joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455ef0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x455f28]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x455f09
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x455f18
or bl, 4
test esi, 0x20000000
je 0x455f23
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45c5d0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45c5e2
add esp, 0xfffffff0
call fcn.004038d4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041e1c0
mov eax, dword [0x4a9f5c]
mov dword [eax + 4], ebx
mov dword [eax], 0x45c974
mov eax, dword [0x4a9f68]
mov dword [eax + 4], ebx
mov dword [eax], 0x45c980
mov eax, ebx
call fcn.0045c98c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4164b8]
call fcn.00403580
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4164b8]
call fcn.00403580
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4164b8]
call fcn.00403580
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4164b8]
call fcn.00403580
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4164b8]
call fcn.00403580
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x458da8
push eax
push 0
push 0
mov eax, dword [0x4aa144]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41fc7c]
call fcn.00421490
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41fc7c]
call fcn.00421490
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41fc7c]
call fcn.00421490
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045cdac
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45cc88
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45cc88
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45cc88
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45c71f
call fcn.0040392c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45ca6c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45cc17
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45cbf8
mov dl, 1
mov eax, dword [0x4168d4]
call fcn.00403580
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004043e0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45cbe7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044a9ac
test al, al
je 0x45cbda
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45cc28
lea eax, [ebp - 0x254]
call fcn.00409d50
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45cbda
xor eax, eax
push ebp
push 0x45cbd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45cc60
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45cbbc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404650
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45cbbc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404650
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cbda
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45cadd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041a3b0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cc1e
lea eax, [ebp - 0x260]
call fcn.004043e0
ret

Function at 0x45d54c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4abbe8]
cmp byte [eax + 0xa5], 0
jne 0x45d5bd
cmp dword [0x4abc00], 0
jne 0x45d57e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45d508
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4abc00], eax
cmp dword [0x4abbfc], 0
jne 0x45d599
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4abbfc], eax
cmp dword [0x4abc04], 0
jne 0x45d5bd
push esp
push 0
push 0
push 0x45d4ac
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4abc04], eax
pop edx
ret
Function at 0x45d6b4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45d6cb
add esp, 0xfffffff0
call fcn.004038d4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041e1c0
mov eax, dword [0x4aa128]
cmp word [eax + 2], 0
jne 0x45d6f3
mov eax, dword [0x4aa128]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045eda4
mov eax, dword [0x4aa234]
cmp word [eax + 2], 0
jne 0x45d70d
mov eax, dword [0x4aa234]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045ef9c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4164b8]
call fcn.00403580
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4164b8]
call fcn.00403580
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4207fc]
call fcn.0042863c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45d894
mov eax, dword [0x4a9ff0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00428a0c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45f54c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4a9ff0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d760
test eax, eax
je 0x45d802
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409730
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d788
test eax, eax
je 0x45d816
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404650
mov eax, dword [0x4a9e34]
cmp byte [eax], 0
jne 0x45d84a
mov eax, ebx
call fcn.0045d9bc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045f728
mov eax, ebx
call fcn.004600ec
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45d88a
call fcn.0040392c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45dc3c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4abbe8]
cmp dword [eax + 0x30], 0
je 0x45dce6
cmp dword [ebx + 0x94], 0
jne 0x45dce0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45dbcc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45dce0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45dca6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45dce0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418820
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45dcb5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45e848
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45e87d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004044d0
jmp 0x45e88a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404434
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45f904
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45f945
mov eax, esi
call fcn.00445fd8
test al, al
je 0x45f945
mov eax, dword [ebx + 0x84]
call fcn.00445cd4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45f945
push 0
mov eax, dword [ebx + 0x84]
call fcn.00445cd4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x469608
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415a50]
call fcn.00404e40
xor eax, eax
push ebp
push 0x46974c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a5f78], 0
jne 0x46965b
mov ecx, dword [0x4a9e54]
mov dl, 1
mov eax, dword [0x407a4c]
call fcn.0040c820
call fcn.00403e00
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402ec0
mov eax, ebx
call fcn.00404c48
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x46975c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405fd8
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404c58
test eax, eax
jle 0x4696f3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4696ec
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404668
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404650
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004088a4
test eax, eax
jne 0x4696ec
mov ebx, 0x15
jmp 0x4696f8
mov ebx, 0x10
jmp 0x4696f8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4a5f78]
call fcn.00469504
mov eax, dword [ebp - 8]
call fcn.00469504
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405ff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469753
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404404
lea eax, [ebp - 0x10]
mov edx, dword [0x415a50]
call fcn.00404f10
ret

Function at 0x473624
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042256c
cmp ebx, dword [ebp - 8]
jge 0x473687
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042287c
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042287c
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004228a8
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x47364d
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x473690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042256c
cmp ebx, dword [ebp - 8]
jge 0x4736f3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042287c
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042287c
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004228a8
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4736b9
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x47ad04
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407418
ret
Function at 0x47ae2c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404890
xor eax, eax
push ebp
push 0x47af9e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.0047ad04
mov eax, dword [ebp - 4]
call fcn.00409000
test al, al
jne 0x47ae72
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.0047adb8
jmp 0x47af88
lea eax, [ebp - 0x6c]
call fcn.0047ad04
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004048a0
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x47af7d
xor eax, eax
push ebp
push 0x47af76
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x47af5f
xor eax, eax
push ebp
push 0x47af58
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47af41
xor eax, eax
push ebp
push 0x47af3a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.0047ad38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47af41
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47af5f
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47af7d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.0047adb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47afa5
lea eax, [ebp - 4]
call fcn.004043e0
ret
Function at 0x47b0e4
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov edx, dword [ebp + 8]
test edx, edx
jns 0x47b10a
add edx, 3
sar edx, 2
test edx, edx
jle 0x47b220
mov dword [ebp - 0x14], edx
mov edx, 4
lea eax, [ebp - 0xc]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x47b13e
je 0x47b17e
sub ecx, 0x2b
je 0x47b174
sub ecx, 4
je 0x47b179
dec ecx
sub ecx, 0xa
jb 0x47b167
jmp 0x47b181
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x47b150
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x47b15a
jmp 0x47b181
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x47b181
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x47b181
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x47b181
mov byte [eax], 0x3e
jmp 0x47b181
mov byte [eax], 0x3f
jmp 0x47b181
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x47b120
mov al, byte [ebp - 0xc]
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0xb]
shr edx, 4
or al, dl
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov byte [edx + ecx], al
mov eax, dword [ebp - 8]
inc eax
mov dl, byte [ebp - 0xa]
cmp dl, 0xff
je 0x47b1d7
cmp byte [ebp - 9], 0xff
jne 0x47b1d7
mov al, byte [ebp - 0xb]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 8]
add eax, 2
inc dword [ebp - 8]
jmp 0x47b214
cmp dl, 0xff
je 0x47b214
mov al, byte [ebp - 0xb]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov cl, byte [ebp - 0xa]
shl ecx, 6
or cl, byte [ebp - 9]
mov byte [eax + edx + 2], cl
mov eax, dword [ebp - 8]
add eax, 3
add dword [ebp - 8], 2
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0x47b118
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x482af4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x482c65
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482c40
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004045c8
lea eax, [ebp - 0x118]
mov edx, 0x482c7c
call fcn.004046a8
mov eax, dword [ebp - 0x118]
call fcn.004048a0
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x482bb2
lea eax, [ebp - 0x111]
call fcn.004096f4
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004044d0
jmp 0x482bb9
mov eax, esi
call fcn.004043e0
cmp bl, 0x61
jae 0x482bda
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040d634
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404434
jmp 0x482bf4
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040d5a8
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404434
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x482c88
call fcn.00409dd0
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404434
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482c47
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x487f64
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404890
xor eax, eax
push ebp
push 0x48805d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.00489890
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040953c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00488924
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409420
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00488998
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488064
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404404
ret
Function at 0x48806c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404890
xor eax, eax
push ebp
push 0x488175
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.00489890
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x48813b
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040953c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00488924
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409420
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00488998
jmp 0x48814d
xor edx, edx
mov eax, ebx
call fcn.00488924
xor edx, edx
mov eax, ebx
call fcn.00488998
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48817c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404404
ret

Function at 0x489aec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404890
xor eax, eax
push ebp
push 0x489b4a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.00489bc8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x489b32
lea eax, [ebp - 4]
call fcn.00489bc8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x489b34
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489b51
lea eax, [ebp - 4]
call fcn.004043e0
ret

Function at 0x489b58
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404890
xor eax, eax
push ebp
push 0x489bbc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.00489bc8
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.004098e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489bc3
lea eax, [ebp - 4]
call fcn.004043e0
ret