joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b4b0
Capabilities:
Query service status
Start service
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push 0x20000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x41b4d4
pop ebp
pop ebx
add esp, 0x1c
ret
push esi
push 0x34
push 0x480ad4
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x41b4f9
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x10]
push eax
push esi
call edi
test eax, eax
je 0x41b55d
mov eax, dword [esp + 0x14]
cmp eax, 4
jne 0x41b589
test ebp, ebp
jne 0x41b55d
lea ecx, [esp + 0x10]
push ecx
mov ebp, 1
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x41b55d
lea edx, [esp + 0x10]
push edx
push esi
call edi
cmp eax, ebp
jne 0x41b55d
jmp 0x41b540
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x14], ebp
je 0x41b573
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
cmp eax, ebp
je 0x41b540
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret
cmp eax, 1
jne 0x41b55d
test ebp, ebp
je 0x41b55d
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x41b55d
lea edx, [esp + 0x10]
push edx
push esi
call edi
cmp eax, 1
jne 0x41b55d
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x28]
push eax
call ebp
cmp dword [esp + 0x14], 4
je 0x41b5d1
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
cmp eax, 1
je 0x41b5b4
jmp 0x41b55d
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x41db30
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
call fcn.004197c0
mov ecx, dword [0x47d684]
and ebx, eax
mov eax, dword [0x47d680]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
xor edi, edi
jmp 0x41db70
mov esi, 1
mov ecx, edi
shl esi, cl
test ebx, esi
je 0x41db9e
lea eax, [esp + 0xc]
lea edx, [edi + 0x41]
push eax
mov word [esp + 0x10], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x41db9e
cmp eax, 2
je 0x41db9e
not esi
and ebx, esi
inc edi
cmp edi, 0x20
jl 0x41db70
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004734e6
mov esp, ebp
pop ebp
ret
Function at 0x427220
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47a9cb
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 0x18]
push eax
mov dword [esp + 0x28], eax
call fcn.00426dc0
push edi
call fcn.00427400
call fcn.004197c0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, dword [0x47d684]
and esi, eax
mov eax, dword [0x47d680]
mov dword [esp + 0x30], eax
xor eax, eax
xor edx, edx
xor ebx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], ecx
mov word [esp + 0x18], dx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x28]
mov esi, 1
mov ecx, ebx
shl esi, cl
mov dword [esp + 0x14], esi
test eax, esi
je 0x4273ae
lea edx, [esp + 0x30]
lea ecx, [ebx + 0x41]
push edx
mov word [esp + 0x34], cx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x4272eb
cmp eax, 2
jne 0x4273ae
or dword [edi + 0x90], esi
push 0x3c0
call fcn.0047286a
add esp, 4
mov dword [esp + 0x2c], eax
xor esi, esi
mov dword [esp + 0x48], esi
cmp eax, esi
je 0x427319
lea ecx, [esp + 0x30]
push ecx
push eax
call fcn.004552d0
mov esi, eax
push esi
mov dword [esp + 0x4c], 0xffffffff
call fcn.00426dc0
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
mov dword [esi + 0x2c], 0x428f90
mov dword [esi + 0x30], edi
call eax
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xe4]
mov dword [esi + 0xf0], ecx
mov dword [esi + 0xf4], eax
mov ecx, dword [esp + 0x30]
call int.0043adc0
neg eax
sbb eax, eax
add eax, 1
mov ebx, eax
mov dword [esp + 0x20], ebx
je 0x427384
mov eax, dword [esp + 0x14]
mov edx, dword [ebp + 0xc]
test edx, eax
je 0x427384
mov ebx, eax
and ebx, dword [ebp + 8]
neg ebx
sbb ebx, ebx
neg ebx
mov dword [esp + 0x20], ebx
mov ax, word [esp + 0x30]
lea ecx, [esp + 0x18]
push ecx
mov word [esp + 0x1c], ax
mov dword [esp + 0x20], esi
call fcn.0042b3a0
test ebx, ebx
mov ebx, dword [esp + 0x10]
je 0x4273ae
mov edx, dword [esp + 0x14]
or dword [edi + 0x8c], edx
inc ebx
cmp ebx, 0x20
mov dword [esp + 0x10], ebx
jl 0x4272b1
mov ecx, dword [edi + 0x10]
sub ecx, dword [edi + 0xc]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx]
sar edx, 1
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [eax + 0x1c]
call edx
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004734e6
mov esp, ebp
pop ebp
ret 8
Function at 0x42a850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x477969
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0
call dword [0x47c860]
mov edi, dword [esp + 0x38]
mov eax, dword [edi + 0xd4]
add edi, 0xc4
mov dword [esp + 0x38], eax
cmp dword [edi + 0xc], eax
jbe 0x42a8a8
call dword [0x47c2fc]
mov ebx, dword [edi + 0x10]
mov eax, dword [edi]
mov dword [esp + 0x18], eax
cmp dword [edi + 0xc], ebx
jbe 0x42a8bc
call dword [0x47c2fc]
mov esi, dword [edi + 0xc]
mov ebp, dword [edi]
cmp esi, dword [edi + 0x10]
jbe 0x42a8cc
call dword [0x47c2fc]
mov eax, dword [edi]
push ebx
push ebp
push esi
push eax
lea ecx, [esp + 0x30]
push ecx
lea ebx, [esp + 0x50]
call fcn.0042c280
mov esi, eax
mov eax, dword [esi]
add esp, 0x14
test eax, eax
je 0x42a8f1
cmp eax, dword [esp + 0x18]
je 0x42a8f7
call dword [0x47c2fc]
mov edx, dword [esp + 0x38]
cmp dword [esi + 4], edx
je 0x42a90e
lea ecx, [esp + 0x3c]
call dword [0x47ce24]
xor eax, eax
jmp 0x42a924
lea ebx, [esp + 0x3c]
call fcn.004116e0
mov ecx, ebx
call dword [0x47ce24]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8

Function at 0x42a940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x477969
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0
call dword [0x47c860]
mov edi, dword [esp + 0x38]
mov eax, dword [edi + 0xbc]
add edi, 0xac
mov dword [esp + 0x38], eax
cmp dword [edi + 0xc], eax
jbe 0x42a998
call dword [0x47c2fc]
mov ebx, dword [edi + 0x10]
mov eax, dword [edi]
mov dword [esp + 0x18], eax
cmp dword [edi + 0xc], ebx
jbe 0x42a9ac
call dword [0x47c2fc]
mov esi, dword [edi + 0xc]
mov ebp, dword [edi]
cmp esi, dword [edi + 0x10]
jbe 0x42a9bc
call dword [0x47c2fc]
mov eax, dword [edi]
push ebx
push ebp
push esi
push eax
lea ecx, [esp + 0x30]
push ecx
lea ebx, [esp + 0x50]
call fcn.0042c280
mov esi, eax
mov eax, dword [esi]
add esp, 0x14
test eax, eax
je 0x42a9e1
cmp eax, dword [esp + 0x18]
je 0x42a9e7
call dword [0x47c2fc]
mov edx, dword [esp + 0x38]
cmp dword [esi + 4], edx
je 0x42a9fe
lea ecx, [esp + 0x3c]
call dword [0x47ce24]
xor eax, eax
jmp 0x42aa14
lea ebx, [esp + 0x3c]
call fcn.004116e0
mov ecx, ebx
call dword [0x47ce24]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x439686
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
add edi, 0x17091
jmp 0x439678
pop edi
push esi
call 0x439686
add byte [eax + ecx*2 + 0x47], cl
cmp dword [edi + 0x42], eax
add esp, 4
add esi, 0x13028
and esi, 0x1795
xor esi, 0x28c6
pop esi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
call 0x43985d
add byte [esi + 0x46], cl
dec ebp
inc ebp
inc esp
dec edx
dec edx
add esp, 4
xor edi, 0xebb3
and edi, 0x16f45
xor edi, 0x48d8
pop edi
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x43989f
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x43966a
mov dword [ebp - 0x2a8], 0
Function at 0x439850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
add edi, 0x17091
jmp 0x439678
pop edi
push esi
call 0x439686
add byte [eax + ecx*2 + 0x47], cl
cmp dword [edi + 0x42], eax
add esp, 4
add esi, 0x13028
and esi, 0x1795
xor esi, 0x28c6
pop esi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
call 0x43985d
add byte [esi + 0x46], cl
dec ebp
inc ebp
inc esp
dec edx
dec edx
add esp, 4
xor edi, 0xebb3
and edi, 0x16f45
xor edi, 0x48d8
pop edi
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x43989f
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x43966a
mov dword [ebp - 0x2a8], 0

Function at 0x43985d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
add edi, 0x17091
jmp 0x439678
pop edi
push esi
call 0x439686
add byte [eax + ecx*2 + 0x47], cl
cmp dword [edi + 0x42], eax
add esp, 4
add esi, 0x13028
and esi, 0x1795
xor esi, 0x28c6
pop esi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
call 0x43985d
add byte [esi + 0x46], cl
dec ebp
inc ebp
inc esp
dec edx
dec edx
add esp, 4
xor edi, 0xebb3
and edi, 0x16f45
xor edi, 0x48d8
pop edi
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x43989f
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x43966a
mov dword [ebp - 0x2a8], 0
Function at 0x457080
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4784f3
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00411620
lea eax, [esi + 0x18]
xor edi, edi
push eax
mov dword [esp + 0x18], edi
call fcn.00411620
lea ecx, [esi + 0x30]
push ecx
mov byte [esp + 0x18], 1
call fcn.00449a80
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x45a6b0
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x474ffc
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x2b8], eax
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x2c4]
mov dword fs:[0], eax
mov eax, dword [esi + 0x2d4]
mov eax, dword [eax - 0xc]
lea edi, [esi + 0x2d4]
test eax, eax
je 0x45a70e
push edi
mov ecx, ebx
call dword [0x47c994]
mov eax, 1
jmp 0x45a7a1
lea ecx, [esp + 8]
call dword [0x47ce28]
mov dword [esp + 0x2cc], 0
mov edx, dword [esi + 0x28]
cmp dword [edx - 0xc], 0
lea ecx, [esi + 0x28]
jle 0x45a795
push 0
call dword [0x47c848]
movzx eax, ax
push eax
lea ecx, [esp + 0xc]
push str._c:_
push ecx
call dword [0x47cdfc]
mov eax, dword [esp + 0x14]
add esp, 0xc
push 0x200
push 0x2b4
lea edx, [esp + 0x14]
push edx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x45a795
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
call dword [0x47ce18]
push eax
mov ecx, edi
call dword [0x47c994]
lea ecx, [esp + 8]
call dword [0x47ce24]
mov eax, 1
jmp 0x45a7a1
lea ecx, [esp + 8]
call dword [0x47ce24]
xor eax, eax
mov ecx, dword [esp + 0x2c4]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.004734e6
add esp, 0x2c8
ret
Function at 0x45bf80
Capabilities:
Get disk information

Disassembly:
sub esp, 0x28
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
lea ecx, [eax + 0x28]
mov dword [esp + 4], 0
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
push 0
je 0x45c00b
mov edx, dword [0x47d680]
mov eax, dword [0x47d684]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
call dword [0x47c848]
push 0xc
mov word [esp + 8], ax
xor eax, eax
lea edx, [esp + 0x10]
push edx
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov word [esp + 0x3e], ax
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
mov word [esp + 0x2c], cx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x45c009
lea ecx, [esp + 0xc]
push ecx
jmp 0x45c00b
push 0
mov ecx, esi
call dword [0x47ce1c]
mov ecx, dword [esp + 0x24]
xor ecx, esp
mov eax, esi
call fcn.004734e6
add esp, 0x28
ret 4

Function at 0x45de80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4790e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, edx
mov dword [esp + 0x38], 0
mov edi, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov ecx, edi
sub ecx, ebp
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jbe 0x45df07
cmp ebp, edi
jbe 0x45dedc
call dword [0x47c2fc]
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push edi
push eax
lea eax, [esp + 0x48]
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
push ebx
push esi
call fcn.0045e240
jmp 0x45df55
jae 0x45df55
cmp ebp, edi
jbe 0x45df13
call dword [0x47c2fc]
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
cmp ebp, dword [esi + 0x10]
jbe 0x45df27
call dword [0x47c2fc]
mov eax, dword [esi]
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], eax
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], ebp
call fcn.0043e640
mov edx, dword [esp + 0x20]
mov ecx, dword [eax + 4]
push edi
push edx
mov edx, dword [eax]
push ecx
push edx
lea ebx, [esp + 0x30]
call fcn.0045df90
lea ebx, [esp + 0x40]
call fcn.00418f50
mov eax, dword [esp + 0x40]
push eax
call fcn.0047284c
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x18
Function at 0x460070
Capabilities:
Get volume information via ioctl

Disassembly:
push ecx
mov edx, dword [esi + 0xc]
push 0
lea eax, [esp + 4]
push eax
push 0x68
lea ecx, [esi + 0x18]
push ecx
push 0
push 0
push 0x90064
push edx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4600c7
mov eax, dword [esi + 0x48]
mov dword [esi + 0xa0], eax
test edi, edi
je 0x4600ac
mov dword [edi], eax
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov edx, dword [esi + 0x54]
push 0
push ecx
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x50]
push edx
push eax
call fcn.00474310
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x462c40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push edi
call edx
push eax
mov dword [esi + 0x210], eax
call fcn.00472d56
add esp, 4
mov dword [esi + 0x218], eax
test eax, eax
jne 0x462c79
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
movzx ecx, word [esi + 0x1b]
mov edi, eax
movzx eax, word [esi + 0x1e]
imul eax, ecx
mov ecx, dword [esi + 0x210]
sub ecx, edi
add ecx, eax
cdq
mov ebp, eax
mov ebx, edx
xor eax, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0
cmp ebx, eax
ja 0x462d08
jb 0x462cb6
cmp ebp, ecx
ja 0x462d08
mov ecx, dword [esi + 0x218]
add ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esi + 0x238]
lea eax, [esp + 0x1c]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
add dword [esp + 0x10], edi
test eax, eax
je 0x462c6f
add ebp, edi
adc ebx, 0
xor eax, eax
cmp ebx, eax
jb 0x462cb6
ja 0x462d08
cmp ebp, dword [esp + 0x14]
jbe 0x462cb6
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463750
Capabilities:
Get disk size

Disassembly:
sub esp, 0x20
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x1c], eax
mov ecx, dword [0x47d680]
mov edx, dword [0x47d684]
mov eax, dword [esp + 0x24]
mov ax, word [eax]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
mov word [esp + 0x1c], ax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x4637e8
mov eax, dword [esp + 8]
mul dword [esp + 0x10]
mov dword [esi + 0x260], eax
mov eax, dword [esp + 4]
sub eax, dword [esp + 0xc]
mov dword [esi + 0x264], edx
mov dword [esi + 0x268], eax
xor eax, eax
mov dword [esi + 0x26c], eax
mov dword [esi + 0x270], eax
mov dword [esi + 0x274], eax
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004734e6
add esp, 0x20
ret 4
mov ecx, dword [esp + 0x1c]
xor ecx, esp
or eax, 0xffffffff
call fcn.004734e6
add esp, 0x20
ret 4
Function at 0x100018d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100018ea
test al, 0x10
je 0x100018ea
mov eax, 1
ret
xor eax, eax
ret

Function at 0x100018f0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x414
mov eax, dword [0x100780f0]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x418]
lea edx, [esp + 0x208]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10001914
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x218]
push 0x1007535c
push eax
call fcn.1001b1c0
lea esi, [esp + 0x18]
add esp, 8
mov ecx, eax
sub esi, eax
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, 2
test dx, dx
jne 0x10001944
test eax, eax
je 0x100019f1
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x10]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x100019de
test al, 0x10
je 0x100019de
push 0x1007535c
push 0
call fcn.1001b1c0
add esp, 8
test eax, eax
je 0x100019f1
lea edi, [esp + 0x10]
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10001991
mov edx, dword [0x1007535c]
mov dword [edi], edx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100019a7
lea edi, [esp + 0x10]
sub eax, edx
add edi, 0xfffffffe
jmp 0x100019c0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x100019c0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x10001967
push 0
lea eax, [esp + 0x14]
push eax
call ebp
test eax, eax
jne 0x10001967
jmp 0x100019f6
mov eax, 1
mov ecx, dword [esp + 0x420]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10019470
add esp, 0x414
ret
Function at 0x10003510
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
xor eax, eax
mov edx, eax
shr edx, 3
mov dl, byte [edx + esi]
mov cl, al
and cl, 7
shr dl, cl
add eax, 1
and dl, 1
cmp eax, 0x40
mov byte [eax + 0x1007a727], dl
jb 0x10003517
xor eax, eax
lea esp, [esp]
movzx ecx, byte [eax + str.91__]
movzx edx, byte [ecx + 0x1007a727]
mov byte [edi + eax + 8], dl
movzx ecx, byte [eax + 0x10075839]
movzx edx, byte [ecx + 0x1007a727]
mov byte [edi + eax + 9], dl
movzx ecx, byte [eax + 0x1007583a]
movzx edx, byte [ecx + 0x1007a727]
mov byte [edi + eax + 0xa], dl
movzx ecx, byte [eax + 0x1007583b]
movzx edx, byte [ecx + 0x1007a727]
mov byte [edi + eax + 0xb], dl
add eax, 4
cmp eax, 0x38
jb 0x10003540
push 0x38
lea ebx, [edi + 8]
push ebx
push 0x1007a728
call fcn.10018b80
mov eax, dword [esp + 0x1c]
add esp, 0xc
xor ebp, ebp
mov dword [esp + 0x10], eax
lea ecx, [ecx]
movzx esi, byte [ebp + 0x100758a0]
push esi
push 0x1007a728
push ebx
call fcn.10018b80
mov ecx, 0x1c
sub ecx, esi
push ecx
lea edx, [esi + 0x1007a728]
push edx
push 0x1007a728
call fcn.10018b80
push esi
mov eax, 0x1007a744
sub eax, esi
push ebx
push eax
call fcn.10018b80
movzx esi, byte [ebp + 0x100758a0]
push esi
push 0x1007a744
push ebx
call fcn.10018b80
mov ecx, 0x5252411c
dec ebp
xor dword [esi], ebp
xor al, byte [eax]
push ecx
add dword [edx], ebp
mov al, 0x2c
mov ch, pe_nt_image_headers32
xor eax, 0xcf5bde9b
out dx, al
xchg ebp, eax
xchg esi, eax
add dword [ecx], eax
xchg edx, eax
add dword [eax], eax
add dh, al
push ebx
push eax
call fcn.10018500
add esp, 0x48
xor eax, eax
jmp 0x10003630
movzx ecx, byte [eax + 0x100759b0]
movzx edx, byte [ecx + 0x1007b74f]
mov byte [edi + eax + 8], dl
movzx ecx, byte [eax + 0x100759b1]
movzx edx, byte [ecx + 0x1007b74f]
mov byte [edi + eax + 9], dl
movzx ecx, byte [eax + 0x100759b2]
movzx edx, byte [ecx + 0x1007b74f]
mov byte [edi + eax + 0xa], dl
movzx ecx, byte [eax + 0x100759b3]
movzx edx, byte [ecx + 0x1007b74f]
mov byte [edi + eax + 0xb], dl
movzx ecx, byte [eax + 0x100759b4]
movzx edx, byte [ecx + 0x1007b74f]
mov byte [edi + eax + 0xc], dl
movzx ecx, byte [eax + 0x100759b5]
movzx edx, byte [ecx + 0x1007b74f]
mov byte [edi + eax + 0xd], dl
add eax, 6
cmp eax, 0x30
jb 0x10003630
mov esi, dword [esp + 0x10]
push 0x30
push ebx
push esi
call fcn.10018500
add ebp, 1
add esi, 0x30
add esp, 0xc
cmp ebp, 0x10
mov dword [esp + 0x10], esi
jl 0x100035b0
pop esi
pop ebp
pop ebx
ret 4
Function at 0x10003c60
Capabilities:
Read file on windows

Disassembly:
mov esi, 0x9c0c746e
jne 0x10003cd7
inc ebp
mov esi, 0x9c0c746e
jne 0x10003cdf
inc ebp
mov esi, 0x9c0c746e
jne 0x10003ce7
inc ebp
mov esi, 0x9c0c746e
jne 0x10003cef
inc ebp
mov esi, 0x9c0c746e
jne 0x10003cf7
inc ebp
mov esi, 0x9c0c746e
jne 0x10003cff
inc ebp
mov esi, 0x9c0c746e
jne 0x10003d07
inc ebp
mov esi, 0x9c0c746e
jne 0x10003d0f
inc ebp

Function at 0x10003ca0
Capabilities:
Read file on windows

Disassembly:
mov esi, 0x9c0c746e
jne 0x10003d17
inc ebp
mov esi, 0x9c0c746e
jne 0x10003d1f
inc ebp
Function at 0x10004510
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
xor eax, eax
cmp ebp, eax
je 0x1000456d
push ebx
mov ebx, dword [esp + 0xc]
cmp ebx, eax
je 0x1000456c
push esi
lea esi, [ecx + 4]
push edi
mov edi, dword [esp + 0x20]
cmp edi, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
jbe 0x10004561
push ebx
mov eax, ebp
mov ecx, esi
call fcn.100045b0
sub edi, 1
jne 0x10004552
mov edi, dword [esp + 0x1c]
call fcn.10004650
pop edi
pop esi
pop ebx
pop ebp
ret 0x10