joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100957b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x100a0ba8], 0x4e7
mov dword [0x100a0bac], 0
mov dword [0x100a0bb0], 0
mov dword [0x100a0bbc], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jne 0x10095914
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov dword [0x100a0ba8], 0x1670
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x100a0bac], edx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x100a0bb0], edx
mov esi, dword [0x100a0ba4]
add esi, 0x7be
mov dword [0x100a0ba4], esi
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x100a0bb4], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x100a0bb4]
mov edx, dword [0x100a0bb0]
mov byte [edi + edx], cl
mov dword [0x100a0ba4], 0xa1
mov edx, dword [0x100a0bac]
movzx edx, byte [edi + edx]
mov ebx, dword [0x100a0bb0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x100a0bbc], ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov byte [ebx + edx], cl
mov ecx, dword [0x100a0ba8]
add ecx, 0xffffdc3f
mov dword [0x100a0ba8], ecx
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x38], edx
je 0x1009590f
mov eax, dword [0x100a0bac]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x100a0bb0]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jmp 0x1009580c
jmp 0x10095804
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
jmp 0x1009580c

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x4fb331b2
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6bdc1ec0
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2ed01a62
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1c384918
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40b750
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov edx, ebx
push esi
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40b760
sub edx, ecx
sar edx, 1
push 2
lea eax, [edx + 4]
push eax
call fcn.00464c74
mov esi, eax
add esp, 8
mov dword [ebp - 4], esi
test esi, esi
jne 0x40b78f
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 2
push 0x104
call fcn.00464c74
mov edi, eax
add esp, 8
test edi, edi
jne 0x40b7b8
push esi
call fcn.00464c8a
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor esi, esi
sub ecx, ebx
nop
movzx eax, word [ebx]
lea ebx, [ebx + 2]
mov word [ecx + ebx - 2], ax
test ax, ax
jne 0x40b7c0
mov ebx, dword [ebp - 4]
push 0x5c
push ebx
call fcn.004626c5
add esp, 8
test eax, eax
je 0x40b7e8
xor ecx, ecx
mov word [eax + 2], cx
cmp word [ebx], 0x5c
jne 0x40b810
cmp word [ebx + 2], 0x5c
jne 0x40b810
lea eax, [ebx + 4]
push 0x5c
push eax
call fcn.00462767
add esp, 8
test eax, eax
je 0x40b8b3
lea ebx, [eax + 2]
jmp 0x40b821
cmp word [ebx + 2], 0x3a
jne 0x40b821
cmp word [ebx + 4], 0x5c
jne 0x40b821
add ebx, 6
push 0x5c
push ebx
call fcn.00462767
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40b8b0
mov ecx, dword [ebp - 4]
mov eax, ebx
sub eax, ecx
sar eax, 1
push eax
push ecx
push edi
call fcn.004661fe
push edi
call fcn.004663cc
add esp, 0x10
test eax, eax
je 0x40b877
push edi
call fcn.004663d7
add esp, 4
test eax, eax
je 0x40b864
mov esi, 1
jmp 0x40b877
push edi
call fcn.004663cc
add esp, 4
test eax, eax
mov eax, 1
cmovne esi, eax
lea eax, [ebx + 2]
mov dword [ebp - 8], ebx
push 0x5c
push eax
call fcn.00462767
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40b895
mov ecx, dword [ebp - 8]
test esi, esi
je 0x40b835
mov ebx, dword [ebp - 4]
push edi
call fcn.00464c8a
push ebx
call fcn.00464c8a
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
mov edx, edi
mov ecx, ebx
sub edx, ebx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x40b8c0
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b8d5
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x40b8f8
cmp word [edi + ecx*2 - 2], 0x5c
jne 0x40b8f8
xor eax, eax
mov word [edi + ecx*2 - 2], ax
push edi
call fcn.004663cc
add esp, 4
test eax, eax
je 0x40b898
push edi
call fcn.004663d7
add esp, 4
test eax, eax
je 0x40b91c
mov esi, 1
jmp 0x40b898
push edi
call fcn.004663cc
add esp, 4
mov ecx, 1
test eax, eax
cmovne esi, ecx
jmp 0x40b898
Function at 0x40dc30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, dword [edi + 0xbc]
mov eax, dword [ecx + 0x14]
add esi, edi
mov edx, dword [edi + 0x1c]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0x18]
mov ecx, 1
mov dword [esi + 0xc], eax
mov eax, pe_nt_image_headers32
mov dword [esi + 0x10], 1
test word [edi + 0x94], ax
jne 0x40dc76
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x14], 0
lea eax, [edx + 0x3a]
mov ebx, dword [edi + 0x78]
test bl, 4
je 0x40dc8d
test byte [eax], 1
je 0x40dcb7
and ebx, 0xfffffffb
mov dword [edi + 0x78], ebx
mov ebx, eax
mov ecx, dword [esi + 0x10]
or ecx, 0x200
mov dword [esi + 0x10], ecx
test byte [ebx], 2
je 0x40dcb7
mov eax, dword [edx + 0x46]
or ecx, 0x400
mov dword [esi + 0x14], eax
mov eax, ebx
mov dword [esi + 0x10], ecx
test dword [edi + 0x78], 0x400
je 0x40dcc9
or ecx, 0x4000
mov dword [esi + 0x10], ecx
test byte [eax], 4
je 0x40dcd7
or ecx, 0x100
mov dword [esi + 0x10], ecx
mov eax, dword [ebp + 8]
mov ebx, 1
test byte [eax + 6], 2
je 0x40dd04
or ecx, 0x80
mov word [esi + 0x20], bx
mov dword [esi + 0x10], ecx
cmp word [edi + 0x18], 3
jne 0x40dd09
mov eax, 0x2000
or word [edi + 0x7c], ax
jmp 0x40dd09
or word [esi + 0x20], 0x20
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x18], ecx
mov eax, dword [edx + 0x40]
mov dword [esi + 0x1c], eax
cmp cx, 0xd
jne 0x40dd68
mov ecx, dword [0x49e5d4]
movsx edx, word [edx]
cmp edx, dword [ecx + 0x194]
jge 0x40dd5b
mov eax, dword [ecx + 0x198]
movzx eax, word [eax + edx*2]
mov dword [ecx + 0x1a0], eax
lea edx, [eax + eax*2]
shl edx, 4
add edx, dword [ecx + 0x400]
je 0x40dd5b
mov ecx, dword [edx + 0x28]
test ecx, ecx
je 0x40dd5b
mov edx, dword [edx + 0xc]
call fcn.0044d970
jmp 0x40dd5d
xor eax, eax
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x40dd68
mov word [esi + 0x18], ax
cmp dword [edi + 0xcc], 0
jne 0x40dd8d
or word [esi + 0x20], 2
mov eax, ebx
or dword [esi + 0x10], 8
mov ecx, dword [esi + 0x10]
movzx ecx, cx
pop edi
mov word [esi + 0x22], cx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [esi + 0x10]
pop edi
mov word [esi + 0x22], ax
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x54]
mov dword [esi + 0x104], ecx
sub ecx, dword [esi + 0x58]
add eax, ecx
mov dword [esi + 0x108], edx
sub edx, dword [esi + 0x5c]
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0x64]
add eax, edx
mov dword [esi + 0x118], ecx
mov dword [esi + 0x124], eax
mov ecx, esi
mov eax, dword [esi + 0xdc]
mov dword [esi + 0x10c], eax
mov eax, dword [esi + 0xe8]
mov dword [esi + 0x11c], edx
mov edx, 1
mov dword [esi + 0x110], eax
pop esi
pop ebp
jmp fcn.0044b4b0
Function at 0x45eb40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x49c014]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm1, xmmword [0x48e0a0]
xor al, al
push ebx
push esi
mov byte [ebp - 0x412], al
lea esi, [ebp - 0x3fc]
push edi
mov edi, dword [ebp + 8]
mov al, 0x36
mov dword [ebp - 0x420], edx
mov ah, 1
mov dword [ebp - 0x424], ecx
mov edx, 8
mov dword [ebp - 0x41c], edi
mov byte [ebp - 0x411], al
mov dword [ebp - 0x410], 0
mov dword [ebp - 0xc], 0
lea ecx, [edx - 8]
movd xmm0, ecx
lea esi, [esi + 0x40]
pshufd xmm0, xmm0, 0
lea ecx, [edx - 4]
paddd xmm0, xmm1
movups xmmword [esi - 0x50], xmm0
movd xmm0, ecx
lea ecx, [edx + 4]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [esi - 0x40], xmm0
movd xmm0, edx
add edx, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [esi - 0x30], xmm0
movd xmm0, ecx
lea ecx, [edx - 8]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [esi - 0x20], xmm0
cmp ecx, 0x100
jl 0x45eba0
xor esi, esi
xor ebx, ebx
xor edx, edx
mov dword [ebp - 0x418], edx
nop word [eax + eax]
mov cl, al
shr al, 1
shl cl, 7
add al, cl
test ah, ah
je 0x45ec45
movzx edx, byte [esi + edi]
mov cl, al
and cl, 1
add cl, 2
movzx ecx, cl
imul edx, ecx
mov ch, byte [ebp - 0x411]
add ch, dl
mov edx, dword [ebp - 0x418]
mov byte [ebp - 0x411], ch
jmp 0x45ec4b
mov ch, byte [ebp - 0x411]
mov cl, byte [esi + edi]
xor cl, al
jne 0x45ec6b
test ah, ah
je 0x45ec61
cmp ch, byte [esi + edi + 1]
sete byte [ebp - 0x412]
mov cl, byte [edi]
mov al, 0x1b
xor ah, ah
xor esi, esi
xor cl, al
mov edx, dword [ebp + edx*4 - 0x40c]
inc esi
mov edi, dword [ebp - 0x418]
add bl, dl
add bl, cl
movzx ebx, bl
mov ecx, dword [ebp + ebx*4 - 0x40c]
mov dword [ebp + edi*4 - 0x40c], ecx
mov dword [ebp + ebx*4 - 0x40c], edx
mov edx, edi
mov edi, dword [ebp - 0x41c]
inc edx
mov dword [ebp - 0x418], edx
cmp edx, 0x100
jl 0x45ec10
cmp byte [ebp - 0x412], 0
je 0x45ed28
mov edi, dword [ebp - 0x420]
xor esi, esi
mov edx, dword [ebp - 0x410]
mov ebx, dword [ebp - 0xc]
test edi, edi
jle 0x45ed12
nop
inc dl
movzx edx, dl
mov ecx, dword [ebp + edx*4 - 0x40c]
mov al, cl
add al, bl
movzx ebx, al
mov eax, dword [ebp + ebx*4 - 0x40c]
mov dword [ebp + edx*4 - 0x40c], eax
mov dword [ebp + ebx*4 - 0x40c], ecx
add cl, al
movzx eax, cl
mov ecx, dword [ebp - 0x424]
mov al, byte [ebp + eax*4 - 0x40c]
xor byte [esi + ecx], al
inc esi
cmp esi, edi
jl 0x45ecd0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461195
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00461195
mov esp, ebp
pop ebp
ret
Function at 0x405690
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4481ab
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x45d320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0042b018
push 4
mov dword [ebp - 4], 0
call fcn.0042b831
mov edi, eax
add esp, 4
test edi, edi
je 0x405710
call fcn.0042ade8
mov dword [edi], eax
call fcn.0042aba7
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0042aadc
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x405706
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0042ab04
jmp 0x405712
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408c70
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
push str.advapi32.dll
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x408c9b
push str.advapi32.dll
call fcn.00409360
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExW
push edi
call ebx
push str.RegCreateKeyExW
push edi
mov dword [esi + 4], eax
call ebx
push str.RegQueryValueExW
push edi
mov dword [esi + 8], eax
call ebx
push str.RegSetValueExW
push edi
mov dword [esi + 0x10], eax
call ebx
push str.RegEnumKeyExW
push edi
mov dword [esi + 0x14], eax
call ebx
push str.RegEnumValueW
push edi
mov dword [esi + 0x18], eax
call ebx
push str.RegDeleteValueW
push edi
mov dword [esi + 0x1c], eax
call ebx
push str.RegCloseKey
push edi
mov dword [esi + 0x20], eax
call ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00408bf0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x409260
Capabilities:
Get file attributes

Disassembly:
push esi
xor esi, esi
push edi
cmp dword [0x460a88], esi
jne 0x40929b
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x409291
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x460a84], eax
mov dword [0x460a88], 1
mov eax, dword [0x460a84]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4092b4
push ebx
push eax
call edi
mov esi, eax
test esi, esi
jne 0x4092f2
mov eax, dword [0x460a8c]
test eax, eax
jne 0x4092eb
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x4092d5
mov eax, dword [0x453aac]
push eax
call dword [0x453aa8]
jmp 0x4092e2
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x453aa0]
test eax, eax
je 0x4092f2
mov dword [0x460a8c], eax
push ebx
push eax
call edi
pop edi
pop esi
ret
pop edi
mov eax, esi
pop esi
ret
Function at 0x40a960
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44981b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x45d320]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
mov dword [ebp - 0x23c], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x40aa5e
lea edx, [ebp - 0x21c]
push edx
call fcn.00430475
add esp, 4
cmp word [ebp - 0x21c], 0
lea edi, [ebp - 0x21c]
je 0x40aa5e
movzx eax, word [edi]
mov dword [ebp - 0x240], eax
cmp eax, 0x43
jb 0x40aa3b
push eax
lea esi, [ebp - 0x238]
call fcn.0040b070
mov dword [ebp - 4], 0
cmp dword [ebp - 0x228], 0
je 0x40aa1c
mov ecx, dword [ebp - 0x23c]
lea edx, [ebp - 0x240]
call fcn.0040b9a0
push 0xffffffffffffffff
push 0
mov ecx, esi
push ecx
mov ecx, eax
call fcn.00409cf0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], 8
jb 0x40aa3b
mov edx, dword [ebp - 0x238]
push edx
call fcn.0042b4be
add esp, 4
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40aa40
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 + 2], cx
lea edi, [edi + eax*2 + 2]
jne 0x40a9d3
mov ecx, dword [ebp - 0x23c]
xor eax, eax
cmp dword [ecx + 8], eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042bea8
mov esp, ebp
pop ebp
ret 4
Function at 0x40b3f0
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x45d320]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
push str.Floppy
xor edi, edi
push eax
mov dword [ebp - 0x46c], edi
call fcn.0042fb38
add esp, 8
test eax, eax
setne al
test al, al
jne 0x40b62b
push esi
push 0x12
push 0
push 0
push 0x44fe88
call dword [0x461008]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b619
xor eax, eax
push ebx
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x43c]
push eax
xor ebx, ebx
push ebx
push 0x44fe88
push ebx
mov edi, 0x1c
push esi
mov dword [ebp - 0x43c], edi
mov dword [ebp - 0x464], edi
call dword [0x46100c]
test eax, eax
je 0x40b5fb
jmp 0x40b4a5
mov edi, 0x1c
lea ecx, [ebp - 0x464]
push ecx
push ebx
push 0x44fe88
push 0
push esi
call dword [0x46100c]
push 0
lea edx, [ebp - 0x468]
push edx
push 0
push 0
lea eax, [ebp - 0x464]
push eax
push esi
mov dword [ebp - 0x468], 0
call dword [0x461010]
mov ecx, dword [ebp - 0x468]
test ecx, ecx
je 0x40b5c0
cmp ecx, 0x400
ja 0x40b5c0
xor eax, eax
mov dword [ebp - 0x420], eax
lea edx, [ebp - 0x420]
push edx
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0x468]
push eax
push ecx
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 0x464]
push edx
push esi
mov dword [ebp - 0x404], 6
mov dword [ebp - 0x420], edi
call dword [0x461010]
test eax, eax
je 0x40b5c0
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40b5c0
push 0
lea ecx, [ebp - 0x470]
push ecx
push 0xc
lea edx, [ebp - 0x448]
push edx
push 0
push 0
push 0x2d1080
push edi
mov dword [ebp - 0x470], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40b5b9
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x444]
je 0x40b5e1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x43c]
push ecx
inc ebx
push ebx
push 0x44fe88
push 0
push esi
call dword [0x46100c]
test eax, eax
jne 0x40b4a0
jmp 0x40b5fb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [0x461014]
mov edx, dword [ebp - 0x40c]
mov dword [ebp - 0x46c], edx
push esi
call dword [0x461014]
mov eax, dword [ebp - 0x46c]
pop ebx
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042bea8
mov esp, ebp
pop ebp
ret
pop esi
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042bea8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0042bea8
mov esp, ebp
pop ebp
ret
Function at 0x40f8f0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push edi
mov ebx, ecx
mov edi, edx
test esi, esi
je 0x40f934
mov dword [0x461028], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0xffffffffffffffff
push 0
push edi
mov ecx, 0x45edb4
mov dword [0x461030], eax
call fcn.00409cf0
push 0
push 0
push 0
push 0x414f70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00423853
test eax, eax
je 0x40f94b
mov edi, str.time.windows.com
call fcn.0040f9a0
test eax, eax
jne 0x40f966
call fcn.00423853
test eax, eax
je 0x40f962
mov edi, str.time.nist.gov
call fcn.0040f9a0
test eax, eax
jne 0x40f966
xor edi, edi
jmp 0x40f96b
mov edi, 1
test esi, esi
je 0x40f98f
mov eax, dword [0x46102c]
mov dword [0x461028], 1
test eax, eax
je 0x40f98f
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x410100
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448ca8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x45d320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
push 0x1c
push str.url.dll_FileProtocolHandler
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], eax
call fcn.00408e30
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x2c]
call fcn.00405780
mov eax, dword [ebp - 0x2c]
mov esi, 8
cmp dword [ebp - 0x18], esi
jae 0x41016e
lea eax, [ebp - 0x2c]
push 1
push 0
push eax
push str.rundll32.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x18], esi
jb 0x410196
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0042b4be
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042bea8
mov esp, ebp
pop ebp
ret

Function at 0x4116e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, eax
xor esi, esi
xor eax, eax
cmp ebx, esi
je 0x4117cf
cmp dword [ebx + 8], 0x70b
jne 0x4117cf
mov ecx, dword [ebx + 0xc]
cmp ecx, 0x201
je 0x41171a
cmp ecx, 0x203
jne 0x4117cf
mov eax, dword [ebp + 8]
push edi
push 0x27da
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
mov edi, eax
push 0xb0
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
call esi
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push eax
push ecx
push 0xb1
push edi
call esi
mov esi, dword [ebx + 0x1c]
sub esi, dword [ebx + 0x18]
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042b411
mov ebx, eax
lea eax, [esi + esi + 2]
push eax
push 0
push ebx
call fcn.0042c3a0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x10
push ebx
push 0
push 0x43e
push edi
call esi
mov ecx, dword [ebp + 8]
push 1
push 0
push 0
push ebx
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
call fcn.0042c6ad
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add esp, 4
push edx
push eax
push 0xb1
push edi
call esi
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret