joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4623e0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push dword [ebp + 8]
lea eax, [ebp - 0x124]
push eax
call fcn.0066c9ec
add esp, 8
push 0x5c
lea edx, [ebp - 0x124]
push edx
call fcn.0066cb29
add esp, 8
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x46241f
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x10]
push ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x124]
push edx
call sub.KERNEL32.DLL_GetDiskFreeSpaceExA
test eax, eax
je 0x462455
push 0
push 0x800
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0067457f
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
jmp 0x462457
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x46245c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcd4
push dword [ebp + 8]
lea eax, [ebp - 0x11c]
push eax
call fcn.0066c9ec
add esp, 8
push 0x5c
lea edx, [ebp - 0x11c]
push edx
call fcn.0066cb29
add esp, 8
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov byte [ecx], 0
mov eax, 0x104
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
lea edx, [ebp - 0x32c]
push edx
lea ecx, [ebp - 0x10]
push ecx
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
lea ecx, [ebp - 0x224]
push ecx
lea eax, [ebp - 0x11c]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x4624f0
push 3
push 0x7582b0
lea edx, [ebp - 0x32c]
push edx
call fcn.0066cc80
add esp, 0xc
test eax, eax
jne 0x4624f0
mov eax, 1
jmp 0x4624f2
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4624f8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push 0x100
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.0066c86c
add esp, 0xc
push dword [ebp + 8]
lea edx, [ebp - 0x124]
push edx
call fcn.0066c9ec
add esp, 8
push 0x1e
push 0
lea ecx, [ebp - 0x24]
push ecx
call fcn.0066c86c
add esp, 0xc
mov eax, dword [0x6e716c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov word [ebp - 0x14], 0x50
lea edx, [ebp - 0x124]
mov dword [ebp - 0x1c], edx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0xe], eax
xor edx, edx
mov dword [ebp - 0xa], edx
lea ecx, [ebp - 0x24]
push ecx
call sub.SHELL32.DLL_SHFileOperationA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x46257d
xor eax, eax
jmp 0x462582
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x462624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x9f2eb0
push 0x104
push 0
push dword [ebp - 8]
call fcn.0066c86c
add esp, 0xc
mov edx, dword [ebp + 8]
test edx, edx
jne 0x462656
xor ecx, ecx
mov dword [ebp + 8], ecx
jmp 0x46266c
mov eax, dword [ebp + 8]
dec eax
jne 0x462665
mov dword [ebp + 8], 5
jmp 0x46266c
mov dword [ebp + 8], 0x26
lea edx, [ebp - 4]
push edx
push dword [ebp + 8]
push dword [ebp + 0xc]
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
test eax, eax
jne 0x46268f
push dword [ebp - 8]
push dword [ebp - 4]
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov eax, dword [ebp - 8]
jmp 0x462691
xor eax, eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x4629c4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 4], eax
push 0
push 0
push 3
push 0
push 1
push 8
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
cmp edx, 0xffffffff
je 0x462a03
push 0
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 4], eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret

Function at 0x462a0c
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff50
xor eax, eax
mov dword [ebp - 4], eax
push 0x94
push 0
lea edx, [ebp - 0xb0]
push edx
call fcn.0066c86c
add esp, 0xc
mov dword [ebp - 0xb0], 0x94
lea ecx, [ebp - 0xb0]
push ecx
call sub.KERNEL32.DLL_GetVersionExA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x462adc
mov edx, dword [ebp - 0xac]
cmp edx, 5
jbe 0x462adc
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 4
lea edx, [ebp - 0xc]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x462adc
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x10]
push ecx
push 0
push str.EnableLUA
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x462ad4
mov edx, dword [ebp - 0x14]
cmp edx, 1
jne 0x462acf
mov ecx, 1
jmp 0x462ad1
xor ecx, ecx
mov dword [ebp - 4], ecx
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x462ae4
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov eax, dword [0x758290]
mov dword [ebp - 0x14], eax
mov ax, word [0x758294]
mov word [ebp - 0x10], ax
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x14]
push ecx
call sub.ADVAPI32.DLL_AllocateAndInitializeSid
test eax, eax
jne 0x462b3d
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
jmp 0x462b57
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push 0
call sub.ADVAPI32.DLL_CheckTokenMembership
test eax, eax
jne 0x462b57
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x462b6b
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_FreeSid
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
test eax, eax
je 0x462b91
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 8]
push edx
push 0x462ba0
call fcn.0067a155
add esp, 0x24
mov ecx, dword [ebp - 4]
test ecx, ecx
setne al
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4640ea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], 0x11021
cmp word [0x9f3ce6], 0
jne 0x464158
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
shl edx, 8
mov dword [ebp - 0x18], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x18]
and eax, 0x8000
mov dword [ebp - 0x1c], eax
shl dword [ebp - 0x18], 1
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x464130
xor dword [ebp - 0x18], 0x11021
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x464114
mov eax, dword [ebp - 0x10]
mov dx, word [ebp - 0x18]
mov word [eax*2 + 0x9f3ce4], dx
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp ecx, 0x100
jb 0x464106
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
cmp ecx, eax
jae 0x4641a4
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [edx + ecx]
mov edx, dword [ebp - 8]
shr edx, 8
xor eax, edx
and eax, 0xff
movzx ecx, word [eax*2 + 0x9f3ce4]
mov eax, dword [ebp - 8]
shl eax, 8
xor ecx, eax
mov dword [ebp - 8], ecx
inc dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
cmp edx, ecx
jb 0x46416c
mov eax, dword [ebp - 8]
and eax, 0xffff
mov esp, ebp
pop ebp
ret
Function at 0x468120
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dl, byte [eax + 1]
test dl, dl
je 0x46819f
mov dword [ebp - 4], 2
mov ecx, dword [ebp + 8]
movsx eax, byte [ecx + 0x9a]
add eax, 0x41
push eax
push 0x7592c7
lea edx, [ebp - 0x120]
push edx
call fcn.00670e94
add esp, 0xc
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x120]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
jne 0x468192
xor edx, edx
mov dword [ebp - 4], edx
push dword [ebp - 0x1c]
call sub.KERNEL32.DLL_SetErrorMode
mov eax, dword [ebp - 4]
jmp 0x468202
mov dl, byte [0x758985]
test dl, dl
jne 0x4681bd
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 0xa]
shl eax, 5
mov byte [0x758980], al
inc byte [0x758985]
push 6
push 0x75897f
push 0
push dword [ebp + 8]
call fcn.00467c10
add esp, 0x10
cmp al, 1
jne 0x4681ff
mov dl, byte [0x9f46f0]
sub dl, 1
jb 0x4681e6
dec dl
je 0x4681ef
jmp 0x4681ff
mov dword [ebp - 4], 2
jmp 0x4681ff
mov cl, byte [0x9f46f1]
cmp cl, 0x3a
jne 0x4681ff
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x468cd8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov eax, dword [ebp + 8]
mov dl, byte [eax + 1]
test dl, dl
je 0x468d7b
mov eax, dword [ebp + 0x14]
cdq
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0
push 0x800
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.006744e4
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 8]
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
cmp edx, 0xffffffff
jne 0x468d40
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x468d40
mov eax, 2
jmp 0x468e57
mov edx, dword [ebp + 0x18]
shl edx, 0xb
mov dword [ebp - 0x10], edx
push 0
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x10]
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.KERNEL32.DLL_ReadFile
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
je 0x468d74
mov eax, 2
jmp 0x468e57
xor eax, eax
jmp 0x468e57
mov dword [ebp - 0x1c], 0xa
mov edx, dword [0x7589d8]
mov dword [ebp - 0x2c], edx
mov edx, dword [0x7589dc]
mov dword [ebp - 0x28], edx
mov edx, dword [0x7589e0]
mov dword [ebp - 0x24], edx
mov byte [ebp - 0x2c], 0x28
mov dword [ebp - 0x1c], 0xa
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 0xa]
shl eax, 5
mov byte [ebp - 0x2b], al
mov edx, dword [ebp + 0x14]
sar edx, 0x18
mov byte [ebp - 0x2a], dl
mov ecx, dword [ebp + 0x14]
sar ecx, 0x10
and cl, 0xff
mov byte [ebp - 0x29], cl
mov eax, dword [ebp + 0x14]
sar eax, 8
and al, 0xff
mov byte [ebp - 0x28], al
mov dl, byte [ebp + 0x14]
and dl, 0xff
mov byte [ebp - 0x27], dl
mov ecx, dword [ebp + 0x18]
shr ecx, 8
and cl, 0xff
mov byte [ebp - 0x25], cl
mov al, byte [ebp + 0x18]
and al, 0xff
mov byte [ebp - 0x24], al
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call fcn.0066c86c
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x20], edx
jmp 0x468e40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
push ecx
push 8
push dword [ebp + 8]
call fcn.00467c44
add esp, 0x18
cmp al, 1
jne 0x468e3d
push dword [ebp + 8]
call fcn.00468c38
pop ecx
dec eax
jg 0x468e36
xor eax, eax
jmp 0x468e57
mov eax, 1
jmp 0x468e57
inc dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
cmp edx, 3
jge 0x468e52
mov ecx, dword [0x6f6920]
test ecx, ecx
je 0x468e08
mov eax, 2
mov esp, ebp
pop ebp
ret
Function at 0x468e5c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 4], 0xa
mov eax, dword [0x7589e4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x7589e8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x7589ec]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 8]
mov cl, byte [edx + 1]
test cl, cl
je 0x468f64
mov eax, dword [ebp + 0x14]
cdq
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
push 0
push 0x800
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.006744e4
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0xc]
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
cmp edx, 0xffffffff
jne 0x468ee6
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x468ee6
mov eax, 2
jmp 0x469023
mov edx, dword [ebp + 0x18]
shl edx, 0xb
mov dword [ebp - 0x14], edx
push dword [ebp - 0x14]
call fcn.0066c210
pop ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x468f0c
mov eax, 2
jmp 0x469023
push 0
lea edx, [ebp - 0x18]
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
call sub.KERNEL32.DLL_ReadFile
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp eax, edx
je 0x468f40
push dword [ebp - 0x1c]
call fcn.0066c220
pop ecx
mov eax, 2
jmp 0x469023
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
call fcn.00439448
add esp, 0x10
push dword [ebp - 0x1c]
call fcn.0066c220
pop ecx
xor eax, eax
jmp 0x469023
mov byte [ebp - 0x2c], 0xbe
mov dword [ebp - 4], 0xc
mov edx, dword [ebp + 8]
mov cl, byte [edx + 0xa]
shl ecx, 5
mov byte [ebp - 0x2b], cl
mov eax, dword [ebp + 0x14]
sar eax, 0x18
mov byte [ebp - 0x2a], al
mov edx, dword [ebp + 0x14]
sar edx, 0x10
and dl, 0xff
mov byte [ebp - 0x29], dl
mov ecx, dword [ebp + 0x14]
sar ecx, 8
and cl, 0xff
mov byte [ebp - 0x28], cl
mov al, byte [ebp + 0x14]
and al, 0xff
mov byte [ebp - 0x27], al
mov edx, dword [ebp + 0x18]
shr edx, 8
and dl, 0xff
mov byte [ebp - 0x25], dl
mov cl, byte [ebp + 0x18]
and cl, 0xff
mov byte [ebp - 0x24], cl
mov byte [ebp - 0x23], 0xf8
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call fcn.0066c86c
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x46900c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
lea edx, [ebp - 0x2c]
push edx
push 8
push dword [ebp + 8]
call fcn.00467c44
add esp, 0x18
cmp al, 1
jne 0x469009
push dword [ebp + 8]
call fcn.00468c38
pop ecx
dec eax
jg 0x469002
xor eax, eax
jmp 0x469023
mov eax, 1
jmp 0x469023
inc dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
cmp edx, 3
jge 0x46901e
mov ecx, dword [0x6f6920]
test ecx, ecx
je 0x468fd4
mov eax, 2
mov esp, ebp
pop ebp
ret
Function at 0x46d73b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
mov eax, dword [ebp + 0xc]
imul dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov edx, dword [0x75aec8]
test edx, edx
je 0x46d8a1
mov eax, dword [ebp - 4]
xor edx, edx
add eax, dword [0x75aecc]
adc edx, dword [0x75aed0]
cmp edx, dword [0x75aed8]
jne 0x46d77e
cmp eax, dword [0x75aed4]
ja 0x46d7ad
jmp 0x46d780
jg 0x46d7ad
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 4]
push dword [ebp + 8]
push dword [0xa04000]
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 4]
xor edx, edx
add dword [0x75aecc], eax
adc dword [0x75aed0], edx
jmp 0x46d8b8
mov eax, dword [0x75aed4]
mov ecx, eax
mov eax, dword [0x75aecc]
sub ecx, eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
test edx, edx
jbe 0x46d7f2
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0x18]
push dword [ebp + 8]
push dword [0xa04000]
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x46d8c2
mov ecx, dword [ebp - 0x18]
sub dword [ebp - 4], ecx
mov eax, dword [0xa04000]
mov dword [ebp - 0x1c], eax
inc dword [0x75aedc]
push dword [0x75aedc]
push dword [0x8f2834]
push 0x75b08b
lea edx, [ebp - 0x124]
push edx
call fcn.00670e94
add esp, 0x10
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x124]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov dword [0xa04000], eax
mov eax, dword [0xa04000]
cmp eax, 0xffffffff
jne 0x46d855
mov edx, dword [ebp - 0x1c]
mov dword [0xa04000], edx
jmp 0x46d8c2
push dword [ebp - 0x1c]
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 4]
test ecx, ecx
jbe 0x46d889
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
add ecx, eax
push ecx
push dword [0xa04000]
call sub.KERNEL32.DLL_WriteFile
jmp 0x46d88e
xor edx, edx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [0x75aecc], eax
mov dword [0x75aed0], edx
jmp 0x46d8b8
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 4]
push dword [ebp + 8]
push dword [0xa04000]
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp eax, edx
je 0x46d8df
mov ecx, dword [0x6f6920]
test ecx, ecx
jne 0x46d8db
call fcn.00462858
mov dword [0x6f6920], 1
xor eax, eax
jmp 0x46d8e2
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x46e9c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
mov eax, 0x75b4fc
call fcn.0066ce04
mov dl, 1
mov eax, dword [0x5cffd4]
call fcn.0046eb28
mov dword [0x75aeb4], eax
push 0x104
push 0
lea edx, [ebp - 0x140]
push edx
call fcn.0066c86c
add esp, 0xc
lea ecx, [ebp - 0x140]
push ecx
push 0x104
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
cmp edx, ecx
jge 0x46eb11
lea eax, [ebp - 0x140]
mov edx, dword [ebp - 0x2c]
add eax, edx
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
cmp ecx, 5
jne 0x46eaf2
mov eax, dword [ebp - 0x2c]
movsx edx, byte [ebp + eax - 0x140]
push edx
push 0x75aee4
lea ecx, [ebp - 0x244]
push ecx
call fcn.00670e94
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
lea eax, [ebp - 0x244]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
cmp edx, 0xffffffff
je 0x46eaf2
push 0x240
call fcn.0066ba2c
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x46eabb
mov word [ebp - 0x18], 0x14
push 0x10
push 0x20
push 0x40
push dword [ebp - 4]
call fcn.00467a38
add esp, 0x10
mov word [ebp - 0x18], 8
mov edx, dword [ebp - 4]
jmp 0x46eabe
mov edx, dword [ebp - 4]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x2c]
mov dl, byte [ebp + eax - 0x140]
add dl, 0xbf
mov ecx, dword [ebp - 0x3c]
mov byte [ecx + 0x9a], dl
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x75aeb4]
call fcn.005d27f8
jmp 0x46eaf2
inc dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov al, byte [ebp + ecx - 0x140]
test al, al
jne 0x46eaef
inc dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
cmp edx, ecx
jl 0x46ea21
mov eax, dword [0x75aeb4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x48f444
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
call fcn.00407784
test eax, eax
je 0x48f4e3
movzx eax, word [0xa08b58]
movzx edx, word [0xa08b5a]
imul edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
add edx, ecx
imul edx
mov edx, dword [ebp + 0x14]
add eax, edx
dec eax
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.005764d4
add esp, 8
xor eax, eax
mov dword [ebp - 0x10], eax
cmp word [0xa08b4b], 0
jne 0x48f4b1
push 0
lea ecx, [ebp - 0x10]
push ecx
push pe_nt_image_headers32
push dword [ebp + 0x18]
push dword [ebp + 8]
call sub.KERNEL32.DLL_ReadFile
mov dword [ebp - 4], eax
jmp 0x48f4d1
push 0
lea eax, [ebp - 0x10]
push eax
movzx edx, word [0xa08b4b]
imul edx, dword [ebp + 0x1c]
push edx
push dword [ebp + 0x18]
push dword [ebp + 8]
call sub.KERNEL32.DLL_ReadFile
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x48f4df
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x48f555
xor eax, eax
jmp 0x48f55a
mov edx, dword [ebp + 0x1c]
or edx, 0x200
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp + 0xc]
shl ecx, 8
mov eax, dword [ebp + 0x14]
or ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp + 0x10]
shl edx, 8
mov ecx, dword [0x75e894]
or edx, ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 1
push 0
lea eax, [ebp - 8]
push eax
push 0x1c
lea edx, [ebp - 0x2c]
push edx
push 0x1c
lea ecx, [ebp - 0x2c]
push ecx
push 4
push dword [ebp + 8]
call sub.KERNEL32.DLL_DeviceIoControl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x48f551
test byte [ebp - 0x14], 1
je 0x48f555
xor eax, eax
jmp 0x48f55a
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x48f560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
call fcn.00407784
test eax, eax
je 0x48f5ff
movzx eax, word [0xa08b58]
movzx edx, word [0xa08b5a]
imul edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
add edx, ecx
imul edx
mov edx, dword [ebp + 0x14]
add eax, edx
dec eax
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.005764d4
add esp, 8
xor eax, eax
mov dword [ebp - 0x10], eax
cmp word [0xa08b4b], 0
jne 0x48f5cd
push 0
lea ecx, [ebp - 0x10]
push ecx
push pe_nt_image_headers32
push dword [ebp + 0x18]
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
mov dword [ebp - 4], eax
jmp 0x48f5ed
push 0
lea eax, [ebp - 0x10]
push eax
movzx edx, word [0xa08b4b]
imul edx, dword [ebp + 0x1c]
push edx
push dword [ebp + 0x18]
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x48f5fb
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x48f671
xor eax, eax
jmp 0x48f676
mov edx, dword [ebp + 0x1c]
or edx, 0x300
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp + 0xc]
shl ecx, 8
mov eax, dword [ebp + 0x14]
or ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp + 0x10]
shl edx, 8
mov ecx, dword [0x75e894]
or edx, ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 1
push 0
lea eax, [ebp - 8]
push eax
push 0x1c
lea edx, [ebp - 0x2c]
push edx
push 0x1c
lea ecx, [ebp - 0x2c]
push ecx
push 4
push dword [ebp + 8]
call sub.KERNEL32.DLL_DeviceIoControl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x48f66d
test byte [ebp - 0x14], 1
je 0x48f671
xor eax, eax
jmp 0x48f676
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x497790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov word [0xa08f90], 1
mov word [0xa08f92], 2
mov dword [0xa08f94], 0xac44
mov word [0xa08f9e], 0x10
movzx eax, word [0xa08f9e]
test eax, eax
jns 0x4977c9
add eax, 7
sar eax, 3
imul dword [0xa08f94]
movzx edx, word [0xa08f92]
imul edx
mov dword [0xa08f98], eax
movzx ecx, word [0xa08f9e]
test ecx, ecx
jns 0x4977ee
add ecx, 7
sar ecx, 3
movzx eax, word [0xa08f92]
imul ecx, eax
mov word [0xa08f9c], cx
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
cmp ecx, 4
jne 0x49782c
push 0
push 0x930
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x234]
mov eax, dword [eax + 0x230]
call fcn.006744e4
mov dword [ebp - 8], eax
jmp 0x497838
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x230]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
add edx, 0x24
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], 0x46464952
push dword [ebp + 8]
push 1
push 4
lea ecx, [ebp - 4]
push ecx
call fcn.0045da3c
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
push dword [ebp + 8]
push 1
push 4
lea edx, [ebp - 4]
push edx
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x45564157
push dword [ebp + 8]
push 1
push 4
lea ecx, [ebp - 4]
push ecx
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x20746d66
push dword [ebp + 8]
push 1
push 4
lea eax, [ebp - 4]
push eax
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x10
push dword [ebp + 8]
push 1
push 4
lea edx, [ebp - 4]
push edx
call fcn.0045da3c
add esp, 0x10
push dword [ebp + 8]
push 1
push dword [ebp - 4]
push 0xa08f90
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x61746164
push dword [ebp + 8]
push 1
push 4
lea ecx, [ebp - 4]
push ecx
call fcn.0045da3c
add esp, 0x10
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
push 1
push 4
lea edx, [ebp - 4]
push edx
call fcn.0045da3c
add esp, 0x10
mov esp, ebp
pop ebp
ret