joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f4b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46f4dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46f4dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x101a520
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x101a542
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x101a549
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101a538
mov eax, 1
add ebx, ebx
jne 0x101a55b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x101a550
jne 0x101a56c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x101a550
xor ecx, ecx
sub eax, 3
jb 0x101a580
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x101a5f2
mov ebp, eax
add ebx, ebx
jne 0x101a58b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x101a598
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x101a5bc
inc ecx
add ebx, ebx
jne 0x101a5a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x101a59d
jne 0x101a5b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x101a59d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x101a5dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x101a5cd
jmp 0x101a53e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x101a5dc
add edi, ecx
jmp 0x101a53e
pop esi
mov edi, esi
mov ecx, 0x93c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x101a5fa
cmp byte [edi], 1
jne 0x101a5fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x101a5ff
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x101a66e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1ccfc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1cd88]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x101a62c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1cd8c]
or eax, eax
je 0x101a668
mov dword [ebx], eax
add ebx, 4
jmp 0x101a649
call dword [esi + 0x1cd9c]
mov ebp, dword [esi + 0x1cd90]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x101a6a2
sub esp, 0xffffff80
jmp 0x1012420
Function at 0x4092ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x76e6ec]
jne 0x4092f4
repz ret
jmp fcn.0040cf92

Function at 0x40f7fc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040af6d
and dword [ebp - 4], 0
cmp dword [0x770058], 0
mov ebx, eax
jne 0x40f8ad
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f95e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40f95e
push eax
call fcn.0040aefb
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x770058], eax
call esi
push eax
call fcn.0040aefb
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x77005c], eax
call esi
push eax
call fcn.0040aefb
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x770060], eax
call esi
push eax
call fcn.0040aefb
pop ecx
mov dword [0x770068], eax
test eax, eax
je 0x40f8ad
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040aefb
pop ecx
mov dword [0x770064], eax
mov eax, dword [0x770064]
cmp eax, ebx
je 0x40f905
cmp dword [0x770068], ebx
je 0x40f905
push eax
call fcn.0040af76
push dword [0x770068]
mov esi, eax
call fcn.0040af76
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f905
test edi, edi
je 0x40f905
call esi
test eax, eax
je 0x40f8fc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f8fc
test byte [ebp - 0xc], 1
jne 0x40f905
or dword [ebp + 0x10], 0x200000
jmp 0x40f93e
mov eax, dword [0x77005c]
cmp eax, ebx
je 0x40f93e
push eax
call fcn.0040af76
pop ecx
test eax, eax
je 0x40f93e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f93e
mov eax, dword [0x770060]
cmp eax, ebx
je 0x40f93e
push eax
call fcn.0040af76
pop ecx
test eax, eax
je 0x40f93e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x770058]
call fcn.0040af76
pop ecx
test eax, eax
je 0x40f95e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f960
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x58a232
Capabilities:
Encode data using xor

Disassembly:
pushfd
ror dword [edi + 0x1d], 0x73
push edx
stc
push ecx
mov edx, dword [edi + 0x72cb211c]
out dx, al
xchg ebx, eax
xor eax, 0xb3717841
mov dh, 0x82
jbe 0x58a240
inc edi
pushal
cdq
and dword [ecx - 0x4e], eax
sbb al, 0xfc
cld
mov byte [0x4ece5f49], al
and ah, byte [eax]
movsd dword es:[edi], dword [esi]
mov al, byte [0xc3cae0d1]
adc al, 0x8e
invalid

Function at 0x5b534b
Capabilities:
Encode data using xor

Disassembly:
inc edx
fdivr qword [edx + 0xd]
xchg ecx, eax
sub al, 0x7b
pop ebx
fistp dword [ebp + 0x3f]
pop ebp
aas
out 0xbb, al
push eax
inc esp
cmpsb byte [esi], byte es:[edi]
popal
mov ecx, 0xbfbd921d
movsd dword es:[edi], dword [esi]
push edi
mov esp, dword [ecx + 0x13c1c054]
nop
and eax, 0xe55cdb87
fldenv [esi + ebp + 0x476206d1]
cdq
sub dword [ecx], esi
call 0xe11f200
xor esp, dword [esi]
loope 0x5b5354
dec ebx
fnstsw word [eax + ecx*8 + 0x52]
xor cl, bh
mov edi, 0xde9eac60
inc ecx
sub byte [edx + edi*2 - 0x76410d5a], al
cmc
mov al, 0xcc
test byte [edx - 0x5a], bh
mov esi, 0xccb0f589
mov al, byte [0xe00c75c]
jg 0x5b5392
or byte [edi], ch
dec edx
invalid

Function at 0x658ded
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f398
cmp edx, dword [eax]
je 0x658e0f
add eax, 8
inc ecx
cmp eax, 0x65f428
jl 0x658e00
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f398]
jne 0x658f3d
mov eax, dword [0xa5bcf4]
cmp eax, 1
je 0x658f17
test eax, eax
jne 0x658e40
cmp dword [0x65f2c4], 1
je 0x658f17
cmp edx, 0xfc
je 0x658f3d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x658e77
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006597d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00659c60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x658eba
lea eax, [ebp - 0x1a4]
push eax
call fcn.00659c60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e4cc
push edi
call fcn.0065bb30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006597d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006597e0
lea eax, [ebp - 0xa0]
push 0x65e4ac
push eax
call fcn.006597e0
push dword [esi + 0x65f39c]
lea eax, [ebp - 0xa0]
push eax
call fcn.006597e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065baa4
add esp, 0x2c
pop edi
jmp 0x658f3d
lea eax, [ebp + 8]
lea esi, [esi + 0x65f39c]
push 0
push eax
push dword [esi]
call fcn.00659c60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40180d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40184c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40184c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40184c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40184c
cmp dword [ecx + 0x74], 0xe
jbe 0x40184c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4073c3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x407460
push ebx
push esi
call fcn.0040738c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407320
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40740d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40745f
push edi
push eax
call fcn.00407fe0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40742d
call fcn.00405e81
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40745e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407320
add esp, 0x20
test eax, eax
jne 0x40744c
push edi
call fcn.00405e81
jmp 0x407454
push ebx
call fcn.00405e81
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40875d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410fd8
push 0x410fd0
push str.FlsAlloc
push 0x1f
call fcn.0040861c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408791
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f10c]
call esi
jmp 0x408797
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4087db
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410fe8
push 0x410fe0
push str.FlsGetValue
push 0x21
call fcn.0040861c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408812
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f10c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40881a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410ff0
push 0x410fe8
push str.FlsSetValue
push 0x22
call fcn.0040861c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408854
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f10c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40dcb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40dcdd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40dcdd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1001e34
Capabilities:
Parse pe header

Disassembly:
push 0x60
push 0x10011e0
call fcn.01002c88
mov edi, 0x94
mov eax, edi
call fcn.01002df0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x10010a8]
mov ecx, dword [esi + 0x10]
mov dword [0x10062b8], ecx
mov eax, dword [esi + 4]
mov dword [0x10062c4], eax
mov edx, dword [esi + 8]
mov dword [0x10062c8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x10062bc], esi
cmp ecx, 2
je 0x1001e94
or esi, 0x8000
mov dword [0x10062bc], esi
shl eax, 8
add eax, edx
mov dword [0x10062c0], eax
cmp word [0x1000000], 0x5a4d
jne 0x1001ed0
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1001ed0
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1001ee9
cmp ecx, 0x20b
je 0x1001ed6
and dword [ebp - 0x1c], 0
jmp 0x1001efd
cmp dword [eax + 0x84], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x1001ef7
cmp dword [eax + 0x74], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
push 0
call fcn.01002c2a
pop ecx
test eax, eax
jne 0x1001f2a
cmp dword [0x10062a8], 1
jne 0x1001f17
call fcn.01002406
push 0x1c
call fcn.01002219
push 0xff
call fcn.01002078
pop ecx
pop ecx
and dword [ebp - 4], 0
call fcn.01002a5a
test eax, eax
jge 0x1001f3f
push 0x1b
call fcn.01001e05
pop ecx
call dword [0x10010ac]
mov dword [0x1006854], eax
call fcn.0100292d
mov dword [0x10062a0], eax
call fcn.01002884
test eax, eax
jge 0x1001f65
push 8
call fcn.01001e05
pop ecx
call fcn.0100262a
test eax, eax
jge 0x1001f76
push 9
call fcn.01001e05
pop ecx
call fcn.010020d2
mov dword [ebp - 0x28], eax
test eax, eax
je 0x1001f89
push eax
call fcn.01001e05
pop ecx
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [fcn.010010b0]
call fcn.010025bc
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x1001fab
movzx eax, word [ebp - 0x40]
jmp 0x1001fae
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push 0
push 0x1000000
call fcn.01001c3d
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1001fcf
push esi
call fcn.010021b2
call fcn.010021ea
jmp 0x1002001
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x7c]
call fcn.01002cc3
ret
Function at 0x401860
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450a60
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x46c074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00401300
test al, al
je 0x401899
mov al, 1
jmp 0x4019ae
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0x20019
push 0
push str.SOFTWAREOracleVirtualBox_Guest_Additions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401892
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0x1b
push str.HARDWAREDescriptionSystem
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00401eb0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x460a40
mov byte [ecx], 0
call fcn.00401eb0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x30], esp
push 4
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.QEMU
mov byte [ecx], 0
call fcn.00401eb0
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0x11
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.SystemBiosVersion
mov byte [ecx], 0
call fcn.00401eb0
sub esp, 0x18
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00401b80
mov byte [ebp - 4], 0
call fcn.00401580
add esp, 0x60
test al, al
jne 0x4019a2
push str.SbieDll.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
jne 0x4019a2
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
jne 0x4019a2
xor bl, bl
jmp 0x4019a4
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.00401ae0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bb6a
mov esp, ebp
pop ebp
ret
Function at 0x4081b0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45144b
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x46c074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push 0x100
push edi
push esi
push 0
push 1
push 0
push dword [ebp + 0x14]
mov dword [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x4082b1
mov eax, dword [ebp + 0x2c]
cmp eax, 0x10
jb 0x408246
mov ecx, dword [ebp + 0x18]
inc eax
cmp eax, 0x1000
jb 0x40823d
test cl, 0x1f
jne 0x4082ac
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4082ac
sub ecx, eax
cmp ecx, 4
jb 0x4082ac
cmp ecx, 0x23
ja 0x4082ac
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov eax, dword [ebp + 0x44]
mov byte [ebp + 0x18], 0
mov dword [ebp + 0x2c], 0xf
mov dword [ebp + 0x28], 0
cmp eax, 0x10
jb 0x40828e
mov ecx, dword [ebp + 0x30]
inc eax
cmp eax, 0x1000
jb 0x408285
test cl, 0x1f
jne 0x4082ac
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4082ac
sub ecx, eax
cmp ecx, 4
jb 0x4082ac
cmp ecx, 0x23
ja 0x4082ac
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041bb6a
mov esp, ebp
pop ebp
ret 0x40
call fcn.00437255
push 0xb0
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.00433c30
cmp dword [ebp + 0x2c], 0x10
lea eax, [ebp + 0x18]
lea ecx, [ebp - 0xc8]
cmovae eax, dword [ebp + 0x18]
add esp, 4
push 0x20
push eax
call fcn.0040e310
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc8], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xcc], eax
push 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc8]
push dword [edi]
push esi
call fcn.0040d350
lea ecx, [ebp - 0xc8]
call fcn.004088e0
jmp 0x40820c
Function at 0x408ee0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4515b8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x46c074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov edi, dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsA]
push 0
push 0
call edi
mov ebx, eax
xor edx, edx
mov ecx, ebx
add ecx, 1
setb dl
neg edx
or edx, ecx
push edx
call fcn.0043ae04
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
test esi, esi
je 0x40902f
push esi
push ebx
call edi
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ebx, dword [ebp - 0x14]
nop word [eax + eax]
cmp byte [esi], 0
je 0x409024
push esi
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 3
je 0x408f84
cmp eax, 2
je 0x408f84
cmp eax, 4
je 0x408f84
cmp eax, 6
jne 0x408ffc
mov ecx, esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408fa0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x30]
call fcn.00401eb0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.0040c580
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x408ffc
mov ecx, dword [ebp - 0x30]
inc eax
cmp eax, 0x1000
jb 0x408ff3
test cl, 0x1f
jne 0x409007
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x409007
sub ecx, eax
cmp ecx, 4
jb 0x409007
cmp ecx, 0x23
ja 0x409007
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
push esi
call edi
inc esi
add esi, eax
jmp 0x408f60
call fcn.00437255
mov eax, 0x409012
ret
push dword [ebp - 0x18]
call fcn.0043a975
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c780
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jl 0x40c7a0
pop edi
mov dword [ecx], 0x270
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x40e4e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451d98
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x46c074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40e626
cmp byte [ebx + 0x3d], 0
je 0x40e626
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40e534
xor al, al
jmp 0x40e628
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.0040c7f0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
nop dword [eax]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmp edx, 0x10
lea esi, [ebp - 0x28]
cmovae esi, eax
cmovae edi, eax
mov edx, dword [ecx]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40e58f
sub eax, 1
je 0x40e593
mov edx, dword [ebp - 0x14]
sub eax, 2
mov eax, dword [ebp - 0x28]
je 0x40e5e9
xor bl, bl
jmp 0x40e5eb
mov byte [ebx + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae ecx, eax
sub esi, ecx
je 0x40e5cb
push dword [ebx + 0x4c]
cmp edx, 0x10
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, eax
push 1
push ecx
call fcn.0043a67a
mov edx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
mov eax, dword [ebp - 0x28]
jne 0x40e58b
cmp byte [ebx + 0x3d], 0
je 0x40e5e9
test esi, esi
jne 0x40e550
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0040e1a0
jmp 0x40e547
mov bl, 1
cmp edx, 0x10
jb 0x40e61d
lea ecx, [edx + 1]
cmp ecx, 0x1000
jb 0x40e614
test al, 0x1f
jne 0x40e621
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x40e621
sub eax, ecx
cmp eax, 4
jb 0x40e621
cmp eax, 0x23
ja 0x40e621
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
mov al, bl
jmp 0x40e628
call fcn.00437255
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bb6a
mov esp, ebp
pop ebp
ret