joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e184
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
lea eax, [ebp - 4]
push eax
movzx eax, word [0x496b68]
or eax, 0x2001b
push eax
xor esi, esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x42e2d7
test byte [ebp + 0x10], 1
mov dword [ebp - 0x18], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
je 0x42e1d6
push 0x480934
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jae 0x42e204
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042c827
cmp dword [ebp - 0xc], esi
jne 0x42e2c3
test byte [ebp + 0x10], 4
push ebx
push edi
mov edi, dword [ebp - 0x1c]
je 0x42e273
mov ebx, dword [ebp - 0x14]
dec ebx
cmp ebx, esi
jl 0x42e273
mov eax, dword [ebp - 8]
push esi
push esi
push esi
lea eax, [eax*4 + 1]
push esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
mov word [edi], si
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x42e26d
cmp word [edi], si
je 0x42e270
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x42e270
mov dword [ebp - 0xc], eax
dec ebx
jns 0x42e233
test byte [ebp + 0x10], 2
je 0x42e2c1
mov ebx, dword [ebp - 0x18]
dec ebx
cmp ebx, esi
jl 0x42e2c1
mov eax, dword [ebp - 8]
push esi
push esi
push esi
lea eax, [eax*4 + 1]
push esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
mov word [edi], si
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x42e2bb
cmp word [edi], si
je 0x42e2be
push edi
push dword [ebp - 4]
call dword [0x496fd8]
cmp eax, esi
je 0x42e2be
mov dword [ebp - 0xc], eax
dec ebx
jns 0x42e281
pop edi
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c]
call fcn.00427365
mov eax, dword [ebp - 0xc]
pop esi
leave
ret
Function at 0x42f364
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 7
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.00403ce4
cmp dword [ebp - 8], ebx
je 0x42f3a9
push dword [ebp - 8]
call fcn.0042c1b2
mov edi, edx
cmp edi, ebx
pop ecx
mov esi, eax
jg 0x42f3ad
jl 0x42f3a9
cmp esi, ebx
jae 0x42f3ad
xor esi, esi
xor edi, edi
lea ecx, [ebp - 4]
call fcn.0042c693
cmp edi, ebx
jl 0x42f3f7
jg 0x42f3bf
cmp esi, ebx
jbe 0x42f3f7
lea eax, [esi + 5]
push eax
lea ecx, [ebp - 4]
call fcn.0042c6d7
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp eax, edi
jl 0x42f3f1
jg 0x42f3ef
cmp ecx, esi
jbe 0x42f3f1
mov ecx, esi
mov eax, dword [ebp - 4]
mov byte [ecx + eax], bl
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 4]
call fcn.0042c8c6
lea ecx, [ebp - 4]
call fcn.00427365
lea ecx, [ebp - 8]
call fcn.00402a26
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42f91a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 7
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 4]
mov byte [ebp - 0x28], bl
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.00403ce4
cmp dword [ebp - 4], ebx
je 0x42f96e
push ebx
lea eax, [ebp - 8]
push eax
push 0x20
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call fcn.00429952
add esp, 0xc
mov bl, al
lea ecx, [ebp - 4]
call fcn.00402a26
mov al, bl
pop ebx
leave
ret
Function at 0x42fb39
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
xor eax, eax
push edi
inc eax
xor ebx, ebx
push 0x100000
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov word [ebp - 0x21c], bx
call fcn.0042c827
mov edi, dword [ebp + 0x14]
cmp edi, ebx
jne 0x42fb90
lea eax, [ebp - 0x21c]
push eax
push 0x104
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
mov dword [ebp - 4], eax
lea edi, [ebp - 0x21c]
je 0x42fca0
cmp dword [ebp - 0xc], ebx
push esi
mov esi, 0xa0000000
mov dword [ebp - 8], ebx
je 0x42fba3
mov esi, 0xe0000000
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 3
push esi
push dword [ebp + 0xc]
call dword [0x496ff8]
cmp eax, ebx
mov dword [ebp + 0x14], eax
jne 0x42fbf6
cmp dword [ebp - 0xc], 1
jne 0x42fbe8
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 3
and esi, 0xbfffffff
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 2
call dword [0x496ff8]
cmp eax, ebx
mov dword [ebp + 0x14], eax
je 0x42fbbc
cmp dword [ebp + 0x14], ebx
jne 0x42fbf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x42fc91
push edi
push dword [ebp + 0x14]
call dword [0x496ffc]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x42fc1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], 1
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [0x497000]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x42fc39
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x42fc83
xor esi, esi
cmp dword [ebp - 0xc], ebx
mov edi, 0x200
jne 0x42fc4c
mov esi, edi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [0x497004]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x42fc83
cmp dword [ebp - 0xc], 2
jne 0x42fc78
or esi, edi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [0x497004]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jne 0x42fc83
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 8], ebx
je 0x42fc91
push dword [ebp - 8]
call dword [0x497008]
cmp dword [ebp + 0x14], ebx
pop esi
je 0x42fca0
push dword [ebp + 0x14]
call dword [0x497008]
lea ecx, [ebp - 0x10]
call fcn.00427365
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x42fcaf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 8], 0xffffffff
push ebx
push esi
push edi
lea eax, [ebp + 8]
push eax
movzx eax, word [0x496b68]
or eax, 0x20019
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x42fd54
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
push 0xffe
mov ecx, edi
mov dword [esi], 0xffa
call fcn.0042c6d7
mov eax, dword [edi]
push esi
mov byte [eax], bl
push dword [edi]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call ebx
cmp eax, 0xea
mov dword [ebp - 4], eax
jne 0x42fd3f
add dword [esi], 0xa
mov eax, dword [esi]
add eax, 4
push eax
mov ecx, edi
call fcn.0042c6d7
push esi
push dword [edi]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call ebx
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or ebx, 0xffffffff
cmp dword [ebp - 4], 0
je 0x42fd62
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x42fd5d
mov dword [ecx], eax
lea eax, [ebx - 1]
jmp 0x42fd8d
xor ecx, ecx
cmp dword [esi], ecx
jge 0x42fd6a
mov dword [esi], ecx
mov eax, dword [edi]
mov edx, dword [esi]
mov byte [eax + edx], 0
mov eax, dword [edi]
add eax, dword [esi]
mov word [eax + 2], cx
mov word [eax], cx
mov eax, dword [esi]
add eax, 5
push eax
mov ecx, edi
call fcn.0042c6d7
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42ff17
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0x10]
neg esi
sbb esi, esi
mov eax, 0x2000000
and esi, eax
push edi
push dword [ebp + 0x14]
mov edi, dword [ebp + 8]
add esi, eax
mov eax, dword [ebp + 0x14]
xor eax, 0xa
push edi
mov dword [ebp - 0x10], eax
call fcn.0040c7d6
and dword [ebp + 8], 0
cmp dword [ebp + 0x14], 0
pop ecx
pop ecx
lea ecx, [edi + eax*2]
mov dword [ebp - 8], ecx
mov ebx, eax
mov dword [ebp + 0x10], edi
jne 0x42ff60
mov edi, ecx
jmp 0x42ff83
cmp edi, dword [ebp - 8]
jae 0x430025
mov dword [ebp + 0x10], edi
mov ax, word [edi]
inc edi
inc edi
cmp word [ebp - 0x10], ax
je 0x42ff7c
cmp edi, dword [ebp - 8]
jb 0x42ff6c
mov ebx, edi
sub ebx, dword [ebp + 0x10]
sar ebx, 1
mov eax, dword [ebp + 0x10]
cmp eax, edi
jae 0x42ff97
mov cx, word [ebp + 0x14]
xor word [eax], cx
inc eax
inc eax
cmp eax, edi
jb 0x42ff8a
push 0
push 0
push ebx
push dword [ebp + 0x10]
mov eax, 0x20804
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [eax + ecx + 1]
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0042c850
push dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
lea eax, [eax + ecx*2]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push esi
mov eax, 0x20804
push eax
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov dword [ebp - 4], eax
lea eax, [ebx + ebx]
push eax
push 0
push dword [ebp + 0x10]
call fcn.0046c9b0
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
jle 0x42ff60
add dword [ebp + 8], eax
dec eax
js 0x42ff60
lea ecx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dx, word [ebp + 0x14]
xor word [eax], dx
inc eax
inc eax
dec ecx
mov dword [ebp - 0xc], eax
jne 0x43000e
jmp 0x42ff60
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov esi, dword [ebp + 8]
mov dx, word [ebp + 0x14]
pop edi
mov word [ecx + esi*2], dx
mov eax, dword [eax]
pop esi
pop ebx
leave
ret
Function at 0x43003c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x209
lea ecx, [ebp - 4]
call fcn.0042c827
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
push 8
push esi
xor edi, edi
push 0x48621c
mov word [eax], di
call fcn.00428263
add esp, 0xc
test al, al
jne 0x43009e
push 0xc
push esi
push str.DosDevices_
call fcn.00428263
add esp, 0xc
test al, al
jne 0x43009e
cmp word [esi], di
je 0x4300a2
cmp word [esi + 2], di
je 0x4300a2
push 0x3a
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x4300a2
or dword [ebp + 0x14], 1
push 0xb
push esi
push 0x486200
call fcn.00428263
mov ebx, dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
add esp, 0xc
test al, al
je 0x4300c6
and dword [ebp + 0x14], 0xfffffffe
cmp byte [ebp + 0x18], 0
jne 0x4300dd
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call ebx
mov edi, eax
test edi, edi
jne 0x4300ee
cmp byte [ebp + 0x18], al
jl 0x430134
mov byte [ebp + 0x18], al
push 0x208
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x430116
cmp byte [ebp + 0x18], 0
jle 0x430134
push 0x208
push dword [ebp - 4]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x430134
mov eax, dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
or eax, 0xe
push eax
call ebx
push dword [ebp - 4]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
cmp byte [ebp + 0x18], 0
mov edi, eax
jl 0x430134
test edi, edi
jne 0x430134
mov byte [ebp + 0x18], 0xff
jmp 0x4300c6
lea ecx, [ebp - 4]
call fcn.00427365
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430143
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push esi
xor esi, esi
push esi
push 0x20000000
push 3
push esi
push 3
push 0x100080
push dword [ebp + 8]
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.00403ce4
cmp dword [ebp - 4], esi
jne 0x430177
or esi, 0xffffffff
jmp 0x4301a6
or dword [ebp - 0xc], 0xffffffff
push esi
lea eax, [ebp - 0x1a0]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push 0x2d1080
push dword [ebp - 4]
mov dword [ebp - 0x1a0], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x430172
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 4]
call fcn.00402a26
mov eax, esi
pop esi
leave
ret
Function at 0x43034a
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
movzx eax, word [ebp + 0x10]
and dword [ebp - 0xc], 0
push ebx
mov ebx, dword [ebp + 0x10]
sar ebx, 0x10
push esi
and ebx, 0xffdf
cmp dword [ebp + 0xc], 0
push edi
mov dword [ebp + 0x10], eax
jne 0x430386
push 0x100000
lea ecx, [ebp - 0xc]
call fcn.0042c6d7
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
push 5
pop ecx
xor eax, eax
mov esi, 0x486228
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push 0x1b
add eax, 4
pop edx
and word [eax + 4], 0
or ecx, 0xffffffff
mov word [eax + 2], cx
mov word [eax], cx
mov word [eax - 4], cx
mov word [eax - 2], cx
add eax, 0xa
dec edx
jne 0x4303a6
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x18], eax
xor edi, edi
xor eax, eax
cmp bx, 0x41
mov dword [ebp - 8], 0x19
jb 0x4303ec
cmp bx, 0x5a
ja 0x4303ec
movzx eax, bx
sub eax, 0x41
mov dword [ebp - 8], eax
movsx ecx, ax
cmp ecx, dword [ebp - 8]
jg 0x43053c
lea esi, [eax + 0x41]
mov dword [ebp - 0x10], esi
mov edx, dword [ebp - 0x18]
xor eax, eax
inc eax
shl eax, cl
mov word [ebp - 0x38], si
test edx, eax
je 0x430529
lea eax, [ecx + ecx*4]
mov ecx, dword [ebp + 8]
lea ebx, [ecx + eax*2]
lea eax, [ebp - 0x38]
push eax
mov word [ebx + 8], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
mov dword [ebp - 0x14], eax
je 0x430529
cmp eax, 3
je 0x430443
cmp eax, 2
je 0x430443
xor al, al
jmp 0x430445
mov al, 1
cmp dword [ebp + 0x10], 4
je 0x430453
test al, al
je 0x430529
push edi
push 0x20000000
push 3
push edi
push 3
push 0x80000000
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.00403ce4
cmp dword [ebp - 4], edi
jne 0x430484
lea ecx, [ebp - 4]
call fcn.00402a26
jmp 0x430529
mov esi, dword [ebp + 0xc]
push 0x90
push edi
push esi
mov dword [ebp - 0x1d0], edi
call fcn.0046c9b0
or dword [esi + 0x18], 0xffffffff
add esp, 0xc
push edi
lea eax, [ebp - 0x1d0]
push eax
push 0x90
push esi
push edi
push edi
push 0x70048
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4304c9
mov ax, word [esi + 0x18]
mov word [ebx], ax
push edi
mov dword [ebp - 0x1d0], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [esi + 4], 0xffffffff
push edi
lea eax, [ebp - 0x1d0]
push eax
push 0xc
push esi
push edi
push edi
push 0x2d1080
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x430501
mov ax, word [esi + 4]
mov word [ebx + 2], ax
cmp dword [ebp + 0x10], 4
jne 0x430516
push dword [ebp - 4]
push edi
call fcn.0042e0d5
pop ecx
pop ecx
mov word [ebx + 6], ax
mov ax, word [ebp - 0x14]
lea ecx, [ebp - 4]
mov word [ebx + 4], ax
call fcn.00402a26
mov esi, dword [ebp - 0x10]
inc esi
lea eax, [esi - 0x41]
movsx ecx, ax
cmp ecx, dword [ebp - 8]
mov dword [ebp - 0x10], esi
jle 0x4303fe
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xc]
call fcn.00427365
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4307e8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x20]
push ebx
xor ebx, ebx
cmp ecx, ebx
push esi
push edi
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], eax
ja 0x430815
cmp dword [ebp + 0x18], ebx
jbe 0x43081e
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
cmp eax, ebx
jne 0x430828
lea eax, [ebp - 0x14]
mov dword [ebp + 0x20], eax
mov edi, dword [ebp + 0x14]
cmp edi, ebx
mov esi, dword [ebp + 8]
jg 0x43083c
push dword [esi]
call fcn.00429b24
pop ecx
mov edi, eax
mov eax, dword [ebp + 0x10]
shl eax, 7
lea eax, [eax + edi - 1]
xor edx, edx
div edi
inc eax
inc eax
mov dword [ebp + 0x10], eax
add eax, 2
imul eax, edi
push eax
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.0046c9b0
xor eax, eax
push eax
push eax
push eax
push dword [esi]
mov dword [ebp + 0x14], eax
call fcn.004281cd
add esp, 0x1c
push 0
lea eax, [ebp + 0x14]
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
cmp dword [ebp + 0x1c], ecx
ja 0x4308af
jb 0x430890
cmp dword [ebp + 0x18], ecx
ja 0x4308af
mov eax, 0x1c2
cmp byte [eax + ebx], 0xee
jne 0x4308a5
mov edx, dword [eax + ebx + 4]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
add eax, 0x10
cmp eax, 0x1f2
jle 0x430895
push ecx
push dword [ebp - 8]
mov eax, edi
push dword [ebp - 0xc]
cdq
push edx
push eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], edx
call fcn.0046d9d0
push edx
push eax
push dword [esi]
call fcn.004281cd
add esp, 0x10
push 0
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
inc eax
imul eax, edi
push eax
lea eax, [ebx + edi]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], 0
lea eax, [ebx + edi*2 + 0x10000]
mov dword [ebp + 0x10], eax
je 0x430959
push edi
push 0
push eax
call fcn.0046c9b0
mov eax, dword [ebp + 0x20]
add esp, 0xc
cmp dword [eax + 4], 0
ja 0x430929
jb 0x430918
cmp dword [eax], 2
jae 0x430929
mov ecx, dword [ebx + 0x220]
mov dword [eax], ecx
mov ecx, dword [ebx + 0x224]
mov dword [eax + 4], ecx
push 0
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.0046d9d0
push edx
push eax
push dword [esi]
call fcn.004281cd
add esp, 0x10
push 0
lea eax, [ebp + 0x14]
push eax
push edi
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430d69
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x604
push ebx
push esi
push edi
push 0
mov ebx, 0x200
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0046d9d0
and dword [ebp - 4], 0
push 0
push edx
push eax
push dword [ebp + 8]
lea edi, [ebp - 0x404]
and edi, 0xfffffe00
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
lea esi, [edi + 0x200]
call fcn.004281cd
add esp, 0x10
cmp eax, dword [ebp + 0xc]
jne 0x430e5f
cmp edx, dword [ebp + 0x10]
jne 0x430e5f
push 0
lea eax, [ebp - 4]
push eax
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x430e5f
push ebx
push esi
push edi
call fcn.0046cbf0
mov esi, dword [ebp + 0x18]
add esp, 0xc
cmp esi, 1
jne 0x430e05
push 0x10
push dword [ebp + 0x14]
lea eax, [edi + 0x3ce]
push eax
call fcn.0046cbf0
add esp, 0xc
dec esi
push 0
push dword [ebp + 0x10]
neg esi
push dword [ebp + 0xc]
sbb esi, esi
push dword [ebp + 8]
and esi, 0xffff55ab
add esi, 0xaa55
mov word [edi + 0x3fe], si
call fcn.004281cd
add esp, 0x10
cmp eax, dword [ebp + 0xc]
jne 0x430e5f
cmp edx, dword [ebp + 0x10]
jne 0x430e5f
push ebx
lea esi, [edi + 0x200]
push esi
push edi
call fcn.0042cad9
add esp, 0xc
test eax, eax
jne 0x430e5f
push eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x431d35
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x134
mov ecx, edi
call fcn.0042c850
push 0xca
lea ecx, [ebp - 0x10]
call fcn.0042c827
mov eax, dword [ebp + 0x18]
movzx esi, byte [ebp + 0x18]
and eax, 0x100
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [edi]
test esi, esi
sete bl
neg esi
sbb esi, esi
and esi, 0x19
cmp dword [ebp + 0x14], 0
mov dword [ebp - 4], eax
mov byte [ebp + 0x1b], 0
lea ebx, [ebx + ebx - 1]
mov edx, esi
je 0x431e0a
cmp dword [ebp + 0x14], 1
not dword [ebp - 4]
jle 0x431e0a
and dword [ebp - 4], 0xfffffffc
jmp 0x431e0a
test edx, edx
jl 0x431e0f
xor eax, eax
mov ecx, edx
inc eax
shl eax, cl
movsx esi, bl
mov cl, dl
add edx, esi
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
add cl, 0x41
test edx, eax
mov byte [ebp + 0x17], cl
je 0x431e07
cmp dword [ebp - 8], 0
je 0x431dd9
movsx ax, cl
push eax
call fcn.0046c4b6
test eax, eax
pop ecx
je 0x431e07
mov cl, byte [ebp + 0x17]
cmp byte [ebp + 0x1b], 0
je 0x431ded
mov ax, word [ebp + 0xc]
test ax, ax
je 0x431ded
mov word [edi], ax
inc edi
inc edi
movsx ax, cl
mov word [edi], ax
inc edi
inc edi
cmp dword [ebp + 0x10], 0
mov byte [ebp + 0x1b], 1
je 0x431e07
mov word [edi], 0x3a
inc edi
inc edi
mov edx, dword [ebp - 0xc]
cmp edx, 0x1a
jl 0x431d9f
mov eax, dword [ebp + 8]
and word [edi], 0
mov esi, dword [eax]
lea ecx, [ebp - 0x10]
call fcn.00427365
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x431e45
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
cmp byte [esi], 0x23
push edi
sete byte [esp + 0x14]
cmp byte [esp + 0x14], 0
je 0x431e5d
inc esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
mov ebp, dword [esp + 0x18]
lea eax, [eax + eax*2 + 3]
push eax
mov ecx, ebp
call fcn.0042c6d7
mov eax, dword [ebp]
xor ebx, ebx
mov byte [eax], 0
mov dword [esp + 0x18], eax
xor cl, cl
jmp 0x431e99
mov dl, byte [esi]
cmp dl, 0x3d
jne 0x431eda
test cl, cl
jle 0x431e98
mov byte [eax], bl
inc eax
xor ebx, ebx
xor cl, cl
inc esi
cmp byte [esi], 0
jne 0x431e86
push dword [esp + 0x18]
mov byte [eax], 0
call edi
cmp byte [esp + 0x14], 0
mov esi, eax
je 0x431ed2
xor ecx, ecx
test esi, esi
jle 0x431ed2
mov eax, dword [esp + 0x18]
lea edi, [ecx + eax]
mov eax, ecx
cdq
push 0x14
pop ebx
idiv ebx
mov al, byte [edx + 0x484f24]
xor byte [edi], al
inc ecx
cmp ecx, esi
jl 0x431eb6
mov eax, dword [ebp]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dl, 0x2b
jne 0x431ee3
xor dl, dl
jmp 0x431f09
cmp dl, 0x2f
jne 0x431eed
add dl, 0xd2
jmp 0x431f09
cmp dl, 0x39
ja 0x431ef7
add dl, 0xd2
jmp 0x431f09
cmp dl, 0x5a
ja 0x431f01
add dl, 0xcb
jmp 0x431f09
cmp dl, 0x7a
ja 0x431f0e
add dl, 0xc5
movzx edx, dl
jmp 0x431f11
or edx, 0xffffffff
test edx, edx
jl 0x431f3d
shl edx, cl
or ebx, edx
add cl, 6
cmp cl, 8
jge 0x431f32
test cl, cl
jle 0x431e98
cmp byte [esi], 0
jne 0x431e98
mov byte [eax], bl
inc eax
shr ebx, 8
add cl, 0xf8
jmp 0x431f1c
xor eax, eax
jmp 0x431ed5