joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e2520
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.004efde0
mov eax, dword [0x574be0]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x4e256f
mov eax, 1
mov dword [esi], ebp
jmp 0x4e2571
mov ebp, dword [esi]
test ecx, ecx
je 0x4e2654
push ebp
call fcn.004b3ba0
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x4e25a0
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.0049e560
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x4e25f7
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.004bcc20
add esp, 0xc
test eax, eax
je 0x4e26f6
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.004bcdd0
add esp, 0xc
test eax, eax
je 0x4e26f6
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.004bcde0
add esp, 0xc
test eax, eax
je 0x4e26f6
jmp 0x4e2631
cmp edi, 0x80
jbe 0x4e2613
push str.len_0__len__int_sizeof_ctx__key_
push 0x5f
push str..cryptohmachmac.c
call fcn.0049e560
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.004ef6e0
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x4e265c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.004efe90
add esp, 0xc
jmp 0x4e265c
test eax, eax
je 0x4e26e2
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x4e2660
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.004bcc20
add esp, 0xc
test eax, eax
je 0x4e26f6
push ebp
call fcn.004b3ba0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.004bcdd0
add esp, 0x10
test eax, eax
je 0x4e26f6
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x4e26a4
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.004bcc20
add esp, 0xc
test eax, eax
je 0x4e26f6
push ebp
call fcn.004b3ba0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.004bcdd0
add esp, 0x10
test eax, eax
je 0x4e26f6
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.004bcf40
add esp, 8
test eax, eax
jne 0x4e26fa
xor eax, eax
jmp 0x4e26ff
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e9eea
add esp, 0x8c
ret
Function at 0x4e53a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.004efde0
mov eax, dword [esp + 0x38]
push ebx
push edi
xor edi, edi
push eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
call fcn.004b3bb0
mov ebx, eax
add esp, 4
cmp ebx, edi
jl 0x4e55e1
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
jne 0x4e5467
mov esi, ebx
mov edi, dword [esp + 0x38]
mov ecx, dword [edi + 0x10]
push ebp
push ecx
call fcn.0049d7f0
mov ebp, eax
dec ebp
and ebp, 7
push edi
mov dword [esp + 0x24], ebp
call fcn.00498fd0
add esp, 8
mov edi, eax
mov dword [esp + 0x18], eax
test ebp, ebp
jne 0x4e5419
mov eax, dword [esp + 0x40]
mov byte [eax], 0
inc eax
dec edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x18], edi
cmp esi, 0xfffffffe
jne 0x4e549b
mov esi, edi
sub esi, ebx
sub esi, 2
test esi, esi
jle 0x4e54d9
push 0xda
push str..crypto_rsa_rsa_pss.c
push esi
call fcn.0049d190
mov ebp, eax
add esp, 0xc
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x4e54c7
push 0xde
push str..crypto_rsa_rsa_pss.c
push 0x41
push 0x7d
push 4
call fcn.0049add0
add esp, 0x14
jmp 0x4e55c4
cmp esi, 0xfffffffe
jne 0x4e5471
jmp 0x4e53dd
jge 0x4e53dd
push 0xc3
push str..crypto_rsa_rsa_pss.c
push 0x88
push 0x7d
push 4
call fcn.0049add0
add esp, 0x14
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
lea edx, [ebx + esi + 2]
cmp edi, edx
jge 0x4e5425
push 0xd5
push str..crypto_rsa_rsa_pss.c
push 0x6e
push 0x7d
push 4
call fcn.0049add0
add esp, 0x14
mov eax, dword [esp + 0x14]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
push esi
push ebp
call fcn.004a04c0
add esp, 8
test eax, eax
jle 0x4e55c0
lea eax, [esp + 0x20]
sub edi, ebx
push eax
lea ebp, [edi - 1]
call fcn.004bcbd0
mov ecx, dword [esp + 0x4c]
push 0
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.004bcc20
push 8
lea eax, [esp + 0x34]
push 0x543140
push eax
call fcn.004bcdd0
mov ecx, dword [esp + 0x60]
push ebx
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.004bcdd0
add esp, 0x28
test esi, esi
je 0x4e5534
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.004bcdd0
add esp, 0xc
mov edx, dword [esp + 0x40]
lea eax, [edx + ebp]
push 0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004bcf10
lea ecx, [esp + 0x2c]
push ecx
call fcn.004bce60
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
push edx
push ebx
add eax, ebp
push eax
push ebp
mov ebp, dword [esp + 0x60]
push ebp
call fcn.004a8ce0
add esp, 0x24
test eax, eax
jne 0x4e55c0
sub edi, esi
xor byte [edi + ebp - 2], 1
lea eax, [edi + ebp - 2]
inc eax
test esi, esi
jle 0x4e5596
xor ecx, ecx
test esi, esi
jle 0x4e5596
mov edx, dword [esp + 0x10]
mov dl, byte [ecx + edx]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, esi
jl 0x4e5587
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4e55af
mov ecx, 8
sub ecx, eax
mov eax, 0xff
sar eax, cl
and byte [ebp], al
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp - 1], 0xbc
mov dword [esp + 0x14], 1
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x4e54bb
push ebp
call fcn.0049d330
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
Function at 0x4fc19f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x574be0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004f4f6e
mov dword [ebp - 0x14], eax
cmp dword [0x57b55c], edi
jne 0x4fc290
push 0x800
push edi
push 0x546bac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4fc21d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4fc370
push 0x546bac
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4fc370
push 0x546bc4
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4fc370
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x57b55c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x57b560], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x546bf4
push esi
mov dword [0x57b564], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x57b56c], eax
test eax, eax
je 0x4fc28d
push 0x546c10
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x57b568], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4fc2b5
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4fc2a8
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4fc2ca
push 4
pop eax
jmp 0x4fc372
cmp dword [ebp - 0x14], edi
je 0x4fc2ca
push dword [0x57b55c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4fc2af
mov eax, dword [0x57b568]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4fc328
cmp dword [0x57b56c], esi
je 0x4fc328
push eax
call ebx
push dword [0x57b56c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4fc328
test eax, eax
je 0x4fc328
call ecx
test eax, eax
je 0x4fc31d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4fc31d
test byte [ebp - 8], 1
jne 0x4fc328
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4fc358
mov eax, dword [0x57b560]
cmp eax, esi
je 0x4fc355
push eax
call ebx
test eax, eax
je 0x4fc355
call eax
mov edi, eax
test edi, edi
je 0x4fc355
mov eax, dword [0x57b564]
cmp eax, esi
je 0x4fc355
push eax
call ebx
test eax, eax
je 0x4fc355
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x57b55c]
call ebx
test eax, eax
je 0x4fc370
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4fc372
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e9eea
leave
ret
Function at 0x5030db
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004f366e
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x503113
xor eax, eax
jmp 0x50313f
cmp esi, dword [ebp - 4]
je 0x50313c
cmp dword [ebp + 0xc], 0
je 0x50313c
push dword [edi + 0x9c]
call fcn.00502ce9
push dword [edi + 0x9c]
mov esi, eax
call fcn.004fbf4f
pop ecx
pop ecx
cmp esi, eax
je 0x50310f
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x456bb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x456bd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x456bd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x456bc8
mov eax, 1
add ebx, ebx
jne 0x456beb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x456bfc
jne 0x456c1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x456c1b
dec eax
add ebx, ebx
jne 0x456c08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x456be0
add ebx, ebx
jne 0x456c17
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x456c6d
xor ecx, ecx
sub eax, 3
jb 0x456c33
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x456ca2
sar eax, 1
mov ebp, eax
jmp 0x456c3e
add ebx, ebx
jne 0x456c3e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x456c0c
inc ecx
add ebx, ebx
jne 0x456c4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x456c0c
add ebx, ebx
jne 0x456c59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x456c4e
jne 0x456c6a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x456c4e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x456c8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x456c7e
jmp 0x456bce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x456c8c
add edi, ecx
jmp 0x456bce
pop esi
mov edi, esi
mov ecx, 0x743
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x456caa
cmp byte [edi], 1
jne 0x456caa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x456caf
lea edi, [esi + 0x50000]
mov eax, dword [edi]
or eax, eax
je 0x456d1e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x575d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x576a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x456cdc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x576a4]
or eax, eax
je 0x456d18
mov dword [ebx], eax
add ebx, 4
jmp 0x456cf9
call dword [esi + 0x576b4]
mov ebp, dword [esi + 0x576a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x456d52
sub esp, 0xffffff80
jmp 0x40bbf4
Function at 0x42f080
Capabilities:
Encode data using xor

Disassembly:
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
fidivr word [ecx]
adc al, 0x95
js 0x42f0bb
xchg edi, eax
das
lds esp, [ebp + 0x25]
push ds
xchg ecx, eax
or al, 0x8c
aam 2
out dx, eax
or al, 0x9d
rol dword [ebp - 9], 0x86
sbb edi, dword [edx + eax*2 - 0x76]
hlt
and ecx, dword [edx + 0x7f9905c4]
pop ecx
sti
popfd
fnstcw word [ecx + 0x72828647]
stosd dword es:[edi], eax
invalid
inc edi
xchg byte [edx - 0x323a548e], al
xor dword [esp + edx*8], eax
inc esp
aam 0
mov ebx, 0x141edefb
enter 0x49fd, 0x74
cwde
xor dword [eax + 0xbe5f95a], 0xffffffcb
stc
jg 0x42f0c6
inc sp
add byte [eax + 0x926db6e], bl
jne 0x42f076
mov bh, 0xfe
lodsd eax, dword [esi]
jae 0x42f14c
mov al, 0xc6
lcall 0x8588, 0xd70d1f65
or eax, 0x4d74350d
clc
push ss
sbb dword [ecx + 0x4f], eax
sahf
add byte [ebp + 0x604100cb], ch
aas
std
cmp byte [ecx - 0x4e60efe8], ch
adc eax, 0x76f83812
mov ecx, 0xe2d5f58c
invalid
adc bh, byte [eax - 0x5d]
js 0x42f0ce
ja 0x42f129
adc eax, dword [edi]
sub byte [edi + 0x1f6cf43f], 0x59
invalid
mov esi, 0xb8a15e88
xor al, cl
pop edx
loope 0x42f1b9
inc esp
add byte [ebx + 0x92bdb6e], dl
div esp
mov eax, dword [0x1b8132a8]
aad 0x38
fptan
fsub qword [0x87f01723]
adc dh, 0
salc
add ah, ah
in al, 0x97
salc
add ah, ah
in al, 0x97
jne 0x42f128
cmp edi, dword [ecx - 0x6e]
mov word [edx - 0x72fffd77], fs
xlatb
inc ebx
cmp esi, dword [ebp - 0x33e7e002]
fucompi st(5)
sub ecx, edx
retf 0x2fd
pop es
cdq
jnp 0x42f1c9
xor dword [edx - 0x6d], esp
invalid
add eax, edx
add ecx, dword [ecx - 0xa2bb273]
mov dl, 0xf8
lahf
rol ebp, 1
dec edi
cmp eax, dword [edx + 0x28fe388]
pop dword [edx]
mov bl, ah

Function at 0x48b2af
Capabilities:
Encode data using xor

Disassembly:
arpl word [edx + esi*2], bp
dec esp
sti
xor al, 0x48
test eax, 0xf8b0896c
mov byte [edi - 0x5884a6fb], dh
xchg ebp, eax
add byte [edi], ah
dec esi
xchg esi, eax
mov esp, 0xdb797dbb
shl esi, 1
in al, dx
and dword [ecx], eax
push ds
mov edx, 0x97f7e3ac
in al, 0xfd
lea eax, [0x4d5edf7]
Function at 0x4baef5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23a8
cmp edx, dword [eax]
je 0x4baf17
add eax, 8
inc ecx
cmp eax, 0x4c2438
jl 0x4baf08
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23a8]
jne 0x4bb045
mov eax, dword [0x4c7dd0]
cmp eax, 1
je 0x4bb01f
test eax, eax
jne 0x4baf48
cmp dword [0x4c22d4], 1
je 0x4bb01f
cmp edx, 0xfc
je 0x4bb045
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4baf7f
lea eax, [ebp - 0x1a4]
push 0x4c06c8
push eax
call fcn.004bb8e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbd70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bafc2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbd70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c06c4
push edi
call fcn.004bdc40
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c06a8
push eax
call fcn.004bb8e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb8f0
lea eax, [ebp - 0xa0]
push 0x4c06a4
push eax
call fcn.004bb8f0
push dword [esi + 0x4c23ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb8f0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c067c
push eax
call fcn.004bdbb4
add esp, 0x2c
pop edi
jmp 0x4bb045
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23ac]
push 0
push eax
push dword [esi]
call fcn.004bbd70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4013c3
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push str.DriveVolumeInfo::PutExProps_i_i
mov edi, ecx
push 3
call fcn.0040116e
imul esi, esi, 0x10e4
add esi, edi
xor ebx, ebx
add esp, 0xc
cmp byte [esi + 0x23c], bl
lea eax, [esi + 0x23c]
jne 0x40140f
lea ecx, [esi + 0x2bc]
push ecx
push eax
lea eax, [esi + 0x37c]
push eax
lea eax, [esi + 0x34]
push eax
call fcn.00403dc7
add esp, 0x10
cmp byte [esi + 0x10be], bl
jne 0x401445
lea edi, [esi + 0x33c]
push 0x20
lea eax, [esp + 0x14]
push edi
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp byte [edi], bl
jne 0x401445
push str.unformatted
push edi
call fcn.00404900
pop ecx
pop ecx
cmp dword [esi + 0x10b4], 2
jne 0x4014ec
cmp byte [esi + 0x10bd], bl
jne 0x4014ec
push ebp
mov ebp, str.flash
lea edi, [esi + 0x2bc]
push ebp
push edi
call fcn.00404887
pop ecx
test eax, eax
pop ecx
je 0x401488
push str.card
push edi
call fcn.00404887
pop ecx
test eax, eax
pop ecx
jne 0x4014c8
push ebp
push edi
call fcn.00404887
pop ecx
test eax, eax
pop ecx
je 0x4014a6
push str.read
push edi
call fcn.00404887
pop ecx
test eax, eax
pop ecx
jne 0x4014c8
push str.cardr
push edi
call fcn.00404887
pop ecx
test eax, eax
pop ecx
jne 0x4014c8
push str.reader
push edi
call fcn.00404887
pop ecx
test eax, eax
pop ecx
je 0x4014cf
mov byte [esi + 0x10e1], 1
mov eax, dword [esi + 0x10cc]
pop ebp
cmp eax, 2
jg 0x4014e5
jne 0x4014ec
cmp byte [esi + 0x10e1], bl
je 0x4014ec
mov byte [esi + 0x10e0], 1
mov eax, dword [esi + 0x10b4]
cmp eax, 2
jne 0x40152b
cmp byte [esi + 0x10bd], bl
jne 0x40150e
cmp byte [esi + 0x10be], bl
jne 0x40150e
mov byte [esi + 0x10e2], 1
cmp eax, 2
jne 0x40152b
cmp dword [esi + 0x37c], 7
je 0x40152b
cmp byte [esi + 0x10e1], bl
je 0x40152b
mov byte [esi + 0x10e2], 1
movzx eax, byte [esi + 0x10e2]
push eax
movzx eax, byte [esi + 0x10e1]
push eax
movzx eax, byte [esi + 0x10e0]
push eax
lea eax, [esi + 0x33c]
push eax
lea eax, [esi + 0x2bc]
push eax
push dword [esi + 0x37c]
push esi
push str.vol_s__bus_i__fn_s__fsn_s_mscr_i_fcr_i_ok4nmnl_i
push 3
call fcn.0040116e
add esp, 0x24
pop edi
pop esi
pop ebx
ret 4
Function at 0x401fbc
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f8
push ebx
push esi
push edi
push 0x41
mov edi, ecx
pop ebx
mov dword [ebp - 4], 0x1a
push ebx
lea eax, [ebp - 0xf8]
push str._c:_
push eax
call fcn.00404bae
add esp, 0xc
lea eax, [ebp - 0x78]
push 0x104
push eax
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
je 0x40203f
lea eax, [ebp - 0x78]
mov ecx, edi
push eax
call fcn.004021b8
cmp eax, 0xffffffff
je 0x40203f
imul eax, eax, 0x10e4
lea ecx, [ebp - 0xf8]
lea esi, [eax + edi + 0xeac]
push ecx
mov ecx, dword [esi]
shl ecx, 7
add ecx, eax
lea eax, [ecx + edi + 0x9ac]
push eax
call fcn.00404900
inc dword [esi]
pop ecx
pop ecx
inc ebx
dec dword [ebp - 4]
jne 0x401fd4
lea eax, [ebp - 0x44]
push 0x34
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x4021a8
xor ebx, ebx
lea eax, [ebp - 0x44]
mov ecx, edi
push eax
mov dword [ebp - 4], ebx
call fcn.004021b8
cmp eax, 0xffffffff
je 0x402191
imul eax, eax, 0x10e4
cmp byte [eax + edi + 0x10be], bl
jne 0x402191
push ebx
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
lea eax, [ebp - 0x44]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test byte [ebp - 4], 0x80
je 0x402191
lea eax, [ebp - 0x1f8]
push 0x34
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x402188
lea eax, [ebp - 0x44]
push eax
call fcn.004040b2
cmp al, bl
pop ecx
je 0x40216b
movsx eax, al
lea ecx, [ebp - 0x1f8]
push ecx
push eax
lea eax, [ebp - 0x178]
push str._c:_s
push eax
call fcn.00404bae
add esp, 0x10
push str.FMP_1
push 4
call fcn.0040116e
pop ecx
lea eax, [ebp - 0x78]
pop ecx
push 0x34
push eax
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
push str.FMP_2
push 4
mov esi, eax
call fcn.0040116e
pop ecx
cmp esi, ebx
pop ecx
je 0x40216b
lea eax, [ebp - 0x78]
mov ecx, edi
push eax
call fcn.004021b8
cmp eax, 0xffffffff
je 0x40216b
imul eax, eax, 0x10e4
lea ecx, [ebp - 0x178]
lea esi, [eax + edi + 0xeac]
push ecx
mov ecx, dword [esi]
shl ecx, 7
add ecx, eax
lea eax, [ecx + edi + 0x9ac]
push eax
call fcn.00404900
inc dword [esi]
pop ecx
pop ecx
lea eax, [ebp - 0x1f8]
push 0x80
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
test eax, eax
jne 0x4020c9
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
lea eax, [ebp - 0x44]
push 0x34
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
test eax, eax
jne 0x40205f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
pop edi
pop esi
mov al, 1
pop ebx
leave
ret