joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa3b790
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xa3b7cf
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebp
ret

Function at 0xa53d42
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a539bf

Function at 0xa5a3f5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a5a26b

Function at 0x40d93c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
xor ecx, ecx
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 8], ecx
jbe 0x40d9a6
nop dword [eax]
lea eax, [ebx + 1]
movzx ebx, al
mov dl, byte [ebx + edi]
movzx eax, dl
add eax, ecx
movzx ecx, al
mov dword [ebp - 8], ecx
movzx eax, byte [ecx + edi]
mov byte [ebx + edi], al
mov byte [ecx + edi], dl
movzx ecx, byte [ebx + edi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x40d993
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ecx + edi]
mov ecx, dword [ebp - 4]
xor byte [esi + ecx], al
inc esi
mov ecx, dword [ebp - 8]
cmp esi, dword [ebp + 8]
jb 0x40d95c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408989
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
dec edx
call fcn.004089ac
or edx, edx
xor dword [esi], ecx
inc edx
inc esi
cmp esi, eax
jne fcn.00408989
sub edi, 1
sub esp, 4
mov dword [esp], edi
pop edx
ret

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x401750
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x330
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
xor edx, edx
inc eax
je 0x4018c6
push 0
lea esi, [ebp - 0x11c]
push esi
push 0x104
push ebx
call sub.KERNEL32.dll_GetFullPathNameA
test eax, eax
mov ebx, eax
je 0x4018c4
cmp eax, 0x103
jbe 0x4017a1
push 0x6f
xor ebx, ebx
call sub.KERNEL32.dll_SetLastError
jmp 0x4018c4
lea eax, [ebp - 0x330]
push eax
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
js 0x4018c4
push 0x104
lea edi, [ebp - 0x32c]
push edi
push 0xffffffffffffffff
push esi
push 0
call sub.KERNEL32.dll_AreFileApisANSI
test eax, eax
sete al
movzx eax, al
push eax
call fcn.0040821f
test eax, eax
mov ebx, eax
jne 0x4017f9
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x4018b8
push 0x6f
call sub.KERNEL32.dll_SetLastError
jmp 0x4018b8
mov edx, dword [ebp - 0x330]
lea eax, [ebp - 0x334]
mov ecx, dword [edx]
push 0
push eax
lea eax, [ebp - 0x338]
push eax
push edi
push 0
push 0
push edx
call dword [ecx + 0xc]
test eax, eax
mov edx, eax
jns 0x40183e
sar eax, 0x10
and eax, 0x1fff
cmp eax, 7
jne 0x401833
movzx eax, dx
push eax
jmp 0x401835
push 0xd
call sub.KERNEL32.dll_SetLastError
xor ebx, ebx
jmp 0x4018b8
push esi
push dword [ebp - 0x334]
call sub.SHELL32.DLL_SHGetPathFromIDListA
test eax, eax
mov ebx, eax
jne 0x40185d
cmp byte [ebp - 0x11c], 0
je 0x40185d
push 0xd
jmp 0x401877
lea edi, [ebp - 0x11c]
push edi
call sub.KERNEL32.dll_lstrlenA
lea esi, [eax + 1]
mov ebx, eax
cmp esi, dword [ebp + 0x10]
jbe 0x40187e
push 0x7a
mov ebx, esi
call sub.KERNEL32.dll_SetLastError
jmp 0x40188a
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
call sub.KERNEL32.dll_lstrcpynA
lea eax, [ebp - 0x33c]
push eax
call sub.SHELL32.DLL_SHGetMalloc
test eax, eax
js 0x4018b8
mov eax, dword [ebp - 0x33c]
mov edx, dword [eax]
push dword [ebp - 0x334]
push eax
call dword [edx + 0x14]
mov eax, dword [ebp - 0x33c]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x330]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov edx, ebx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x4019bf
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
push eax
push eax
push 0
push pe_nt_image_headers32
push 4
push 0
push 2
push 0x40000000
push dword [0x40a024]
call sub.KERNEL32.dll_CreateFileA
mov dword [0x40c240], eax
inc eax
jne 0x4019fd
push 0x40197f
call fcn.00407e60
jmp 0x401b0c
push 0x40199c
push 0
call fcn.00407ea0
push 1
call fcn.00401955
add esp, 0xc
mov ebx, eax
cmp dword [0x40c0b8], 0
je 0x401a20
add ebx, ebx
lea eax, [ebx + 2]
push eax
call fcn.00407ebb
mov esi, eax
test esi, esi
pop eax
je 0x401aeb
mov dword [0x40c228], 0
xor eax, eax
cmp dword [0x40c040], 0
mov dword [0x40c220], ebx
sete al
cmp dword [0x40c0b8], 0
mov dword [0x40c224], eax
je 0x401a87
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xe]
push 2
push eax
push dword [0x40c240]
mov byte [ebp - 0xe], 0xff
mov byte [ebp - 0xd], 0xfe
call sub.KERNEL32.dll_WriteFile
mov dword [0x40c228], 0x4b0
push esi
push 0x40c220
push 0x45e
push dword [0x40c048]
call sub.USER32.dll_SendMessageA
cmp dword [0x40c0b8], 0
mov edx, eax
je 0x401aac
add edx, edx
jmp 0x401acb
cmp dword [0x40c040], 1
jne 0x401acb
xor ecx, ecx
mov eax, esi
cmp edi, edx
jae 0x401acb
cmp byte [eax], 0xd
jne 0x401ac5
mov byte [eax], 0xa
inc ecx
inc eax
cmp ecx, edx
jb 0x401abd
push 0
lea eax, [ebp - 0x14]
push eax
push edx
push esi
push dword [0x40c240]
call sub.KERNEL32.dll_WriteFile
push esi
mov edi, eax
call fcn.00407ed1
pop ebx
test edi, edi
jne 0x401b13
push 0x4019ab
call fcn.00407e60
push dword [0x40c240]
call sub.KERNEL32.dll_CloseHandle
push 0x4019be
push 0
call fcn.00407ea0
xor eax, eax
jmp 0x401b9f
push dword [0x40c240]
call sub.KERNEL32.dll_SetEndOfFile
push dword [0x40c240]
call sub.KERNEL32.dll_CloseHandle
push 0
push 0
push 0xb9
push dword [0x40c048]
call sub.USER32.dll_SendMessageA
cmp dword [0x40a094], 0
mov dword [0x40c064], 1
je 0x401b62
push 0x40c400
push dword [0x40a024]
call fcn.0040608c
pop edx
pop ecx
call fcn.0040213a
push 0
push 0x1f7
push 0x401
push dword [0x40c050]
call sub.USER32.dll_SendMessageA
push 0x4019be
push 0
call fcn.00407ea0
push 0x40c3b0
push dword [0x40a024]
call sub.msvcrt.dll__stat
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401c4b
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push 0
mov esi, dword [ebp + 8]
push 0x8000080
mov dword [ebp - 0x24], eax
and eax, 0xffff8000
test ax, ax
setne al
push 3
push 0
push 3
movzx eax, al
lea eax, [eax + eax + 1]
push 0x80000000
push esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x401ed3
call sub.KERNEL32.dll_CreateFileA
mov dword [0x40c240], eax
inc eax
jne 0x401d2d
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jne 0x401d02
push esi
call sub.KERNEL32.dll_lstrlenA
add eax, 0x28
push eax
call fcn.00407ebb
push esi
mov ebx, eax
push 0x401bb0
push eax
call sub.USER32.dll_wsprintfA
push 0x34
push 0x401bd7
push ebx
push 0
call sub.USER32.dll_MessageBoxA
add esp, 0x10
cmp eax, 6
jne 0x401d25
push 0
push pe_nt_image_headers32
push 1
push 0
push 3
push 0x80000000
push esi
call sub.KERNEL32.dll_CreateFileA
mov dword [0x40c240], eax
inc eax
jne 0x401d2d
push esi
call sub.KERNEL32.dll_lstrlenA
add eax, 0x14
push eax
call fcn.00407ebb
push esi
mov ebx, eax
push 0x401be0
push eax
call sub.USER32.dll_wsprintfA
push ebx
call fcn.00407e60
push ebx
call fcn.00407ed1
jmp 0x401d57
push 0
push dword [0x40c240]
call sub.KERNEL32.dll_GetFileSize
mov dword [0x40c210], eax
inc eax
jne 0x401d5e
push 0x401c10
call fcn.004081a6
push dword [0x40c240]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
jmp 0x401ecb
cmp dword [ebp - 0x1c], 1
jne 0x401e8c
push 0x400
call fcn.00407ebb
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push 0
push eax
push 0x400
push dword [ebp - 0x28]
push dword [0x40c240]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 0x20], 0
mov dword [0x40c0b8], 0
pop eax
je 0x401e8c
mov ebx, dword [ebp - 0x28]
cmp byte [ebx], 0xff
jne 0x401dcc
cmp byte [ebx + 1], 0xfe
jne 0x401dcc
push 0
mov edi, dword [ebp + 0xc]
push 0
push 2
or edi, 0x10
mov dword [ebp - 0x24], edi
mov dword [0x40c0b8], 1
jmp 0x401dd2
push 0
push 0
push 0
push dword [0x40c240]
call sub.KERNEL32.dll_SetFilePointer
mov ecx, dword [ebp - 0x20]
mov eax, 1
xor edx, edx
cmp eax, ecx
jae 0x401e14
mov ebx, dword [ebp - 0x28]
cmp byte [eax + ebx], 0
jne 0x401df5
inc edx
add eax, 2
cmp eax, 0x13
jg 0x401e01
cmp eax, ecx
jb 0x401deb
cmp edx, 9
jle 0x401e14
or dword [ebp - 0x24], 0x10
mov dword [0x40c0b8], 1
cld
mov esi, dword [ebp - 0x28]
mov eax, 0x401c36
mov ecx, 4
mov edi, eax
repe cmpsb byte [esi], byte es:[edi]
push dword [ebp - 0x20]
sete al
push 0xd
movzx eax, al
push dword [ebp - 0x28]
mov dword [0x40c010], eax
call sub.msvcrt.dll_memchr
add esp, 0xc
invalid
Function at 0x403e95
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test eax, eax
jne 0x403f08
cld
mov ecx, 0xa
lea edi, [ebp - 0x5c]
rep stosd dword es:[edi], eax
push 0x7f00
push 0
mov dword [ebp - 0x58], 0x4048c7
mov dword [ebp - 0x4c], esi
call sub.USER32.dll_LoadCursorA
push 0x68
push esi
mov dword [ebp - 0x44], eax
call sub.USER32.dll_LoadIconA
push 0xf
mov dword [0x40c3a0], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], 0x2710
call sub.USER32.dll_GetSysColorBrush
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x38], 0x403e20
call sub.USER32.dll_RegisterClassA
xor edx, edx
sub ecx, edi
mov ecx, dword [0x40a200]
or esi, edi
mov esi, 0x2b62522
or eax, 0x426d00
sub dword [0x40a35e], 0x781623e
shr esi, 0xa
rol esi, 0x10
mov edi, 0x186e7360
add eax, 0x2eb226f8
call fcn.00402c46
test esi, ebx
jb 0x403ebd
invalid
invalid
invalid
sub edx, esp
sub ebx, edx
test ecx, esp
jo 0x403f22
add edi, ebp
not ebx
dec eax
xchg edx, eax
xor ebx, ecx
rol esi, 0x19
dec ebx
xor ebx, ecx
rol ebx, 0x1e
mov eax, edi
and esi, 0x8fa48f
mov esi, 0x6e8a15b
shl ebx, 9
and esi, edi
sub esi, eax
xchg ecx, edx
call fcn.00405273
mov ebx, edx
mov ebx, eax
dec edx
inc ebx
xor dword [0x40a0e4], 0x179b2ccf
test esp, ebp
jo 0x403f9b
mov edx, dword [0x40a3b0]
sub ebx, edx
mov ecx, edx
mov esi, eax
rol ecx, 0x18
mov esi, eax
shl ecx, 0xe
test esp, eax
jo 0x404016
sub edx, edx
not eax
mov edx, 0x8f3c354
xor ecx, esp
inc eax
xchg esi, edx
mov ecx, 0x364d034
add edx, dword [0x40a0d0]
shr edi, 8
mov dword [0x40a318], 0x2f0d918
inc esi
xor dword [0x40a340], ecx
inc edx
not eax
shr edx, 0x16
mov dword [0x40a22e], edi
dec eax
loop 0x403fac
mov esi, 0xa735ee
mov ebx, edx
dec esi
call fcn.00408b51
add byte [ecx + 0x4596c5f6], al
invalid

Function at 0x405c59
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x124
mov edi, dword [ebp + 8]
cmp esi, dword [edi + 8]
jge 0x405ccd
lea eax, [esi + 1]
lea ebx, [ebp - 0x2c]
push eax
push dword [ebp + 0x14]
mov dword [ebp - 0x130], eax
push ebx
call sub.USER32.dll_wsprintfA
push dword [ebp + 0xc]
lea eax, [ebp - 0x12c]
push 0xfa
push eax
push 0x405c58
push ebx
push dword [ebp + 0x10]
call sub.KERNEL32.dll_GetPrivateProfileStringA
add esp, 0xc
cmp byte [ebp - 0x12c], 0
je 0x405ccd
lea eax, [ebp - 0x12c]
push eax
push esi
push edi
call fcn.00405c24
inc dword [edi + 4]
add esp, 0xc
mov esi, dword [ebp - 0x130]
cmp esi, dword [edi + 8]
jl 0x405c6f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x406c21
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.KERNEL32.dll_GetPrivateProfileIntA
cmp eax, esi
je 0x406c5f
push 0xa
lea ebx, [ebp - 0x2c]
push ebx
push esi
call sub.msvcrt.dll__itoa
push edi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.KERNEL32.dll_WritePrivateProfileStringA
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp

Function at 0x4080d2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4080e1
mov eax, dword [0x40c044]
push 1
push 0
push 0
push dword [ebp + 0xc]
push 0x4080cd
push eax
call sub.SHELL32.DLL_ShellExecuteA
leave
ret

Function at 0x4084e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 0x78
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
cmp eax, dword [ebp - 4]
jbe 0x40859a
sub esp, 8
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
lea ecx, [eax*4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [ecx + edx]
push eax
call sub.KERNEL32.dll_lstrcmpA
add esp, 8
test eax, eax
jne 0x408593
mov eax, dword [ebp - 4]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x18]
mov ax, word [edx + eax]
and eax, 0xffff
lea ecx, [eax*4]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, dword [ecx + edx]
mov dword [ebp - 0x24], eax
jmp 0x4085a1
lea eax, [ebp - 4]
inc dword [eax]
jmp 0x40853b
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
leave
ret
Function at 0x408a40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.004090c0
call fcn.00408d30
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x408a78
jmp 0x408b16
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x408a77
cmp cl, 0x22
je 0x408ad0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x408af0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x408af0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x408ab0
jmp 0x408af0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x408ad0
cmp cl, 0x22
je 0x408b52
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x408b10
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x408b00
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x408b34
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.00403e95
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
inc ebx
movzx ecx, byte [ebx]
jmp 0x408af0
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x4028f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x402901
pop dword [ebp - 0x2c]
mov eax, 0x2f97fdb8
add eax, 0xd0a82b49
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xf17f5614
sub dword [ebp - 0x3c], 0xa32d10c9
mov dword [ebp - 0x38], 0x857d47d1
add dword [ebp - 0x38], 0xacb60474
mov dword [ebp - 0x34], 0x3b2a2870
add dword [ebp - 0x34], 0x11221bbe
mov dword [ebp - 0x30], 0xce078c4c
add dword [ebp - 0x30], 0x31f873b4
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x53ebc0
add eax, 0xffece48c
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xaab499b8
add dword [ebp - 0x3c], 0xc9bdcf9e
mov dword [ebp - 0x38], 0x403477e9
add dword [ebp - 0x38], 0x137e98c
mov dword [ebp - 0x34], 0x3eb27cd5
add dword [ebp - 0x34], 0x24bcef97
mov dword [ebp - 0x30], 0x40234ff7
add dword [ebp - 0x30], 0xbfdcb009
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xa88a0211
sub eax, 0xa84931c9
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x39583
push 0
call eax
mov ecx, 0xfe0fbd0d
add ecx, 0x1f08a85
xor edi, edi
add edi, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x2c]
mov esi, 0xe97e83ae
sub esi, 0xe4c77835
xor dword [ebp - 4], ebx
mov edx, dword [ebx]
add dword [ebp - 0x18], 0xf4321e7b
add edx, esi
mov dword [ebp - 0xc], 0x17a45117
mov dword [edi], edx
xor dword [ebp - 0xc], 0x9c5d94e7
add edi, 0x45ea3bd
add edi, 0xfba15c47
add ebx, 0xbba13882
sub ebx, 0xbba1387e
loop 0x402a1f
add eax, 0x1111b
xor ebx, ebx
add ebx, eax
add eax, 0xac3de543
sub eax, 0xac3de53e
mov ecx, 0xbc72772f
add ecx, 0x43cd88d1
invalid
invalid
aam 0xff
invalid
Function at 0x4020b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
je 0x402177
cmp dword [ebp + 8], 0
je 0x4020d7
lea eax, [edi + 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
lea esi, [edi + 0xc]
mov word [edi + 0x630], cx
mov dword [edi + 8], ecx
cmp dword [esi + 4], 1
je 0x402121
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push 0
push 0
push eax
call fcn.0040e710
add eax, 0x540000
adc edx, 6
push edx
push eax
push 0x55
push str..DosDevice.cpp
push str._S__d_nRet0x_016llX_n
call fcn.00401850
add esp, 0x14
jmp 0x402162
cmp dword [esi + 8], ecx
je 0x402162
push 0
lea edx, [esi + 0x14]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x40215b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push 0
push 0
push eax
call fcn.0040e710
add eax, 0x720000
adc edx, 0x15
push edx
push eax
push 0x73
jmp 0x40210d
mov dword [esi + 8], 0
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
xor eax, eax
mov word [edi + 0x428], ax
mov dword [edi + 4], eax
pop edi
xor eax, eax
xor edx, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4023e0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x220
mov eax, dword [0x41414c]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push esi
push edi
xor edi, edi
push 0x206
mov esi, ecx
lea ecx, [esp + 0x26]
xor eax, eax
push edi
push ecx
mov dword [esp + 0x1c], edi
xor ebx, ebx
mov word [esp + 0x2c], ax
call fcn.00407330
xor eax, eax
lea edx, [esp + 0x2c]
add esp, 0xc
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
mov eax, esi
sub edx, esi
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, di
jne 0x402440
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402456
sub eax, edx
sar eax, 1
mov edx, 0x5c
cmp dx, word [esp + eax*2 + 0x1e]
jne 0x402496
lea eax, [esp + 0x20]
lea edx, [eax + 2]
jmp 0x402480
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402480
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x1e], cx
push edi
push edi
push 3
push edi
push 3
push 0x80000000
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4024f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push edi
push edi
push eax
call fcn.0040e710
mov esi, eax
mov edi, edx
add esi, 0xf80000
adc edi, 0x15
push edi
push esi
push 0xf9
push str..ExchangeFileReader.cpp
push str._S__d_nRet0x_016llX_n
call fcn.00401850
add esp, 0x14
mov eax, esi
mov edx, edi
jmp 0x402562
push edi
lea eax, [esp + 0x14]
push eax
push 0x400
push ebp
push 0xc
lea ecx, [esp + 0x28]
push ecx
push 0x2d1400
push esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x402557
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push edi
push edi
push eax
call fcn.0040e710
mov edi, eax
mov ebx, edx
add edi, 0x10a0000
adc ebx, 0x15
push ebx
push edi
push 0x10b
push str..ExchangeFileReader.cpp
push str._S__d_nRet0x_016llX_n
call fcn.00401850
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov edx, ebx
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004049d2
add esp, 0x220
ret 4