joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a760
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [0x100ad1c4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1000a77d
mov eax, 0xffffffe8
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [ebp + 8]
call fcn.1000a630
add esp, 8
xor eax, eax
pop ebp
ret

Function at 0x1000d140
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4018
call fcn.10001050
mov eax, dword [0x100ad00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4018], eax
jbe 0x1000d20f
lea eax, [ebp - 0x4014]
push eax
push 0x1004
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1000d1f2
push 0
lea eax, [ebp - 0x200c]
push eax
push 0x1004
lea eax, [ebp - 0x4014]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x1000d1f2
cmp word [ebp - 0x200a], 0x3a
jne 0x1000d1c2
movzx ecx, word [ebp - 0x200c]
lea eax, [ecx - 0x61]
cmp eax, 0x1a
jae 0x1000d1c2
lea eax, [ecx - 0x20]
mov word [ebp - 0x200c], ax
push str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winpath_win.cpp
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x4018]
push eax
lea eax, [ebp - 0x200c]
push 0xffffffffffffffff
push eax
call fcn.10004520
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000ab30
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffffd7
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret

Function at 0x1000d2f0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push 0
push dword [ebp + 8]
push eax
call fcn.1000d480
add esp, 0xc
test eax, eax
js 0x1000d3c0
push esi
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.1000d480
mov esi, eax
add esp, 0xc
test esi, esi
js 0x1000d3b2
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x1000d37e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000d356
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000ab30
add esp, 4
mov esi, eax
jmp 0x1000d37a
and edi, 0xf000
and esi, 0x10
cmp edi, 0x4000
jne 0x1000d373
neg esi
sbb esi, esi
and esi, 0x7e
add esi, 0xffffff82
jmp 0x1000d37a
neg esi
sbb esi, esi
and esi, 0xffffff81
test esi, esi
js 0x1000d3a6
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1000d395
xor esi, esi
jmp 0x1000d3a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000ab30
add esp, 4
mov esi, eax
push dword [ebp - 8]
call fcn.1000d470
add esp, 4
pop edi
push dword [ebp - 4]
call fcn.1000d470
add esp, 4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000d480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winpathint_win.cpp
push eax
push 0
push edi
push 0xffffffffffffffff
push esi
mov dword [edi], 0
mov dword [ebp - 4], 0
call fcn.1000c670
mov ebx, eax
add esp, 0x18
test ebx, ebx
js 0x1000d5ee
mov ecx, dword [ebp - 4]
cmp ecx, 0xf3
ja 0x1000d567
mov dl, byte [esi]
movsx ebx, dl
lea eax, [ebx - 0x61]
cmp eax, 0x1a
jb 0x1000d4e1
lea eax, [ebx - 0x41]
cmp eax, 0x1a
jae 0x1000d510
cmp byte [esi + 1], 0x3a
jne 0x1000d510
mov al, byte [esi + 2]
cmp al, 0x5c
je 0x1000d5d5
cmp al, 0x2f
je 0x1000d5d5
push edi
call fcn.1000d3f0
add esp, 4
test al, al
je 0x1000d567
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dl, 0x5c
je 0x1000d52e
cmp dl, 0x2f
je 0x1000d52e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, dword [ebp - 4]
cmp eax, 0xf2
jmp 0x1000d565
mov al, byte [esi + 1]
cmp al, 0x5c
je 0x1000d539
cmp al, 0x2f
jne 0x1000d55f
mov al, byte [esi + 2]
cmp al, 0x5c
je 0x1000d55f
cmp al, 0x2f
je 0x1000d55f
test al, al
je 0x1000d55f
cmp al, 0x3f
jne 0x1000d557
mov al, byte [esi + 3]
cmp al, 0x5c
je 0x1000d557
cmp al, 0x2f
jne 0x1000d5d5
cmp ecx, 0xf0
jmp 0x1000d565
cmp ecx, 0xf1
jbe 0x1000d5d5
push dword [edi]
call fcn.10003ae0
xor eax, eax
mov dword [edi], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100311d0
mov ebx, eax
add esp, 0x10
test ebx, ebx
js 0x1000d5ee
cmp dword [ebp - 8], 0
jne 0x1000d5de
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x5c
jne 0x1000d5de
cmp word [eax + 2], 0x3f
jne 0x1000d5de
cmp word [eax + 4], 0x3f
jne 0x1000d5de
cmp word [eax + 6], 0x5c
jne 0x1000d5de
mov ecx, 0x5c
mov word [eax + 2], cx
movzx eax, word [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
shr eax, 1
cmp word [ecx + eax*2], 0
jne 0x1000d5de
mov dword [edi], ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100311b0
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [0x100ae110]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x1000e78d
push 0x17
mov ecx, esi
call dword [section..rdata]
call esi
test eax, eax
je 0x1000e78d
mov ecx, edi
int 0x29
mov esi, dword [0x100ae0ec]
test esi, esi
je 0x1000e7a6
mov ecx, esi
call dword [section..rdata]
call esi
test eax, eax
je 0x1000e7a6
int3
mov esi, dword [0x100ae108]
test esi, esi
je 0x1000e820
cmp dword [0x100ae10c], 0
je 0x1000e820
push 0
mov ecx, esi
call dword [section..rdata]
call esi
mov eax, dword [ebx + 0xb8]
push 0x38
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x50], 0xc0000409
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], edi
call sym.IntelFirmwareInterfaceInstallHelper.dll_nocrt_memset
mov esi, dword [0x100ae10c]
lea eax, [ebp - 0x50]
add esp, 0xc
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], ebx
mov ecx, esi
push eax
call dword [section..rdata]
call esi
lea ebx, [ebx]
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1000e820

Function at 0x1000ea30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 3
jne 0x1000eb43
shr eax, 8
cmp al, 0x32
jae 0x1000eb43
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1000ea63
mov eax, dword [ecx + 0x3c]
add eax, ecx
jmp 0x1000ea65
mov eax, ecx
cmp dword [eax], 0x4550
jne 0x1000eb47
push esi
movzx esi, word [eax + 0x14]
add esi, eax
movzx eax, word [eax + 6]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1000eb42
push ebx
add esi, 0x20
push edi
lea esp, [esp]
mov ebx, dword [esi]
mov eax, dword [esi + 8]
cmp ebx, eax
jbe 0x1000eb33
mov edi, dword [esi + 4]
sub ebx, eax
add edi, eax
add edi, ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jns 0x1000eabb
push ebx
push 0
push edi
call sym.IntelFirmwareInterfaceInstallHelper.dll_nocrt_memset
add esp, 0xc
jmp 0x1000eb30
mov eax, edi
and ecx, 0x20000000
and eax, 0xfffff000
mov dword [ebp - 0xc], eax
mov eax, edi
and eax, 0xfff
add eax, 0xfff
add eax, ebx
and eax, 0xfffff000
neg ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
sbb ecx, ecx
push eax
and ecx, 0x3c
lea eax, [ebp - 8]
add ecx, 4
push ecx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], ecx
push eax
push 0xffffffffffffffff
mov dword [ebp - 4], ecx
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x1000eb2f
push ebx
push 0
push edi
call sym.IntelFirmwareInterfaceInstallHelper.dll_nocrt_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
jmp 0x1000eb30
int3
mov ecx, dword [ebp + 8]
add esi, 0x28
sub dword [ebp - 0x10], 1
jne 0x1000ea90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
int3
Function at 0x10012a60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10012a70

Function at 0x10014970
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x10014987
xor eax, eax
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000ab30
add esp, 4
pop ebp
ret
Function at 0x10036eb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x100ad00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x88]
push 0
push ecx
push dword [ebp + 0xc]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2010
push 0
push 0
push 0xa
push dword [ebp + 0x10]
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.100549f0
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x88]
push eax
push 2
push 0x10079ea4
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret

Function at 0x10036f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x100ad00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x2080
push 8
push 8
push 0x10
push eax
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.100549f0
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret

Function at 0x10037000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x100ad00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 0x1000]
cmp eax, 0x2000
jb 0x10037044
xor eax, eax
cmp byte [esi], al
je 0x10037037
lea ebx, [ebx]
inc eax
cmp byte [esi + eax], 0
jne 0x10037030
push 0
lea ecx, [ebp - 0x88]
push ecx
push eax
push esi
jmp 0x100370b3
push 0
lea eax, [ebp - 0x88]
push eax
push 0xb
push str._pszString
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2080
push 8
push 8
push 0x10
push esi
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.100549f0
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x88]
push eax
push 1
push 0x1007b708
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10001210
mov esp, ebp
pop ebp
ret
Function at 0x100370e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x100ad00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x2000
push 0
push 0
push 0xa
push dword [ebp + 8]
lea eax, [ebp - 0xac]
push 0xa8
push eax
call fcn.100549f0
push 0x2008
push 0
push 0
mov word [ebp + eax - 0xac], 0x2820
lea esi, [eax + 2]
push 0x10
push dword [ebp + 8]
mov eax, 0xa8
sub eax, esi
push eax
lea eax, [ebp - 0xac]
add eax, esi
push eax
call fcn.100549f0
add esp, 0x38
lea ecx, [ebp - 0xb0]
add eax, esi
push 0
mov byte [ebp + eax - 0xac], 0x29
inc eax
push ecx
push eax
lea eax, [ebp - 0xac]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10001210
mov esp, ebp
pop ebp
ret

Function at 0x10037190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x100ad00c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x2008
push 0
push 0
push 0x10
push dword [ebp + 8]
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.100549f0
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
Function at 0x10063e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, 0x10
mov bl, byte [eax + 0x3f]
add eax, 0x30
movzx ecx, byte [eax - 0x30]
lea eax, [eax + 1]
xor cl, byte [eax - 0x21]
movzx edx, byte [eax - 0x21]
mov byte [eax - 0x11], cl
movzx ecx, bl
xor edx, ecx
movzx ecx, byte [edx + str._.C]
xor byte [eax - 1], cl
mov bl, byte [eax - 1]
sub esi, 1
jne 0x10063e13
pop esi
pop ebx
pop ebp
ret

Function at 0x10063e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor cl, cl
xor edx, edx
lea esp, [esp]
lea eax, [edi + 2]
mov esi, 8
jmp 0x10063e60
movzx ecx, cl
lea eax, [eax + 6]
mov cl, byte [ecx + str._.C]
xor cl, byte [eax - 8]
mov byte [eax - 8], cl
movzx ecx, cl
mov cl, byte [ecx + str._.C]
xor cl, byte [eax - 7]
mov byte [eax - 7], cl
movzx ecx, cl
mov cl, byte [ecx + str._.C]
xor cl, byte [eax - 6]
mov byte [eax - 6], cl
movzx ecx, cl
mov cl, byte [ecx + str._.C]
xor cl, byte [eax - 5]
mov byte [eax - 5], cl
movzx ecx, cl
mov cl, byte [ecx + str._.C]
xor cl, byte [eax - 4]
mov byte [eax - 4], cl
movzx ecx, cl
mov cl, byte [ecx + str._.C]
xor cl, byte [eax - 3]
mov byte [eax - 3], cl
sub esi, 1
jne 0x10063e60
add cl, dl
inc edx
cmp edx, 0x12
jb 0x10063e50
pop edi
pop esi
pop ebp
ret
Function at 0x100646f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0x40
push 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
add eax, 0x18
push eax
call sym.IntelFirmwareInterfaceInstallHelper.dll_nocrt_memset
add esp, 0xc
pop ebp
ret
Function at 0x40168d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x424d90]
push esi
mov esi, ecx
push edi
mov dword [esi + 4], eax
mov dword [0x424d90], esi
mov eax, dword [esi + 4]
test eax, eax
je 0x4016c0
mov eax, dword [eax + 8]
test eax, eax
je 0x4016c0
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4016c0
mov eax, dword [esi + 4]
mov edi, dword [eax + 8]
jmp 0x4016c4
mov edi, dword [esp + 0xc]
movzx eax, word [esi + 0xc]
and dword [esi + 8], 0
push 5
push eax
mov dword [esi + 0x14], 0x40160c
push dword [0x424d88]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x401717
push eax
push dword [0x424d88]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401717
push 0
push dword [esi + 0x14]
push edi
push eax
push dword [0x424d88]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
test eax, eax
mov dword [esi + 8], eax
jne 0x401717
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, dword [esi + 8]
pop edi
pop esi
ret 4

Function at 0x4054a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [ecx + 4]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40551e
cmp byte [eax], 0x2e
je 0x40551e
cmp ecx, 3
jne 0x4054ed
cmp byte [eax + 1], 0x3a
jne 0x4054ed
cmp byte [eax + 2], 0x5c
jne 0x4054ed
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x405515
cmp eax, 4
je 0x405515
cmp eax, 2
je 0x405515
cmp eax, 6
jne 0x40551e
mov eax, 1
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x140]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40551e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x140]
and edx, 0x10
cmp dl, 0x10
jne 0x40551e
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x408490
Capabilities:
Get disk size

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x40849c
xor ecx, ecx
jmp 0x4084c0
cmp eax, 0x1a
jbe 0x4084a7
mov eax, 0x57
ret
add al, 0x40
lea ecx, [esp + 4]
mov byte [esp + 4], al
mov byte [esp + 5], 0x3a
mov byte [esp + 6], 0x5c
mov byte [esp + 7], 0
mov eax, dword [esp + 8]
push eax
lea edx, [eax + 4]
push edx
lea edx, [eax + 0xc]
add eax, 8
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x4084e2
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
ret
Function at 0x408bf0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ebe8
push 0x40c798
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x425268], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x425264], ecx
shl ecx, 8
add ecx, edx
mov dword [0x425260], ecx
shr eax, 0x10
mov dword [0x42525c], eax
call fcn.0040c660
test eax, eax
jne 0x408c5a
push 0x1c
call fcn.00408dd0
add esp, 4
call fcn.0040c560
test eax, eax
jne 0x408c6d
push 0x10
call fcn.00408dd0
add esp, 4
mov dword [ebp - 4], 0
call fcn.0040c350
call fcn.0040a530
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x437944], eax
call fcn.0040c1f0
mov dword [0x425000], eax
test eax, eax
je 0x408ca0
mov eax, dword [0x437944]
test eax, eax
jne 0x408caa
push 0xffffffffffffffff
call fcn.0040abe0
add esp, 4
call fcn.0040bf40
call fcn.0040be50
call fcn.0040abb0
mov esi, dword [0x437944]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x408d89
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x408cf1
test al, al
je 0x408cf1
and eax, 0xff
push eax
call fcn.0040bdf0
add esp, 4
test eax, eax
je 0x408ccb
inc esi
mov dword [ebp - 0x64], esi
jmp 0x408ccb
cmp byte [esi], 0x22
jne 0x408cfa
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x408d0a
cmp al, 0x20
ja 0x408d0a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x408cfa
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x408d2b
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x408d30
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.0040abe0
jmp 0x408d6e
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x408cfa
inc esi
mov dword [ebp - 0x64], esi
jmp 0x408d89

Function at 0x408dd0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x425008], 1
jne 0x408dde
call fcn.0040c870
mov eax, dword [esp + 4]
push eax
call fcn.0040c8b0
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4098e0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40990a
test byte [esp + 0xc], 0x80
je 0x4098fc
and al, 0xfe
jmp 0x4098fe
or al, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x40991e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409840
add esp, 4
or eax, 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x409930
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x40994c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40994e
xor eax, eax
test eax, eax
je 0x40995f
push eax
call fcn.00409840
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x40ac20
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.0040ace0
mov eax, dword [0x425298]
mov ebp, dword [esp + 0x10]
cmp eax, 1
jne 0x40ac44
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x425294], 1
mov byte [0x425290], bl
jne 0x40ac9e
mov ecx, dword [0x436928]
test ecx, ecx
je 0x40ac8c
mov esi, dword [0x436924]
sub esi, 4
cmp esi, ecx
jb 0x40ac8c
mov eax, dword [esi]
test eax, eax
je 0x40ac85
call eax
mov ecx, dword [0x436928]
sub esi, 4
cmp esi, ecx
jae 0x40ac77
push 0x421034
push 0x421028
call fcn.0040ad00
add esp, 8
push 0x421040
push 0x421038
call fcn.0040ad00
add esp, 8
test ebx, ebx
je 0x40acbd
call fcn.0040acf0
pop esi
pop ebp
pop ebx
ret
push ebp
mov dword [0x425298], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]