joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4be2b0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
movzx esi, ax
add eax, 0xffffff90
cmp ax, 0xb
ja 0x4be2de
lea eax, [esi - 0x6f]
push eax
push 0x4ea3a0
push 0x58fc08
call fcn.004010a0
add esp, 0xc
jmp 0x4be4d2
lea eax, [esi - 1]
cmp eax, 0xa4
ja case.0x4be2f3.5
movzx eax, byte [eax + 0x4be5a0]
jmp dword [eax*4 + 0x4be510]
mov ecx, str.Lbutton
jmp 0x4be41d
mov ecx, str.Rbutton
jmp 0x4be41d
mov ecx, 0x4e55b0
jmp 0x4be41d
mov ecx, str.Mbutton
jmp 0x4be41d
mov ecx, str.Backspace
jmp 0x4be41d
mov ecx, 0x4ea3c8
jmp 0x4be41d
mov ecx, str.Clear
jmp 0x4be41d
mov ecx, str.Enter
jmp 0x4be41d
mov ecx, 0x4ea3d4
jmp 0x4be41d
mov ecx, 0x4ea3dc
jmp 0x4be41d
mov ecx, 0x4ea3e4
jmp 0x4be41d
mov ecx, str.Pause
jmp 0x4be41d
mov ecx, str.Capital
jmp 0x4be41d
mov ecx, 0x4ea3f8
jmp 0x4be41d
mov ecx, str.Space
jmp 0x4be41d
mov ecx, str.PgUp
jmp 0x4be41d
mov ecx, str.PgDown
jmp 0x4be41d
mov ecx, 0x4ea414
jmp 0x4be41d
mov ecx, str.Home
jmp 0x4be41d
mov ecx, 0x4e5c8c
jmp 0x4be41d
mov ecx, 0x4f22d4
jmp 0x4be41d
mov ecx, 0x4e5c9c
jmp 0x4be41d
mov ecx, str.Down
jmp 0x4be41d
mov ecx, 0x4ea420
jmp 0x4be41d
mov ecx, 0x4ea424
jmp 0x4be41d
mov ecx, str.Help
jmp 0x4be41d
mov ecx, 0x4ea430
jmp 0x4be41d
mov ecx, str.Apps
jmp 0x4be41d
mov ecx, 0x4ea43c
jmp 0x4be41d
mov ecx, str.Lshift
jmp 0x4be41d
mov ecx, str.Rshift
jmp 0x4be41d
mov ecx, str.Lctrl
jmp 0x4be41d
mov ecx, str.Rctrl
jmp 0x4be41d
mov ecx, str.Lalt
jmp 0x4be41d
mov ecx, str.Ralt
mov edx, 0x58fc08
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4be424
jmp 0x4be4d2
push 0x32
push 0x58fc08
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
or eax, 0x100
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jne 0x4be4d2
call fcn.00493410
test eax, eax
je 0x4be4d2
call fcn.00493410
cmp dword [eax], 0
je 0x4be4d2
mov eax, dword [0x52e820]
push ebx
push edi
test eax, eax
je 0x4be47f
mov edi, dword [eax + 0x190]
jmp 0x4be485
mov edi, dword [0x52e824]
call fcn.00493410
test eax, eax
je 0x4be497
call fcn.00493410
mov ebx, dword [eax]
jmp 0x4be499
xor ebx, ebx
push str.Error_getting_virtual_key_name_for_scan_key__02X:__s
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047f8c0
add esp, 8
push eax
push esi
push str.Error_getting_virtual_key_name_for_scan_key__02X:__s
push dword [0x52e820]
push edi
push 0
push 0xd7
push str.MainMenu.c
push 2
call ebx
add esp, 0x28
pop edi
pop ebx
cmp word [ebp + 8], 0xd
pop esi
jne 0x4be4f0
push 0x20
push 0x58fc08
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__mbsrchr
add esp, 8
test eax, eax
je 0x4be4f0
inc eax
jmp 0x4be4f5
mov eax, 0x58fc08
cmp byte [eax], 0
mov dword [0x58fc3c], eax
je 0x4be50e
inc eax
push eax
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__mbslwr
mov eax, dword [0x58fc3c]
add esp, 4
pop ebp
ret
Function at 0x4c56a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x50dc10]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x58fc58], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, str.UNKNOWN
je 0x4c57fb
test edi, edi
je 0x4c57fb
cmp dword [ebp + 8], 1
je 0x4c579b
xor ebx, ebx
mov dword [ebp - 8], ebx
cmp byte [edi], bl
je 0x4c57fb
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4c56f0
sub esi, ecx
lea eax, [esi + 4]
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [ebp - 0xc], eax
lea eax, [esi + 1]
push eax
push edi
mov edi, dword [ebp - 0xc]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, esi
add esp, 0x10
and eax, 3
je 0x4c5737
push eax
mov eax, esi
and eax, 0xfc
add eax, edi
push eax
lea eax, [ebp - 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [ebp - 8]
add esp, 0xc
sar esi, 2
test esi, esi
je 0x4c5749
nop
xor ebx, dword [edi + esi*4 - 4]
dec esi
test esi, esi
jne 0x4c5740
mov esi, dword [ebp - 0xc]
mov eax, 0x446f8657
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x65
sub ebx, eax
mov eax, dword [0x58fc58]
mov edi, dword [eax + ebx*4 + 4]
test edi, edi
je 0x4c5789
push dword [edi]
push esi
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp
add esp, 8
test eax, eax
je 0x4c5789
mov edi, dword [edi + 0x1a0]
test edi, edi
jne 0x4c5770
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
test edi, edi
je 0x4c57fb
mov ebx, str.UNKNOWN
mov ecx, dword [edi + 4]
mov eax, 0x446f8657
mov esi, dword [ebp + 0x10]
test ecx, ecx
cmovne ebx, ecx
mov ecx, esi
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x65
sub ecx, eax
mov eax, dword [edi + ecx*4 + 0xc]
test eax, eax
je 0x4c57e8
cmp esi, dword [eax]
je 0x4c57e5
mov eax, dword [eax + 8]
test eax, eax
jne 0x4c57c7
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2538
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 4]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2538
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, str.UNKNOWN
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e2538
mov esp, ebp
pop ebp
ret
Function at 0x4c5ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x50dc10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
test ebx, ebx
je 0x4c6067
cmp byte [ebx], 0
je 0x4c6067
cmp dword [0x58fc58], edi
jne 0x4c5f41
push 0x198
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [0x58fc58], eax
test eax, eax
je 0x4c5f41
push 0x198
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4c5f47
sub esi, ecx
lea eax, [esi + 4]
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, esi
add esp, 0x10
and eax, 3
je 0x4c5f8c
push eax
mov eax, esi
and eax, 0xfc
add eax, ebx
push eax
lea eax, [ebp - 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 8]
add esp, 0xc
sar esi, 2
test esi, esi
jle 0x4c5f9c
xor edi, dword [ebx + esi*4 - 4]
dec esi
test esi, esi
jg 0x4c5f93
mov eax, 0x446f8657
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x65
sub edi, eax
mov eax, dword [0x58fc58]
mov esi, dword [eax + edi*4 + 4]
test esi, esi
je 0x4c5fdd
push dword [esi]
push ebx
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp
add esp, 8
test eax, eax
je 0x4c605c
mov esi, dword [esi + 0x1a0]
test esi, esi
jne 0x4c5fc0
push 0x1a4
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x4c6003
push 0x1a0
lea eax, [esi + 4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], ebx
mov eax, dword [0x58fc58]
mov eax, dword [eax + edi*4 + 4]
mov dword [esi + 0x1a0], eax
mov eax, dword [0x58fc58]
mov dword [eax + edi*4 + 4], esi
mov eax, dword [0x58fc58]
inc dword [eax]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4c6049
push 0xe9
push str.Message.c
push sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
push 0
push eax
lea ecx, [esi + 4]
push ecx
call fcn.0047ce40
add esp, 0x18
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2538
mov esp, ebp
pop ebp
ret
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
jmp 0x4c6024
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.004e2538
mov esp, ebp
pop ebp
ret
Function at 0x4d0d10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
pop ebp
ret
Function at 0x4d62f0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x50dc10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi]
cmp ecx, 0xf
jne 0x4d6326
lea ecx, [ebp - 0x54]
push ecx
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
movups xmm0, xmmword [ebp - 0x4c]
mov edi, eax
movups xmmword [ebp - 0x64], xmm0
jmp 0x4d6373
cmp ecx, 0x85
jne 0x4d634f
push 0x81
push dword [esi + 0x24]
push eax
call dword [sym.imp.USER32.dll_GetDCEx]
mov edi, eax
lea eax, [ebp - 0x64]
push 0
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetUpdateRect]
jmp 0x4d6373
cmp ecx, 0x14
jne 0x4d635e
mov edi, dword [esi + 0x24]
lea ecx, [ebp - 0x64]
push ecx
push eax
jmp 0x4d636d
push eax
call dword [sym.imp.USER32.dll_GetWindowDC]
mov edi, eax
lea eax, [ebp - 0x64]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetClientRect]
push ebx
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x58]
mov ebx, eax
sub ecx, dword [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x64]
push ecx
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
movups xmm0, xmmword [ebp - 0x64]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x14]
push 2
push eax
push dword [esi]
movups xmmword [ebp - 0x14], xmm0
call dword [0x595d94]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [0x595d94]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push esi
mov dword [esi + 0x18], ebx
call fcn.004d6600
mov eax, dword [esi + 0x10]
add esp, 4
cmp dword [eax], 5
jne 0x4d63f1
call fcn.00493410
test dword [eax + 4], 0x20000
jne 0x4d6416
xor eax, eax
cmp dword [esi + 0x2c], 0x85
setne al
lea eax, [eax*2 + 2]
push eax
push ebx
push 0x318
push dword [esi]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_CallWindowProcA]
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x60]
push 0xcc0020
push 0
push 0
push ebx
push eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
call fcn.004d6160
push esi
call fcn.004d6600
add esp, 8
push dword [ebp - 0x68]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esi + 0x2c]
pop ebx
cmp eax, 0xf
jne 0x4d6477
lea eax, [ebp - 0x54]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x4d6485
cmp eax, 0x14
je 0x4d6485
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 0x18], 0
xor ecx, ebp
pop esi
call fcn.004e2538
mov esp, ebp
pop ebp
ret
Function at 0x4dc6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x100
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
or esi, edi
nop dword [eax]
mov eax, esi
add ebx, ebx
shr eax, 7
mov ecx, edi
and eax, 1
and ecx, ebx
push eax
mov eax, esi
add ecx, edi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
lea edx, [edx + eax*2]
call fcn.004dd9b0
mov edx, dword [ebp - 8]
add esi, esi
mov eax, esi
xor eax, ebx
not eax
and edi, eax
cmp esi, 0x10000
jb 0x4dc6f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4dc740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
or edx, 0x100
mov ecx, edx
mov eax, edx
shr ecx, 7
add edx, edx
shr eax, 8
and ecx, 1
neg ecx
sar ecx, 4
and ecx, 0x7f
movzx esi, word [ebx + eax*2]
mov eax, dword [ebp + 8]
shr esi, 4
xor esi, ecx
add edi, dword [eax + esi*4]
cmp edx, 0x10000
jb 0x4dc750
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4dc790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x100
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
add ecx, esi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x4dc7a6
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ddc10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
bts esi, edx
mov ebx, ecx
cmp esi, 1
je 0x4ddc4b
push edi
mov edi, dword [ebp + 0xc]
mov edx, esi
and esi, 1
shr edx, 1
neg esi
sar esi, 4
and esi, 0x7f
movzx ecx, word [ebx + edx*2]
shr ecx, 4
xor ecx, esi
mov esi, edx
add eax, dword [edi + ecx*4]
cmp esi, 1
jne 0x4ddc28
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4ddcb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
push edi
lea edi, [eax + 1]
test edx, edx
je 0x4ddcff
push ebx
mov ebx, dword [ebp + 8]
push esi
nop dword [eax + eax]
movzx edx, word [ecx + edi*2]
mov esi, ebx
and esi, 1
shr edx, 4
mov ecx, esi
shr ebx, 1
neg ecx
add edi, edi
sar ecx, 4
or edi, esi
and ecx, 0x7f
xor edx, ecx
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx + edx*4]
sub dword [ebp - 4], 1
mov ecx, dword [ebp - 8]
jne 0x4ddcd0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x4e0790
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x20], 0
call fcn.004e0c80
xor edx, edx
lea esi, [ecx + 0x6c]
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x4e07b0
pop esi
ret

Function at 0x4e1f90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x50dc10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [ebp - 8]
push ecx
push 0
push eax
push edx
push 0
push 0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
mov ecx, eax
call fcn.004e1dc0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004e2538
mov esp, ebp
pop ebp
ret 4
Function at 0x4046e0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov dword [esp + 0x18], ecx
mov al, byte [esi]
test al, 0x80
je 0x404793
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + 7]
mov dl, byte [esi + 6]
mov edi, ecx
xor ecx, ecx
mov cl, byte [esi + 5]
and eax, 0x7f
shl edi, 8
add edi, edx
mov dword [esp + 0x20], eax
shl edi, 8
add edi, ecx
cmp eax, 0x64
jle 0x40472c
mov dword [esp + 0x20], 0x64
mov eax, dword [esp + 0x20]
add esi, 8
xor ecx, ecx
test eax, eax
mov dword [esp + 0x14], ecx
jle 0x4047f1
lea eax, [edi - 1]
xor edx, edx
mov ebp, 0x8c0
mov bl, byte [ecx + esi]
div ebp
mov al, byte [edx + 0x4105b4]
mov byte [esp + 0x10], bl
cmp al, bl
lea ebp, [edx + 0x4105b4]
je 0x404773
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push edx
push edi
call fcn.00404920
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
inc ecx
inc edi
cmp ecx, eax
mov byte [ebp], bl
mov dword [esp + 0x14], ecx
jl 0x40473d
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 4
and eax, 0x7f
add esi, 5
test eax, eax
jle 0x4047f1
mov ebp, eax
xor ecx, ecx
xor eax, eax
mov cl, byte [esi + 2]
mov al, byte [esi + 1]
shl ecx, 8
add ecx, eax
xor edx, edx
mov dl, byte [esi]
mov edi, 0x8c0
shl ecx, 8
add ecx, edx
xor edx, edx
mov bl, byte [esi + 3]
lea eax, [ecx - 1]
mov byte [esp + 0x10], bl
div edi
mov al, byte [edx + 0x4105b4]
cmp al, bl
lea edi, [edx + 0x4105b4]
je 0x4047e9
mov eax, dword [esp + 0x10]
push eax
push ecx
mov ecx, dword [esp + 0x20]
call fcn.00404920
add esi, 4
dec ebp
mov byte [edi], bl
jne 0x40479f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 4
Function at 0x2d834fff
Capabilities:
Get disk information

Disassembly:
push 0x3c
mov eax, 0x2d8e471e
call fcn.2d805e23
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
call fcn.2d897637
pop ecx
test al, al
je 0x2d835159
lea eax, [ebp - 0x44]
push eax
push ebx
push esi
call fcn.2d834ce5
add esp, 0xc
test eax, eax
jne 0x2d835161
push dword [ebp - 0x44]
push 1
call fcn.2d897637
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x2d835161
lea eax, [ebp - 0x44]
push eax
push edi
push esi
call fcn.2d834ce5
add esp, 0xc
test eax, eax
jne 0x2d835161
mov byte [edi + 3], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
call fcn.2d82bc14
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.2d8359fe
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], bl
pop ecx
pop ecx
cmp eax, 0x10
jb 0x2d8350df
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
cmp eax, 0x1000
jb 0x2d8350d3
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.2d897637
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.2d897637
pop ecx
pop ecx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
cmp eax, 2
je 0x2d8350fb
cmp eax, 5
jne 0x2d8350fd
mov bl, 1
mov eax, dword [0x2d966aec]
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8f7384]
call esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 8
jb 0x2d835159
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x2d835150
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.2d897637
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.2d897637
pop ecx
pop ecx
mov al, bl
call fcn.2d8076ce
ret
xor al, al
jmp 0x2d83515b
Function at 0x2d897637
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x2d897646
pop dword [ebp - 0xc]
mov eax, 0x4303fed3
add eax, 0xea857773
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x5f2f3c7b
sub dword [ebp - 0x1c], 0x10dcf730
mov dword [ebp - 0x18], 0x9b06703f
add dword [ebp - 0x18], 0x972cdc06
mov dword [ebp - 0x14], 0x4c452f41
add dword [ebp - 0x14], 0x714ed
mov dword [ebp - 0x10], 0x1d3a4995
add dword [ebp - 0x10], 0xe2c5b66b
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xb16f1eb2
sub dword [ebp - 0x1c], 0x3cfcb55c
mov dword [ebp - 0x18], 0xff3be719
add dword [ebp - 0x18], 0x42307a5c
mov dword [ebp - 0x14], 0x4c5486a4
sub dword [ebp - 0x14], 0xe8e51a38
mov dword [ebp - 0x10], 0x15f04da2
add dword [ebp - 0x10], 0xea0fb25e
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x6c1c3
push 0
call eax
mov ecx, 0x4c83
xor edx, edx
add edx, eax
mov ebx, 0xb6d11f65
add ebx, 0x76c9809b
add ebx, dword [ebp - 0xc]
mov edi, 0xc0f7c076
xor dword [ebp - 4], esi
mov esi, dword [ebx]
add dword [ebp - 4], ecx
add esi, edi
sub dword [ebp - 8], ebx
mov dword [edx], esi
sub dword [ebp - 8], edx
add edx, 0x370231cc
sub edx, 0x370231c8
add ebx, 0x679385b7
sub ebx, 0x679385b3
loop 0x2d897754
add eax, 0xc5a9ac17
add eax, 0x3a5778c8
xor ebx, ebx
add ebx, eax
add eax, 0xfea420af
sub eax, 0xfea420aa
mov ecx, 0x900a1d29
sub ecx, 0x628a1d29
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x100502c0
Capabilities:
Encode data using xor

Disassembly:
add eax, dword [ecx - 0x72]
mov al, byte [0x72423f1f]
pop dword [ebx + 0x4b810929]
add dword [eax + 0x47], ebp
inc ecx
or al, byte [ebx + 0x4a]
mov eax, dword [0x6ec6ccc3]
mov bh, 0x5d
or al, 0x7d
mov ch, byte [ebx]
sbb al, 0xf0
adc byte [edi], 0xdd
jns 0x100502a5
jecxz 0x100502d2
je 0x1005033a
inc ebp
ljmp 0x162e
or esi, edi
or byte [edx - 0x6db5ecce], bl
dec edx
xchg edx, eax
push esi
stc
sbb al, 0x61
add esi, dword [eax]
adc bh, byte [ecx - 0x539d6cf4]
mov dword [edi - 0x419554d0], ebx
jecxz 0x100503bd
xlatb
cmp eax, 0xe659c7a8
aam 0x1f
or esp, dword [ecx + 0x7e3b3979]
mov eax, 0x54288c05
add eax, dword [eax + 0x35]
pop ebx
pop ebx
ret
paddusw mm0, qword [0x5789a224]
test al, 0xa9
xor ch, byte [esi + 0x15]
cwde
test eax, 0x98156e32
or dword [0x39000ee9], ebx
mov eax, dword [0xe3b7051a]
aas
invalid

Function at 0x10050750
Capabilities:
Encode data using xor

Disassembly:
js 0x10050754
mov edx, 0x3cea0913
in al, 0xf3
and byte [esi + 0x70], 0x1b
int 0x14
xor eax, 0x3896a95f
push ecx
pop edx
imul edx, dword [eax + edi*2 - 0x14], 0xdbf3aa26
cmc
sti
xor dword [ebp + 0x39d3b13f], eax
cld
in al, 0x22
cmp ebx, dword [ecx]
dec edx
les ebx, [esi]
fidiv dword [edi + eax*4 + 0x19b3fd65]
mov ah, 0x87
std
mov bl, 0x19
lodsd eax, dword [esi]
xchg byte [esi - 0x1d], cl
sub dword [ebp - 0x636f19ea], eax
push 0xdf800e27
cmp edi, ebp
push es
pop es
out 0x2a, al
inc ecx
sar byte [esi], 1
xor al, 0x63
xor byte [ebp + ebx*2 + 0x1c], 0x3e
shl dword [eax + 0x51], cl
push ecx
add ch, dl
std
jne 0x10050728
adc al, 0x60
jge 0x100506f9
fiadd dword [esi - 0x7f]
adc byte [edx], 0x90
mov bl, 0x1a
or byte [0xb84e195a], bl
or eax, 0x11a64f1b
jle 0x10050792
popfd
jmp 0x9075ba18
or dword [esi - 0x1d7c569e], eax
or bh, bl
cdq
add dword [ebx - 0x80], esp
lodsd eax, dword [esi]
ret

Function at 0x100519f0
Capabilities:
Encode data using xor

Disassembly:
inc eax
fidivr dword [esi + 0xec419db]
push cs
xchg edi, eax
sbb al, byte [ebx]
rcl dword [eax - 0x1ec67c37], cl
mov ebx, 0xf3644c19
loopne 0x10051a26
inc ebx
inc ecx
or al, 0x74
test byte [ebp + 0x37], dl
ror byte [eax - 0x34], 0xb5
jbe 0x100519f6
in eax, dx
pop ebx
rcl byte [0xb438fd23], cl
xor edx, dword [esi + 0x53cd8947]
inc edi
mov ebp, ecx
push ebx
inc ebx
mov cl, 0xab
stosd dword es:[edi], eax
mov ah, 0xad
in eax, 7
or cl, dh
popal
jne 0x10051a16
mov ebx, 0xa8e56f30
cdq
test dword [edi + 0x16787b65], ebp
pushal
or dh, al
retf 0xe985

Function at 0x10820053
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1081a140]
jne 0x1082005d
repz ret
jmp fcn.108202df