joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4875a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004f717c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret

Function at 0x493693
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
cmp dword [ebp - 0x15e0], 0
jne 0x4936af
mov dword [ebp - 0x2d4], 0
jmp 0x49396b
mov eax, dword [ebp - 0x15e0]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc9c], edx
push eax
push edx
add esp, 4
or eax, 0x6d51
call 0x4936d9
add byte [eax + 0x49], al
xor eax, 0x48374548
add esp, 4
xor eax, 0x12d5a
pop eax
push ecx
or ecx, 0x16e2d
pop ecx
push ebx
xor ebx, 0x464
pop ebx
cmp dword [ebp - 0xc9c], 0
jne 0x49370b
mov dword [ebp - 0x2d4], 0
jmp 0x49396b
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0x508], eax
push edi
xor edi, 0x10440
xor edi, 0xc6d0
pop edi
push edi
push ebx
add esp, 4
jmp 0x49372f
pop edi
push ebx
push ebx
add esp, 4
and ebx, 0x24c
add ebx, 0x76c1
jmp 0x493748
pop ebx
lea ecx, [ebp - 0x1740]
mov dword [ebp - 0xc98], ecx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc94], eax
xor ecx, ecx
mov word [ebp - 0x210], cx
xor edx, edx
mov word [ebp - 0x10c], dx
push edx
or edx, 0x887b
and edx, 0x351a
call 0x493791
add byte [0x35454b3f], dh
cmp al, 0x4f
cmp dword [ebx + 0x565a04c4], eax
or esi, 0xe478
add esi, 0xb945
jmp 0x4937a7
pop esi
mov eax, dword [ebp - 0xc94]
invalid
invalid

Function at 0x4936d9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
cmp dword [ebp - 0x15e0], 0
jne 0x4936af
mov dword [ebp - 0x2d4], 0
jmp 0x49396b
mov eax, dword [ebp - 0x15e0]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc9c], edx
push eax
push edx
add esp, 4
or eax, 0x6d51
call 0x4936d9
add byte [eax + 0x49], al
xor eax, 0x48374548
add esp, 4
xor eax, 0x12d5a
pop eax
push ecx
or ecx, 0x16e2d
pop ecx
push ebx
xor ebx, 0x464
pop ebx
cmp dword [ebp - 0xc9c], 0
jne 0x49370b
mov dword [ebp - 0x2d4], 0
jmp 0x49396b
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0x508], eax
push edi
xor edi, 0x10440
xor edi, 0xc6d0
pop edi
push edi
push ebx
add esp, 4
jmp 0x49372f
pop edi
push ebx
push ebx
add esp, 4
and ebx, 0x24c
add ebx, 0x76c1
jmp 0x493748
pop ebx
lea ecx, [ebp - 0x1740]
mov dword [ebp - 0xc98], ecx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc94], eax
xor ecx, ecx
mov word [ebp - 0x210], cx
xor edx, edx
mov word [ebp - 0x10c], dx
push edx
or edx, 0x887b
and edx, 0x351a
call 0x493791
add byte [0x35454b3f], dh
cmp al, 0x4f
cmp dword [ebx + 0x565a04c4], eax
or esi, 0xe478
add esi, 0xb945
jmp 0x4937a7
pop esi
mov eax, dword [ebp - 0xc94]
invalid
invalid
Function at 0x498700
Capabilities:
Encode data using xor

Disassembly:
add al, byte [edx]
xor ebx, 0xffffffe8
pop ds
add eax, dword [edx]
pop ebx
push ebp
add ebp, 0x1f
xor byte [edx], al
add al, byte [ebx + 0x2e780f5]
add bl, byte [ebp + 0x55]
pop eax
test esi, eax
push es
add ebp, 0x39
push edx
add al, byte [edx]
xor ebp, 0x65
pop ebx
add al, byte [edx]
pop ebp
enter 0x3a87, 0xfffffffffffffff9
xchg dword [edx], edi
stc
add dword [ecx], eax
dec esi
enter 0x3b87, 0xfffffffffffffff9
add dword [ecx], eax
jno 0x498695
xchg dword [ecx + edi*8], edi
add dword [ecx], eax
arpl ax, cx
xchg dword [0x660101f9], edi
enter 0x3e87, 0xfffffffffffffff9
add dword [ecx], eax
dec esi
enter 0x3f87, 0xfffffffffffffff9
add dword [ecx], eax
imul ecx, eax, 0xffffff87
inc eax
stc
add dword [ecx], eax
enter 0x4187, 0xfffffffffffffff9
add dword [ecx], eax
je 0x4986bf
xchg dword [edx - 7], eax
add dword [ecx], eax
arpl ax, cx
xchg dword [ebx - 7], eax
stc
stc
add dword [ecx], eax
je 0x4986cd
xchg dword [ecx + edi*8 + 1], eax
add dword [ebx - 0x38], edi
xchg dword [ebp - 7], eax
add dword [ecx], eax
pop ecx
enter 0x4687, 0xfffffffffffffff9
add dword [ecx], eax
add ah, byte [esi - 0x73]
bndldx bnd0, [edx]
add al, byte [edx]
mov ecx, dword [edi + 0x101e79e]
lea edx, [edi + 0x101e79e]
lea eax, [edx + esi - 0x75]
xchg dword [edx - 0x72fefe19], ebx
invalid

Function at 0x4aeedc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x71d8dc]
cmp dword [eax + 0x24], 0
je 0x4aef7f
cmp dword [ebx + 0x84], 0
jne 0x4aef79
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4aee6c
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x4aef79
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x4aef42
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4aef79
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.004e026c
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4aef51
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4af98c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x4af9c1
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004f6e20
jmp 0x4af9cb
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.004f6d8c
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x4b0908
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x4b0940
mov eax, esi
call fcn.004c119c
test al, al
je 0x4b0940
mov eax, dword [ebx + 0x74]
call fcn.004c0ea0
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x4b0940
push 0
mov eax, dword [ebx + 0x74]
call fcn.004c0ea0
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret

Function at 0x4b8a10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x71d978], 0
sete dl
or al, dl
jne 0x4b8b50
mov eax, dword [0x71d97c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x71d978]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4b8b1f
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x71d978]
call fcn.004e026c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4b8b17
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x4b8b17
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x4b8b17
mov eax, dword [ebp - 0x14]
call fcn.004c0ea0
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x4b8b17
push ebp
call fcn.004b89cc
pop ecx
test al, al
jne 0x4b8b17
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x4b8ad3
mov eax, dword [ebp - 0x14]
call fcn.004bf82c
dec eax
jle 0x4b8b17
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.004f6464
cmp byte [ebp - 1], 0
je 0x4b8b17
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x4b8b17
mov edx, dword [ebp - 0x14]
mov eax, dword [0x71d97c]
call fcn.004b8218
inc edi
dec esi
jne 0x4b8a66
mov eax, dword [0x71d97c]
cmp dword [eax + 8], 0
jle 0x4b8b37
mov eax, dword [0x71d97c]
call fcn.004b82a8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4b8b50
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004b8834
pop ecx
test al, al
jne 0x4b8b50
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cc494
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cc56c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x71d9c4], 0
jne 0x4cc550
lea eax, [ebp - 4]
mov edx, 0x4cc584
call fcn.004f6dd0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004f717c
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4cc550
mov eax, ebx
call fcn.004f5b58
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4cc549
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x4cc533
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4cc594
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x4cc533
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x71d9c4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc550
mov eax, dword [ebp - 0xc]
call fcn.004f5b70
ret
mov ebx, dword [0x71d9c4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc573
lea eax, [ebp - 4]
call fcn.004f6d38
ret

Function at 0x4dda90
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004dda14
push 1
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ddb02
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4ddad6
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.004f6ef0
jmp 0x4ddadd
mov eax, ebx
call fcn.004f6d38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddb09
cmp dword [ebp - 8], 0
je 0x4ddaf9
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.004dd9e8
ret

Function at 0x4ddb10
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004dda14
xor edx, edx
push ebp
push 0x4ddbb2
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x4ddb85
mov edx, ebx
mov eax, dword [0x49b878]
call fcn.0049fe34
test al, al
je 0x4ddb75
movzx eax, bx
push eax
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0049fd44
call fcn.004f6aa0
jmp 0x4ddbb9
movzx eax, bx
push eax
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x4ddb40
mov ecx, dword [0x71d450]
mov dl, 1
mov eax, dword [0x4eda40]
call fcn.004f1c90
call fcn.004f6a00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddbb9
mov eax, dword [ebp - 4]
call fcn.004dd9e8
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4ddbc0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004dda14
xor eax, eax
push ebp
push 0x4ddc18
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddc1f
mov eax, dword [ebp - 4]
call fcn.004dd9e8
ret

Function at 0x4ddc28
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004dda14
xor edx, edx
push ebp
push 0x4ddc7d
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddc84
mov eax, dword [ebp - 4]
call fcn.004dd9e8
ret

Function at 0x4ddcf4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004dda14
xor eax, eax
push ebp
push 0x4ddd69
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004dd9cc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0049fe08
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4ddd53
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddd70
mov eax, dword [ebp - 4]
call fcn.004dd9e8
ret

Function at 0x4ddd78
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004dda14
xor eax, eax
push ebp
push 0x4ddded
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004dd9cc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4dddd7
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dddf4
mov eax, dword [ebp - 4]
call fcn.004dd9e8
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402000
Capabilities:
Get storage device properties
Set console window title
Terminate process

Disassembly:
push str.S.M.A.R.T._ver_0.1
call dword [sym.imp.kernel32.dll_SetConsoleTitleA]
mov byte [0x4012ff], 0x4f
mov byte [0x401300], 0xc2
mov byte [0x401302], 0xb0
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
push str..PhysicalDrive0
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x4020a8
mov dword [0x4010c0], eax
push 0
push 0x4010bc
push 0x224
push 0x4010d4
push 0xc
push 0x4010c8
push 0x2d1400
push eax
call dword [sym.imp.kernel32.dll_DeviceIoControl]
mov eax, dword [0x4010e4]
add eax, 0x4010d4
push str._n________Attribute_ID________________Life__Max_Thresh_Min___Raw_Values_n
push eax
call 0x40208f
or cl, byte [edx]
or al, byte [ecx + ebp*2 + 0x73]
imul edi, dword [edx], 0x20
and byte [eax], ah
and eax, 0x73252073
add byte [eax], al
call dword [sym.imp.msvcrt.dll_printf]
add esp, 0xc
call 0x4020c1
inc byte [0x401024]
jmp 0x402020
push 0x401318
call dword [sym.imp.msvcrt.dll_gets]
add esp, 4
push 0
call dword [sym.imp.msvcrt.dll_exit]
add esp, 4
mov byte [0x4012fc], 0xd0
push 0
push 0x4010bc
push 0x210
push 0x401318
push 0x20
push 0x4012f8
push 0x7c088
push dword [0x4010c0]
call dword [sym.imp.kernel32.dll_DeviceIoControl]
or eax, eax
jne 0x4020f6
ret
mov byte [0x4012fc], 0xd1
push 0
push 0x4010bc
push 0x210
push 0x40152a
push 0x20
push 0x4012f8
push 0x7c088
push dword [0x4010c0]
call dword [sym.imp.kernel32.dll_DeviceIoControl]
mov edi, 0x40132a
mov ebp, 0x40153c
mov ecx, 0x1e
push ebp
push edi
push ecx
movzx eax, byte [edi]
mov dword [0x4010c4], eax
or al, al
je 0x4021bd
mov ecx, dword [0x403238]
mov ebx, eax
mov esi, section..smart
lodsd eax, dword [esi]
cmp eax, ebx
je 0x40215d
add esi, 4
loop 0x402151
jmp 0x4021bd
mov eax, dword [esi]
movzx ebx, byte [edi + 3]
movzx ecx, byte [edi + 4]
mov edx, dword [edi + 5]
movzx esi, byte [ebp + 1]
mov edi, 0x401026
cmp ebx, esi
jae 0x40217c
mov edi, 0x40102a
push edx
push ecx
push esi
push ebx
push edi
push eax
push dword [0x4010c4]
call 0x4021b4
or ah, byte [0x20643330]
and eax, 0x25202073
jae 0x4021ba
and byte [0x20643330], ah
and byte [eax], ah
and eax, 0x20643230
and byte [eax], ah
and eax, 0x20643330
and byte [eax], ah
and eax, 0xff000075
adc eax, sym.imp.msvcrt.dll_printf
add esp, 0x20
pop ecx
pop edi
pop ebp
add edi, 0xc
add ebp, 0xc
dec ecx
jne 0x402135
ret
Function at 0x40208f
Capabilities:
Get storage device properties

Disassembly:
push str.S.M.A.R.T._ver_0.1
call dword [sym.imp.kernel32.dll_SetConsoleTitleA]
mov byte [0x4012ff], 0x4f
mov byte [0x401300], 0xc2
mov byte [0x401302], 0xb0
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
push str..PhysicalDrive0
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x4020a8
mov dword [0x4010c0], eax
push 0
push 0x4010bc
push 0x224
push 0x4010d4
push 0xc
push 0x4010c8
push 0x2d1400
push eax
call dword [sym.imp.kernel32.dll_DeviceIoControl]
mov eax, dword [0x4010e4]
add eax, 0x4010d4
push str._n________Attribute_ID________________Life__Max_Thresh_Min___Raw_Values_n
push eax
call 0x40208f
or cl, byte [edx]
or al, byte [ecx + ebp*2 + 0x73]
imul edi, dword [edx], 0x20
and byte [eax], ah
and eax, 0x73252073
add byte [eax], al
call dword [sym.imp.msvcrt.dll_printf]
add esp, 0xc
call 0x4020c1
inc byte [0x401024]
jmp 0x402020
push 0x401318
call dword [sym.imp.msvcrt.dll_gets]
add esp, 4
push 0
call dword [sym.imp.msvcrt.dll_exit]
add esp, 4
mov byte [0x4012fc], 0xd0
push 0
push 0x4010bc
push 0x210
push 0x401318
push 0x20
push 0x4012f8
push 0x7c088
push dword [0x4010c0]
call dword [sym.imp.kernel32.dll_DeviceIoControl]
or eax, eax
jne 0x4020f6
ret
mov byte [0x4012fc], 0xd1
push 0
push 0x4010bc
push 0x210
push 0x40152a
push 0x20
push 0x4012f8
push 0x7c088
push dword [0x4010c0]
call dword [sym.imp.kernel32.dll_DeviceIoControl]
mov edi, 0x40132a
mov ebp, 0x40153c
mov ecx, 0x1e
push ebp
push edi
push ecx
movzx eax, byte [edi]
mov dword [0x4010c4], eax
or al, al
je 0x4021bd
mov ecx, dword [0x403238]
mov ebx, eax
mov esi, section..smart
lodsd eax, dword [esi]
cmp eax, ebx
je 0x40215d
add esi, 4
loop 0x402151
jmp 0x4021bd
mov eax, dword [esi]
movzx ebx, byte [edi + 3]
movzx ecx, byte [edi + 4]
mov edx, dword [edi + 5]
movzx esi, byte [ebp + 1]
mov edi, 0x401026
cmp ebx, esi
jae 0x40217c
mov edi, 0x40102a
push edx
push ecx
push esi
push ebx
push edi
push eax
push dword [0x4010c4]
call 0x4021b4
or ah, byte [0x20643330]
and eax, 0x25202073
jae 0x4021ba
and byte [0x20643330], ah
and byte [eax], ah
and eax, 0x20643230
and byte [eax], ah
and eax, 0x20643330
and byte [eax], ah
and eax, 0xff000075
adc eax, sym.imp.msvcrt.dll_printf
add esp, 0x20
pop ecx
pop edi
pop ebp
add edi, 0xc
add ebp, 0xc
dec ecx
jne 0x402135
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x444b0271
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x68ec329f
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219