joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423e58
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff98
push ebx
push esi
push edi
mov byte [ebp - 0x104d], cl
mov dword [ebp - 0x104c], edx
mov edi, eax
mov ebx, dword [ebp + 0x14]
lea esi, [ebp - 0x105c]
push esi
push edi
mov esi, 0x7618bc
lea edi, [ebp - 0x48]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
mov esi, 0x761904
lea edi, [ebp - 0x1048]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebp
mov dword [ebp - 0x1068], ebx
mov eax, dword [ebp - 0x1068]
call fcn.00409e24
push eax
mov eax, ebx
call fcn.0040a3a8
pop edx
call fcn.00423d50
pop ecx
mov ebx, edi
cmp byte [ebp - 0x104d], 0
je 0x423ee9
lea eax, [ebp - 0x48]
mov dword [ebp - 0x1054], eax
mov dword [ebp - 0x1058], 1
jmp 0x423efc
lea eax, [ebp - 4]
mov dword [ebp - 0x1054], eax
mov dword [ebp - 0x1058], 0xffffffff
mov eax, dword [ebp - 0x104c]
shr eax, 3
dec eax
test eax, eax
jl 0x42401c
inc eax
mov dword [ebp - 0x1064], eax
cmp dword [ebp + 0x10], 0
jne 0x423f1f
cmp dword [ebp + 0xc], 0
je 0x423f9c
mov dword [esi], 7
lea eax, [ebp + 0xc]
add eax, dword [esi]
movzx edx, byte [eax]
inc edx
and dl, 0xff
mov byte [eax], dl
lea eax, [ebp + 0xc]
add eax, dword [esi]
cmp byte [eax], 0
jne 0x423f46
dec dword [esi]
cmp dword [esi], 0xffffffff
jne 0x423f27
lea eax, [ebp + 0xc]
mov eax, dword [eax]
call fcn.00423964
mov dword [esi], eax
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.00423964
mov dword [ebp - 0x1060], eax
push ebp
mov eax, dword [ebp - 0x1058]
push eax
lea edx, [ebp - 0x1060]
mov eax, esi
mov ecx, dword [ebp - 0x1054]
call fcn.00423990
pop ecx
mov eax, dword [esi]
call fcn.00423964
xor dword [ebx], eax
mov eax, dword [ebp - 0x1060]
call fcn.00423964
lea edx, [ebx + 4]
xor dword [edx], eax
jmp 0x42400d
cmp byte [ebp + 8], 0
jne 0x423ff4
mov edi, ebx
mov eax, dword [edi]
call fcn.00423964
mov dword [esi], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
call fcn.00423964
mov dword [ebp - 0x1060], eax
push ebp
mov eax, dword [ebp - 0x1058]
push eax
lea edx, [ebp - 0x1060]
mov eax, esi
mov ecx, dword [ebp - 0x1054]
call fcn.00423990
pop ecx
mov eax, dword [esi]
call fcn.00423964
mov dword [edi], eax
mov eax, dword [ebp - 0x1060]
call fcn.00423964
lea edx, [ebx + 4]
mov dword [edx], eax
jmp 0x42400d
push ebp
mov eax, dword [ebp - 0x1058]
push eax
mov edx, ebx
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x1054]
call fcn.00423990
pop ecx
add ebx, 8
dec dword [ebp - 0x1064]
jne 0x423f15
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42412c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
jle 0x424257
lea eax, [esi + 2]
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, edx
add edx, edx
mov eax, edi
xor ecx, ecx
call fcn.0040a4dc
mov ecx, dword [edi]
mov eax, esi
mov edi, 3
cdq
idiv edi
mov edi, eax
test edi, edi
jle 0x4241c9
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
movzx edx, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x762904]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + 0x762904]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x762904]
mov byte [ecx + 2], dl
and eax, 0x3f
movzx eax, byte [eax + 0x762904]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec edi
jne 0x424169
mov eax, esi
mov esi, 3
cdq
idiv esi
dec edx
je 0x4241de
dec edx
je 0x42420f
jmp 0x42425e
movzx eax, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x762904]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x762904]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x42425e
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x762904]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + 0x762904]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x762904]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
jmp 0x42425e
mov eax, edi
call fcn.00409938
pop edi
pop esi
pop ebx
ret
Function at 0x425b74
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x425ceb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x425bb8
mov eax, ebx
call fcn.0040a944
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x425bee
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x425cd0
lea eax, [ebp - 0x10]
mov edx, ebx
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x10]
call fcn.0040a3a8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x425cd0
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x425c1e
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, ebx
call fcn.0040a944
push eax
call sub.kernel32.dll_CreateFileW_1
mov dword [ebp - 8], eax
jmp 0x425c50
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x14]
mov edx, ebx
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x14]
call fcn.0040a3a8
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x425cd0
xor eax, eax
push ebp
push 0x425cc9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
mov edx, eax
mov eax, esi
xor ecx, ecx
call fcn.0040a4dc
cmp dword [esi], 0
je 0x425ca9
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi]
call fcn.00409e24
push eax
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x425ca9
mov eax, dword [esi]
call fcn.00409e24
cmp eax, dword [ebp - 0xc]
je 0x425cad
xor eax, eax
jmp 0x425caf
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425cd0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425cf2
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004099a4
ret
Function at 0x431634
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
movzx eax, cl
mov edx, dword [ebp - 4]
cmp word [edx + eax*2], 0xffff
jne 0x431686
mov dword [ebp - 0xc], 0x7fffffff
xor esi, esi
mov ebx, dword [ebp - 8]
movzx eax, cl
movzx edx, byte [ebx]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [ebp - 0xc]
jge 0x43167d
movzx edx, cl
mov edi, dword [ebp - 4]
lea edi, [edi + edx*2]
mov word [edi], si
mov dword [ebp - 0xc], eax
inc esi
add ebx, 3
cmp esi, 0x10
jne 0x43165c
movzx eax, cl
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432614
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, eax
lea eax, [ebp - 0x14]
mov edx, 0x14
call fcn.004120bc
mov dword [ebp - 0x14], 0x14
push 0x43271c
push 0x432738
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411010
mov ebx, eax
test ebx, ebx
je 0x432657
lea eax, [ebp - 0x14]
push eax
call ebx
test eax, eax
jne 0x4326ad
lea eax, [ebp - 8]
push eax
call sub.user32.dll_GetCursorPos
test eax, eax
je 0x4326ad
push dword [ebp - 4]
push dword [ebp - 8]
call sub.user32.dll_WindowFromPoint
test eax, eax
je 0x43267f
push 0
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov ebx, eax
jmp 0x432681
xor ebx, ebx
test ebx, ebx
je 0x432693
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetCursor
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x4326ad
push 0
push ebx
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_AttachThreadInput
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x432716
test byte [ebp - 0x10], 1
je 0x432716
lea eax, [ebp - 0x28]
push eax
push ebx
call sub.user32.dll_GetIconInfo
test eax, eax
je 0x4326ee
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4326d5
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4326e2
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0x24]
sub dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 4], eax
push 3
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub edx, dword [eax - 8]
push edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
sub edx, dword [eax - 4]
push edx
push esi
call sub.user32.dll_DrawIconEx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov byte [esp + 4], cl
mov dword [esp], edx
mov edi, eax
mov ecx, edi
movzx eax, byte [esp]
mov byte [esp + 5], al
mov edx, edi
shr edx, 8
mov eax, dword [esp]
shr eax, 8
mov byte [esp + 6], al
mov eax, edi
shr eax, 0x10
mov ebx, dword [esp]
shr ebx, 0x10
mov byte [esp + 7], bl
xor esi, esi
cmp byte [esp + 4], 0
je 0x4344f8
movzx ebx, cl
movzx ebp, byte [esp + 5]
add ebx, ebp
cmp ebx, 0xff
jbe 0x4344bc
inc esi
mov cl, 0xff
jmp 0x4344c0
add cl, byte [esp + 5]
movzx ebx, dl
movzx ebp, byte [esp + 6]
add ebx, ebp
cmp ebx, 0xff
jbe 0x4344d7
inc esi
mov dl, 0xff
jmp 0x4344db
add dl, byte [esp + 6]
movzx ebx, al
movzx ebp, byte [esp + 7]
add ebx, ebp
cmp ebx, 0xff
jbe 0x4344f2
inc esi
mov al, 0xff
jmp 0x434525
add al, byte [esp + 7]
jmp 0x434525
cmp cl, byte [esp + 5]
jae 0x434503
inc esi
xor ecx, ecx
jmp 0x434507
sub cl, byte [esp + 5]
cmp dl, byte [esp + 6]
jae 0x434512
inc esi
xor edx, edx
jmp 0x434516
sub dl, byte [esp + 6]
cmp al, byte [esp + 7]
jae 0x434521
inc esi
xor eax, eax
jmp 0x434525
sub al, byte [esp + 7]
dec esi
jle 0x43453c
movzx ecx, byte [esp + 4]
xor cl, 1
mov edx, dword [esp]
mov eax, edi
call fcn.00434464
jmp 0x43454f
movzx eax, al
shl eax, 0x10
movzx edx, dl
shl edx, 8
add eax, edx
movzx edx, cl
add eax, edx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x435734
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43583f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x10
call fcn.004120bc
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
sub eax, 0x2e
mov dword [esi + 8], eax
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4357b2
push 0x410
push esi
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0043595c
mov eax, dword [ebp - 4]
call fcn.00409e0c
push eax
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0043595c
mov eax, dword [ebp - 8]
call fcn.0040a944
push eax
push edi
call sub.user32.dll_DrawTextW
jmp 0x435804
push 0x410
push esi
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0043595c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0xc]
call fcn.00409e24
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0043595c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x14]
call fcn.0040a3a8
push eax
push edi
call sub.user32.dll_DrawTextA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435846
lea eax, [ebp - 0x18]
call fcn.00409914
lea eax, [ebp - 0x14]
call fcn.00409938
lea eax, [ebp - 0x10]
call fcn.00409914
lea eax, [ebp - 0xc]
call fcn.00409938
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409974
ret

Function at 0x435d18
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x435df0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x14], 0
je 0x435dd0
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x435d85
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageW
mov edx, eax
inc edx
lea eax, [ebx + 0x50]
call fcn.0040aad8
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [ebx + 0x50]
call fcn.00409e0c
push eax
push 0xd
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageW
mov edx, eax
lea eax, [ebx + 0x50]
call fcn.0040aad8
jmp 0x435dd0
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageA
mov edx, eax
inc edx
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.0040a4dc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00409e24
push eax
push 0xd
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageA
mov edx, eax
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.0040a4dc
lea eax, [ebx + 0x50]
mov edx, dword [ebp - 4]
call fcn.0040aa1c
mov eax, esi
mov edx, dword [ebx + 0x50]
call fcn.00409cf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435df7
lea eax, [ebp - 4]
call fcn.00409938
ret
Function at 0x447d28
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x447e56
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x218]
push eax
push 0x104
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jle 0x447e30
lea ebx, [ebp - 0x218]
lea eax, [ebx + 4]
mov word [eax], 0
push 0x104
lea eax, [ebp - 0x424]
push eax
push ebx
call sub.kernel32.dll_QueryDosDeviceW
mov esi, eax
test esi, esi
jle 0x447e19
lea eax, [ebp - 4]
lea edx, [ebp - 0x424]
mov ecx, 0x106
call fcn.0040aa00
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040af30
test eax, eax
jle 0x447e19
mov eax, dword [ebp - 4]
test eax, eax
je 0x447dcd
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov edi, dword [ebp - 8]
test edi, edi
je 0x447ddb
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.0040ad20
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
mov edx, ebx
call fcn.0040a9ac
mov edx, dword [ebp - 0x42c]
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.0040abb0
jmp 0x447e30
add ebx, 2
cmp word [ebx], 0
jne 0x447e16
add ebx, 4
test ebx, ebx
je 0x447e2a
cmp word [ebx], 0
jne 0x447d7a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447e5d
lea eax, [ebp - 0x42c]
mov edx, 2
call fcn.00409974
lea eax, [ebp - 4]
call fcn.00409914
ret
Function at 0x447f50
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44818d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.00409914
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ebx, eax
test ebx, ebx
jne 0x448027
cmp dword [ebp - 0x14], 0
jne 0x448027
xor edx, edx
mov eax, 6
call fcn.00450374
test al, al
je 0x448027
push 2
push 0x104
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFinalPathNameByHandleW
test eax, eax
jbe 0x448027
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x224]
mov ecx, 0x106
call fcn.0040aa00
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.00447d28
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 8]
call fcn.00409cf4
mov byte [ebp - 9], 1
jmp 0x44816f
test ebx, ebx
jne 0x448035
cmp dword [ebp - 0x14], 0
je 0x448123
push 0
push 1
push 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3ee
je 0x448123
xor eax, eax
push ebp
push 0x44811c
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x448105
xor eax, eax
push ebp
push 0x4480fe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
call sub.kernel32.dll_GetCurrentProcess
lea ecx, [ebp - 0x224]
mov edx, dword [ebp - 0x18]
call fcn.0043a4e4
test eax, eax
jbe 0x4480e7
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x224]
mov ecx, 0x106
call fcn.0040aa00
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x230]
call fcn.00447d28
mov edx, dword [ebp - 0x230]
mov eax, dword [ebp - 8]
call fcn.00409cf4
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448105
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448123
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
cmp byte [ebp - 9], 0
jne 0x44816f
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 4]
call fcn.00447e64
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 8]
call fcn.00409cf4
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x44816f
lea edx, [ebp - 0x23c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00447d28
mov edx, dword [ebp - 0x23c]
mov eax, dword [ebp - 8]
call fcn.00409cf4
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448194
lea eax, [ebp - 0x23c]
mov edx, 6
call fcn.00409974
ret
Function at 0x4481a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 0
xor edx, edx
mov eax, 6
call fcn.00450374
test al, al
je 0x448268
xor edx, edx
mov eax, ebx
call fcn.00449c4c
test al, al
je 0x448268
mov eax, ebx
call fcn.004497a0
test al, 0x20
je 0x448268
mov eax, ebx
call fcn.0040a944
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x448268
test ah, 4
je 0x448268
test al, 0x10
je 0x448207
mov edi, 0x2000000
jmp 0x448209
xor edi, edi
push 0
push edi
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.0040a944
push eax
call sub.kernel32.dll_CreateFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x448268
xor eax, eax
push ebp
push 0x448261
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov ecx, edi
mov eax, dword [ebp - 8]
call fcn.00447f50
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448268
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x448570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4485c9
test eax, edx
je 0x4485cc
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x448587
movzx eax, word [eax]
sub eax, ecx
jmp 0x4485ae
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4485af
add ecx, 4
js 0x44859f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4485ac
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4485ae
xor eax, eax
ret
test eax, eax
je 0x4485d8
test edx, edx
jne 0x448578
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x4497a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x449904
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x449740]
call fcn.0040bea4
add esp, 4
push 0x104
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x449770]
call fcn.0040bea4
add esp, 4
movzx ebx, byte [0x449914]
mov dl, 1
mov eax, esi
call fcn.00449ce4
test al, al
jne 0x44981a
mov dl, 1
mov eax, esi
call fcn.00449c4c
test al, al
je 0x4498a4
lea edx, [ebp - 0x1c]
mov eax, esi
call fcn.0044a260
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.00450884
push 0x104
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x104
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a944
mov esi, eax
push esi
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x44989f
test byte [ebp - 0x14], 1
je 0x44986a
or bl, 1
test byte [ebp - 0x14], 2
je 0x449873
or bl, 2
test byte [ebp - 0x14], 0x80
je 0x44987c
or bl, 0x20
push esi
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
je 0x449890
dec eax
je 0x449895
dec eax
je 0x44989a
dec eax
jne 0x4498c5
or bl, 0x10
jmp 0x4498c5
or bl, 4
jmp 0x4498c5
or bl, 8
jmp 0x4498c5
call fcn.00451070
lea edx, [ebp - 0x20]
mov eax, dword [0x768ec0]
call fcn.0040db48
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x4423e4]
call fcn.0044f73c
call fcn.00408fa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44990b
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00409974
lea eax, [ebp - 0xc]
mov edx, dword [0x449770]
call fcn.0040bfc8
lea eax, [ebp - 8]
mov edx, dword [0x449740]
call fcn.0040bfc8
lea eax, [ebp - 4]
call fcn.00409914
ret

Function at 0x449970
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x44999d
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4