joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454a68
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x454b07
cmp dword [ebx + 0x94], 0
jne 0x454b01
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4549f0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x454b01
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x454ac7
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x454b01
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041410c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x454ad6
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454d20
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x460c94]
cmp dword [eax + 0x30], 0
je 0x454e7d
test bl, bl
jne 0x454dce
cmp dword [esi + 0x9c], 0
jne 0x454dc3
mov eax, esi
call fcn.00457618
push eax
push 0x454c4c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x454d94
mov eax, dword [0x460c94]
call fcn.00457cf8
test al, al
je 0x454d94
mov eax, dword [0x460cb8]
call fcn.004056d0
mov edi, eax
cmp edi, 0
jl 0x454d94
push 0
mov eax, dword [0x460cb8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x454d7e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x454dc3
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041410c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x454da3
inc dword [esi + 0x9c]
jmp 0x454e7d
cmp dword [esi + 0x9c], 0
jle 0x454e7d
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x454e7d
cmp dword [esi + 0x44], 0
je 0x454e29
mov eax, dword [0x460c94]
call fcn.00457cf8
test al, al
je 0x454e29
mov eax, dword [0x460cb8]
call fcn.004056d0
mov edi, eax
cmp edi, 0
jl 0x454e29
push 5
mov eax, dword [0x460cb8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x454e13
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x454e58
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041410c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x454e38
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x460cb8
mov ecx, 1
mov edx, dword [0x454c2c]
call fcn.00405884
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x455964
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4559ce
mov eax, ebx
call fcn.00457cf8
test al, al
jne 0x4559ce
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404904
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x4559bb
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4559db
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404868
jmp 0x4559db
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404868
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x456e1c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x456e8a
mov eax, esi
call fcn.0043fbd8
test al, al
je 0x456e8a
mov eax, dword [ebx + 0x84]
call fcn.0043f838
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x456e8a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x456e7e
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043f838
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004376f8
jmp 0x456e8a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00456c58
pop esi
pop ebx
ret

Function at 0x4580cc
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x45b8b0]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x458104
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x45811c
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x458115
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.0040333c
xor edx, edx
mov eax, 0x45bab0
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x458183
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x45813a
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4583c4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4583dd
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4583d6
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4583ef
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4583e8
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.00457fbc
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x458409
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.004580cc
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x458491
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4584af
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.0045804c
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4584d9
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4584f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x458509
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x458502
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x45851d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00457ebc
test bl, bl
jne 0x4585f7
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x460cc8
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x458555
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x45856a
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004583c4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x45859d
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x45854a
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4585c1
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4585d3
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4585e8
jmp 0x4586b8
cmp bl, 1
jne 0x4586b8
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x460d22
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x458617
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x45862c
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004583c4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x45865f
sub ebx, 6
inc dword [ebp - 8]
jne 0x45860c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x458687
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x458699
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4586ae
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00457f3c
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x40352c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035c4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4035a4
xor eax, eax
push ebp
push 0x40359d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e90
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a044], 0
je 0x403ef1
cmp word [0x40a218], 0xd7b2
jne 0x403eb9
cmp dword [0x40a220], 0
jbe 0x403eb9
mov eax, 0x40a214
call dword [0x40a230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f18
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409020], 0
jne 0x403f0d
push 0
push 0x409058
push 0x409060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404c64
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404cca
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040425c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402f78
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404cb4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404cd1
lea eax, [ebp - 0x10]
call fcn.00404014
ret

Function at 0x406aac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406ae5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404104
jmp 0x406aee
mov eax, ebx
mov edx, esi
call fcn.00404068
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406af8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406b19
mov al, byte [esp]
jmp 0x406b1b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4071b0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x407018
mov eax, dword [0x4093b8]
cmp byte [eax], 0
je 0x40722c
mov eax, dword [0x40930c]
call fcn.00402d6c
call fcn.004029a8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00405f80
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x407274
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x407262
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4092ec]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40a660]
call fcn.00404634
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x407c50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x407cb4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040425c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00405e48
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407cbb
lea eax, [ebp - 0xc]
call fcn.00404014
ret
Function at 0x4e254e
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x4e259a
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x4e257f
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x4e258f
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4e25aa
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4e25e9
test ebx, ebx
je 0x4e25be
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x4e25b3
cmp ecx, 0xfff1
jb 0x4e25cc
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4e26d4
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4e260e
Function at 0x5cddde
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x270adb73
pop eax
push dword [ebp - 0x1a]
push 0xffffffffffffffc6
insb byte es:[edi], dx
cmp dword [eax + edi*8], ecx
adc ah, byte [esi + 0x3ffcd83]
xor byte [eax + 0x75], 0x66
lodsd eax, dword [esi]
push esi
add esp, dword [eax + 0x16]
adc al, 0xf2
in eax, 0xb8
in eax, 0xb8
xchg edi, eax
stc
jae fcn.005cddde
rol dword [edi - 0xc], cl
popfd
fsin
jnp 0x5cddfd
push 0xa60343ff
push edx
ljmp 0xf84d
Function at 0x6578ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f3b8
cmp edx, dword [eax]
je 0x6578cf
add eax, 8
inc ecx
cmp eax, 0x65f448
jl 0x6578c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f3b8]
jne 0x6579fd
mov eax, dword [0xa64d28]
cmp eax, 1
je 0x6579d7
test eax, eax
jne 0x657900
cmp dword [0x65f2e4], 1
je 0x6579d7
cmp edx, 0xfc
je 0x6579fd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657937
lea eax, [ebp - 0x1a4]
push 0x65c9b8
push eax
call fcn.00658290
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658720
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65797a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658720
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65c9b4
push edi
call fcn.0065a5f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65c998
push eax
call fcn.00658290
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006582a0
lea eax, [ebp - 0xa0]
push 0x65c994
push eax
call fcn.006582a0
push dword [esi + 0x65f3bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.006582a0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65c96c
push eax
call fcn.0065a564
add esp, 0x2c
pop edi
jmp 0x6579fd
lea eax, [ebp + 8]
lea esi, [esi + 0x65f3bc]
push 0
push eax
push dword [esi]
call fcn.00658720
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401350
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov al, byte [esp + 0x47]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0x675d
mov dword [esp + 0x34], 0x4019
mov byte [esp + 0x33], 0xd1
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov esi, 0x35d
mov byte [esp + 0x27], al
mov eax, ecx
mov dword [esp + 0x20], edx
mul esi
mov esi, dword [esp + 0x20]
imul edi, esi, 0x35d
add edx, edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov bl, byte [esp + 0x33]
add bl, 0xdc
mov byte [esp + 0x31], bl
mov bl, byte [esp + 0x31]
mov eax, esp
mov dword [eax + 4], 0x44f15c
mov dword [eax], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x1b], bl
call eax
sub esp, 8
mov bl, 0x2b
sub bl, byte [esp + 0x33]
mov ecx, eax
sub ecx, 0x51ca
mov dword [esp + 0x50], ecx
mov bh, byte [esp + 0x1b]
cmp bl, bh
mov dword [esp + 0x14], eax
jb 0x40140b
mov al, byte [esp + 0x33]
add al, 0x48
mov byte [esp + 0x32], 0xbf
cmp byte [esp + 0x32], al
jb 0x40143b
jmp 0x401444
mov eax, dword [esp + 0x1c]
and eax, 0x189a
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x34]
add eax, 0xffffbfe6
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jne 0x4013f8
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call section.nqpf
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0x2c21
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
xor edx, edx
mov esi, 0xd90d
sub esi, eax
sbb edx, ecx
sub esi, 0x2c22
sbb edx, 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
jb 0x40143b
jmp 0x40143b
Function at 0x44b550
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
lea eax, [fcn.0044b550]
mov dword [esp + 0x10], 0x7f75
mov byte [esp + 0xf], 0x9b
mov dword [esp + 4], eax
jmp 0x44b57a
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp word [eax], 0x5a4d
jne 0x44b5be
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [esp + 8]
cmp dword [ecx + eax], 0x4550
je 0x44b572
jmp 0x44b5be
mov eax, 0x6f75
sub eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
add ecx, 0xfffff000
and ecx, eax
mov dword [esp + 4], ecx
jmp 0x44b57a
mov al, byte [esp + 0xf]
xor al, 0x5c
mov byte [esp + 0xe], al
mov al, byte [esp + 0xf]
mov dword [esp + 0x14], 0x67e9
add al, 0x65
cmp al, byte [esp + 0xe]
ja 0x44b5a3
jmp 0x44b5a3
Function at 0x44b9c0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov byte [esp + 0xf], 0x1f
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 4]
mov cl, byte [esp + 0xf]
mov edx, dword [esp + 8]
mov ch, byte [edx + eax]
xor cl, 0x1f
mov esi, eax
add esi, 1
cmp ch, cl
mov dword [esp], eax
mov dword [esp + 4], esi
jne 0x44b9d7
mov eax, dword [esp]
add esp, 0x10
pop esi
ret 4

Function at 0x44e000
Capabilities:
Get disk information

Disassembly:
push ebp
push esp
mov dword [0x4502b8], esi
mov dword [0x4502bc], edi
mov dword [0x4502c0], ebx
pop dword [0x4502c8]
pop dword [0x4502c4]
jmp fcn.00401350