al, 3
jne 0x403784
mov edx, dword [esp + 0x14]
add edx, ebx
add edx, ebp
push eax
mov eax, dword [0x40c330]
mov dword [esp + 0x2c], edx
add edx, esi
push edx
mov edx, dword [esp + 0x28]
push ecx
mov ecx, dword [0x40c5b8]
push eax
push ecx
push edx
mov ecx, ebx
call fcn.00403520
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push section..text1
push ecx
mov esi, ebx
call fcn.00403470
test eax, eax
je 0x403846
test ebp, ebp
je 0x4037f6
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x34]
push eax
lea edi, [ebx + ecx]
push edx
mov esi, ebp
call fcn.00403470
test eax, eax
je 0x403846
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40381d
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x18]
push eax
push ecx
lea edi, [ebx + ebp]
add edi, dword [esp + 0x18]
push edx
call fcn.00403470
test eax, eax
je 0x403846
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + 0x10]
mov edx, dword [esp + 0x10]
mov esi, dword [ebx + 0x18]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x30]
lea edi, [eax + edx]
push ecx
call fcn.00403470
test eax, eax
jne 0x403852
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edx
mov ecx, ebx
call fcn.00402440
pop esi
neg eax
pop edi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x404460
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
push esi
push eax
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00403c00
mov ecx, dword [esp + 0x6c]
push ecx
lea esi, [esp + 0xc]
call fcn.00403cc0
pop esi
add esp, 0x5c
ret 0xc

Function at 0x4046e0
Capabilities:
Parse pe header

Disassembly:
cmp esi, 0x40
jae 0x4046e8
xor eax, eax
ret
mov ecx, 0x5a4d
mov dword [edx + 0x18], eax
cmp word [eax], cx
jne 0x4046e5
mov ecx, dword [eax + 0x3c]
push edi
lea edi, [ecx + 0xf8]
cmp esi, edi
jb 0x404766
add eax, ecx
mov dword [edx + 0x1c], eax
cmp dword [eax], 0x4550
jne 0x404766
movzx ecx, word [eax + 0x16]
test ecx, 0x2000
je 0x404766
test cl, 2
je 0x404766
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x404766
mov edi, dword [edx + 0x1c]
push ebx
lea ecx, [eax + 0xf8]
xor ebx, ebx
mov dword [edx + 0x20], ecx
xor eax, eax
cmp bx, word [edi + 6]
pop ebx
jae 0x40475f
add ecx, 0x10
mov edi, dword [ecx + 4]
add edi, dword [ecx]
cmp edi, esi
ja 0x404766
mov edi, dword [edx + 0x1c]
movzx edi, word [edi + 6]
inc eax
add ecx, 0x28
cmp eax, edi
jl 0x404747
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x4047f0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esi + 0x1c]
movzx ecx, word [eax + 6]
mov edx, dword [eax + 0x54]
push ebx
lea ecx, [ecx + ecx*4]
push ebp
mov ebp, dword [esp + 0xc]
lea eax, [edx + ecx*8]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push ebp
call sub.ntoskrnl.exe_memcpy
mov edx, dword [esi + 0x1c]
xor eax, eax
add esp, 0xc
xor ebx, ebx
cmp ax, word [edx + 6]
jae 0x40485d
push edi
xor edi, edi
mov ecx, dword [esi + 0x20]
lea eax, [ecx + edi]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x40484d
mov edx, dword [eax + 0x10]
test edx, edx
je 0x40484d
push edx
mov edx, dword [eax + 0x14]
add edx, dword [esp + 0x18]
add ecx, ebp
push edx
push ecx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov eax, dword [esi + 0x1c]
movzx ecx, word [eax + 6]
inc ebx
add edi, 0x28
cmp ebx, ecx
jl 0x404825
pop edi
mov dword [esi + 0x18], ebp
mov edx, dword [ebp + 0x3c]
lea eax, [edx + ebp]
mov dword [esi + 0x1c], eax
add eax, 0xf8
pop ebp
mov dword [esi + 0x20], eax
pop ebx
ret 8

Function at 0x404d40
Capabilities:
Parse pe header

Disassembly:
cmp esi, 0x40
jae 0x404d48
xor eax, eax
ret
mov edx, 0x5a4d
mov dword [ecx + 0x14], eax
cmp word [eax], dx
jne 0x404d45
mov edx, dword [eax + 0x3c]
push edi
lea edi, [edx + 0xf8]
cmp esi, edi
jb 0x404db5
add eax, edx
mov dword [ecx + 0x18], eax
cmp dword [eax], 0x4550
jne 0x404db5
mov edx, 0xe0
cmp word [eax + 0x14], dx
jne 0x404db5
mov edi, dword [ecx + 0x18]
push ebx
lea edx, [eax + 0xf8]
xor ebx, ebx
mov dword [ecx + 0x1c], edx
xor eax, eax
cmp bx, word [edi + 6]
pop ebx
jae 0x404dae
add edx, 0x10
mov edi, dword [edx + 4]
add edi, dword [edx]
cmp edi, esi
ja 0x404db5
mov edi, dword [ecx + 0x18]
movzx edi, word [edi + 6]
inc eax
add edx, 0x28
cmp eax, edi
jl 0x404d96
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x404e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
test ecx, ecx
jne 0x404e55
xor eax, eax
pop ebx
add esp, 8
ret 4
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov eax, dword [eax + 0x78]
test eax, eax
je 0x404e4c
mov edx, dword [eax + ecx + 0x18]
push ebp
mov ebp, dword [eax + ecx + 0x1c]
push esi
mov esi, dword [eax + ecx + 0x24]
push edi
mov edi, dword [eax + ecx + 0x20]
add ebp, ecx
add esi, ecx
add edi, ecx
mov dword [esp + 0x1c], edx
mov edx, dword [eax + ecx + 0x10]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], esi
test ebx, 0xffff0000
jne 0x404eb4
cmp ebx, edx
jb 0x404ef7
mov eax, dword [eax + ecx + 0x14]
lea eax, [eax + edx - 1]
cmp ebx, eax
ja 0x404ef7
pop edi
sub ebx, edx
mov eax, dword [ebp + ebx*4]
pop esi
pop ebp
add eax, ecx
pop ebx
add esp, 8
ret 4
xor ebp, ebp
cmp dword [esp + 0x1c], ebp
jle 0x404ef7
lea esp, [esp]
mov eax, dword [edi + ebp*4]
add eax, ecx
mov esi, ebx
mov dl, byte [esi]
cmp dl, byte [eax]
jne 0x404ee7
test dl, dl
je 0x404ee3
mov dl, byte [esi + 1]
cmp dl, byte [eax + 1]
jne 0x404ee7
add esi, 2
add eax, 2
test dl, dl
jne 0x404ec7
xor eax, eax
jmp 0x404eec
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404f03
inc ebp
cmp ebp, dword [esp + 0x1c]
jl 0x404ec0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov edx, dword [esp + 0x10]
movzx eax, word [edx + ebp*2]
mov edx, dword [esp + 0x14]
mov eax, dword [edx + eax*4]
pop edi
pop esi
pop ebp
add eax, ecx
pop ebx
add esp, 8
ret 4
Function at 0x404f20
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
sub esp, 0x34
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
push edi
test ebp, ebp
je 0x404f4e
lea edx, [esp + 0x10]
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x404f37
lea eax, [esp + 0x10]
push eax
call sub.ntoskrnl.exe__strupr
add esp, 4
mov eax, dword [0x40dfbc]
mov dword [esp + 0x48], 0
test eax, eax
jne 0x404fb5
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x404f70
lea ecx, [esp + 0x48]
push ecx
push 0
push 0
push 0xb
call sub.ntoskrnl.exe_NtQuerySystemInformation
mov edx, dword [esp + 0x48]
push 0x4d6c7431
push edx
push 0
call esi
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x48]
push ecx
push edx
push eax
push 0xb
mov dword [0x40dfbc], eax
call sub.ntoskrnl.exe_NtQuerySystemInformation
test eax, eax
mov eax, dword [0x40dfbc]
je 0x404fb5
push 0
push eax
call edi
jmp 0x404f70
mov ebx, eax
test ebp, ebp
jne 0x404fcc
cmp dword [eax], ebp
jbe 0x405030
mov eax, dword [eax + 0xc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
xor ebp, ebp
cmp dword [eax], ebp
jbe 0x405030
xor esi, esi
lea edi, [eax + 0x1e]
movzx ecx, word [edi]
add ecx, esi
lea edx, [ecx + ebx + 0x20]
push edx
call sub.ntoskrnl.exe__strupr
movzx eax, word [edi]
add esp, 4
add eax, esi
lea ecx, [esp + 0x10]
lea eax, [eax + ebx + 0x20]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405016
test dl, dl
je 0x405012
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405016
add eax, 2
add ecx, 2
test dl, dl
jne 0x404ff6
xor eax, eax
jmp 0x40501b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40503c
inc ebp
add esi, 0x11c
add edi, 0x11c
cmp ebp, dword [ebx]
jb 0x404fd7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret 4
imul ebp, ebp, 0x11c
mov eax, dword [ebx + ebp + 0xc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
Function at 0x405cc0
Capabilities:
Parse pe header

Disassembly:
cmp esi, 0x40
jae 0x405cc8
xor eax, eax
ret
mov ecx, 0x5a4d
mov dword [edx + 0x14], eax
cmp word [eax], cx
jne 0x405cc5
mov ecx, dword [eax + 0x3c]
push edi
lea edi, [ecx + 0xf8]
cmp esi, edi
jb 0x405d47
add eax, ecx
mov dword [edx + 0x18], eax
cmp dword [eax], 0x4550
jne 0x405d47
cmp word [eax + 0x5c], 1
jne 0x405d47
mov ecx, 0x14c
cmp word [eax + 4], cx
jne 0x405d47
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x405d47
mov edi, dword [edx + 0x18]
push ebx
lea ecx, [eax + 0xf8]
xor ebx, ebx
mov dword [edx + 0x1c], ecx
xor eax, eax
cmp bx, word [edi + 6]
pop ebx
jae 0x405d40
add ecx, 0x10
mov edi, dword [ecx + 4]
add edi, dword [ecx]
cmp edi, esi
ja 0x405d47
mov edi, dword [edx + 0x18]
movzx edi, word [edi + 6]
inc eax
add ecx, 0x28
cmp eax, edi
jl 0x405d28
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x406bb0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov esi, eax
push esi
push 0x406bf0
push 0
push 0
push 0
push 0
lea edi, [esi + 0x18]
push edi
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
jne 0x406be9
push eax
add esi, 0x1c
push esi
push eax
push eax
push eax
mov eax, dword [edi]
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x407f20
Capabilities:
Create thread

Disassembly:
push ebp
push esi
mov esi, dword [0x40d038]
lea eax, [esi + 0x40]
xor ecx, ecx
mov dword [eax], ecx
push edi
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
push eax
mov dword [eax + 0xc], ecx
call fcn.00405d50
test byte [esi + 0x2c], 2
jne 0x407f7a
lea edi, [esi + 8]
push edi
push 0x408500
push 0
push 0
push 0
push 0
lea ebp, [edi + 0xc]
push ebp
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
jne 0x407f86
push eax
add edi, 0x10
push edi
push eax
push eax
push eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
or dword [esi + 0x2c], 2
mov eax, dword [esi + 0x2c]
shr eax, 1
and eax, 1
pop edi
pop esi
pop ebp
ret
and dword [esi + 0x2c], 0xfffffffd
pop edi
pop esi
xor eax, eax
pop ebp
ret
Function at 0x408530
Capabilities:
Create device object
Create thread

Disassembly:
sub esp, 0x1c
push ebx
push edi
push 0x4d6c7431
push 0x20
xor ebx, ebx
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebx
je 0x408572
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax + 0xc], ebx
xor ecx, ecx
cmp dword [ecx*4 + 0x40d77c], ebx
je 0x408565
inc ecx
cmp ecx, 0xa
jl 0x408554
jmp 0x408572
inc dword [0x40d7a4]
mov dword [ecx*4 + 0x40d77c], eax
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x40b748
lea eax, [esp + 0x14]
push eax
call edi
push str.DosDevicesHelpDetectWz
lea ecx, [esp + 0x1c]
push ecx
call edi
lea edx, [esp + 0xc]
push edx
push 1
push 0x100
push 0x22
lea eax, [esp + 0x20]
push eax
push ebx
push esi
mov dword [esp + 0x28], ebx
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, ebx
jl 0x4086a8
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
cmp edi, ebx
mov eax, dword [esp + 0xc]
jge 0x4085e0
push eax
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, edi
pop edi
pop ebx
add esp, 0x1c
ret
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x70]
push 0xc8
push ebx
push 0x40d694
mov dword [0x40d4e4], ecx
mov dword [0x40d690], edx
mov dword [esi + 0x70], 0x408790
mov dword [0x40d778], esi
mov dword [0x40d68c], eax
mov dword [esi + 0x34], 0x4086b0
call dword [sym.imp.ntoskrnl.exe_KeInitializeSemaphore]
mov eax, 0x40d680
mov dword [0x40d684], eax
mov dword [0x40d680], eax
mov eax, 0x40d570
mov dword [0x40d56c], ebx
mov dword [0x40d574], eax
mov dword [0x40d570], eax
call fcn.00405100
push ebx
push 0x408d30
push ebx
push ebx
push ebx
push ebx
push 0x40d688
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, ebx
je 0x40867c
mov ecx, dword [0x40d044]
mov edx, dword [ecx]
push eax
mov eax, dword [edx]
push str.Create_Thread_Fail_Code__x
push ecx
call eax
add esp, 0xc
xor eax, eax
pop edi
pop ebx
add esp, 0x1c
ret
mov ecx, dword [sym.imp.ntoskrnl.exe_PsThreadType]
mov edx, dword [ecx]
mov eax, dword [0x40d688]
push ebx
push 0x40d568
push ebx
push edx
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ecx, dword [0x40d688]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
pop edi
pop ebx
add esp, 0x1c
ret
Function at 0x408f30
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esi + 0x18]
movzx ecx, word [eax + 6]
mov edx, dword [eax + 0x54]
push ebx
lea ecx, [ecx + ecx*4]
push ebp
mov ebp, dword [esp + 0xc]
lea eax, [edx + ecx*8]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push ebp
call sub.ntoskrnl.exe_memcpy
mov edx, dword [esi + 0x18]
xor eax, eax
add esp, 0xc
xor ebx, ebx
cmp ax, word [edx + 6]
jae 0x408f9d
push edi
xor edi, edi
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + edi]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x408f8d
mov edx, dword [eax + 0x10]
test edx, edx
je 0x408f8d
push edx
mov edx, dword [eax + 0x14]
add edx, dword [esp + 0x18]
add ecx, ebp
push edx
push ecx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov eax, dword [esi + 0x18]
movzx ecx, word [eax + 6]
inc ebx
add edi, 0x28
cmp ebx, ecx
jl 0x408f65
pop edi
mov dword [esi + 0x14], ebp
mov edx, dword [ebp + 0x3c]
lea eax, [edx + ebp]
mov dword [esi + 0x18], eax
add eax, 0xf8
pop ebp
mov dword [esi + 0x1c], eax
pop ebx
ret 8
Function at 0x401000
Capabilities:
Check if file exists
Create process on windows
Enumerate processes

Disassembly:
sub esp, 0x760
mov eax, dword [0x40b004]
xor eax, esp
mov dword [esp + 0x758], eax
mov eax, dword [0x40a2a0]
mov ecx, dword [0x40a2a4]
push esi
push 0x188
lea edx, [esp + 0x5d4]
push 0
push edx
mov dword [esp + 0x5d4], eax
mov dword [esp + 0x5d8], ecx
call fcn.004060f0
push 0x18e
lea eax, [esp + 0x44a]
push 0
push eax
mov word [esp + 0x450], 0
call fcn.004060f0
push 0x228
lea ecx, [esp + 0x28]
push 0
push ecx
mov dword [esp + 0x2c], 0
call fcn.004060f0
add esp, 0x24
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 8]
mov esi, eax
push edx
push esi
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x401112
mov edi, edi
lea eax, [esp + 0x2c]
push eax
call fcn.0040821e
push 0xc
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x444]
push edx
call fcn.00401e49
add esp, 0x10
lea ecx, [esp + 0x5c8]
lea eax, [esp + 0x438]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4010f6
test dx, dx
je 0x4010f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4010f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4010d0
xor eax, eax
jmp 0x4010fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401263
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4010a0
push 0xff
lea ecx, [esp + 0x23c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x238]
push 0x5c
push edx
call fcn.00401e86
add eax, 2
add esp, 8
cmp dword [0x4109c8], 0
mov edx, eax
jge 0x401161
mov ecx, str.XBDAutoUpdate.exe
sub edx, ecx
mov edi, edi
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x401150
jmp 0x40117f
mov ecx, str.XBDDSAutoUpdate.exe
sub edx, ecx
jmp 0x401170
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x401170
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [esp + 0x238]
push eax
call esi
test eax, eax
je 0x4011a6
push 1
push 0
push 0
lea ecx, [esp + 0x244]
push ecx
jmp 0x401259
mov eax, ebx
lea edx, [eax + 2]
jmp 0x4011b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4011b0
sub eax, edx
sar eax, 1
je 0x40123d
push 0x5c
push ebx
call fcn.00401e86
add eax, 2
add esp, 8
cmp dword [0x4109c8], 0
mov edx, eax
jge 0x4011f6
mov ecx, str.XBD.exe
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x4011e5
jmp 0x40120f
mov ecx, str.XBDDS.exe
sub edx, ecx
lea ecx, [ecx]
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x401200
push ebx
call esi
test eax, eax
je 0x40121f
push 1
push 0
push 0
push ebx
jmp 0x401259
lea edx, [esp + 0x238]
push edx
call esi
test eax, eax
je 0x401263
push 1
push 0
push 0
lea eax, [esp + 0x244]
push eax
jmp 0x401259
lea ecx, [esp + 0x238]
push ecx
call esi
test eax, eax
je 0x401263
push 1
push 0
push 0
lea edx, [esp + 0x244]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x75c]
pop esi
xor ecx, esp
call fcn.00401e3a
add esp, 0x760
ret
Function at 0x4018d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44c
mov eax, dword [0x40b004]
xor eax, esp
mov dword [esp + 0x448], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
mov dword [esp + 0x20], eax
call edi
lea ecx, [esp + 0x50]
mov esi, eax
push ecx
push esi
call edi
mov eax, esi
cdq
and edx, 3
add eax, edx
mov ebx, eax
sar ebx, 2
xor cl, cl
test ebx, ebx
mov dword [esp + 0x14], 0
jle 0x401a6b
lea edx, [esp + 0x50]
mov dword [esp + 0x10], edx
mov edi, edx
mov ecx, 0x40a318
mov eax, edi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401966
test dx, dx
je 0x401962
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401966
add eax, 4
add ecx, 4
test dx, dx
jne 0x401940
xor eax, eax
jmp 0x40196b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401a07
mov ecx, 0x40a320
mov eax, edi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4019a6
test dx, dx
je 0x4019a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4019a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x401980
xor eax, eax
jmp 0x4019ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401a07
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x4019c0
cmp eax, 2
jne 0x401a07
xor eax, eax
jmp 0x4019d0
movzx ecx, word [eax + str._B:]
mov word [esp + eax + 0x1c], cx
add eax, 2
test cx, cx
jne 0x4019d0
mov eax, dword [esp + 0x10]
mov cx, word [eax]
mov word [esp + 0x24], cx
xor esi, esi
lea ecx, [esp + 0x1c]
call fcn.004013b0
test al, al
jne 0x401a39
add esi, 1
cmp esi, 3
jl 0x4019f2
mov eax, dword [esp + 0x14]
add dword [esp + 0x10], 8
add eax, 1
add edi, 8
cmp eax, ebx
mov dword [esp + 0x14], eax
jl 0x401933
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.00401e3a
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x18]
test edx, edx
je 0x401a54
mov eax, edi
sub edx, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401a45
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.00401e3a
mov esp, ebp
pop ebp
ret
pop edi
mov al, cl
mov ecx, dword [esp + 0x450]
pop esi
pop ebx
xor ecx, esp
call fcn.00401e3a
mov esp, ebp
pop ebp
ret
Function at 0x401a90
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
push edi
mov edi, dword [esp + 0x24]
mov ecx, 0x40a338
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401ac7
test dx, dx
je 0x401ac3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401ac7
add eax, 4
add ecx, 4
test dx, dx
jne 0x401aa1
xor eax, eax
jmp 0x401acc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401af2
push str.XBDDetector
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop edi
add esp, 0x1c
ret 0x10
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x4108f8
push 0x67
push edi
call esi
push 0x64
push 0x410830
push 0x6d
push edi
call esi
mov eax, edi
call fcn.00401ba0
push str.RunOnlyOneStartUpXBD
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401b41
push edi
call fcn.00401c10
add esp, 4
test eax, eax
jne 0x401b4b
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret 0x10
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
je 0x401b90
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
nop
lea ecx, [esp + 0xc]
push ecx
call edi
lea edx, [esp + 0xc]
push edx
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
call esi
test eax, eax
jne 0x401b70
pop ebx
mov eax, dword [esp + 0x10]
pop esi
pop edi
add esp, 0x1c
ret 0x10

Function at 0x401c10
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x204
mov eax, dword [0x40b004]
xor eax, esp
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x208]
push esi
push 0
push eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x4108f8
push 0x410830
push 0
mov dword [0x4109c0], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
jne 0x401c79
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.00401e3a
add esp, 0x204
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x1fe
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call fcn.004060f0
lea ecx, [esp + 0x10]
push ecx
call fcn.004018d0
add esp, 0x10
test al, al
je 0x401cbd
push ebx
lea ebx, [esp + 8]
call section..text
pop ebx
mov ecx, dword [esp + 0x204]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00401e3a
add esp, 0x204
ret

Function at 0x401e3a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b004]
jne 0x401e44
repz ret
jmp fcn.00402104