joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100080c7
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100080c7
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100080c7
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100080c7
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100080c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100080c7
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100080c7
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100080c7
push 0xd008
push edi
call fcn.100080c7
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100080c7
int3

Function at 0x100080c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x100080d6
pop dword [ebp - 0x3c]
mov eax, 0x1e9bd5cc
add eax, 0xf164ab0a
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3a7fe
push 0
mov eax, 0x6d23157
add eax, 0x92f0f0d
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0xc4e16964
add ecx, 0x3b1ee499
mov edi, eax
mov ebx, 0x8eb82b29
sub ebx, 0x7eb6a529
add ebx, dword [ebp - 0x3c]
mov esi, 0xf5604ef1
sub esi, 0x55bb4532
xor dword [ebp - 0x18], 0xf59a776b
mov edx, dword [ebx]
xor edx, esi
xor dword [ebp - 0xc], edi
mov dword [edi], edx
mov dword [ebp - 0x30], 0xac32a564
add edi, 4
add ebx, 0x7f46d8d
add ebx, 0xf80b9277
loop 0x10008135
add eax, 0xeca45712
sub eax, 0xeca32c4b
xor ebx, ebx
add ebx, eax
add eax, 0x119647ae
sub eax, 0x119647a9
mov ecx, 0xa4fb10e2
sub ecx, 0x94fb10e2
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x406930
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
sub esp, 0xc
xor eax, eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi]
mov edx, dword [eax + 0x493470]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x48
jl 0x40693b
xor eax, eax
mov ecx, 0x100
mov edx, dword [edi + 4]
mov esi, dword [eax + 0x4934b8]
mov dword [eax + edx], esi
add eax, 4
dec ecx
jne 0x406955
cmp eax, 0x1000
jl 0x406950
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor esi, esi
xor eax, eax
mov dword [esp + 0x18], eax
mov edx, dword [edi]
xor ebx, ebx
add eax, edx
mov dword [esp + 0x24], eax
lea eax, [esi + 1]
cdq
idiv ebp
lea eax, [esi + 2]
mov bl, byte [edx + ecx]
cdq
idiv ebp
mov bh, byte [esi + ecx]
xor eax, eax
shl ebx, 8
mov al, byte [edx + ecx]
or ebx, eax
lea eax, [esi + 3]
cdq
idiv ebp
xor eax, eax
shl ebx, 8
mov al, byte [edx + ecx]
or ebx, eax
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
xor edx, ebx
mov dword [eax], edx
lea eax, [esi + 4]
cdq
idiv ebp
mov eax, dword [esp + 0x18]
add eax, 4
cmp eax, 0x48
mov dword [esp + 0x18], eax
mov esi, edx
jl 0x40697e
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, edi
call fcn.00406130
mov eax, dword [edi]
mov ecx, dword [esp + 0x10]
mov dword [esi + eax], ecx
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
mov dword [esi + edx + 4], eax
add esi, 8
cmp esi, 0x48
jl 0x4069e0
mov esi, 4
mov ebx, 0x80
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, edi
call fcn.00406130
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x10]
mov dword [esi + eax - 4], ecx
mov edx, dword [edi + 4]
mov eax, dword [esp + 0x14]
mov dword [esi + edx], eax
add esi, 8
dec ebx
jne 0x406a16
cmp esi, 0x1004
jl 0x406a11
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8

Function at 0x4071d0
Capabilities:
Query or enumerate registry value

Disassembly:
call fcn.004074e0
test eax, eax
je 0x407245
push 0x494500
push 0x4944f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [fcn.00498e7c], eax
jne 0x4071fd
or eax, 0xffffffff
ret
push 0
push 0x2c
push 0x498e50
push 0
call eax
test eax, eax
je 0x407212
or eax, 0xffffffff
ret
mov dword [0x498e48], 0
mov dword [0x498e4c], 0
mov dword [0x498e40], 0
mov dword [0x498e44], 0
call fcn.004073b0
mov eax, 1
ret
push 0x498e3c
push 0xf003f
push 0
push 0x4944e4
push reloc.OLEAUT32.dll_SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x407269
or eax, 0xffffffff
ret
mov eax, dword [0x498e3c]
push 0x498e38
push 0x498e30
push 0x498e34
push 0
push 0x4944d4
push eax
mov dword [0x498e38], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [0x498e3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret
Function at 0x4072b0
Capabilities:
Query or enumerate registry value

Disassembly:
call fcn.004074e0
test eax, eax
jne 0x407315
push 0x498e3c
push 0xf003f
push eax
push 0x49451c
push reloc.OLEAUT32.dll_SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4072dc
or eax, 0xffffffff
ret
mov eax, dword [0x498e3c]
push 0x498e38
push 0x498e30
push 0x498e34
push 0
push 0x4944d4
push eax
mov dword [0x498e38], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [0x498e3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret
Function at 0x409c40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47603f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x4967f0]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x38]
mov ebx, 2
push 0x498ae8
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.00463355
test esi, esi
je 0x409d82
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x3c]
push esi
push eax
mov ecx, edi
call fcn.0045d0d0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 3
call fcn.00463305
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], bl
call fcn.004631cc
mov ecx, dword [edi + 0x1c]
push esi
push 3
push 0x110a
push ecx
call ebp
test eax, eax
jne 0x409d2b
lea edx, [esp + 0x1c]
push 3
push edx
lea ecx, [esp + 0x1c]
call fcn.0045bb85
lea ecx, [esp + 0x18]
push ebx
push ecx
mov ecx, eax
mov byte [esp + 0x38], 4
call fcn.0045bc01
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 5
call fcn.00463305
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 4
call fcn.004631cc
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.004631cc
push 0x494648
lea ecx, [esp + 0x18]
call fcn.00463534
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.004633fb
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 6
call fcn.00463305
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], bl
call fcn.004631cc
mov edx, dword [edi + 0x1c]
push esi
push 3
push 0x110a
push edx
call ebp
mov esi, eax
test esi, esi
jne 0x409ca4
pop ebp
push 1
push 0x5c
lea ecx, [esp + 0x1c]
call fcn.0045b8d3
lea eax, [esp + 0x1c]
push 1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 7
call fcn.0045bb85
mov ecx, dword [esp + 0x14]
mov eax, dword [eax]
push ecx
push eax
call fcn.0043ca7a
add esp, 8
lea ecx, [esp + 0x1c]
test eax, eax
sete byte [esp + 0x38]
call fcn.004631cc
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], bl
call fcn.004631cc
mov al, byte [esp + 0x38]
test al, al
je 0x409ded
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x10]
mov eax, dword [edx - 8]
dec eax
push eax
call fcn.0046369e
mov esi, dword [esp + 0x34]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00462f41
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.004631cc
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.004631cc
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x40b7b0
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1c8
test eax, eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
je 0x40b979
mov eax, dword [edi + 0x78]
push 0
push 0
push 0x1004
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
xor ebp, ebp
test ebx, ebx
mov byte [esp + 0x13], 0
jle 0x40b888
push ebp
lea ecx, [edi + 0x5c]
call fcn.0045cff2
mov esi, eax
test esi, esi
je 0x40b873
mov ecx, dword [esp + 0x1dc]
mov eax, dword [esi]
cmp eax, ecx
jne 0x40b873
mov eax, dword [esi + 4]
mov byte [esp + 0x13], 1
inc eax
mov dword [esi + 4], eax
mov edx, dword [edi + 0x238]
mov ecx, dword [edi + 0x23c]
add dword [esi + 8], edx
mov edx, dword [esi + 0xc]
push eax
push 0x4931f8
adc edx, ecx
mov dword [esi + 0xc], edx
lea edx, [esp + 0x1c]
push edx
call fcn.0043c57a
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [edi + 0x5c]
push eax
push 2
push ebp
call fcn.0045cedd
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
call fcn.00411ac0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 3
push ebp
lea ecx, [edi + 0x5c]
call fcn.0045cedd
inc ebp
cmp ebp, ebx
jl 0x40b7ec
mov al, byte [esp + 0x13]
test al, al
jne 0x40b979
push 0x501
lea edx, [esp + 0x7c]
push 0x160
push edx
lea eax, [edi + 0x134]
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x7c]
push 0
push ecx
push 0
lea edx, [esp + 0x194]
push 0
lea ebp, [edi + 0x5c]
push edx
push ebx
push 3
mov ecx, ebp
call fcn.0045cde2
xor eax, eax
xor ecx, ecx
mov al, byte [esp + 0x1de]
lea edx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1e0]
mov cl, ah
and eax, 0xff
push ecx
push eax
push 0x494748
push edx
call fcn.0043c57a
add esp, 0x14
lea eax, [esp + 0x14]
mov ecx, ebp
push eax
push 1
push ebx
call fcn.0045cedd
push 0x10
call fcn.00462485
add esp, 4
mov esi, eax
mov ecx, ebp
push esi
push 0
push 0
push 0
push 0
push 4
push 0
push ebx
call fcn.0045ce64
mov ecx, dword [esp + 0x1dc]
mov dword [esi + 4], 1
mov dword [esi], ecx
mov edx, dword [edi + 0x238]
mov dword [esi + 8], edx
mov eax, dword [edi + 0x23c]
push 0x494744
push 2
push ebx
mov ecx, ebp
mov dword [esi + 0xc], eax
call fcn.0045cedd
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
call fcn.00411ac0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 3
push ebx
mov ecx, ebp
call fcn.0045cedd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c8
ret 4
Function at 0x40be70
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
push esi
call fcn.0043c72b
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40be90
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
push 0
rep stosb byte es:[edi], al
mov eax, dword [0x498e90]
mov edi, dword [esp + 0x20]
cdq
idiv esi
push 0
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test ebp, ebp
mov dword [esp + 0x20], 0
jle 0x40beec
lea eax, [esp + 0x10]
push 0
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40befd
mov eax, dword [esp + 0x20]
inc eax
cmp eax, ebp
mov dword [esp + 0x20], eax
jl 0x40becb
push ebx
call fcn.0043c6b4
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ebx
call fcn.0043c6b4
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
Function at 0x40da20
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x160
lea eax, [esp]
mov dword [0x498ea4], 0
mov dword [0x498ea8], 0
push esi
mov esi, dword [esp + 0x168]
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push 0x101
push 0x160
push eax
push 0
push esi
call edi
test eax, eax
je 0x40da75
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [0x498eb0], ecx
mov dword [0x498ea8], edx
push 0x103
lea eax, [esp + 0xc]
push 0x160
push eax
push 0
push esi
call edi
pop edi
pop esi
test eax, eax
je 0x40daa3
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov dword [0x498eac], ecx
mov dword [0x498ea4], edx
add esp, 0x160
ret

Function at 0x40dc75
Capabilities:
Get disk size

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp esi, ebp
jne 0x40dc83
xor eax, eax
jmp 0x40dc86
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x5f8]
push 0x1004
mov dword [ecx], eax
mov edx, dword [esi + 0x5f8]
mov dword [edx + 0x128], ebp
mov dword [edx + 0x12c], ebp
mov eax, dword [esi + 0x5f8]
mov dword [eax + 0x114], ebp
mov ecx, dword [esi + 0x5f8]
mov dword [ecx + 0x110], ebp
mov edx, dword [esi + 0x5f8]
mov eax, dword [esi + 0x8c]
mov dword [edx + 8], eax
call fcn.0043c72b
mov ebx, eax
mov ecx, 0x401
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x5f8]
add esp, 4
lea eax, [esp + 0x10]
mov dword [ecx + 4], 1
mov edx, dword [esi + 0x5f8]
push ebp
push eax
mov dword [edx + 0x130], ebp
push 0x1004
push ebx
push ebp
mov dword [edx + 0x134], ebp
mov ecx, dword [esi + 0x5f8]
push ebp
push 0x7400c
mov edx, dword [ecx + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40dda2
cmp dword [ebx], 0
jbe 0x40dda0
lea edi, [ebx + 0x1c]
mov eax, dword [edi]
test eax, eax
jbe 0x40dd96
mov edx, dword [esi + 0x5f8]
lea ecx, [esp + 0x24]
push ecx
push eax
mov eax, dword [edx + 8]
mov ecx, dword [eax + 4]
push ecx
call fcn.00410d60
add esp, 0xc
cmp eax, 0xffffffff
je 0x40dd96
lea edx, [esp + 0x1c]
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x2c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x40dd96
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0x5f8]
sub edx, ecx
mov ecx, dword [esp + 0x18]
sbb ecx, dword [esp + 0x20]
add dword [eax + 0x130], edx
adc dword [eax + 0x134], ecx
mov eax, dword [ebx]
inc ebp
add edi, 0x20
cmp ebp, eax
jb 0x40dd31
xor ebp, ebp
push 1
call fcn.00410270
add esp, 4
lea ecx, [esi + 0xa4]
push ebp
call fcn.00461e27
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
pop ebp
mov dword [0x498e9c], eax
pop ebx
add esp, 0x34
ret
Function at 0x40f070
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
imul ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x40f0a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
mov eax, esi
push edi
cdq
push edx
push eax
mov eax, dword [esp + 0x20]
push 0
push eax
call fcn.0043c680
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
imul eax, esi
lea edx, [esp + 0x20]
push 0
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 8
ret

Function at 0x40f100
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
imul ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push 0
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x40f130
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
mov eax, esi
push edi
cdq
push edx
push eax
mov eax, dword [esp + 0x20]
push 0
push eax
call fcn.0043c680
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
imul eax, esi
lea edx, [esp + 0x20]
push 0
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 8
ret
Function at 0x40fd60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc0
push ebx
push ebp
push esi
push edi
mov edi, 0x495308
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [esp + 0xd4]
mov eax, ecx
mov esi, edi
mov edi, ebx
mov dword [esp + 0x10], 0x4952e8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x14], 0x4952c8
and ecx, 3
mov dword [esp + 0x18], 0x4952a8
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x1c], 0x495288
mov dword [esp + 0x20], 0x495268
mov dword [esp + 0x24], 0x495248
mov dword [esp + 0x28], 0x495228
mov dword [esp + 0x2c], 0x495208
mov dword [esp + 0x30], 0x4951e8
mov dword [esp + 0x34], 0x4951c8
mov dword [esp + 0x38], 0x4951a8
mov dword [esp + 0x3c], 0x495188
mov dword [esp + 0x40], 0x495168
mov dword [esp + 0x44], 0x495148
mov dword [esp + 0x48], 0x495128
mov dword [esp + 0x4c], 0x495108
mov dword [esp + 0x50], 0x4950e8
mov dword [esp + 0x54], 0x4950c8
mov dword [esp + 0x58], 0x4950a8
mov dword [esp + 0x5c], 0x495088
mov dword [esp + 0x60], 0x495068
mov dword [esp + 0x64], 0x495048
mov dword [esp + 0x68], 0x495028
mov dword [esp + 0x6c], 0x495008
mov dword [esp + 0x70], 0x494fe8
mov dword [esp + 0x74], 0x494fc8
mov dword [esp + 0x78], 0x494fa8
mov dword [esp + 0x7c], 0x494f88
mov dword [esp + 0x80], 0x494f68
mov dword [esp + 0x84], 0x494f48
mov dword [esp + 0x88], 0x494f28
mov dword [esp + 0x8c], 0x494f08
mov dword [esp + 0x90], 0x494ee8
mov dword [esp + 0x94], 0x494ec8
mov dword [esp + 0x98], 0x494ea8
mov dword [esp + 0x9c], 0x494e88
mov dword [esp + 0xa0], 0x494e68
mov dword [esp + 0xa4], 0x494e48
mov dword [esp + 0xa8], 0x494e28
mov dword [esp + 0xac], 0x494e08
mov dword [esp + 0xb0], 0x494de8
mov dword [esp + 0xb4], 0x494dc8
mov dword [esp + 0xb8], 0x494da8
mov dword [esp + 0xbc], 0x494d88
mov dword [esp + 0xc0], 0x494d68
mov dword [esp + 0xc4], 0x494d48
mov dword [esp + 0xc8], 0x494d28
mov dword [esp + 0xcc], 0x494d24
xor edi, edi
mov esi, dword [esp + edi*4 + 0x10]
push esi
call fcn.0043d1e9
mov edx, eax
add esp, 4
cmp edx, ebp
jne 0x40ff90
lea edi, [esi + 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or edi, 0xffffffff
jmp 0x40ff91
inc edi
cmp edx, 0xffffffff
je 0x40ff9b
cmp edi, 0xffffffff
jne 0x40ff58
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xc0
ret
Function at 0x410d60
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov edi, 0x498ae8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x4954a0]
mov dx, word [0x4954a4]
mov al, byte [0x4954a6]
mov dword [esp + 0x20], ecx
mov ecx, dword [0x494640]
mov word [esp + 0x24], dx
mov byte [esp + 0x26], al
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor ecx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x18]
shr edx, cl
test dl, 1
je 0x410e4d
mov bl, cl
lea eax, [esp + 0x10]
add bl, 0x41
push eax
mov byte [esp + 0x14], bl
call edi
cmp eax, 3
jne 0x410e49
push 0
push 0
push eax
push 0
push eax
lea ecx, [esp + 0x34]
push 0xc0000000
push ecx
mov byte [esp + 0x40], bl
call esi
cmp eax, 0xffffffff
je 0x410e49
lea edx, [esp + 0x1c]
push 0
push edx
lea ecx, [esp + 0x30]
push 0xc
push ecx
push 0
push 0
push 0x2d1080
push eax
call ebp
test eax, eax
je 0x410e49
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
cmp edx, eax
jne 0x410e49
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
cmp eax, ecx
je 0x410e66
mov ecx, dword [esp + 0x14]
inc ecx
cmp ecx, 0x1a
mov dword [esp + 0x14], ecx
jl 0x410dd6
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x14]
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x410ea0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x28
push 0x4954b8
push 0x4954a8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410f1a
lea ecx, [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x18]
push ecx
push edx
call eax
test eax, eax
jne 0x410ede
xor al, al
add esp, 0x28
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, 0x14
call fcn.0043d4c0
mov ecx, dword [esp + 0x34]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x1c]
mov ecx, 0x14
call fcn.0043d4c0
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
add esp, 0x28
ret
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x34]
lea eax, [esp + 8]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x410f43
xor al, al
add esp, 0x28
ret
mov eax, dword [esp]
mov ecx, dword [esp + 0x34]
imul eax, dword [esp + 4]
mov edx, eax
imul eax, dword [esp + 0xc]
imul edx, dword [esp + 8]
shr edx, 0x14
mov dword [ecx], edx
mov dword [ecx + 4], 0
mov ecx, dword [esp + 0x30]
shr eax, 0x14
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov al, 1
add esp, 0x28
ret

Function at 0x411020
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
mov edi, dword [esp + 0x10]
push 0x4ff
push edi
push 0
push 0
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
call ebx
mov ecx, eax
sub ecx, esi
cmp ecx, edi
jge 0x41107e
push ebp
mov ebp, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, esi
jge 0x41105a
mov esi, eax
sub esi, eax
add edi, esi
mov esi, eax
call fcn.00410fd0
push 0x4ff
push edi
push 0
push 0
push 0
call ebp
call ebx
mov edx, eax
sub edx, esi
cmp edx, edi
jl 0x411054
pop ebp
pop edi
pop esi
pop ebx
ret