joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f744
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
and byte [ebp - 1], bl
cmp dword [ebp + 8], esi
push edi
je 0x45f7e8
cmp dword [ebp + 0xc], esi
jl 0x45f7e8
mov edi, dword [ebp + 0x10]
cmp edi, esi
je 0x45f7e8
mov eax, dword [ebp + 0x14]
cmp eax, 1
jle 0x45f7e8
cmp dword [ebp + 0xc], esi
jle 0x45f7e0
dec eax
mov dword [ebp + 0x10], eax
cmp esi, dword [ebp + 0x10]
jge 0x45f7e0
mov eax, esi
push 4
cdq
pop ecx
idiv ecx
cmp edx, 3
je 0x45f7aa
mov eax, dword [ebp + 8]
mov dl, byte [ebp - 1]
shl dl, 2
mov cl, byte [ebx + eax]
mov al, cl
and cl, 3
add cl, dl
shr al, 2
mov byte [ebp - 1], cl
inc ebx
jmp 0x45f7b1
mov al, byte [ebp - 1]
and byte [ebp - 1], 0
cmp al, 0xa
jae 0x45f7bc
add al, 0x30
mov byte [esi + edi], al
jmp 0x45f7da
cmp al, 0x24
jae 0x45f7c4
add al, 0x37
jmp 0x45f7b7
cmp al, 0x3e
jae 0x45f7cc
add al, 0x3d
jmp 0x45f7b7
cmp al, 0x3f
jae 0x45f7d6
mov byte [esi + edi], 0x2d
jmp 0x45f7da
mov byte [esi + edi], 0x5f
inc esi
cmp ebx, dword [ebp + 0xc]
jl 0x45f77c
and byte [esi + edi], 0
xor eax, eax
jmp 0x45f7eb
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x45f8af
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
or ebx, 0xffffffff
cmp dword [ebp + 0xc], 0
push esi
je 0x45f967
mov esi, dword [ebp + 8]
test esi, esi
je 0x45f967
push 0x105
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004d9ad0
push dword [ebp + 0xc]
lea eax, [ebp - 0x114]
push str.Global_
push 0x51c750
push 0x104
push eax
call fcn.004de975
lea eax, [ebp - 0xc]
push eax
call fcn.0045f6fd
add esp, 0x24
test eax, eax
jne 0x45f92c
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [esi], eax
jne 0x45f930
push 3
jmp 0x45f969
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x45f961
cmp eax, 0x80
je 0x45f95c
cmp eax, 0x102
jne 0x45f963
push 2
pop ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
jmp 0x45f963
or ebx, 0xffffffff
jmp 0x45f963
xor ebx, ebx
mov eax, ebx
jmp 0x45f96a
push 1
pop eax
pop esi
pop ebx
leave
ret
Function at 0x45f96e
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
push 1
pop eax
cmp ecx, eax
jl 0x45fa80
cmp ecx, 7
jg 0x45fa80
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
jl 0x45fa80
mov esi, ecx
shl esi, 3
mov ecx, dword [esi + str.Unknown]
cmp ecx, ebx
jne 0x45f9bc
cmp dword [ebp + 0xc], ebx
je 0x45fa80
cmp ecx, ebx
je 0x45f9c5
cmp dword [ebp + 0xc], ebx
jne 0x45fa80
push 0x105
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.004d9ad0
add esp, 0xc
cmp dword [esi + str.Unknown], ebx
push str..lck
je 0x45f9f5
call fcn.0043236c
push eax
push dword [esi + str.Unknown]
jmp 0x45f9fe
call fcn.0043236c
push eax
push dword [ebp + 0xc]
push str._s_d_s
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.004de975
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
call fcn.0045f6fd
test eax, eax
pop ecx
jne 0x45fa3d
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
cmp edi, ebx
jne 0x45fa42
push 3
pop eax
jmp 0x45fa80
push dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x45fa74
cmp eax, 0x80
je 0x45fa6e
cmp eax, 0x102
jne 0x45fa7d
push edi
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45fa7d
or dword [ebp - 4], 0xffffffff
jmp 0x45fa7d
mov dword [ebp - 4], ebx
mov dword [esi + 0x52424c], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45fb6d
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
push esi
mov esi, 0xff
push edi
xor ebx, ebx
push esi
lea eax, [ebp - 0x224]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call fcn.004d9ad0
push esi
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.004d9ad0
add esp, 0x18
call fcn.0048b624
cmp eax, 1
jne 0x45fcd4
push str.ADVAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x45fcd4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CheckTokenMembership
push edi
call esi
push str.AllocateAndInitializeSid
push edi
mov dword [ebp - 0x14], eax
call esi
push str.FreeSid
push edi
mov dword [ebp - 0x18], eax
call esi
cmp dword [ebp - 0x14], ebx
mov esi, eax
je 0x45fc58
cmp dword [ebp - 0x18], ebx
je 0x45fc58
cmp esi, ebx
je 0x45fc58
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 0xc]
push 2
push eax
call dword [ebp - 0x18]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x45fc4d
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
push ebx
call dword [ebp - 0x14]
test eax, eax
je 0x45fc4d
xor eax, eax
cmp dword [ebp - 4], ebx
setne al
dec eax
mov dword [ebp - 4], eax
jmp 0x45fc51
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call esi
jmp 0x45fc5f
mov dword [ebp - 0x1c], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x1c], ebx
je 0x45fcd4
lea eax, [ebp - 0x224]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.slmdummytestfile.tmp
lea eax, [ebp - 0x224]
push 0x51d538
push eax
lea eax, [ebp - 0x11c]
push str._s_s_s
push eax
call fcn.004dd565
lea eax, [ebp - 0x11c]
push 0x520164
push eax
call fcn.004de577
add esp, 0x1c
cmp eax, ebx
jne 0x45fcbd
or dword [ebp - 4], 0xffffffff
jmp 0x45fcd4
push eax
mov dword [ebp - 4], ebx
call fcn.004de06b
pop ecx
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x462988
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x462a5e
mov edi, dword [ebp + 0x18]
cmp edi, ebx
je 0x462a5e
mov esi, dword [ebp + 0xc]
push 0x10
mov eax, esi
pop ecx
cdq
idiv ecx
test edx, edx
jne 0x462a5e
cmp dword [ebp + 0x1c], esi
jl 0x462a5e
push 0x80
lea eax, [ebp - 0x214]
push dword [ebp + 0x14]
push eax
call fcn.0049398b
add esp, 0xc
cmp eax, 0xffffffff
je 0x462a5e
push 0x10
lea eax, [ebp - 0x10]
push dword [ebp + 0x10]
push eax
call fcn.004dcb20
add esp, 0xc
cmp esi, ebx
jle 0x462a53
mov eax, dword [ebp + 8]
add esi, 0xf
shr esi, 4
sub eax, edi
mov ebx, esi
mov dword [ebp + 8], eax
shl ebx, 4
jmp 0x462a0f
mov eax, dword [ebp + 8]
add eax, edi
push 0x10
push eax
push edi
call fcn.004dcb20
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.004939bb
add esp, 0x14
xor eax, eax
mov cl, byte [ebp + eax - 0x10]
xor byte [edi + eax], cl
inc eax
cmp eax, 0x10
jl 0x462a2c
mov eax, dword [ebp + 8]
push 0x10
add eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004dcb20
add esp, 0xc
add edi, 0x10
dec esi
jne 0x462a0c
mov eax, dword [ebp + 0x18]
and byte [ebx + eax], 0
xor eax, eax
jmp 0x462a61
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x462a66
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x469113
Capabilities:
Get session user name

Disassembly:
mov eax, dword [esp + 8]
push esi
dec eax
push edi
mov edi, dword [esp + 0xc]
mov esi, str.NONAME
push eax
push esi
push edi
call fcn.004dded0
mov eax, dword [esp + 0x1c]
add esp, 0xc
and byte [edi + eax - 1], 0
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x469155
push esi
push edi
call fcn.004dd750
pop ecx
pop ecx
push 0xfffffffffffffffe
pop eax
jmp 0x469157
xor eax, eax
pop edi
pop esi
ret
Function at 0x469220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2370
call fcn.004dc850
and byte [ebp - 0x17b8], 0
push ebx
push esi
push edi
mov ecx, 0x2ed
xor eax, eax
lea edi, [ebp - 0x17b7]
cmp dword [ebp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x46940f
cmp dword [ebp + 0xc], 0
je 0x46940f
push 0x20
push dword [ebp + 8]
call fcn.004deef0
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x469366
lea eax, [ebp - 4]
inc esi
push eax
lea eax, [ebp - 0x17b8]
mov edi, 0xbb8
push eax
push esi
mov dword [ebp - 4], edi
call fcn.00462305
add esp, 0xc
test eax, eax
jne 0x469366
push 0x10
pop ebx
cmp dword [ebp - 4], ebx
jle 0x469366
push dword [ebp + 0x10]
and byte [esi], al
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.004dded0
push esi
call fcn.004d9400
mov eax, dword [ebp - 4]
push ebx
lea eax, [ebp + eax - 0x17c8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004dcb20
add esp, 0x1c
xor eax, eax
mov cl, byte [ebp + eax - 0x10]
xor byte [ebp + eax - 0x18], cl
inc eax
cmp eax, 8
jl 0x4692d5
mov eax, dword [ebp - 4]
push ebx
and byte [ebp + eax - 0x17c8], 0
lea eax, [ebp - 0x38]
push eax
push esi
call fcn.004d9400
pop ecx
push eax
push esi
call fcn.0046c036
add esp, 0x10
test eax, eax
jne 0x469366
lea eax, [ebp - 0x28]
push ebx
push eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.004624ef
add esp, 0x10
test eax, eax
jne 0x469366
push edi
push eax
lea eax, [ebp - 0xc00]
push eax
call fcn.004d9ad0
lea eax, [ebp - 0xc00]
push 0xbb7
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
push eax
lea eax, [ebp - 0x17b8]
push eax
call fcn.00462988
add esp, 0x24
test eax, eax
lea eax, [ebp - 0x28]
push ebx
push eax
je 0x46936d
call fcn.004621c5
pop ecx
pop ecx
push 0x14
jmp 0x469411
call fcn.004621c5
pop ecx
test eax, eax
pop ecx
jne 0x469366
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0x2370]
push eax
lea eax, [ebp - 0xc00]
push eax
call fcn.00494dc1
add esp, 0xc
test eax, eax
jne 0x469366
push edi
lea eax, [ebp - 0xc00]
push esi
push eax
call fcn.0043f6c3
lea eax, [ebp - 0x2370]
push edi
push eax
lea eax, [ebp - 0xc00]
push eax
call fcn.0043f70d
add esp, 0x18
lea eax, [ebp - 0x48]
push ebx
push eax
lea eax, [ebp - 0xc00]
push eax
call fcn.004d9400
pop ecx
push eax
lea eax, [ebp - 0xc00]
push eax
call fcn.0046c036
add esp, 0x10
test eax, eax
jne 0x469366
mov cl, byte [ebp + eax - 0x18]
cmp cl, byte [ebp + eax - 0x48]
jne 0x469366
inc eax
cmp eax, 8
jl 0x4693e4
push dword [ebp + 0x10]
lea eax, [ebp - 0x2370]
push eax
push esi
call fcn.0043f6c3
add esp, 0xc
xor eax, eax
jmp 0x469412
push 0x1e
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x469417
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbfc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x469431
push 0x1e
jmp 0x46950c
push 0x20
push ebx
call fcn.004deef0
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x46950a
lea eax, [ebp - 4]
inc edi
push eax
lea eax, [ebp - 0xbfc]
push eax
push edi
mov dword [ebp - 4], 0xbb8
call fcn.00462305
add esp, 0xc
test eax, eax
jne 0x46950a
mov eax, dword [ebp - 4]
push 0x10
pop esi
cmp eax, esi
jle 0x46950a
lea eax, [ebp + eax - 0xc0c]
push esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004dcb20
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax - 0xc]
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 8
jl 0x46948e
and byte [edi], 0
lea eax, [ebp - 0x44]
push esi
push eax
push ebx
call fcn.004d9400
pop ecx
push eax
push ebx
call fcn.0046c036
add esp, 0x10
test eax, eax
jne 0x46950a
lea eax, [ebp - 0x24]
push esi
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.004624ef
add esp, 0x10
test eax, eax
jne 0x46950a
mov ecx, dword [ebp - 4]
mov ebx, esi
mov eax, ecx
add ecx, 0xfffffff0
cdq
idiv ebx
imul eax, eax, 0x16
inc eax
push eax
lea eax, [ebp - 0x24]
push edi
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xbfc]
push ecx
push eax
call fcn.00462988
add esp, 0x18
test eax, eax
lea eax, [ebp - 0x24]
push esi
push eax
je 0x469512
call fcn.004621c5
pop ecx
pop ecx
push 0x14
pop eax
pop edi
pop esi
pop ebx
leave
ret
call fcn.004621c5
pop ecx
test eax, eax
pop ecx
jne 0x46950a
lea eax, [ebp - 0x34]
push esi
push eax
push dword [ebp + 0xc]
call fcn.00462807
add esp, 0xc
test eax, eax
jne 0x46950a
mov cl, byte [ebp + eax - 0x14]
cmp cl, byte [ebp + eax - 0x34]
jne 0x46950a
inc eax
cmp eax, 8
jl 0x469531
xor eax, eax
jmp 0x46950d

Function at 0x46bce6
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x24], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
ret
Function at 0x46bdf8
Capabilities:
Encode data using xor
Encrypt data using hc-128

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax]
mov esi, dword [eax + 0x10]
mov dword [ebp + 8], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x24], ecx
lea ecx, [eax + 0x30]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x20], 0x30
mov edx, dword [ecx + 0x34]
mov ecx, dword [ecx]
mov dword [ebp - 0x18], ecx
mov edi, edx
mov ecx, edx
mov ebx, edx
shr edi, 0x11
shl ecx, 0xf
or edi, ecx
mov ecx, edx
shr ecx, 0x13
shl ebx, 0xd
or ecx, ebx
xor edi, ecx
mov ecx, dword [ebp - 0x18]
shr edx, 0xa
xor edi, edx
mov edx, ecx
mov ebx, ecx
shr edx, 0x12
shl ebx, 0xe
or edx, ebx
mov ebx, ecx
shl ebx, 0x19
shr ecx, 7
or ebx, ecx
mov ecx, dword [ebp - 0x18]
xor edx, ebx
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 8]
add edi, edx
add edi, dword [ecx + 0x20]
add ecx, 4
mov dword [ebp - 8], ecx
add edi, dword [ecx - 8]
dec dword [ebp - 0x20]
mov dword [ecx + 0x38], edi
jne 0x46be3d
mov edi, dword [ebp + 8]
lea ecx, [eax + 0x2c]
mov dword [ebp - 8], 0x526b74
mov dword [ebp - 0x18], ecx
mov ecx, esi
mov edx, esi
shl ecx, 0x15
shr edx, 0xb
or ecx, edx
mov edx, esi
mov ebx, esi
shl edx, 0x1a
shr ebx, 6
or edx, ebx
mov ebx, esi
xor ecx, edx
mov edx, esi
shr edx, 0x19
shl ebx, 7
or edx, ebx
mov ebx, dword [ebp - 0x10]
xor ecx, edx
mov edx, esi
not edx
and edx, dword [ebp - 0x14]
and ebx, esi
or edx, ebx
mov ebx, edi
add ecx, edx
mov edx, dword [ebp - 0x18]
shr ebx, 0xd
add ecx, dword [edx]
mov edx, dword [ebp - 8]
add dword [ebp - 8], 4
add dword [ebp - 0x18], 4
add ecx, dword [edx]
mov edx, edi
shl edx, 0x13
or edx, ebx
mov ebx, edi
shr ebx, 0x16
shl edi, 0xa
or ebx, edi
mov edi, dword [ebp + 8]
xor edx, ebx
mov ebx, dword [ebp + 8]
shl edi, 0x1e
shr ebx, 2
or edi, ebx
mov ebx, dword [ebp - 4]
and ebx, dword [ebp + 8]
xor edx, edi
mov edi, dword [ebp - 4]
add ecx, dword [ebp - 0x24]
or edi, dword [ebp + 8]
and edi, dword [ebp - 0xc]
or edi, ebx
mov ebx, dword [ebp - 0x14]
add edx, edi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 4]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edi
add esi, ecx
cmp dword [ebp - 8], 0x526c74
lea edi, [edx + ecx]
mov dword [ebp - 0x24], ebx
mov dword [ebp + 8], edi
jl 0x46beb0
mov ecx, dword [ebp - 4]
add dword [eax], edi
add dword [eax + 4], ecx
mov ecx, dword [ebp - 0xc]
add dword [eax + 8], ecx
mov ecx, dword [ebp - 0x1c]
add dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x10]
add dword [eax + 0x14], ecx
mov ecx, dword [ebp - 0x14]
add dword [eax + 0x10], esi
add dword [eax + 0x18], ecx
add dword [eax + 0x1c], ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46c1e5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
lea eax, [ebp - 0x51c]
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x104
je 0x46c321
push 0x106
lea eax, [ebp - 0x11c]
push esi
push eax
call fcn.004d9ad0
push 5
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.004d9ad0
mov edi, 0x400
lea eax, [ebp - 0x51c]
push edi
push esi
push eax
call fcn.004d9ad0
lea eax, [ebp - 0xc]
push 0x18
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0048b858
add esp, 0x30
cmp eax, esi
je 0x46c278
lea eax, [ebp - 0xc]
push 0x19
push eax
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0xc], 0x104
call fcn.0048b858
add esp, 0xc
cmp eax, esi
jne 0x46c2bb
lea eax, [ebp - 0x11c]
push 3
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004dded0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x46c2bb
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
lea eax, [ebp - 0x14]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x46c2bb
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x46c318
lea eax, [ebp - 0x51c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea eax, [ebp - 0x51c]
push eax
call fcn.004d9400
test eax, eax
pop ecx
je 0x46c321
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x46c315
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x46c305
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x46c318
push edi
call fcn.004d9400
lea eax, [edi + eax + 1]
pop ecx
mov dword [ebp - 8], eax
mov edi, eax
push edi
jmp 0x46c2d0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
jmp 0x46c324
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
leave
ret

Function at 0x46c3d4
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, 0xc6ef3720
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
mov dword [ebp + 8], 0x20
mov edi, dword [eax]
mov dword [ebp - 0xc], edi
mov edi, dword [eax + 4]
mov dword [ebp - 8], edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], edi
mov dword [ebp + 0x10], eax
mov eax, edx
mov edi, edx
shr eax, 5
add eax, dword [ebp + 0x10]
shl edi, 4
add edi, dword [ebp - 4]
xor eax, edi
lea edi, [esi + edx]
xor eax, edi
sub ecx, eax
mov eax, ecx
mov edi, ecx
shr eax, 5
add eax, dword [ebp - 8]
shl edi, 4
add edi, dword [ebp - 0xc]
xor eax, edi
lea edi, [esi + ecx]
xor eax, edi
add esi, 0x61c88647
sub edx, eax
dec dword [ebp + 8]
jne 0x46c40a
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
leave
ret
Function at 0x47d998
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
and byte [ebp - 1], bl
cmp dword [ebp + 8], esi
push edi
je 0x47da3c
cmp dword [ebp + 0xc], esi
jl 0x47da3c
mov edi, dword [ebp + 0x10]
cmp edi, esi
je 0x47da3c
mov eax, dword [ebp + 0x14]
cmp eax, 1
jle 0x47da3c
cmp dword [ebp + 0xc], esi
jle 0x47da34
dec eax
mov dword [ebp + 0x10], eax
cmp esi, dword [ebp + 0x10]
jge 0x47da34
mov eax, esi
push 4
cdq
pop ecx
idiv ecx
cmp edx, 3
je 0x47d9fe
mov eax, dword [ebp + 8]
mov dl, byte [ebp - 1]
shl dl, 2
mov cl, byte [ebx + eax]
mov al, cl
and cl, 3
add cl, dl
shr al, 2
mov byte [ebp - 1], cl
inc ebx
jmp 0x47da05
mov al, byte [ebp - 1]
and byte [ebp - 1], 0
cmp al, 0xa
jae 0x47da10
add al, 0x30
mov byte [esi + edi], al
jmp 0x47da2e
cmp al, 0x24
jae 0x47da18
add al, 0x37
jmp 0x47da0b
cmp al, 0x3e
jae 0x47da20
add al, 0x3d
jmp 0x47da0b
cmp al, 0x3f
jae 0x47da2a
mov byte [esi + edi], 0x2d
jmp 0x47da2e
mov byte [esi + edi], 0x5f
inc esi
cmp ebx, dword [ebp + 0xc]
jl 0x47d9d0
and byte [esi + edi], 0
xor eax, eax
jmp 0x47da41
mov eax, 0xdad
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47e0f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
lea eax, [ebp - 0xc]
push 1
push eax
lea eax, [ebp - 0x114]
mov esi, 0x104
push eax
mov dword [ebp - 0xc], esi
call fcn.0048b858
add esp, 0xc
test eax, eax
je 0x47e181
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.004696e5
pop ecx
test eax, eax
pop ecx
je 0x47e14a
lea eax, [ebp - 0x114]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x47e181
xor esi, esi
lea eax, [ebp - 0x214]
push esi
push esi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.004e2762
push esi
lea eax, [ebp - 0x214]
push esi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.004e2b9c
add esp, 0x28
lea eax, [ebp - 8]
push eax
call fcn.0043f5cc
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.004981a9
add esp, 0x10
pop esi
leave
ret
Function at 0x48b6a1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp ebx, esi
push edi
mov dword [ebp - 4], esi
je 0x48b6c9
push ebx
call fcn.004d9400
mov edi, 0x104
pop ecx
cmp eax, edi
jb 0x48b6d3
mov eax, 0xc8003004
jmp 0x48b853
push edi
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.004d9ad0
push edi
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004d9ad0
push ebx
call fcn.004d9400
mov ecx, 0x103
add esp, 0x1c
cmp eax, ecx
jae 0x48b70c
push ebx
call fcn.004d9400
pop ecx
jmp 0x48b70e
mov eax, ecx
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.004dded0
mov al, byte [ebp - 0x108]
and byte [ebp - 5], 0
add esp, 0xc
test al, al
je 0x48b758
lea ecx, [ebp - 0x20c]
lea edx, [ebp - 0x108]
sub ecx, edx
cmp al, 0x5c
je 0x48b758
lea edx, [ecx + esi]
inc esi
inc dword [ebp - 4]
mov byte [ebp + edx - 0x108], al
mov al, byte [ebp + esi - 0x108]
test al, al
jne 0x48b73b
mov eax, dword [ebp - 4]
xor ebx, ebx
and byte [ebp + eax - 0x20c], 0
lea eax, [ebp - 0x20c]
push eax
inc esi
call fcn.004d9400
test eax, eax
pop ecx
jbe 0x48b78a
push edi
lea eax, [ebp - 0x310]
push dword [ebp + 8]
push eax
call fcn.0043f6c3
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.004d9400
test eax, eax
pop ecx
jbe 0x48b851
lea eax, [ebp - 0x20c]
push edi
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.0043f70d
add esp, 0xc
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x48b7f8
lea eax, [ebp - 0x310]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x48b84a
cmp dword [ebp + 0x10], 0x23
jne 0x48b7f8
lea eax, [ebp - 0x310]
push eax
call fcn.0048b638
pop ecx
push edi
lea eax, [ebp - 0x310]
push 0x51d538
push eax
call fcn.0043f70d
add esp, 0xc
mov al, byte [ebp + esi - 0x108]
test al, al
je 0x48b827
cmp al, 0x5c
je 0x48b827
mov byte [ebp + ebx - 0x20c], al
inc esi
inc ebx
jmp 0x48b80d
and byte [ebp + ebx - 0x20c], 0
inc esi
xor ebx, ebx
cmp dword [ebp + 0xc], 0xffffffff
je 0x48b78a
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x48b78a
mov eax, 0xc8003005
jmp 0x48b853
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret