joyce8/EMBER2024-capa huggingface dataset:
Function at 0x766180
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0x1f
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x134]
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jne 0x7662dc
push edi
lea ecx, [eax + 0x1cb4]
lea edi, [eax + 0x1eb4]
mov dword [edi], ecx
cmp ecx, edi
jae 0x7661bb
mov byte [ecx], 0xff
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x7661c6
mov byte [ecx], 0xfa
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x7661d1
mov byte [ecx], 0x1f
inc dword [edi]
movzx eax, word [eax + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x1caa]
push eax
call esi
mov ecx, dword [ebp + 8]
movzx edx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x766205
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x76620f
mov byte [eax], ch
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x766219
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x766223
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x76622e
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x766239
mov byte [eax], 0xf0
inc dword [edi]
mov esi, dword [ebp - 4]
mov eax, dword [edi]
mov dword [esi + 0x1eb8], eax
lea ecx, [esi + 0x1cb4]
sub eax, ecx
mov dword [edi], ecx
sub eax, 2
push eax
lea eax, [esi + 0x1cb6]
push eax
push 0x3e
push ebx
call fcn.00765a20
add esp, 0x10
lea eax, [esi + 0x1cb4]
push 0
push 3
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x148]
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x766299
call edi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0074a7f0
add esp, 0xc
push 4
lea eax, [esi + 0x1cb7]
push eax
push ebx
call fcn.00766070
add esp, 0xc
lea eax, [esi + 0x1cbb]
push 0
push 2
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x148]
call dword [sym.imp.WS2_32.dll_send]
pop esi
test eax, eax
jns 0x7662db
call edi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0074a7f0
add esp, 0xc
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7673b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x9d8c80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + 0x438]
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [edi + 0x13c]
lea esi, [edi + 0x148]
push 0
add eax, 4
push eax
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x130], 0
mov dword [edi + 0x134], eax
jne 0x76743e
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.00646450
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [edi + 0x130], eax
mov edx, dword [edi + 0x134]
cmp edx, 4
jge 0x767471
push str.Received_too_short_packet
push ebx
call fcn.0074a7f0
add esp, 8
mov dword [edi + 0xc], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00645ebf
mov esp, ebp
pop ebp
ret
push esi
call fcn.00766fc0
movzx eax, ax
add esp, 4
mov dword [edi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x76748c
jmp dword [eax*4 + 0x7675cc]
cmp edx, 4
jle case.0x76748c.4
push esi
call fcn.00766fa0
movzx ecx, word [edi + 0x144]
add esp, 4
inc ecx
cmp cx, ax
jne case.0x76748c.4
lea eax, [edx - 4]
push eax
mov eax, dword [esi]
add eax, 4
push eax
push 1
push ebx
call fcn.0074a740
mov esi, eax
add esp, 0x10
test esi, esi
je 0x7674ef
push 5
push edi
call fcn.00767df0
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00645ebf
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x134]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push ebx
call fcn.007587b0
jmp 0x767597
mov eax, dword [esi]
lea esi, [edx - 4]
add eax, 4
mov dword [ebp - 0x8c], eax
lea eax, [edi + 0x148]
push eax
call fcn.00766fa0
push esi
push dword [ebp - 0x8c]
movzx eax, ax
mov dword [edi + 8], eax
call fcn.00767f20
add esp, 0xc
cmp eax, esi
jae case.0x76748c.4
push dword [ebp - 0x8c]
push str.TFTP_error:__s
push ebx
call fcn.0074a8b0
jmp 0x767597
lea eax, [edx - 2]
push eax
mov eax, dword [esi]
add eax, 2
push eax
push edi
call fcn.00767180
add esp, 0xc
test eax, eax
je case.0x76748c.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00645ebf
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x7ddbac
push ebx
call fcn.0074a7f0
add esp, 0xc
push ebx
call fcn.00758ae0
add esp, 4
test eax, eax
je 0x76745e
push 5
push edi
call fcn.00767df0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 0x2a
pop edi
pop esi
pop ebx
call fcn.00645ebf
mov esp, ebp
pop ebp
ret
Function at 0x767df0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x767e00
jmp dword [edx*4 + 0x767e54]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.007678b0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.007675e0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00768050
push str.TFTP_finished
push 0x7ddbac
push ecx
call fcn.0074a8b0
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x7ddbac
push ecx
call fcn.0074a7f0
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x76e880
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x9d8c80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
or esi, 0xffffffff
push ecx
mov ebx, dword [edi + 0xc]
mov eax, dword [ebx + 0x14c]
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x76e8d9
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push dword [ebp - 0x1c]
push ebx
push edi
call fcn.0074b0f0
add esp, 0xc
cmp esi, 0xffffffff
jne 0x76e90f
push str.Error_accept__ing_server_connect
push edi
call fcn.0074a7f0
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00645ebf
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server
push edi
call fcn.0074a8b0
push 1
push esi
mov byte [ebx + 0x265], 0
mov dword [ebx + 0x14c], esi
call fcn.00777250
add esp, 0x10
mov byte [ebx + 0x278], 1
cmp dword [edi + 0x1b8], 0
je 0x76e98c
push 1
push edi
call fcn.0073c920
mov eax, dword [edi + 0x1b8]
push 1
push esi
push dword [edi + 0x1bc]
call eax
push 0
push edi
mov esi, eax
call fcn.0073c920
add esp, 0x1c
test esi, esi
je 0x76e98c
push ebx
push edi
call fcn.0076edd0
add esp, 8
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00645ebf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00645ebf
mov esp, ebp
pop ebp
ret

Function at 0x770db0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, 0x51eb851f
imul ecx
push ebx
sar edx, 5
push esi
mov esi, dword [ebp + 8]
mov eax, edx
shr eax, 0x1f
push edi
add eax, edx
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 2
je 0x770ded
push str.Couldnt_set_desired_mode
push esi
call fcn.0074a7f0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x770e04
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.0074a8b0
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x770e1d
push ebx
push esi
call fcn.00770a70
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x770e32
push esi
call fcn.0076faa0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x770e47
push esi
call fcn.00770a50
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x770e57
push esi
call fcn.00770c90
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x77cd10
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x9d8c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x11c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], edi
call fcn.0075d830
add esp, 4
mov dword [ebp - 0x118], eax
test eax, eax
jne 0x77cd8d
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0075cf80
push eax
push dword [ebp - 0x108]
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push edi
call fcn.0074a7f0
add esp, 0x1c
lea esi, [ebx + 0x4d]
jmp 0x77ceee
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x110], eax
cmp eax, 0xffffffff
jne 0x77cde8
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0075cf80
push eax
push dword [ebp - 0x108]
push str.schannel:_failed_to_open_CA_file__s:__s
push edi
call fcn.0074a7f0
add esp, 0x1c
mov esi, 0x4d
jmp 0x77ceee
lea ecx, [ebp - 0x124]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x77ce31
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0075cf80
push eax
push dword [ebp - 0x108]
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push edi
call fcn.0074a7f0
add esp, 0x1c
mov esi, 0x4d
jmp 0x77cee2
mov edi, dword [ebp - 0x124]
cmp dword [ebp - 0x120], ebx
jl 0x77ce68
jg 0x77ce49
cmp edi, 0x100000
jbe 0x77ce68
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push dword [ebp - 0x10c]
call fcn.0074a7f0
add esp, 0xc
mov esi, 0x4d
jmp 0x77cee2
lea eax, [edi + 1]
push eax
call dword [0x9da1b0]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x77ce80
lea esi, [eax + 0x1b]
jmp 0x77cee2
test edi, edi
je 0x77cec0
push 0
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x77cf26
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x77cf1e
add esi, eax
cmp esi, edi
jb 0x77ce84
mov byte [edi + ebx], 0
push dword [ebp - 0x10c]
push dword [ebp - 0x108]
push edi
push ebx
push dword [ebp - 0x11c]
call fcn.0077cab0
add esp, 0x14
mov esi, eax
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x9da1b4]
mov eax, dword [ebp - 0x118]
add esp, 4
test eax, eax
je 0x77cf0b
push eax
call fcn.006457dc
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00645ebf
mov esp, ebp
pop ebp
ret
mov edi, esi
mov byte [esi + ebx], 0
jmp 0x77cec4
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0075cf80
push eax
push dword [ebp - 0x108]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push dword [ebp - 0x10c]
call fcn.0074a7f0
add esp, 0x1c
mov esi, 0x4d
jmp 0x77cee2
Function at 0x77ece0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x9d8c80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 0x10]
push 0xf0000040
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x77ed78
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x18], xmm0
push edi
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], 8
call fcn.0077ede0
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.00781f00
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x77ed8a
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00645ebf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push dword [ebp - 0x20]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00645ebf
mov esp, ebp
pop ebp
ret

Function at 0x780660
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x780693
push 0x2e
push edi
call fcn.007862b0
add esp, 8
test eax, eax
je 0x780691
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x781ac0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x9da1b0]
mov edi, eax
add esp, 4
test edi, edi
jne 0x781aed
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x781b34
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x781b3a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x781b9a
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ebx, [ebx]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
dec dword [ebp + 0x10]
jne 0x781b60
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x781bc7
nop
mov eax, dword [esi + 4]
push 1
push 0x830488
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x830489
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x781ba0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x781c40
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x781c72
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
pop esi
pop ebp
ret

Function at 0x781f90
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x781fcf
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebp
ret
Function at 0x7953ba
Capabilities:
Get file system object information

Disassembly:
push 0x330
mov eax, 0x7c5944
call fcn.00645f96
mov edi, ecx
mov eax, dword [ebp + 8]
push eax
mov byte [edi + 0x40], 0
call fcn.00408ed9
push 0x200
push 0x2b4
lea eax, [ebp - 0x324]
mov ecx, edi
push eax
push 0
call fcn.00669d63
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x795483
push str.Cannot_read_typename_from__s_
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x50]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x33c]
push eax
call fcn.0066154b
sub esp, 0xc
mov ecx, edi
push esp
call fcn.004474bf
lea eax, [ebp - 0x33c]
push eax
call fcn.00690d81
add esp, 0x10
lea ecx, [ebp - 0x33c]
call fcn.00661721
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
xor al, al
jmp 0x795498
lea eax, [ebp - 0x318]
push eax
lea ecx, [edi + 0x20]
call fcn.006617cc
mov byte [edi + 0x40], 1
mov al, 1
call fcn.00645f45
ret 4

Function at 0x79559e
Capabilities:
Get disk information
Get file system object information

Disassembly:
push 0x2e0
mov eax, 0x7c5974
call fcn.00645f96
mov ebx, dword [ebp + 8]
xor esi, esi
push ebx
inc esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec eax
je 0x7955e2
dec eax
je 0x7955db
dec eax
je 0x7955d7
dec eax
je 0x7955d0
dec eax
jne 0x7955e4
push 7
pop esi
push 2
jmp 0x7955e6
push 9
pop esi
push 4
jmp 0x7955e6
mov edi, esi
jmp 0x7955e7
push 3
pop esi
xor edi, edi
jmp 0x7955e7
xor esi, esi
push 5
pop edi
push 0x800
push 0x2b4
lea eax, [ebp - 0x2e4]
push eax
push 0
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x795623
test dword [ebp - 0x2dc], 0x40000
je 0x795614
or esi, 4
test dword [ebp - 0x2dc], 0x2000000
je 0x795623
or esi, 2
push ebx
lea ecx, [ebp - 0x30]
call fcn.0042aa63
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2ec]
push edi
push esi
call fcn.006a4f6a
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00795665
mov ecx, eax
call fcn.00794eb1
mov ecx, eax
call fcn.00794e9b
lea ecx, [ebp - 0x30]
call fcn.00408e36
mov eax, esi
call fcn.00645f45
ret
Function at 0x79578e
Capabilities:
Get disk information

Disassembly:
push 0x58
mov eax, 0x7c5a17
call fcn.00645f96
mov esi, dword [ebp + 8]
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x5c], esi
mov ecx, 0x9e8c90
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x58], ebx
xchg dword [ecx], eax
mov edi, 0x9e8c94
mov ecx, edi
call fcn.006b61ae
test al, al
jne 0x7957f2
push str.mpr.dll
lea ecx, [ebp - 0x50]
call fcn.0042aa63
xor eax, eax
mov ecx, edi
inc eax
push 2
mov ebx, eax
mov dword [ebp - 4], eax
pop eax
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x58], ebx
push eax
call fcn.00669467
mov byte [ebp - 0x51], bl
test al, al
jne 0x7957f6
mov byte [ebp - 0x51], 0
and dword [ebp - 4], 0
test bl, 1
je 0x79580d
and ebx, 0xfffffffe
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x58], ebx
call fcn.00408e36
cmp byte [ebp - 0x51], 0
je 0x7958ac
push str.WNetOpenEnumW
lea ecx, [ebp - 0x30]
call fcn.0042aa63
push 2
pop eax
mov dword [ebp - 4], eax
mov ecx, edi
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.006693e9
lea ecx, [ebp - 0x30]
mov dword [0x9e8c98], eax
mov byte [ebp - 4], 0
call fcn.00408e36
push str.WNetEnumResourceW
lea ecx, [ebp - 0x30]
call fcn.0042aa63
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 3
push eax
mov ecx, edi
call fcn.006693e9
lea ecx, [ebp - 0x30]
mov dword [0x9e8c9c], eax
mov byte [ebp - 4], 0
call fcn.00408e36
push str.WNetCloseEnum
lea ecx, [ebp - 0x30]
call fcn.0042aa63
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 4
push eax
mov ecx, edi
call fcn.006693e9
lea ecx, [ebp - 0x30]
mov dword [0x9e8ca0], eax
mov byte [ebp - 4], 0
call fcn.00408e36
mov ecx, esi
call fcn.004a7679
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor eax, eax
push 2
pop ecx
push eax
or ebx, ecx
mov dword [ebp - 4], eax
push eax
mov dword [ebp - 0x58], ebx
call edi
mov esi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00646d1f
pop ecx
mov ebx, eax
push ebx
push esi
mov dword [ebp - 0x60], ebx
call edi
mov edi, dword [ebp - 0x5c]
xor eax, eax
mov esi, ebx
cmp word [ebx], ax
je 0x79591f
xor ebx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push edi
call fcn.00795509
push esi
call fcn.00663c07
add esp, 0x14
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], bx
jne 0x7958fb
mov ebx, dword [ebp - 0x60]
push ebx
call fcn.0067fc0e
test byte [ebp + 0x10], 8
pop ecx
jne 0x795993
test byte [ebp + 0xc], 2
jne 0x795993
lea ecx, [ebp - 0x24]
call fcn.004a7679
push dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 4], 5
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.007950eb
add esp, 0x10
test al, al
je 0x795988
lea ecx, [ebp - 0x24]
mov esi, ebx
call fcn.00673fe2
test eax, eax
je 0x795988
push 1
push esi
lea ecx, [ebp - 0x24]
call fcn.0066978c
push eax
mov ecx, edi
call fcn.0066c4d7
lea ecx, [ebp - 0x24]
inc esi
call fcn.00673fe2
cmp esi, eax
jb 0x795968
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.0066c3d9
mov eax, edi
call fcn.00645f45
ret

Function at 0x7ac058
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.007ac061
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x31a6195
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2e02666d
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219