joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433431
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af09f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4335b1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x433596
mov dword [ebp - 0x24], 0x2731
mov dword [ebp - 0x30], str.ikbrq_oyxau_ojrlfyanw_muikince_xkjbsiz_sxnchlz_tfrl_roudjcu_hduyxm_hzd_xubzwxq_diaqd_njlksmdl
cmp dword [ebp - 0x24], 0x27a5
jle 0x433525
call dword [sym.imp.USER32.dll_EndMenu]
and dword [ebp - 0x18], 0
jmp 0x4334a7
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x237f
jge 0x433518
and dword [ebp - 0x1c], 0
jmp 0x4334bd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x248f
jge 0x433516
and dword [ebp - 0x20], 0
jmp 0x4334d3
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x23f2
jge 0x433514
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.004019d3
pop ecx
pop ecx
mov ecx, eax
call fcn.00441f2b
push eax
call fcn.00499008
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.00441f21
jmp 0x4334cc
jmp 0x4334b6
jmp 0x4334a0
push 0x1f92
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2568
jge 0x433541
push dword [ebp - 0x30]
call fcn.00499008
pop ecx
jmp 0x43355d
or dword [ebp - 4], 0xffffffff
jmp 0x433567
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0x6f91
push 0x65e4
push 1
push 0
push 0x7c97
push 1
push 0x17e
mov eax, dword [ebp - 0x38]
push dword [eax]
call fcn.0041e760
add esp, 0x20
jmp 0x4335af
mov byte [ebp - 0x11], 0
push 1
push 1
push 0x3e70
lea eax, [ebp - 0x11]
push eax
call fcn.00425093
add esp, 0x10
jmp 0x4335c3
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push 0
call fcn.00409984
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434384
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4343b1
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
push 0x6e33
push 1
push dword [ebp - 4]
push 0x7968
call fcn.0043441e
add esp, 0x10
jmp 0x43441a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4343f3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4343f1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
jmp 0x43441a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43441a
push 0x1d3d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esp, ebp
pop ebp
ret
Function at 0x436a59
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af13f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], 0x3df4
mov dword [ebp - 0x30], str.irgerrsi_rqmmcspp_rnyfvt_tvqvivs_jgncf_hiz_ulfznhnjd_ifewzfea_boo_ujhncrt
cmp dword [ebp - 0x28], 0x3e7f
jle 0x436b24
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and dword [ebp - 0x18], 0
jmp 0x436aab
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x369e
jge 0x436b1e
and dword [ebp - 0x1c], 0
jmp 0x436ac1
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5ed9
jge 0x436b1c
and dword [ebp - 0x20], 0
jmp 0x436ad7
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x83
jge 0x436b1a
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x70]
call fcn.004019d3
pop ecx
pop ecx
mov ecx, eax
call fcn.00441f2b
push eax
call fcn.00499008
pop ecx
lea ecx, [ebp - 0x70]
call fcn.00441f21
jmp 0x436ad0
jmp 0x436aba
jmp 0x436aa4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x3a2e
jge 0x436b40
push dword [ebp - 0x30]
call fcn.00499008
pop ecx
jmp 0x436b5c
or dword [ebp - 4], 0xffffffff
jmp 0x436b66
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
push 0
mov ecx, dword [ebp - 0x24]
call fcn.00442139
mov dword [eax], 0xfffffff2
jmp 0x436ba2
push 0
mov ecx, dword [ebp - 0x24]
call fcn.00442139
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 0x24]
call fcn.00442139
cmp dword [eax], 0x15
jle 0x436c60
mov dword [ebp - 0x40], 0x71a6e483
push 3
lea ecx, [ebp - 0x58]
call fcn.0044204b
lea eax, [ebp - 0x44]
push eax
push 0x7b49
push 0xc05
push 0x13fe
push 0
push 0x4c2d
push 0x6292
push 0x108d
push 0x241c
lea eax, [ebp - 0x58]
push eax
push 1
push 0x6019
call fcn.0043d655
add esp, 0x30
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x436c2e
push 1
push 0x6aa3
push 1
push 0x1e33
push 0x634c
push 0x3597
call fcn.0042d124
add esp, 0x18
push 0x13cb
lea eax, [ebp - 0x58]
push eax
push 1
push dword [ebp - 0x34]
push 1
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x24]
call fcn.0042d2ef
add esp, 0x24
lea ecx, [ebp - 0x58]
call fcn.0044211d
jmp 0x436b8a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ceac
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43cef4
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43cee3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x43ceef
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x43cfa7
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43cf5c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov esi, dword [eax]
mov eax, dword [ebp - 0x2c]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.00442139
mov dword [eax], esi
jmp 0x43cfa7
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43cf8a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x43cfa7
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.00442139
mov dword [eax], 0xdb58e469
jmp 0x43cf7f
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44708d
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af365
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4471db
mov dword [ebp - 0x24], 0x12fb
mov dword [ebp - 0x28], str.gqenqx_ihuw_gxfh_xyzu
cmp dword [ebp - 0x24], 0x133e
jle 0x447177
and dword [ebp - 0x14], 0
jmp 0x4470e3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x52c3
jge 0x447160
and dword [ebp - 0x18], 0
jmp 0x4470f9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x227b
jge 0x44715b
and dword [ebp - 0x1c], 0
jmp 0x44710f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2ae8
jge 0x447159
and dword [ebp - 0x20], 0
jmp 0x447125
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1f91
jge 0x447157
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
mov ecx, dword [ebp - 0x20]
sar eax, cl
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov ecx, 0xae0558
call fcn.00441f36
jmp 0x44711e
jmp 0x447108
jmp 0x4470f2
jmp 0x4470dc
push 0
push 0x210d
push 0x1393
push 0x245f
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x107f
jge 0x447197
mov edx, dword [ebp - 0x28]
mov ecx, 0xae0558
call fcn.004438dc
jmp 0x4471b3
or dword [ebp - 4], 0xffffffff
jmp 0x4471bd
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4471d1
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4471d9
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x447210
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push 0
push 0x552d
push 0x6938
push dword [ebp - 0x34]
push 0x4914
push 0x270
push 0x4422
call fcn.0044403a
add esp, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4497d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x449804
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 1
push dword [ebp - 8]
call fcn.00449862
add esp, 0xc
jmp 0x44985e
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x449851
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x44984f
push 0x2466
push 0x153f
push 0x18b7
push 0x744
push 0x1bf8
call dword [sym.imp.GDI32.dll_Ellipse]
jmp 0x44985e
push 0x1510
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x44d7fc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af47d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x44d88b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x44d874
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x44d872
push 0x326f
push 0
push 0x150b
push 1
push 0x401e
push 0x38d5
call fcn.00445154
add esp, 0x18
jmp 0x44d886
push 0x9a6
push 0
push 0x1324
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x44d955
mov dword [ebp - 0x1c], 0x49ef
mov dword [ebp - 0x30], str.mjys_whghjsx_zsx
cmp dword [ebp - 0x1c], 0x4da3
jle 0x44d905
and dword [ebp - 0x14], 0
jmp 0x44d8af
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1b43
jge 0x44d905
and dword [ebp - 0x18], 0
jmp 0x44d8c5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x408f
jge 0x44d903
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x50]
call fcn.004019d3
pop ecx
pop ecx
mov ecx, eax
call fcn.00441f2b
push eax
call fcn.00499008
pop ecx
lea ecx, [ebp - 0x50]
call fcn.00441f21
jmp 0x44d8be
jmp 0x44d8a8
push 0x2309
push 0
push 0x7aea
call fcn.0044fd6d
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x488d
jge 0x44d92f
push dword [ebp - 0x30]
call fcn.00499008
pop ecx
jmp 0x44d94b
or dword [ebp - 4], 0xffffffff
jmp 0x44d955
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e707
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af4af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x44e79f
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44e773
mov byte [ebp - 0x11], 0
push 0x3890
push 0x1d05
push 0
push 0x9ca
push 0x5d95
push 1
push 0
lea eax, [ebp - 0x11]
push eax
call fcn.0044b96f
add esp, 0x20
jmp 0x44e79a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x44e79a
push 0
push 0x24aa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x44e8d4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x24], 0x7d1b
mov dword [ebp - 0x38], str.pcsw_jqqpruw_ygepo_skpv_vnkoos_ppco_wfdy
cmp dword [ebp - 0x24], 0x7da7
jle 0x44e82a
and dword [ebp - 0x18], 0
jmp 0x44e7cf
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x40ed
jge 0x44e82a
and dword [ebp - 0x1c], 0
jmp 0x44e7e5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4e9e
jge 0x44e828
and dword [ebp - 0x20], 0
jmp 0x44e7fb
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xbdb
jge 0x44e826
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
mov ecx, 0xae0558
call fcn.00441f36
jmp 0x44e7f4
jmp 0x44e7de
jmp 0x44e7c8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x7b56
jge 0x44e84a
mov edx, dword [ebp - 0x38]
mov ecx, 0xae0558
call fcn.004438dc
jmp 0x44e866
or dword [ebp - 4], 0xffffffff
jmp 0x44e870
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push 0
push dword [ebp - 0x68]
call fcn.00445427
add esp, 0x34
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e8e5
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af4b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x44e92c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
push 0
push 0x5296
push dword [ebp - 0x30]
call fcn.00453069
add esp, 0xc
jmp 0x44eab8
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x44eab0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x2c], 0x25c
mov dword [ebp - 0x60], str.kndwcf_fmpq_xtxrjpn_fyrh_osfnwmk_nlxrxydul
cmp dword [ebp - 0x2c], 0x582
jle 0x44ea3f
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
and dword [ebp - 0x14], 0
jmp 0x44e9a0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2977
jge 0x44ea3f
and dword [ebp - 0x18], 0
jmp 0x44e9ba
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6fde
jge 0x44ea3a
and dword [ebp - 0x1c], 0
jmp 0x44e9d0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7fdf
jge 0x44ea35
and dword [ebp - 0x20], 0
jmp 0x44e9e6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x546a
jge 0x44ea33
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov eax, edx
cdq
idiv dword [ebp - 0x1c]
mov eax, edx
cdq
idiv dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
push dword [ebp - 0x64]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x80]
call fcn.004019d3
pop ecx
pop ecx
mov ecx, eax
call fcn.00441f2b
push eax
call fcn.00499008
pop ecx
lea ecx, [ebp - 0x80]
call fcn.00441f21
jmp 0x44e9df
jmp 0x44e9c9
jmp 0x44e9b3
jmp 0x44e999
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov dword [eax], ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x72
jge 0x44ea88
push dword [ebp - 0x60]
call fcn.00499008
pop ecx
jmp 0x44eaa4
or dword [ebp - 4], 0xffffffff
jmp 0x44eaae
jmp 0x44eab8
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450bf9
Capabilities:
Get disk size
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x450c49
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x450c29
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x450c47
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x450c47
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x450c82
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
push 0x397e
push dword [ebp - 0xc]
push 0x3df6
push 0
push 0x6483
push 0x7717
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.00458485
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x473111
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4af879
call fcn.004ae7a8
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0x63a5
cmp dword [ebp - 0x1c], 0x65f7
jle 0x47319f
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
and dword [ebp - 0x20], 0
mov eax, esi
cdq
idiv edi
mov edi, edx
mov esi, dword [ebp - 0x20]
mov eax, edi
and eax, esi
xor eax, ebx
cdq
push edx
push eax
mov ecx, 0xae0558
call fcn.00441f36
inc esi
cmp esi, 0x6d22
jl 0x473156
mov edi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x2fc3
mov esi, dword [ebp - 0x18]
jl 0x473148
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x6ceb
jl 0x473143
inc ebx
cmp ebx, 0x759d
jl 0x47313e
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov eax, dword [eax]
mov edx, dword [ecx]
imul ecx, dword [edx], 0xa
movsx eax, byte [eax]
add eax, 0xffffffd0
add eax, ecx
mov dword [edx], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6359
jge 0x4731cc
mov edx, str.fdyq_vfac_qlfxgkdd_kqiecpw_rpwzy_afki_awdu_mbdgtsk_pastzs_rrgzs_pcn_mgonltn_ftuel
mov ecx, 0xae0558
call fcn.004438dc
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490ac4
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4afa45
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0xee6
mov dword [ebp - 0x24], str.dexu_twy_olzciom_rflgoka_ckeollqn_argvnhvld_dcm_drekr_cgovpvpi_suvdcclyj_nzqpm_fcbs
cmp dword [ebp - 0x20], 0x100a
jle 0x490b8d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
and dword [ebp - 0x1c], 0
jmp 0x490b1c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2f45
jge 0x490b8d
and dword [ebp - 0x14], 0
jmp 0x490b32
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6ef1
jge 0x490b8b
and dword [ebp - 0x18], 0
jmp 0x490b48
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2475
jge 0x490b89
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.004019d3
pop ecx
pop ecx
mov ecx, eax
call fcn.00441f2b
push eax
call fcn.00499008
pop ecx
lea ecx, [ebp - 0x44]
call fcn.00441f21
jmp 0x490b41
jmp 0x490b2b
jmp 0x490b15
push 0x2c6f
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push 0x463
push dword [ebp + 0x24]
push 0
push dword [ebp + 0x14]
push 0xc96
push 0x7dfe
push dword [ebp + 0x1c]
push 0x7348
push dword [ebp + 0x20]
push dword [ebp + 0x18]
push 0x5d17
push 0x7994
push 0x102f
push 0xceb
push 0x5f0d
call fcn.00491cd4
add esp, 0x50
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xc4a
jge 0x490bf9
push dword [ebp - 0x24]
call fcn.00499008
pop ecx
jmp 0x490c15
or dword [ebp - 4], 0xffffffff
jmp 0x490c1f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret