joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546e04
Capabilities:
Get disk information via ioctl
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff6b4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x944], ebx
mov dword [ebp - 0x948], ebx
mov dword [ebp - 0x94c], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a34
xor eax, eax
push ebp
push 0x546f84
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x546f5e
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x546ed8
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
push 0x546fa0
lea edx, [ebp - 0x948]
mov eax, ebx
call fcn.0040dbd8
push dword [ebp - 0x948]
push 0x546fc0
lea edx, [ebp - 0x94c]
mov eax, ebx
call fcn.0040993c
push dword [ebp - 0x94c]
push 0x546fcc
lea eax, [ebp - 0x944]
mov edx, 5
call fcn.00404904
mov eax, dword [ebp - 0x944]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
jmp 0x546f5e
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x940]
xor ecx, ecx
mov edx, 0x930
call fcn.00402f1c
push 0
lea eax, [ebp - 0x10]
push eax
push 0x930
lea eax, [ebp - 0x940]
push eax
push 0
push 0
push 0x70050
push ebx
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x546f58
mov edx, dword [ebp - 0x93c]
dec edx
test edx, edx
jl 0x546f58
inc edx
lea eax, [ebp - 0x8f8]
cmp dword [eax], 0
jbe 0x546f50
mov ecx, dword [eax]
add ecx, ecx
lea ecx, [ecx + ecx*8]
mov esi, dword [ebp - 8]
lea edi, [esi + ecx*8 - 0x90]
lea esi, [eax - 0x18]
mov ecx, 0x24
rep movsd dword es:[edi], dword [esi]
mov esi, dword [eax]
cmp esi, dword [ebp - 0xc]
jle 0x546f50
mov dword [ebp - 0xc], esi
add eax, 0x90
dec edx
jne 0x546f26
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x546f8b
lea eax, [ebp - 0x94c]
mov edx, 3
call fcn.00404598
lea eax, [ebp - 4]
call fcn.00404574
ret
Function at 0x546fd0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a34
xor eax, eax
push ebp
push 0x5470f4
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x5470ce
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.00404bd0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404a44
mov cl, 0x20
mov edx, ebx
call fcn.00402f1c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00546b50
test al, al
je 0x5470ce
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 0xc], eax
xor esi, esi
mov eax, esi
cmp eax, 0x1f
ja 0x547051
bt dword [ebp - 0xc], eax
jae 0x5470c4
lea ebx, [esi + 0x41]
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x24], 2
lea edx, [ebp - 0x28]
xor ecx, ecx
mov eax, 0x54710c
call fcn.0040aca8
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.0040475c
lea eax, [ebp - 0x2c]
mov edx, 0x54711c
call fcn.0040484c
mov eax, dword [ebp - 0x2c]
call fcn.00404a44
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x54709f
cmp eax, 3
jne 0x5470c4
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00546d04
test al, al
je 0x5470c4
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x10]
jne 0x5470c4
mov eax, dword [ebp - 8]
call fcn.00404a9c
mov edx, dword [ebp - 0x18]
mov byte [eax + edx - 1], bl
inc esi
cmp esi, 0x1a
jne 0x547046
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5470fb
lea eax, [ebp - 0x2c]
call fcn.00404574
lea eax, [ebp - 0x14]
call fcn.00404574
lea eax, [ebp - 4]
call fcn.00404574
ret
Function at 0x547394
Capabilities:
Enumerate disk volumes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
xor ecx, ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a34
xor eax, eax
push ebp
push 0x5475bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00547120
test al, al
je 0x54758a
lea edx, [ebp - 0x120]
mov eax, dword [ebp - 0x18]
call fcn.00545838
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 0x18]
call fcn.0040460c
push 0x5475d4
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x128]
call fcn.00409a28
push dword [ebp - 0x128]
push 0x5475e4
push dword [ebp - 0x18]
lea eax, [ebp - 0x124]
mov edx, 4
call fcn.00404904
mov eax, dword [ebp - 0x124]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
push pe_nt_image_headers32
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_FindFirstVolumeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x54758a
xor eax, eax
push ebp
push 0x547583
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
je 0x54754f
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x11c]
mov ecx, pe_nt_image_headers32
call fcn.004047f4
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x14]
call fcn.00547120
test al, al
je 0x54754f
push 0x5475f4
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x134]
call fcn.00409a28
push dword [ebp - 0x134]
push 0x5475e4
push dword [ebp - 0x1c]
lea eax, [ebp - 0x130]
mov edx, 4
call fcn.00404904
mov eax, dword [ebp - 0x130]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
je 0x547532
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.00404b88
test eax, eax
jle 0x54754f
mov byte [ebp - 5], 1
mov eax, ebx
lea edx, [ebp - 0x11c]
mov ecx, pe_nt_image_headers32
call fcn.004047f4
call fcn.00403f9c
jmp 0x54758a
push pe_nt_image_headers32
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextVolumeA
test eax, eax
jne 0x54748d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54758a
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindVolumeClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5475c4
lea eax, [ebp - 0x134]
mov edx, 6
call fcn.00404598
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404598
lea eax, [ebp - 4]
call fcn.00404574
ret
Function at 0x547644
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a34
xor eax, eax
push ebp
push 0x5476bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x109]
xor ecx, ecx
mov edx, 0x105
call fcn.00402f1c
push 0x105
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.004047f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5476c4
lea eax, [ebp - 4]
call fcn.00404574
ret

Function at 0x5479ec
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0x18], 8
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x1c
call fcn.00402f1c
mov dword [ebp - 0x34], 0x1c
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
call sub.SetupAPI.dll_SetupDiEnumDeviceInfo
test eax, eax
je 0x547aef
mov dword [ebp - 0x14], 0x12
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], edi
xor eax, eax
mov dword [ebp - 8], eax
push 0x14
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
call sub.SetupAPI.dll_SetupDiSetClassInstallParamsA
test eax, eax
je 0x547aef
lea eax, [ebp - 0x34]
push eax
push esi
push 0x12
call sub.SetupAPI.dll_SetupDiCallClassInstaller
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x547aef
cmp edi, 2
jne 0x547aef
cmp byte [ebp + 8], 0
jne 0x547aef
mov dword [ebp - 0x15c], 0x128
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
call sub.SetupAPI.dll_SetupDiGetDeviceInstallParamsA
test eax, eax
je 0x547aef
test dword [ebp - 0x158], 0x180
je 0x547aef
push 0x547afc
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.004746e0
push 0
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.005479ec
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.004746e0
push 1
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.005479ec
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x547bec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x547cdd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00402e00
mov edx, 0x547cec
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00402dd0
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x14]
call fcn.00402e00
mov edx, 0x547cf0
lea eax, [ebp - 0x14]
mov cl, 3
call fcn.00402dd0
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.004047e8
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 2
je 0x547c70
sub eax, 3
je 0x547c77
jmp 0x547c7e
mov esi, 0xc0000000
jmp 0x547c83
mov esi, 0x80000000
jmp 0x547c83
or ebx, 0xffffffff
jmp 0x547cc2
lea eax, [ebp - 8]
push eax
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x18], 2
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x547cfc
call fcn.0040aca8
push 0
push 0
push 3
push 0
push 3
push esi
mov eax, dword [ebp - 8]
call fcn.00404a44
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x547cc2
call fcn.004100d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547ce4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404598
ret
Function at 0x5481c8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x818], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x548344
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41d718]
call fcn.00403670
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x43e49c]
call fcn.0043e59c
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x548317
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x14]
call fcn.0043e678
xor ecx, ecx
mov edx, 0x54835c
mov eax, dword [ebp - 0x14]
call fcn.0043e6dc
test al, al
je 0x5482f9
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0043eb08
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5482f9
inc ebx
xor esi, esi
lea ecx, [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 8]
cmp byte [eax], 0x23
jne 0x5482f1
lea eax, [ebp - 0x814]
xor ecx, ecx
mov edx, 0x800
call fcn.00402f1c
push 0x800
lea ecx, [ebp - 0x814]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0043ed68
test eax, eax
jle 0x5482f1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x814]
call fcn.00547ef8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409418
test al, al
je 0x5482f1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0043e9b8
lea eax, [ebp - 0x818]
mov ecx, dword [ebp - 8]
mov edx, 0x54837c
call fcn.00404890
mov eax, dword [ebp - 0x818]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
inc esi
dec ebx
jne 0x548264
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54831e
mov eax, dword [ebp - 0x14]
call fcn.004036a0
mov eax, dword [ebp - 0x10]
call fcn.004036a0
ret
Function at 0x548bc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x548d21
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402ba0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040a320
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x548d3c
call fcn.00404890
mov eax, dword [ebp - 8]
call fcn.00409f98
test al, al
je 0x548c69
cmp byte [ebp + 8], 0
je 0x548c3c
push dword [ebp - 8]
push 0x548d54
push edi
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404904
jmp 0x548c52
push dword [ebp - 8]
push 0x548d68
push edi
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404904
push 0
mov eax, dword [ebp - 8]
call fcn.00404a44
push eax
call sub.kernel32.dll_WinExec
mov bl, 1
jmp 0x548d06
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402ba0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040a320
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov ecx, 0x548d7c
call fcn.00404890
mov eax, dword [ebp - 8]
call fcn.00409f98
test al, al
je 0x548d06
cmp byte [ebp + 8], 0
je 0x548ccb
push dword [ebp - 8]
push 0x548d90
push esi
push 0x548d9c
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040993c
push dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 5
call fcn.00404904
jmp 0x548cf4
push dword [ebp - 8]
push 0x548d90
push esi
push 0x548da8
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0040993c
push dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 5
call fcn.00404904
push 0
mov eax, dword [ebp - 8]
call fcn.00404a44
push eax
call sub.kernel32.dll_WinExec
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548d28
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00404598
ret
Function at 0x5494b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a34
mov eax, dword [ebp - 8]
call fcn.00404a34
xor eax, eax
push ebp
push 0x549522
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x549507
mov eax, dword [ebp - 4]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
mov edx, esi
xor eax, eax
call fcn.00549060
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549529
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404598
ret

Function at 0x549534
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcfc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x304], ebx
mov esi, edx
lea edi, [ebp - 0xee]
push ecx
mov ecx, 0x39
rep movsd dword es:[edi], dword [esi]
pop ecx
movsw word es:[edi], word [esi]
mov dword [ebp - 8], ecx
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
call fcn.00404a34
xor eax, eax
push ebp
push 0x5496a6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2ee]
xor ecx, ecx
mov edx, 0x200
call fcn.00402f1c
lea esi, [ebp - 0xee]
lea edi, [ebp - 0x2e6]
mov ecx, 0x39
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [ebp - 0x2ee]
mov ecx, 7
mov eax, 0x5496c0
call fcn.004f6794
lea edx, [ebp - 0x304]
mov eax, dword [ebp - 8]
call fcn.0040956c
cmp dword [ebp - 0x304], 0
je 0x54962f
xor eax, eax
push ebp
push 0x54960f
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x23c], 1
lea edx, [ebp - 0x2fe]
mov eax, dword [ebp - 8]
call fcn.004f3dc4
lea edx, [ebp - 0x23a]
lea eax, [ebp - 0x2fe]
mov ecx, 0x10
call fcn.00402a14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54962f
call fcn.00402c04
lea edi, [ebp - 0x2ee]
xor esi, esi
lea ebx, [ebp - 0x1ee]
mov eax, pe_nt_image_headers32
call fcn.00402f3c
mov byte [ebx], al
mov al, byte [edi + esi]
xor al, byte [ebx]
mov byte [edi + esi], al
inc esi
inc ebx
cmp esi, 0x100
jne 0x549642
lea eax, [ebp - 0x2ee]
push eax
push 0
push 0xffffffffffffffff
mov ecx, 0x200
mov edx, 0x400
mov al, byte [ebp - 1]
call fcn.00545020
cmp eax, 0x200
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5496ad
lea eax, [ebp - 0x304]
call fcn.00404574
lea eax, [ebp - 8]
call fcn.00404574
ret
Function at 0x549a58
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a34
xor eax, eax
push ebp
push 0x549ab4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x549a9e
push 0xffffffffffffffff
mov edx, esi
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.00549a04
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549abb
lea eax, [ebp - 4]
call fcn.00404574
ret

Function at 0x549ac4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
mov dword [ebp - 4], edx
lea edx, [ebp - 0x204]
push edx
push ecx
mov edx, dword [ebp + 8]
push edx
mov edx, 0x400
mov ecx, 0x200
call fcn.00544c90
cmp eax, 0x200
sete al
test al, al
je 0x549b4b
lea ecx, [ebp - 0x204]
xor eax, eax
lea edx, [ebp - 0x104]
mov bl, byte [ecx + eax]
xor bl, byte [edx]
mov byte [ecx + eax], bl
inc eax
inc edx
cmp eax, 0x100
jne 0x549b08
mov edx, 0x549b54
lea eax, [ebp - 0x204]
mov ecx, 6
call fcn.0040a6e4
test eax, eax
sete al
test al, al
je 0x549b4b
mov edx, dword [ebp - 4]
mov edi, edx
lea esi, [ebp - 0x1fc]
mov ecx, 0x39
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x54c748
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x4c], eax
xor eax, eax
push ebp
push 0x54c805
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x40
call fcn.00402f1c
xor eax, eax
push ebp
push 0x54c7b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x48], 0x40
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
je 0x54c7af
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54c7ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54c80c
lea eax, [ebp - 0x4c]
call fcn.00404574
ret
Function at 0x54c83c
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebx
add esp, 0xffffff74
mov dword [esp], 0
mov dword [esp + 4], 0
lea eax, [esp + 0x20]
push eax
push 0x69
call sub.kernel32.dll_GetLogicalDriveStringsA
lea ebx, [esp + 0x20]
test ebx, ebx
je 0x54c8e5
push ebx
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x54c8d0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push ebx
call sub.kernel32.dll_GetDiskFreeSpaceExA
test eax, eax
je 0x54c8d0
mov eax, dword [esp]
mov edx, dword [esp + 4]
add eax, dword [esp + 0x10]
adc edx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, ebx
call fcn.0040a538
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x54c8e1
xor ebx, ebx
test ebx, ebx
jne 0x54c866
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x8c
pop ebx
ret

Function at 0x54ce3c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
call fcn.00402c04
xor ebx, ebx
mov eax, pe_nt_image_headers32
call fcn.00402f3c
mov byte [esi + ebx + 0x40], al
inc ebx
cmp ebx, 0x40
jne 0x54ce4a
mov eax, edi
mov ecx, esi
lea edx, [esi + 0x40]
mov ebx, 0x10
mov esi, dword [edx]
xor esi, dword [eax]
mov dword [ecx], esi
add ecx, 4
add eax, 4
add edx, 4
dec ebx
jne 0x54ce6a
pop edi
pop esi
pop ebx
ret

Function at 0x54ce80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ecx, eax
lea ebx, [eax + 0x40]
mov eax, 0x10
mov esi, dword [ebx]
xor esi, dword [ecx]
mov dword [edx], esi
add edx, 4
add ecx, 4
add ebx, 4
dec eax
jne 0x54ce8c
pop esi
pop ebx
ret
Function at 0x554938
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x554966
mov eax, ebx
call fcn.005553ec
cmp dword [ebx + 0x40], 0
je 0x55495f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5549d7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5549c9
cmp dword [ebx + 8], 0
je 0x554988
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x55499a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5549c9
cmp dword [ebx + 8], 0
je 0x55497b
cmp eax, 3
je 0x5549ad
dec eax
jne 0x55497b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x55497b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x55497b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5549f5
cmp dword [ebx + 0x14], 0xcc
je 0x5549f5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00554a00
pop ebx
ret
Function at 0x569704
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x569775
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x653b94]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x56975f
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.005696f4
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5694fc]
call fcn.0056979c
mov dword [0x653bf8], eax
mov eax, dword [ebp - 4]
call fcn.005696a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56977c
lea eax, [ebp - 8]
call fcn.00406538
ret

Function at 0x56b448
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x56b502
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404c90
mov eax, dword [0x656148]
cmp dword [eax], 2
jne 0x56b4b7
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004050b0
mov eax, dword [ebx]
call fcn.00404e78
push eax
mov eax, dword [ebx]
call fcn.00404e68
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404e78
mov edx, eax
dec edx
mov eax, ebx
call fcn.004050b0
jmp 0x56b4e9
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040a7b8
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404e58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56b509
lea eax, [ebp - 0x3f0]
call fcn.00404574
ret