joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439290
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
push edi
mov byte [ebp - 0x203], cl
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x21c]
push eax
push ebx
call sub.user32.dll_GetClientRect
test eax, eax
je 0x4393f1
mov eax, dword [0x66d818]
cmp byte [eax], 0
je 0x4392f9
push 0xff
lea eax, [ebp - 0x202]
push eax
push ebx
call sub.user32.dll_GetWindowTextW
test eax, eax
jle 0x439335
mov edx, dword [0x66d1d8]
cmp byte [edx], 0
je 0x439335
cmp eax, 1
jle 0x439335
cmp word [ebp + eax*2 - 0x204], 0x2f
jne 0x439335
dec eax
jmp 0x439335
push 0xff
lea eax, [ebp - 0x202]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x202]
call fcn.00408154
test eax, eax
jle 0x439335
mov edx, dword [0x66d1d8]
cmp byte [edx], 0
je 0x439335
cmp eax, 1
jle 0x439335
cmp byte [ebp + eax - 0x203], 0x2f
jne 0x439335
dec eax
push esi
lea esi, [ebp - 0x21c]
lea edi, [ebp - 0x22c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
xor edx, edx
mov dword [ebp - 0x208], edx
mov edx, dword [0x66d818]
movzx edx, byte [edx]
push edx
movzx edx, byte [ebp - 0x203]
push edx
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x202]
xor edx, edx
mov eax, ebx
call fcn.004206c0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x220], eax
add dword [ebp - 0x224], 4
push 0
mov eax, ebx
call fcn.0041acf8
push eax
lea eax, [ebp - 0x22c]
push eax
call sub.user32.dll_AdjustWindowRect
push 2
lea eax, [ebp - 0x22c]
push eax
push esi
push ebx
call sub.user32.dll_MapWindowPoints
push 0x204
mov ecx, dword [ebp - 0x220]
mov edx, dword [ebp - 0x228]
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x22c]
sub ecx, eax
push ecx
push edx
push eax
push 0
push ebx
call sub.user32.dll_SetWindowPos
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4393f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp word [0x6676e0], 0
jne 0x43941e
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
call fcn.0041ad9c
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0xffffffff
jne 0x43943b
mov eax, dword [ebp + 8]
movzx edx, word [eax - 0xa]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004222e0
pop ebp
ret
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
test eax, 0xffff0000
sete al
test al, al
je 0x439461
mov eax, dword [ebp + 8]
movzx edx, word [eax - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004222e0
jmp 0x43947a
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
push 0x43947c
push 0
call sub.shell32.dll_ShellExecuteA
pop ebp
ret
Function at 0x43a1fc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
mov eax, edx
mov dword [ebx + 0x50], eax
cmp byte [ebx + 0x46], 0
je 0x43a222
shr eax, 0x10
and eax, 0xffff
mov dword [ebx + 0x54], eax
and dword [ebx + 0x50], 0xffff
mov byte [esp], 0
mov eax, dword [ebx + 0x40]
dec eax
test eax, eax
jl 0x43a2ce
inc eax
mov dword [esp + 4], eax
xor esi, esi
mov edx, esi
or edx, 0x8000
mov eax, ebx
mov ecx, dword [eax + 0x1c]
call dword [ecx + 4]
mov edi, eax
test edi, edi
je 0x43a2c3
mov eax, ebx
mov edx, esi
call fcn.00439e04
mov ebp, eax
cmp byte [ebx + 0x47], 0
je 0x43a27d
test ebp, ebp
jne 0x43a26e
push 0
push edi
call sub.user32.dll_ShowWindow
jmp 0x43a27d
cmp ebp, 2
jne 0x43a275
xor ebp, ebp
push 4
push edi
call sub.user32.dll_ShowWindow
push ebp
mov eax, ebx
mov ecx, edi
mov edx, esi
call fcn.00439f8c
cmp byte [ebx + 0x45], 0
jne 0x43a2c3
cmp dword [ebx + 0x50], 0
jge 0x43a2c3
cmp byte [esp], 0
jne 0x43a2c3
mov ecx, esi
mov eax, 1
shl eax, cl
and eax, dword [ebx + 0x58]
je 0x43a2c3
mov byte [esp], 1
mov eax, edi
call fcn.0041acf8
mov edx, eax
or edx, 0x10000
mov eax, edi
call fcn.0041ad08
inc esi
dec dword [esp + 4]
jne 0x43a239
mov eax, ebx
or edx, 0xffffffff
call fcn.0043a0c0
mov al, 1
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43a308
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, edx
mov ebx, eax
xor eax, eax
cmp esi, dword [ebx + 0x28]
jb 0x43a468
cmp byte [ebx + 0x47], 0
je 0x43a425
mov edx, dword [ebx + 0x28]
add edx, dword [ebx + 0x40]
cmp esi, edx
jb 0x43a425
mov edx, dword [ebx + 0x28]
mov ecx, dword [ebx + 0x40]
add ecx, ecx
add edx, ecx
cmp esi, edx
jae 0x43a425
mov edx, dword [ebx + 0x28]
add edx, dword [ebx + 0x40]
sub esi, edx
mov ecx, esi
mov edx, 1
shl edx, cl
and edx, dword [ebx + 0x58]
je 0x43a468
mov ecx, esi
mov eax, 1
shl eax, cl
and eax, dword [ebx + 0x50]
setne al
movzx edi, al
mov edx, esi
or edx, 0x8000
mov eax, ebx
mov ecx, dword [eax + 0x1c]
call dword [ecx + 4]
mov ebp, eax
test edi, edi
jne 0x43a3a3
push 4
push ebp
call sub.user32.dll_ShowWindow
push 1
mov eax, ebx
mov ecx, ebp
mov edx, esi
call fcn.00439f8c
mov edi, 1
jmp 0x43a3e0
mov eax, ebx
mov edx, esi
call fcn.00439f38
cmp byte [ebx + 0x46], 0
je 0x43a3c9
dec eax
jne 0x43a3c9
push 0
mov eax, ebx
mov ecx, ebp
mov edx, esi
call fcn.00439f8c
mov edi, 2
jmp 0x43a3e0
push 0
push ebp
call sub.user32.dll_ShowWindow
push 0
mov eax, ebx
mov ecx, ebp
mov edx, esi
call fcn.00439f8c
xor edi, edi
test edi, edi
jne 0x43a3f4
mov ecx, esi
mov eax, 1
shl eax, cl
not eax
and dword [ebx + 0x50], eax
jmp 0x43a400
mov ecx, esi
mov eax, 1
shl eax, cl
or dword [ebx + 0x50], eax
cmp edi, 2
jne 0x43a413
mov ecx, esi
mov eax, 1
shl eax, cl
or dword [ebx + 0x54], eax
jmp 0x43a421
mov ecx, esi
mov eax, 1
shl eax, cl
not eax
and dword [ebx + 0x54], eax
mov al, 1
jmp 0x43a468
mov edx, dword [ebx + 0x28]
add edx, dword [ebx + 0x40]
cmp esi, edx
jae 0x43a468
cmp byte [ebx + 0x44], 0
jne 0x43a439
mov al, 1
jmp 0x43a468
mov edi, dword [ebx + 0x50]
mov ebp, dword [ebx + 0x54]
mov eax, ebx
call fcn.00439fd4
mov edx, esi
sub edx, dword [ebx + 0x28]
mov eax, ebx
call fcn.0043a0c0
cmp edi, dword [ebx + 0x50]
jne 0x43a466
cmp byte [ebx + 0x46], 0
je 0x43a462
cmp ebp, dword [ebx + 0x54]
jne 0x43a466
xor eax, eax
jmp 0x43a468
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x444a70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov byte [esp + 4], cl
mov esi, edx
mov dword [esp], eax
test esi, esi
jne 0x444a93
xor edx, edx
mov eax, dword [esp]
call fcn.00418b50
jmp 0x444b64
cmp esi, 0xffffffff
jne 0x444aa4
mov ebp, 0x32
mov edi, 0x32
jmp 0x444aaf
call fcn.00442e20
mov dword [esp + 0xc], eax
mov edi, esi
cmp esi, 0xffffffff
je 0x444ac0
mov ebp, edi
cmp ebp, 0x32
jbe 0x444ac0
mov ebp, 0x32
mov edx, ebp
mov eax, dword [esp]
call fcn.00418b50
mov ebx, eax
cmp ebx, 1
jne 0x444b62
cmp esi, 0xffffffff
je 0x444aef
cmp ebp, edi
jae 0x444ae2
sub edi, ebp
jmp 0x444ae4
xor edi, edi
test edi, edi
jne 0x444aef
mov ebx, 1
jmp 0x444b62
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
movzx ecx, byte [esp + 8]
mov edx, edi
call fcn.0041bf68
mov ebx, eax
test ebx, ebx
jne 0x444b18
cmp dword [esp + 8], 0
je 0x444b62
mov ebx, 1
cmp byte [esp + 4], 0
jne 0x444b26
cmp dword [esp + 8], 1
je 0x444b62
cmp esi, 0xffffffff
je 0x444aaf
call fcn.00442e20
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0xc]
jb 0x444b4a
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0xc]
cmp esi, eax
jae 0x444b51
xor edi, edi
jmp 0x444aaf
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0xc]
mov edi, esi
sub edi, eax
jmp 0x444aaf
mov eax, ebx
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x44db48
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff14
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x7c]
xor edx, edx
call fcn.00418420
lea eax, [ebp - 0x7c]
mov ecx, esi
mov edx, ebx
call fcn.00418470
mov eax, dword [ebp + 8]
add eax, 0x14
dec eax
mov ecx, 0x14
cdq
idiv ecx
dec eax
test eax, eax
jl 0x44dc1a
inc eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
xor eax, eax
lea edx, [ebp - 8]
mov ecx, eax
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
mov ecx, 0x18
pop esi
sub ecx, esi
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
mov byte [edx], cl
inc eax
inc edx
cmp eax, 4
jne 0x44db93
lea edx, [ebp - 0xec]
lea eax, [ebp - 0x7c]
mov ecx, 0x70
call fcn.00402da0
lea edx, [ebp - 8]
lea eax, [ebp - 0xec]
mov ecx, 4
call fcn.0041849c
lea eax, [ebp - 0xec]
call fcn.0041850c
xor eax, eax
mov edx, ebx
add edx, edx
add edx, edx
lea edx, [edx + edx*4]
add edx, eax
cmp edx, dword [ebp + 8]
jge 0x44dc0a
mov ecx, dword [ebp - 4]
add ecx, edx
lea edx, [ebp - 0x90]
movzx edx, byte [edx + eax]
mov byte [ecx], dl
inc eax
cmp eax, 0x14
jne 0x44dbe9
inc ebx
dec dword [ebp - 0xc]
jne 0x44db8e
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44dc28
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff14
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x7c]
xor edx, edx
call fcn.00418420
lea eax, [ebp - 0x7c]
mov ecx, esi
mov edx, ebx
call fcn.00418470
mov eax, dword [ebp + 8]
add eax, 0x14
dec eax
mov ecx, 0x14
cdq
idiv ecx
dec eax
test eax, eax
jl 0x44dcfa
inc eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
xor eax, eax
lea edx, [ebp - 8]
mov ecx, eax
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
mov ecx, 0x18
pop esi
sub ecx, esi
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
mov byte [edx], cl
inc eax
inc edx
cmp eax, 4
jne 0x44dc73
lea edx, [ebp - 0xec]
lea eax, [ebp - 0x7c]
mov ecx, 0x70
call fcn.00402da0
lea edx, [ebp - 8]
lea eax, [ebp - 0xec]
mov ecx, 4
call fcn.0041849c
lea eax, [ebp - 0xec]
call fcn.0041850c
xor eax, eax
mov edx, ebx
add edx, edx
add edx, edx
lea edx, [edx + edx*4]
add edx, eax
cmp edx, dword [ebp + 8]
jge 0x44dcea
mov ecx, dword [ebp - 4]
add ecx, edx
lea edx, [ebp - 0x90]
movzx edx, byte [edx + eax]
xor byte [ecx], dl
inc eax
cmp eax, 0x14
jne 0x44dcc9
inc ebx
dec dword [ebp - 0xc]
jne 0x44dc6e
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x461a50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov ebx, eax
mov byte [esp], 0
test dl, dl
je 0x461a73
lea edx, [esp + 0x11]
mov eax, ebx
mov ecx, 0x1a
call fcn.00402da0
jmp 0x461a8f
mov eax, ebx
call fcn.00408154
mov edx, eax
lea ecx, [esp + 0x11]
mov eax, ebx
call fcn.004619e0
test al, al
je 0x461ba3
lea eax, [esp + 0x11]
call fcn.00461770
mov esi, 0x461bb0
mov eax, dword [0x669684]
add eax, 0x434
mov dword [esp + 4], eax
mov byte [esp + 8], 0
mov bl, 5
cmp dword [esi], 0
je 0x461add
mov eax, dword [esp + 4]
mov edi, eax
mov eax, dword [esi]
mov ecx, 0x28
mov edx, edi
call fcn.00461634
mov ebp, eax
mov eax, ebp
xor byte [esp + 8], al
test bl, bl
je 0x461add
dec ebx
add esi, 4
jmp 0x461ab2
movzx eax, byte [esp + 8]
and al, 0xf
xor al, 0xf
mov byte [0x66970c], al
xor edx, edx
mov ecx, 0x1a
mov eax, 0x67c800
movzx ebx, byte [eax]
xor edx, ebx
inc eax
dec ecx
jne 0x461af7
mov eax, edx
xor byte [0x66970c], al
cmp byte [0x66970c], 0
jne 0x461ba3
mov esi, 0x461bcc
mov eax, dword [0x669684]
add eax, 0x434
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], 0
mov bl, 5
cmp dword [esi], 0
je 0x461b5a
mov eax, dword [esp + 0xc]
mov edi, eax
mov eax, dword [esi]
mov ecx, 0x28
mov edx, edi
call fcn.00461634
mov ebp, eax
mov eax, ebp
xor byte [esp + 0x10], al
test bl, bl
je 0x461b5a
dec ebx
add esi, 4
jmp 0x461b2f
movzx eax, byte [esp + 0x10]
and al, 0xf
xor al, 5
mov byte [0x66970c], al
xor ebx, ebx
xor edx, edx
mov eax, 0x67c800
mov ecx, edx
mov esi, 1
shl esi, cl
test esi, 0x3577caf
je 0x461b87
movzx ecx, byte [eax]
xor ebx, ecx
inc edx
inc eax
cmp edx, 0x1a
jne 0x461b71
mov eax, ebx
xor byte [0x66970c], al
cmp byte [0x66970c], 0
jne 0x461ba3
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x461be4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffc8
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp]
cmp word [eax + 0x3d8], 0x260
jae 0x461c18
cmp dword [esp + 4], 0
je 0x461c0e
mov byte [0x669710], 1
mov byte [esp + 8], 1
jmp 0x461d64
mov byte [esp + 8], 0
cmp dword [esp + 4], 0
jne 0x461c2c
lea eax, [esp + 0x19]
mov dword [esp + 4], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
add eax, 0x468
call fcn.00461998
mov esi, 0x461d74
mov eax, dword [esp]
add eax, 0x3da
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], 0
mov bl, 5
cmp dword [esi], 0
je 0x461c80
mov eax, dword [esp + 0xc]
mov edi, eax
mov eax, dword [esi]
mov ecx, 0x28
mov edx, edi
call fcn.00461634
mov ebp, eax
mov eax, ebp
xor byte [esp + 0x10], al
test bl, bl
je 0x461c80
dec ebx
add esi, 4
jmp 0x461c55
movzx eax, byte [esp + 0x10]
and al, 0xf
mov edx, eax
xor dl, 0xc
mov eax, dword [esp + 4]
mov ebx, eax
xor ecx, ecx
xor eax, eax
movzx esi, byte [ebx + eax]
xor ecx, esi
inc eax
cmp eax, 0x1c
jne 0x461c96
mov eax, ecx
xor dl, al
lea eax, [esp + 0x19]
cmp eax, dword [esp + 4]
je 0x461cb6
mov byte [0x669710], dl
test dl, dl
jne 0x461d64
mov esi, 0x461d8c
mov eax, dword [esp]
add eax, 0x3da
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], 0
mov bl, 5
cmp dword [esi], 0
je 0x461d01
mov eax, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esi]
mov ecx, 0x28
mov edx, edi
call fcn.00461634
mov ebp, eax
mov eax, ebp
xor byte [esp + 0x18], al
test bl, bl
je 0x461d01
dec ebx
add esi, 4
jmp 0x461cd6
movzx eax, byte [esp + 0x18]
and al, 0xf
mov edx, eax
xor dl, 9
mov eax, dword [esp + 4]
mov esi, eax
xor ebx, ebx
xor eax, eax
mov ecx, eax
mov edi, 1
shl edi, cl
test edi, 0xe9d4fed
je 0x461d2e
movzx ecx, byte [esi + eax]
xor ebx, ecx
inc eax
cmp eax, 0x1c
jne 0x461d17
mov eax, ebx
xor dl, al
lea eax, [esp + 0x19]
cmp eax, dword [esp + 4]
je 0x461d48
mov byte [0x669710], dl
test dl, dl
jne 0x461d64
mov eax, dword [esp]
movzx eax, word [eax + 0x476]
not ax
mov word [0x669688], ax
mov byte [esp + 8], 1
movzx eax, byte [esp + 8]
add esp, 0x38
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x462ad4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push eax
mov ebp, esp
pushal
mov edi, 0x27428347
pushfd
pushfd
pop eax
mov ebx, eax
mov ecx, 0x200000
xor eax, ecx
push eax
popfd
pushfd
pop eax
popfd
xor eax, ebx
test eax, ecx
je 0x462b4c
xor eax, eax
cpuid
mov eax, edx
rol eax, 1
xor eax, ebx
rol eax, 1
xor eax, ecx
mov edi, eax
xor eax, eax
inc eax
push eax
cpuid
and eax, 0xfff3fff
and edx, 0xdfeffbff
and ecx, 0xe7fefe77
xor eax, ecx
xor eax, edx
xor edi, eax
pop eax
ror eax, 1
push eax
cpuid
pop ecx
mov cl, 4
cmp eax, ecx
jb 0x462b4c
mov eax, ecx
dec eax
dec eax
push eax
cpuid
rol eax, 1
xor eax, ebx
rol eax, 1
xor eax, ecx
rol eax, 1
xor eax, edx
xor edi, eax
rol edi, 1
pop eax
inc eax
cmp al, 5
jb 0x462b33
mov dword [ebp], edi
popal
pop eax
pop ebp
ret

Function at 0x463448
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0x40
jle 0x46347d
lea ecx, [ebp - 0x50]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00418518
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 4]
mov ecx, 0x2c
call fcn.00402da0
jmp 0x4634a7
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00402da0
cmp dword [ebp - 8], 0x40
jge 0x4634a7
mov edx, 0x40
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
lea eax, [ebp + eax - 0x50]
xor ecx, ecx
call fcn.004032f4
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov al, byte [ebp + eax - 0x50]
xor al, 0x5c
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x50], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x40
jne 0x4634ac
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00418420
lea edx, [ebp - 0x50]
mov eax, dword [ebp + 8]
mov ecx, 0x40
call fcn.00418470
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov al, byte [ebp + eax - 0x50]
xor al, 0x6a
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x50], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x40
jne 0x4634e4
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00418420
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0xc]
mov ecx, 0x40
call fcn.00418470
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x40
call fcn.004032f4
mov esp, ebp
pop ebp
ret 4
Function at 0x4635ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
add eax, 4
call fcn.0040d7d8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
call fcn.00402da0
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
shl eax, 3
mov ecx, 0x18
sub ecx, eax
mov eax, dword [ebp + 0xc]
shr eax, cl
and al, 0xff
mov edx, dword [ebp + 0x14]
add edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
lea edx, [ecx + edx]
mov byte [edx], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x4635e1
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0x8c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00463448
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x8c]
mov edx, dword [ebp + 0x14]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0046352c
mov eax, dword [ebp + 8]
mov edi, eax
lea esi, [ebp - 0x110]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x18]
call fcn.0040d7e8
mov eax, dword [ebp + 0x10]
dec eax
test eax, eax
jle 0x4636ce
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
lea esi, [ebp - 0x110]
lea edi, [ebp - 0x124]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x8c]
lea eax, [ebp - 0x124]
mov edx, 0x14
call fcn.0046352c
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x110]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
xor dword [edx + ecx*4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jne 0x4636aa
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x463670
lea eax, [ebp - 0x8c]
xor ecx, ecx
mov edx, 0x70
call fcn.004032f4
lea eax, [ebp - 0xfc]
xor ecx, ecx
mov edx, 0x70
call fcn.004032f4
lea eax, [ebp - 0x110]
xor ecx, ecx
mov edx, 0x14
call fcn.004032f4
lea eax, [ebp - 0x124]
xor ecx, ecx
mov edx, 0x14
call fcn.004032f4
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x467674
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov edi, dword [ebx + 0x14]
dec edi
test edi, edi
jl 0x4676ab
inc edi
xor esi, esi
imul ebp, esi, 0x13
mov eax, dword [ebx + 0x18]
cmp dword [eax + ebp*4 + 0x48], 0
je 0x46769e
mov eax, dword [ebx + 0x18]
lea eax, [eax + ebp*4 + 0x48]
call fcn.0040d7e8
mov eax, dword [ebx + 0x18]
xor edx, edx
mov dword [eax + ebp*4 + 4], edx
inc esi
dec edi
jne 0x467685
cmp dword [ebx + 0x14], 0
je 0x4676c1
lea eax, [ebx + 0x18]
call fcn.0040d7e8
lea eax, [ebx + 0x24]
call fcn.0040d7e8
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x20], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x40]
test eax, eax
jle 0x46776e
mov edi, eax
dec edi
test edi, edi
jl 0x46776e
inc edi
xor esi, esi
mov ebp, esi
shl ebp, 4
add ebp, esi
mov eax, dword [ebx + 0x48]
cmp dword [eax + ebp*4 + 8], 0
jbe 0x467766
mov eax, dword [ebx + 0x48]
cmp dword [eax + ebp*4 + 0x14], 0
je 0x467766
mov eax, dword [ebx + 0x48]
cmp dword [eax + ebp*4 + 0x24], 0
je 0x46771a
mov eax, dword [ebx + 0x48]
lea eax, [eax + ebp*4 + 0x24]
call fcn.0040d7e8
mov eax, dword [ebx + 0x48]
cmp dword [eax + ebp*4 + 0x34], 0
je 0x467766
mov eax, esi
shl eax, 4
add eax, esi
mov edx, dword [ebx + 0x48]
mov ebp, dword [edx + eax*4 + 0x34]
test ebp, ebp
jle 0x467753
mov eax, esi
shl eax, 4
add eax, esi
mov edx, dword [ebx + 0x48]
mov eax, dword [edx + eax*4 + 0x30]
lea edx, [esi + esi*2]
lea eax, [eax + edx*4 - 0xc]
call fcn.0040d7e8
dec ebp
jne 0x467736
mov eax, esi
shl eax, 4
add eax, esi
mov edx, dword [ebx + 0x48]
lea eax, [edx + eax*4 + 0x30]
call fcn.0040d7e8
inc esi
dec edi
jne 0x4676e9
lea eax, [ebx + 0x44]
call fcn.0040d7e8
lea eax, [ebx + 0x48]
call fcn.0040d7e8
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x3c], eax
lea eax, [ebx + 0x50]
call fcn.0040d7e8
xor eax, eax
mov dword [ebx + 0x4c], eax
cmp dword [ebx + 0x78], 0
je 0x4677a3
lea eax, [ebx + 0x78]
call fcn.0040d7e8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46d7fc
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
test eax, esi
je 0x46d83f
mov eax, ebx
add ax, 0x41
mov word [esp], ax
mov edx, 0x46d84c
lea eax, [esp + 2]
mov ecx, 2
call fcn.00414414
mov eax, esp
mov ecx, ebx
xor edx, edx
call fcn.0046d6dc
inc ebx
cmp ebx, 0x1a
jne 0x46d80a
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x46dd78
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov byte [esp + 1], cl
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
test esi, esi
jl 0x46de74
cmp esi, dword [0x669904]
jge 0x46de74
imul edi, esi, 0x299
mov eax, dword [0x669908]
cmp byte [eax + edi*8 + 0x14b4], 0
je 0x46ddba
mov bl, 1
jmp 0x46de74
mov eax, esi
call fcn.0046dc2c
cmp eax, 0xffffffff
je 0x46de74
cmp byte [esp], 0
je 0x46de1e
mov ebp, 0x90020
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push 0
push ebp
mov eax, dword [0x669908]
mov eax, dword [eax + edi*8 + 0x14ac]
push eax
call sub.kernel32.dll_DeviceIoControl
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
mov edx, dword [0x66d734]
movzx edx, byte [edx]
mov eax, esi
call fcn.0046dc3c
cmp eax, 0xffffffff
jne 0x46de1e
mov eax, esi
call fcn.0046da64
jmp 0x46de74
mov ebp, 0x90018
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push 0
push ebp
mov eax, dword [0x669908]
mov eax, dword [eax + edi*8 + 0x14ac]
push eax
call sub.kernel32.dll_DeviceIoControl
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x46de6d
mov eax, dword [0x669908]
mov byte [eax + edi*8 + 0x14b4], 1
mov eax, dword [0x669908]
movzx edx, byte [esp + 1]
mov byte [eax + edi*8 + 0x14b5], dl
mov eax, esi
call fcn.0046da64
mov eax, ebx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46de80
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffff004
push eax
add esp, 0xfffff7fc
mov edx, dword [0x66d7e4]
cmp dword [edx + 4], 5
jae 0x46decc
imul eax, eax, 0x299
mov edx, dword [0x669908]
lea eax, [edx + eax*8 + 0x200]
lea edx, [esp + 0x1002]
mov ecx, 0x7ff
call fcn.00414408
lea eax, [esp + 0x1002]
push eax
call sub.kernel32.dll_GetDriveTypeA
jmp 0x46df1c
imul edx, eax, 0x299
mov ecx, dword [0x669908]
cmp word [ecx + edx*8], 0
jne 0x46def3
mov eax, dword [0x669908]
lea eax, [eax + edx*8 + 0x200]
push eax
call sub.kernel32.dll_GetDriveTypeW
jmp 0x46df1c
mov eax, dword [0x669908]
lea eax, [eax + edx*8]
mov edx, eax
mov eax, esp
mov ecx, 0x7ff
call fcn.0040da74
mov word [esp + eax*2], 0x5c
mov word [esp + eax*2 + 2], 0
push esp
call sub.kernel32.dll_GetDriveTypeW
add esp, 0x1804
ret