joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49dfb4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, eax
cmp dword [edi + 0x24], 0xffffffff
je 0x49e12d
mov eax, dword [edi + 0x60]
cmp dword [eax + 8], 0
je 0x49e12d
cmp byte [edi + 0x7c], 0
je 0x49dfee
mov eax, dword [edi + 0x80]
cmp eax, dword [edi + 0x84]
jge 0x49e12d
mov bl, 1
jmp 0x49e125
mov eax, dword [edi + 0x60]
call fcn.00410b88
mov esi, eax
lea edx, [ebp - 4]
mov eax, esi
call fcn.0049cc98
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
jg 0x49e047
mov eax, dword [edi + 0x60]
cmp dword [eax + 8], 1
jg 0x49e029
mov byte [edi + 0x89], 1
xor ebx, ebx
jmp 0x49e125
mov eax, esi
call fcn.00402f30
xor edx, edx
mov eax, dword [edi + 0x60]
call fcn.00410ab0
mov eax, dword [edi + 0x60]
call fcn.00410e18
jmp 0x49e125
cmp byte [edi + 0x7c], 0
je 0x49e07b
mov cl, 0xa
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0049dfa0
test eax, eax
je 0x49e07b
sub eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 4], eax
inc dword [edi + 0x80]
mov eax, dword [edi + 0x80]
cmp eax, dword [edi + 0x84]
jl 0x49e07b
xor ebx, ebx
cmp dword [edi + 0x44], 2
jne 0x49e0a4
push 0x10
lea eax, [edi + 0x5f0]
push eax
mov eax, dword [edi + 0x68]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [edi + 0x24]
push eax
call sub.wsock32.dll_sendto
mov dword [ebp - 8], eax
jmp 0x49e0bc
mov eax, dword [edi + 0x68]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [edi + 0x24]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49e0c6
xor ebx, ebx
jmp 0x49e125
cmp dword [ebp - 8], 0xffffffff
jne 0x49e10a
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2746
je 0x49e0ed
cmp eax, 0x2736
je 0x49e0ed
cmp eax, 0x2749
je 0x49e0ed
cmp eax, 0x2726
jne 0x49e0f6
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x64]
jmp 0x49e106
cmp eax, 0x2733
je 0x49e106
mov eax, edi
call fcn.0049f7c4
jmp 0x49e12d
xor ebx, ebx
jmp 0x49e125
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0049ccb8
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x49e125
mov byte [edi + 0x88], 0
xor ebx, ebx
test bl, bl
jne 0x49dff5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e2cc
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov bl, 1
jmp 0x49e37d
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x70], edx
xor eax, eax
push ebp
push 0x49e371
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x190], 0
je 0x49e30e
mov eax, dword [ebp - 4]
call fcn.0049dd6c
jmp 0x49e32b
mov edx, dword [ebp - 8]
mov dx, word [edx + 0xa]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x40]
test al, al
jne 0x49e32b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e385
mov eax, dword [ebp - 4]
cmp dword [eax + 0x70], 0
je 0x49e338
xor ebx, ebx
jmp 0x49e367
lea eax, [ebp - 0xc]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
push eax
call sub.wsock32.dll_ioctlsocket
inc eax
jne 0x49e35f
call sub.wsock32.dll_WSAGetLastError
mov edx, dword [ebp - 4]
mov dword [edx + 0x70], eax
xor ebx, ebx
jmp 0x49e367
cmp dword [ebp - 0xc], 0
jne 0x49e367
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e37d
test bl, bl
jne 0x49e2e2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49ea20
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404044
xor eax, eax
push ebp
push 0x49eb12
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 4]
call fcn.00408b54
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.0040998c
cmp byte [0x548f10], 0
jne 0x49ea7c
mov eax, 0x49eb20
call fcn.0049d778
lea eax, [ebp - 0x109]
push eax
call sub.wsock32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x49eaee
mov edx, 0x49eb2c
lea eax, [ebp - 0x109]
call fcn.004099ec
test eax, eax
jne 0x49eaa6
or eax, 0xffffffff
jmp 0x49eaee
lea eax, [ebp - 0x109]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x49eae7
mov eax, dword [ebp - 4]
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x114], 0xb
lea eax, [ebp - 0x118]
push eax
push 0
mov ecx, 0x49eb44
mov dl, 1
mov eax, dword [0x49cd1c]
call fcn.0040bbf4
call fcn.00403688
jmp 0x49eaee
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49eb19
lea eax, [ebp - 0x110]
call fcn.00403c14
lea eax, [ebp - 4]
call fcn.00403c14
ret

Function at 0x49ef04
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
cmp byte [ebx + 0x75], 2
je 0x49ef5a
cmp dword [ebx + 0x24], 0xffffffff
jne 0x49ef25
mov edx, 0x49ef68
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
jmp 0x49ef5a
xor eax, eax
mov al, byte [ebx + 0x75]
mov word [ebp - 4], ax
mov ax, word [ebx + 0x78]
mov word [ebp - 2], ax
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
mov eax, dword [ebx + 0x24]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
je 0x49ef5a
mov eax, ebx
call fcn.0049f7c4
pop ebx
pop ecx
pop ebp
ret
Function at 0x4ab0a8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4ab110
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov ebx, 0x54be60
lea eax, [ebp - 4]
mov edx, esi
add dl, 0x40
call fcn.00403db8
lea eax, [ebp - 4]
mov edx, 0x4ab124
call fcn.00403e98
mov eax, dword [ebp - 4]
call fcn.00404054
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebx], eax
inc esi
add ebx, 4
cmp esi, 0x1a
jne 0x4ab0c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab117
lea eax, [ebp - 4]
call fcn.00403c14
ret

Function at 0x4acbb4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x15c], ebx
mov ebx, ecx
test ebx, ebx
js 0x4acbdb
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4acbd4
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404044
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 8]
mov edx, dword [0x4010c4]
call fcn.004046bc
xor eax, eax
push ebp
push 0x4acd69
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x4acd31
inc eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 4]
push 0x4acd90
push dword [esi]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00403f50
mov eax, dword [ebp - 0x158]
call fcn.00404054
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4acd25
mov eax, dword [ebp - 0x154]
test al, 0x10
jne 0x4acd0a
test al, 2
jne 0x4acd0a
xor eax, eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0x4acd90
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00403e40
push dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00403f50
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x10]
call fcn.0046a0d0
call fcn.00468d78
test al, al
je 0x4accc8
or edi, 0xffffffff
jmp 0x4accd7
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0046a2cc
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.0046a030
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00403e40
mov edx, dword [ebp - 0x158]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax]
mov ecx, edi
mov edi, dword [eax]
call dword [edi + 0x38]
lea eax, [ebp - 0x154]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4acc5d
push ebx
call sub.kernel32.dll_FindClose
add esi, 4
dec dword [ebp - 0x14]
jne 0x4acc20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acd70
lea eax, [ebp - 0x15c]
mov edx, 2
call fcn.00403c38
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x4010c4]
call fcn.004045a4
lea eax, [ebp - 4]
call fcn.00403c14
ret
Function at 0x4adeb4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4adf99
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x14], 0
jne 0x4adefa
lea edx, [ebp - 0x164]
mov eax, ebx
call fcn.004adfa8
mov edx, dword [ebp - 0x164]
lea eax, [ebx + 0x14]
call fcn.00403c68
cmp dword [ebx + 0x14], 0
jne 0x4adf51
lea eax, [ebp - 0x160]
xor ecx, ecx
mov edx, 0x160
call fcn.00402bd8
push 0x208
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.004ade50
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4adf51
lea eax, [ebp - 0x154]
call fcn.0040989c
mov ecx, eax
lea edx, [ebp - 0x154]
lea eax, [ebx + 0x14]
call fcn.00403cf8
mov eax, ebx
call fcn.004addd4
test al, al
je 0x4adf76
mov eax, dword [ebx + 0x14]
call fcn.00403e90
mov edx, eax
sub edx, 3
lea eax, [ebx + 0x14]
mov ecx, 4
call fcn.004040d4
mov eax, esi
mov edx, dword [ebx + 0x14]
call fcn.00403cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adfa0
lea eax, [ebp - 0x164]
call fcn.00403c14
ret
Function at 0x4b236c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b241b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x358], 0
jne 0x4b23ba
push 0x465
mov eax, dword [ebp - 4]
call fcn.00446fc4
mov ecx, eax
mov dl, 1
mov eax, dword [0x4aea08]
call fcn.004aea74
mov edx, dword [ebp - 4]
mov dword [edx + 0x358], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
call fcn.004aef40
lea eax, [ebp - 8]
mov edx, 0x4b2430
call fcn.00403cac
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x4b2405
test bl, 1
je 0x4b23fe
lea eax, [ebp - 8]
call fcn.00404060
lea edx, [esi + 0x41]
mov byte [eax], dl
push ebp
mov eax, dword [ebp - 8]
call fcn.004b2300
pop ecx
shr ebx, 1
inc esi
test ebx, ebx
jne 0x4b23e2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2422
lea eax, [ebp - 8]
call fcn.00403c14
ret

Function at 0x4b2f58
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404044
xor eax, eax
push ebp
push 0x4b306a
push dword fs:[eax]
mov dword fs:[eax], esp
push 3
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b303d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404054
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4b301a
test byte [ebp - 0x14c], 0x10
jne 0x4b2ffd
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403e40
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00408a3c
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4b2fc0
push ebx
call sub.kernel32.dll_FindClose
mov byte [ebp - 5], 1
jmp 0x4b3026
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3044
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4b9e20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov al, byte [ebx + 4]
sub al, 1
jb 0x4b9e31
je 0x4b9e37
jmp 0x4b9e5d
mov eax, dword [ebx + 0xc]
pop ebx
pop ebp
ret
cmp dword [ebx + 0xc], 0
jne 0x4b9e57
lea eax, [ebx + 0xc]
push eax
xor eax, eax
mov al, byte [ebx + 0x10]
push eax
mov eax, dword [0x549798]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 0xc]
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4be4fc
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
test byte [ebx + 0x20], 0x10
jne 0x4be58f
cmp byte [ebx + 0xb7], 0
jne 0x4be58f
mov byte [ebx + 0xb7], 1
cmp byte [ebx + 0xb9], 0
je 0x4be54d
cmp word [ebx + 0xfe], 0
je 0x4be54d
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4be54d
lea edx, [ebx + 0xbc]
mov eax, dword [ebx + 0x100]
call dword [ebx + 0xfc]
mov eax, dword [0x549798]
mov eax, dword [eax]
call fcn.0043ad58
push 6
mov eax, dword [0x549798]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x549798]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebx + 0xb4], 0
jne 0x4be58f
mov dl, 1
mov eax, ebx
call fcn.004be608
pop ebx
pop ebp
ret
Function at 0x4beae0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
jne 0x4becc2
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb7], 0
je 0x4becc2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x88], 0
jne 0x4becc2
xor eax, eax
push ebp
push 0x4becbb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x88], 1
mov byte [ebp - 5], 0
mov byte [ebp - 7], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x11e], 0
je 0x4beb5d
lea ecx, [ebp - 7]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x120]
call dword [ebx + 0x11c]
cmp byte [ebp - 7], 0
jne 0x4beb6d
call fcn.00403728
jmp 0x4becc2
mov al, byte [ebp - 7]
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb9], 0
je 0x4bebcd
mov eax, dword [ebp - 4]
cmp word [eax + 0x106], 0
je 0x4bebcd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xbc]
call fcn.00403e90
test eax, eax
jle 0x4bebcd
mov byte [ebp - 6], 0
lea ecx, [ebp - 6]
mov eax, dword [ebp - 4]
lea edx, [eax + 0xbc]
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x108]
call dword [ebx + 0x104]
cmp byte [ebp - 6], 0
jne 0x4bebcd
call fcn.00403728
jmp 0x4becc2
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb4], 0
jne 0x4bebf2
push 0
push 0
push 0x6d81
mov eax, dword [0x549798]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_PostMessageA
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_LockWindowUpdate
xor eax, eax
push ebp
push 0x4bec9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x549798]
mov eax, dword [eax]
call fcn.0043ada0
push 9
mov eax, dword [0x549798]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [0x431494]
call fcn.004030c0
mov dl, 1
call fcn.004350f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [0x431494]
call fcn.004030c0
call fcn.00446fc4
mov dl, 1
call fcn.00464a40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4beca3
mov eax, dword [ebp - 4]
mov byte [eax + 0xb7], 0
mov eax, dword [ebp - 4]
cmp word [eax + 0xf6], 0
je 0x4bec94
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xf8]
call dword [ebx + 0xf4]
push 0
call sub.user32.dll_LockWindowUpdate
ret
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4c2538
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4c2541
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c274d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
mov eax, dword [ebx + 0x350]
mov edx, esi
call fcn.00403fa0
jne 0x4c2583
cmp byte [ebx + 0x37c], 0
je 0x4c272a
mov byte [ebp - 2], 1
lea eax, [ebx + 0x350]
mov edx, esi
call fcn.00403c68
mov byte [ebx + 0x37c], 0
mov eax, ebx
call fcn.004c1d2c
test eax, eax
jne 0x4c25c1
mov eax, esi
call fcn.00409280
test al, al
je 0x4c272a
mov eax, esi
call fcn.00409378
jmp 0x4c272a
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, esi
call fcn.00404054
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4c272a
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp byte [ebp - 1], 0
je 0x4c2609
mov eax, ebx
call fcn.004c0e98
mov eax, ebx
call fcn.004c1d2c
mov edi, eax
dec edi
test edi, edi
jl 0x4c2721
inc edi
xor esi, esi
cmp byte [ebp - 1], 0
je 0x4c2644
cmp byte [ebp - 1], 0
je 0x4c2719
mov edx, esi
mov eax, dword [ebx + 0x380]
call fcn.00410b94
cmp byte [eax], 0
je 0x4c2719
mov edx, esi
mov eax, ebx
call fcn.004c1edc
and eax, 0xff
lea edx, [ebp - 0x14]
call fcn.00408ef8
push dword [ebp - 0x14]
push 0x4c2768
mov edx, esi
mov eax, ebx
call fcn.004c1ebc
and eax, 0xff
lea edx, [ebp - 0x18]
call fcn.00408ef8
push dword [ebp - 0x18]
push 0x4c2768
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, ebx
call fcn.004c207c
push dword [ebp - 0x1c]
push 0x4c2768
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.004c2140
push dword [ebp - 0x20]
push 0x4c2768
lea ecx, [ebp - 0x24]
mov edx, esi
mov eax, ebx
call fcn.004c1e38
push dword [ebp - 0x24]
push 0x4c2768
lea ecx, [ebp - 0x28]
mov edx, esi
mov eax, ebx
call fcn.004c1e60
push dword [ebp - 0x28]
push 0x4c2768
mov edx, esi
mov eax, ebx
call fcn.004c1e88
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00408f28
push dword [ebp - 0x2c]
push 0x4c2774
lea eax, [ebp - 8]
mov edx, 0xe
call fcn.00403f50
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00403e90
push eax
lea eax, [ebp - 8]
call fcn.00404060
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
inc esi
dec edi
jne 0x4c261e
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2754
lea eax, [ebp - 0x2c]
mov edx, 7
call fcn.00403c38
lea eax, [ebp - 8]
call fcn.00403c14
ret
Function at 0x4c77c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [ebp + 8]
mov edi, esi
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
lodsb al, byte [esi]
xor al, bl
rol ebx, 1
add ebx, 0x139a1fc4
stosb byte es:[edi], al
loop 0x4c77d7
popal
pop ebp
ret 0xc

Function at 0x4c77ec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4c7851
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x4c7868
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
jne 0x4c783e
push 0x4c7868
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
je 0x4c783e
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0xc]
add ebx, 0x87654321
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c785d
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dd594
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004473ec
test al, al
je 0x4dd65a
mov eax, dword [ebp - 4]
call fcn.004dd524
test eax, eax
jle 0x4dd65a
xor edx, edx
push ebp
push 0x4dd653
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xd], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x30], 1
mov eax, dword [eax + 0x40]
mov ebx, dword [eax + 8]
dec ebx
cmp ebx, 0
jl 0x4dd61a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x40]
mov edx, ebx
call fcn.004db1f4
call fcn.004dcf84
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x40]
mov edx, ebx
call fcn.004db1f4
call fcn.00402f30
dec ebx
cmp ebx, 0xffffffff
jne 0x4dd5ea
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x40]
mov bx, 0xffff
call fcn.0040310c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd65a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x30], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xd], 0
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4e8190
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e82a4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403cac
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 8]
add eax, dword [edx - 4]
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
mov eax, dword [ebp + 8]
inc dword [eax - 4]
mov eax, dword [ebp + 8]
mov edi, dword [eax - 4]
mov eax, dword [ebp + 8]
mov ebx, dword [eax - 0xc]
sub ebx, edi
jl 0x4e8210
inc ebx
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
mov dl, byte [edx + edi]
call fcn.00403db8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00403e98
inc edi
dec ebx
jne 0x4e81f0
mov eax, dword [ebp - 4]
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403cac
mov eax, dword [ebp - 8]
call fcn.00403e90
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.00403e90
mov ebx, eax
test ebx, ebx
jle 0x4e827b
mov edi, 1
imul eax, esi, 0x8088405
mov esi, eax
inc esi
mov eax, esi
shr eax, 0x18
mov edx, dword [ebp - 8]
movzx edx, byte [edx + edi - 1]
xor eax, edx
mov edx, dword [ebp + 8]
mov dword [edx - 0x10], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x10]
call fcn.00403db8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00403e98
mov eax, dword [ebp - 4]
inc edi
dec ebx
jne 0x4e823d
mov eax, dword [ebp - 8]
call fcn.00403e90
mov edx, dword [ebp + 8]
add dword [edx - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e82ab
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403c38
ret
Function at 0x4e89f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404044
xor eax, eax
push ebp
push 0x4e8a7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403cac
mov eax, dword [ebp - 4]
call fcn.00403e90
mov ebx, eax
test ebx, ebx
jle 0x4e8a5f
mov edi, 1
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
xor dl, 0xc8
call fcn.00403db8
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00403e98
inc edi
dec ebx
jne 0x4e8a3f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8a81
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403c38
ret