joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40695e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4387a0]
jne 0x406968
repz ret
jmp fcn.0040b97e

Function at 0x40b212
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406a5c
and dword [ebp - 4], 0
cmp dword [0x442698], 0
mov ebx, eax
jne 0x40b2c3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b374
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b374
push eax
call fcn.004069ea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x442698], eax
call esi
push eax
call fcn.004069ea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44269c], eax
call esi
push eax
call fcn.004069ea
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4426a0], eax
call esi
push eax
call fcn.004069ea
pop ecx
mov dword [0x4426a8], eax
test eax, eax
je 0x40b2c3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004069ea
pop ecx
mov dword [0x4426a4], eax
mov eax, dword [0x4426a4]
cmp eax, ebx
je 0x40b31b
cmp dword [0x4426a8], ebx
je 0x40b31b
push eax
call fcn.00406a65
push dword [0x4426a8]
mov esi, eax
call fcn.00406a65
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b31b
test edi, edi
je 0x40b31b
call esi
test eax, eax
je 0x40b312
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b312
test byte [ebp - 0xc], 1
jne 0x40b31b
or dword [ebp + 0x10], 0x200000
jmp 0x40b354
mov eax, dword [0x44269c]
cmp eax, ebx
je 0x40b354
push eax
call fcn.00406a65
pop ecx
test eax, eax
je 0x40b354
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b354
mov eax, dword [0x4426a0]
cmp eax, ebx
je 0x40b354
push eax
call fcn.00406a65
pop ecx
test eax, eax
je 0x40b354
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x442698]
call fcn.00406a65
pop ecx
test eax, eax
je 0x40b374
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b376
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x100121f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10012208
pop dword [ebp - 0x1c]
mov eax, 0xad260b93
sub eax, 0x9d24e98b
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x1b009106
add dword [ebp - 0x2c], 0x3351b445
mov dword [ebp - 0x28], 0x72acb35a
sub dword [ebp - 0x28], 0x40796715
mov dword [ebp - 0x24], 0xc2fe508
sub dword [ebp - 0x24], 0xbfe3a0da
mov dword [ebp - 0x20], 0xb394c687
sub dword [ebp - 0x20], 0xb394c687
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xdf347bc8
sub eax, 0xcf2d7abc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x20cdb9e1
sub dword [ebp - 0x2c], 0xac5b508b
mov dword [ebp - 0x28], 0xc95871a0
add dword [ebp - 0x28], 0x7813efd5
mov dword [ebp - 0x24], 0xd7ca46c1
add dword [ebp - 0x24], 0x8ba525ab
mov dword [ebp - 0x20], 0xdc3f8756
add dword [ebp - 0x20], 0x23c078aa
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xc739787a
sub eax, 0xb732783a
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x657fd
push 0
call eax
mov ecx, 0x32bfc37a
sub ecx, 0x32bf8258
mov edx, eax
mov esi, 0x601f6439
add esi, 0xafe8e7c7
add esi, dword [ebp - 0x1c]
mov ebx, 0x5e005c18
add dword [ebp - 4], 0xd6c03c2f
mov edi, dword [esi]
add edi, ebx
xor dword [ebp - 8], 0x1ba80c7
mov dword [edx], edi
add dword [ebp - 4], 0xa1ad3860
add edx, 0x1001a6ff
add edx, 0xeffe5905
add esi, 0x36e42dd7
sub esi, 0x36e42dd3
loop 0x10012324
add eax, 0xc28b707c
add eax, 0x3d7586df
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x409420
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004098e0
mov byte [esp], al
cmp byte [esp], 0
jne 0x4095a9
test edi, edi
je 0x4095a9
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4094e9
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4094c4
cmp edi, 0xffffffff
je 0x409485
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409485
mov byte [esp], 0
jmp 0x4095a9
cmp dword [esi], 1
jg 0x4094c4
cmp dword [esi], 0
jne 0x4094b6
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4094b6
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4095a9
lea eax, [esp + 0xc]
call fcn.004090dc
dec ebp
test ebp, ebp
jg 0x40946a
cmp edi, 0xffffffff
je 0x4094e9
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4094e7
mov byte [esp], 0
jmp 0x4095a9
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40942e
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4094e9
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00409624
mov edx, eax
mov ebx, dword [0x6cb8fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x40954d
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40954b
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x40954d
xor edi, edi
cmp byte [esp], 0
je 0x409573
mov ebx, dword [esi]
test bl, 1
jne 0x409589
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409553
mov byte [esp + 1], 1
jmp 0x409589
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409573
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x409500
cmp byte [esp], 0
je 0x4095a9
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40a468
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x6cb05c], 0
je 0x40a4cf
cmp word [0x6cb348], 0xd7b2
jne 0x40a491
cmp dword [0x6cb350], 0
jbe 0x40a491
mov eax, 0x6cb344
call dword [0x6cb360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40a4fc
call fcn.0040aff0
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x6b7032], 0
jne 0x40a4eb
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40a690
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x6b7034], 0
je 0x40a6bb
mov edx, edi
mov eax, esi
call dword [0x6b7034]
mov ebx, eax
jmp 0x40a6cc
mov eax, 8
call fcn.00406ef0
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x6cb05d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40a658
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
test esi, esi
jne 0x40a6fc
mov eax, ebx
call fcn.00406f0c
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40d850
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40d9b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a7d0
cmp si, word [0x6b7a10]
jb 0x40d8e8
cmp si, word [0x6b7c10]
ja 0x40d8e8
mov edi, pe_nt_image_headers32
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40d8e8
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x6b7a10]
jae 0x40d8c2
mov edi, ebx
dec edi
jmp 0x40d8e3
cmp si, word [ebx*8 + 0x6b7a10]
jbe 0x40d8d2
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40d8e3
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x6b7a14]
call fcn.0040d770
jmp 0x40d8e8
cmp edi, dword [ebp - 8]
jae 0x40d8ac
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40d997
push 2
movzx eax, si
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x40d997
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040b3a8
push dword [ebp - 0x160]
push 0x40d9d0
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040b3a8
push dword [ebp - 0x164]
push 0x40d9e0
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040b3a8
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040b5e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d9bc
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.0040a830
ret
Function at 0x40db68
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40dc6c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x6cdc14
call sub.KERNEL32.DLL_EnterCriticalSection
cmp bx, word [0x6cdc2c]
jne 0x40dbb4
mov eax, esi
mov edx, 0x6cdc2e
mov ecx, 0x55
call fcn.0040b3a8
push 0x6cdc14
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x40dc56
push 0x6cdc14
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, esi
call fcn.0040a7d0
push 2
movzx eax, bx
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x40dc23
cmp byte [0x6cdc10], 0
je 0x40dbe8
mov edx, esi
mov eax, ebx
call fcn.0040da4c
jmp 0x40dc23
mov edx, esi
mov eax, ebx
call fcn.0040d850
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40dc23
cmp dword [esi], 0
je 0x40dc0c
mov eax, esi
mov edx, 0x40dc84
call fcn.0040b500
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040d850
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040b500
push 0x6cdc14
call sub.KERNEL32.DLL_EnterCriticalSection
mov word [0x6cdc2c], bx
mov eax, dword [esi]
call fcn.0040b2ec
mov ecx, eax
mov eax, 0x6cdc2e
mov edx, 0xaa
call fcn.0040d6d0
push 0x6cdc14
call sub.KERNEL32.DLL_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dc73
lea eax, [ebp - 4]
call fcn.0040a7d0
ret
Function at 0x4250f8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x425226
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x218]
push eax
push 0x104
call sub.KERNEL32.DLL_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jle 0x425200
lea ebx, [ebp - 0x218]
lea eax, [ebx + 4]
mov word [eax], 0
push 0x104
lea eax, [ebp - 0x424]
push eax
push ebx
call sub.KERNEL32.DLL_QueryDosDeviceW
mov esi, eax
test esi, esi
jle 0x4251e9
lea eax, [ebp - 4]
lea edx, [ebp - 0x424]
mov ecx, 0x106
call fcn.0040b3a8
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b8d8
test eax, eax
jle 0x4251e9
mov eax, dword [ebp - 4]
test eax, eax
je 0x42519d
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov edi, dword [ebp - 8]
test edi, edi
je 0x4251ab
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.0040b6c8
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
mov edx, ebx
call fcn.0040b354
mov edx, dword [ebp - 0x42c]
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.0040b558
jmp 0x425200
add ebx, 2
cmp word [ebx], 0
jne 0x4251e6
add ebx, 4
test ebx, ebx
je 0x4251fa
cmp word [ebx], 0
jne 0x42514a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42522d
lea eax, [ebp - 0x42c]
mov edx, 2
call fcn.0040a830
lea eax, [ebp - 4]
call fcn.0040a7d0
ret
Function at 0x425320
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42555d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.0040a7d0
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
test ebx, ebx
jne 0x4253f7
cmp dword [ebp - 0x14], 0
jne 0x4253f7
xor edx, edx
mov eax, 6
call fcn.0042e3bc
test al, al
je 0x4253f7
push 2
push 0x104
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFinalPathNameByHandleW
test eax, eax
jbe 0x4253f7
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x224]
mov ecx, 0x106
call fcn.0040b3a8
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.004250f8
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 8]
call fcn.0040abb0
mov byte [ebp - 9], 1
jmp 0x42553f
test ebx, ebx
jne 0x425405
cmp dword [ebp - 0x14], 0
je 0x4254f3
push 0
push 1
push 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateFileMappingW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3ee
je 0x4254f3
xor eax, eax
push ebp
push 0x4254ec
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4254d5
xor eax, eax
push ebp
push 0x4254ce
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
call sub.KERNEL32.DLL_GetCurrentProcess
lea ecx, [ebp - 0x224]
mov edx, dword [ebp - 0x18]
call fcn.004179a0
test eax, eax
jbe 0x4254b7
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x224]
mov ecx, 0x106
call fcn.0040b3a8
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x230]
call fcn.004250f8
mov edx, dword [ebp - 0x230]
mov eax, dword [ebp - 8]
call fcn.0040abb0
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4254d5
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4254f3
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
cmp byte [ebp - 9], 0
jne 0x42553f
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 4]
call fcn.00425234
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 8]
call fcn.0040abb0
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x42553f
lea edx, [ebp - 0x23c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004250f8
mov edx, dword [ebp - 0x23c]
mov eax, dword [ebp - 8]
call fcn.0040abb0
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425564
lea eax, [ebp - 0x23c]
mov edx, 6
call fcn.0040a830
ret
Function at 0x425570
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 0
xor edx, edx
mov eax, 6
call fcn.0042e3bc
test al, al
je 0x425638
xor edx, edx
mov eax, ebx
call fcn.00427274
test al, al
je 0x425638
mov eax, ebx
call fcn.00426fa4
test al, 0x20
je 0x425638
mov eax, ebx
call fcn.0040b2ec
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x425638
test ah, 4
je 0x425638
test al, 0x10
je 0x4255d7
mov edi, 0x2000000
jmp 0x4255d9
xor edi, edi
push 0
push edi
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.0040b2ec
push eax
call sub.KERNEL32.DLL_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x425638
xor eax, eax
push ebp
push 0x425631
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov ecx, edi
mov eax, dword [ebp - 8]
call fcn.00425320
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425638
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x425ac8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x425b21
test eax, edx
je 0x425b24
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x425adf
movzx eax, word [eax]
sub eax, ecx
jmp 0x425b06
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x425b07
add ecx, 4
js 0x425af7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x425b04
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x425b06
xor eax, eax
ret
test eax, eax
je 0x425b30
test edx, edx
jne 0x425ad0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x426fa4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x427108
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x426f44]
call fcn.0040cf54
add esp, 4
push 0x104
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x426f74]
call fcn.0040cf54
add esp, 4
movzx ebx, byte [0x427118]
mov dl, 1
mov eax, esi
call fcn.0042730c
test al, al
jne 0x42701e
mov dl, 1
mov eax, esi
call fcn.00427274
test al, al
je 0x4270a8
lea edx, [ebp - 0x1c]
mov eax, esi
call fcn.00427b38
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.0042ea00
push 0x104
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x104
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b2ec
mov esi, eax
push esi
call sub.KERNEL32.DLL_GetVolumeInformationW
test eax, eax
je 0x4270a3
test byte [ebp - 0x14], 1
je 0x42706e
or bl, 1
test byte [ebp - 0x14], 2
je 0x427077
or bl, 2
test byte [ebp - 0x14], 0x80
je 0x427080
or bl, 0x20
push esi
call sub.KERNEL32.DLL_GetDriveTypeW
sub eax, 2
je 0x427094
dec eax
je 0x427099
dec eax
je 0x42709e
dec eax
jne 0x4270c9
or bl, 0x10
jmp 0x4270c9
or bl, 4
jmp 0x4270c9
or bl, 8
jmp 0x4270c9
call fcn.0042f98c
lea edx, [ebp - 0x20]
mov eax, dword [0x6caa84]
call fcn.004100a8
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x41efd8]
call fcn.0042d294
call fcn.00409ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42710f
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0040a830
lea eax, [ebp - 0xc]
mov edx, dword [0x426f74]
call fcn.0040d078
lea eax, [ebp - 8]
mov edx, dword [0x426f44]
call fcn.0040d078
lea eax, [ebp - 4]
call fcn.0040a7d0
ret

Function at 0x427174
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4271a1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x427274
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0040b2ec
mov edi, eax
push edi
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4272de
test ah, 4
je 0x4272d7
test bl, bl
jne 0x42729c
mov al, 1
jmp 0x427305
test al, 0x10
je 0x4272a4
xor eax, eax
jmp 0x427305
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x4272c8
push eax
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x427305
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x427305
test al, 0x10
sete al
jmp 0x427305
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x4272ff
cmp ebx, 3
je 0x4272ff
cmp ebx, 0x7b
je 0x4272ff
mov eax, esi
call fcn.00427234
test al, al
jne 0x427303
xor eax, eax
jmp 0x427305
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x42730c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.0040b2ec
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x4273b3
test esi, 0x400
jne 0x427348
test esi, 0x10
setne bl
jmp 0x4273e3
cmp byte [esp], 0
je 0x42737c
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x4273e3
push eax
call sub.KERNEL32.DLL_CloseHandle
test esi, 0x10
setne bl
jmp 0x4273e3
test esi, 0x10
je 0x427388
mov bl, 1
jmp 0x4273e3
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x4273af
push eax
call sub.KERNEL32.DLL_CloseHandle
xor ebx, ebx
jmp 0x4273e3
mov bl, 1
jmp 0x4273e3
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x4273dd
cmp eax, 3
je 0x4273dd
cmp eax, 0xa1
je 0x4273dd
cmp eax, 0x7b
je 0x4273dd
cmp eax, 0x35
je 0x4273dd
cmp eax, 0x15
je 0x4273dd
cmp eax, 0x43
jne 0x4273e1
xor ebx, ebx
jmp 0x4273e3
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42759c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x427641
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040b2ec
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov edi, eax
test edi, 0x400
setne al
test al, bl
je 0x427626
or edi, 0xffffffff
lea edx, [ebp - 4]
mov eax, esi
call fcn.00425570
test al, al
je 0x427626
mov eax, dword [ebp - 4]
call fcn.00427e5c
test al, al
je 0x427616
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004279a4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042ea00
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.0040b558
mov eax, dword [ebp - 4]
call fcn.0040b2ec
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov edi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427648
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a830
ret