joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428340
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4e3038]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call eax
sub esp, 0x18
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.msvcrt.dll_calloc
mov dword [0x4e303c], eax
mov edx, dword [0x4e303c]
mov eax, dword [0x4e3038]
mov ecx, dword [ebp - 0x20]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call eax
sub esp, 0x18
mov eax, dword [0x4e303c]
mov dword [esp + 4], 0x4e3040
mov dword [esp], eax
mov eax, dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call eax
sub esp, 8
mov dword [0x4e3034], eax
mov eax, dword [0x4e3040]
shl eax, 2
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x42846d
mov eax, dword [0x4e3034]
mov edx, dword [ebp - 0x10]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov eax, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call eax
sub esp, 0x20
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0xc], eax
add dword [ebp - 0x10], 1
mov eax, dword [0x4e3040]
cmp dword [ebp - 0x10], eax
jl 0x42840c
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_LocalAlloc]
call eax
sub esp, 8
mov dword [0x4e3030], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [0x4e3040]
shl edx, 2
sub eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [0x4e3030]
mov edx, dword [0x4e3040]
shl edx, 2
add eax, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
jmp 0x428538
mov eax, dword [0x4e3034]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov eax, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call eax
sub esp, 0x20
mov dword [ebp - 0x24], eax
mov eax, dword [0x4e3030]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add edx, eax
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x14], eax
add dword [ebp - 0x1c], 1
mov eax, dword [0x4e3040]
cmp dword [ebp - 0x1c], eax
jl 0x4284c1
mov dword [0x4e302c], 1
nop
leave
ret
Function at 0x42c854
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov byte [eax], 0x51
mov eax, dword [ebp - 0x18]
mov byte [eax + 1], 0x50
mov eax, dword [ebp - 0x18]
mov byte [eax + 2], 0x2f
mov eax, dword [ebp - 0x18]
mov byte [eax + 3], 0x3f
mov eax, dword [ebp - 0x18]
mov byte [eax + 4], 0x3e
mov eax, dword [ebp - 0x18]
mov byte [eax + 5], 0x3d
mov eax, dword [ebp - 0x18]
mov byte [eax + 6], 0x3c
mov eax, dword [ebp - 0x18]
mov byte [eax + 7], 0x3b
mov eax, dword [ebp - 0x18]
mov byte [eax + 8], 0x3a
mov eax, dword [ebp - 0x18]
mov byte [eax + 9], 0x39
mov eax, dword [ebp - 0x18]
mov byte [eax + 0xa], 0x38
mov eax, dword [ebp - 0x18]
mov byte [eax + 0xb], 0x37
mov eax, dword [ebp - 0x18]
mov byte [eax + 0xc], 0x56
mov eax, dword [ebp - 0x18]
mov byte [eax + 0xd], 0x55
mov eax, dword [ebp - 0x18]
mov byte [eax + 0xe], 0
mov dword [ebp - 8], 0
jmp 0x42c90d
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
add eax, edx
movzx eax, byte [eax]
mov ebx, eax
mov eax, dword [ebp - 8]
lea ecx, [eax + 0xe]
mov edx, 0xf0f0f0f1
mov eax, ecx
mul edx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
sub ecx, eax
mov edx, ecx
mov eax, edx
xor eax, ebx
mov ecx, eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
add eax, edx
mov byte [eax], cl
add dword [ebp - 8], 1
cmp dword [ebp - 8], 0xd
jbe 0x42c8cf
nop
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x42f690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x4e5a4d
push ebx
sub esp, 0x9c
mov eax, dword [0x4e5a4c]
mov dword [ebp - 0x81], eax
mov eax, dword [0x4e5ab1]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.0040bc10
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.004d6f28
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4e4668], 0
jne 0x42f7b6
mov byte [0x4e4668], 1
call fcn.004d5d80
test eax, eax
je 0x42f784
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0040ab00
mov dword [esp], 2
mov esi, dword [fcn.0041a160]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x42f774
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4e54ad
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4d6e18
jmp 0x4d6e10
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x42f73a
mov dword [esp], 2
call dword [0x4e2084]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x4d6e0b
mov dword [esp], 2
call dword [0x4e2084]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov ebx, ecx
sub esp, 0x18
mov dword [ecx], 0x4ee710
call fcn.004cdbe0
mov dword [esp], ebx
mov dword [esp + 4], 4
call fcn.004d4eb0
add esp, 0x18
pop ebx
ret
Function at 0x48b4d0
Capabilities:
Delete directory
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 4], ebx
call fcn.00488400
test al, al
je 0x48b52b
cmp al, 0xff
je 0x48b538
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.0048b720
cmp al, 2
je 0x48b550
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
test eax, eax
jne 0x48b562
mov eax, dword [ebx]
test eax, eax
jne 0x48b52b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004b66a0
mov dword [ebx], esi
mov dword [ebx + 4], eax
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.004b66a0
mov dword [ebx], 0
mov dword [ebx + 4], eax
jmp 0x48b52b
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
sub esp, 4
test eax, eax
je 0x48b501
call fcn.004b66a0
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret

Function at 0x48b5d0
Capabilities:
Move file

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.0048b720
cmp al, 0xff
je 0x48b638
mov ecx, dword [ebx]
test ecx, ecx
jne 0x48b62e
test al, al
jne 0x48b650
mov dword [esp + 8], 3
mov eax, dword [esi]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
je 0x48b6a0
call fcn.004b66a0
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call fcn.004b66a0
mov dword [ebx], 0
mov dword [ebx + 4], eax
jmp 0x48b5fc
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call fcn.0048b720
mov edx, dword [ebx]
test edx, edx
jne 0x48b62e
mov ecx, dword [esp + 0x1c]
cmp cl, 2
je 0x48b688
cmp al, 2
jne 0x48b5fc
call fcn.004b66b0
mov dword [ebx], 0x14
mov dword [ebx + 4], eax
jmp 0x48b62e
cmp al, 2
je 0x48b5fc
call fcn.004b66b0
mov dword [ebx], 0x15
mov dword [ebx + 4], eax
jmp 0x48b62e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x48b6d0
call edi
mov dword [eax], 5
call fcn.004b66b0
mov esi, eax
call edi
mov eax, dword [eax]
mov dword [ebx + 4], esi
mov dword [ebx], eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call edi
mov dword [eax], 0xd
jmp 0x48b6b9
Function at 0x492bf0
Capabilities:
Get disk size

Disassembly:
push esi
push ebx
sub esp, 0x34
lea eax, [esp + 0x28]
mov dword [esp + 0x18], 0
mov ebx, dword [esp + 0x50]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
sub esp, 0x10
test eax, eax
je 0x492cb8
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov eax, esi
or eax, ecx
je 0x492c6c
mov eax, dword [esp + 0x44]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, esi
or eax, ecx
je 0x492c83
mov eax, dword [esp + 0x48]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, esi
or eax, ecx
jne 0x492ca8
call fcn.004b66a0
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x34
pop ebx
pop esi
ret
mov eax, dword [esp + 0x4c]
mov dword [eax], esi
mov dword [eax + 4], ecx
jmp 0x492c91
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004b66a0
mov dword [ebx], esi
mov dword [ebx + 4], eax
add esp, 0x34
pop ebx
pop esi
ret

Function at 0x497bf0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__fileno
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x497c30
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x497c01
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x4a9ad0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ecx + 4]
test eax, eax
je 0x4a9af0
mov edx, dword [ecx]
mov dword [esp], edx
call eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea esi, [esp + 0x1c]
nop
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov eax, dword [edi + 8]
mov dword [esp], eax
call sub.msvcrt.dll__read
test eax, eax
jle 0x4a9b30
add esi, eax
sub ebx, eax
jne 0x4a9b00
mov eax, dword [esp + 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0xffffffff
jne 0x4a9b3c
call ebp
cmp dword [eax], 4
je 0x4a9b00
mov dword [esp], str.random_device_could_not_be_read
call fcn.004d70c8
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4b6180
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0xc], 0x80000000
mov dword [ebp - 0x10], 0x7fffffff
mov dword [ebp - 4], 0
jmp 0x4b6203
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4]
and eax, 0x80000000
mov ecx, eax
mov eax, dword [ebp - 4]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + edx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
lea edx, [eax + 0x18d]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x1c]
shr edx, 1
xor edx, eax
mov eax, dword [ebp - 0x1c]
and eax, 1
test eax, eax
je 0x4b61ed
mov eax, 0x9908b0df
jmp 0x4b61f2
mov eax, 0
xor eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov dword [eax + edx*4], ecx
add dword [ebp - 4], 1
cmp dword [ebp - 4], 0xe2
jbe 0x4b61a0
mov dword [ebp - 8], 0xe3
jmp 0x4b6278
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 8]
mov eax, dword [eax + edx*4]
and eax, 0x80000000
mov ecx, eax
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + edx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
lea edx, [eax - 0xe3]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x18]
shr edx, 1
xor edx, eax
mov eax, dword [ebp - 0x18]
and eax, 1
test eax, eax
je 0x4b6262
mov eax, 0x9908b0df
jmp 0x4b6267
mov eax, 0
xor eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 8]
mov dword [eax + edx*4], ecx
add dword [ebp - 8], 1
cmp dword [ebp - 8], 0x26e
jbe 0x4b6215
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x9bc]
and eax, 0x80000000
mov edx, eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
and eax, 0x7fffffff
or eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x630]
mov edx, dword [ebp - 0x14]
shr edx, 1
xor edx, eax
mov eax, dword [ebp - 0x14]
and eax, 1
test eax, eax
je 0x4b62c1
mov eax, 0x9908b0df
jmp 0x4b62c6
mov eax, 0
xor edx, eax
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x9bc], edx
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x9c0], 0
nop
leave
ret
Function at 0x4b62e4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004cb5f4
mov edx, dword [ebp - 0x1c]
mov dword [edx], eax
mov dword [ebp - 0xc], 1
jmp 0x4b6350
mov eax, dword [ebp - 0xc]
lea edx, [eax - 1]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
shr eax, 0x1e
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x6c078965
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004cb610
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004cb5f4
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4], eax
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x26f
jbe 0x4b6306
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x9c0], 0x270
nop
leave
ret 4

Function at 0x4b6390
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x9c0]
cmp eax, 0x26f
jbe 0x4b63b3
mov eax, dword [ebp - 0x1c]
mov ecx, eax
call fcn.004b6180
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x9c0]
lea ecx, [eax + 1]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x9c0], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shr eax, 0xb
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shl eax, 7
and eax, 0x9d2c5680
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shl eax, 0xf
and eax, 0xefc60000
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shr eax, 0x12
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x56fe66bd
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x3c37c6b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x41bbe4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, edx
mov ebp, eax
mov byte [esp], 0
mov eax, ebp
test eax, eax
je 0x41bbfc
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x41bc04
mov al, 1
jmp 0x41bc21
movzx esi, word [ebp]
mov eax, esi
call fcn.0040d594
test al, al
jne 0x41bc1d
cmp si, 0x5f
je 0x41bc1d
xor eax, eax
jmp 0x41bc1f
mov al, 1
xor al, 1
test al, al
jne 0x41bcb1
test bl, bl
je 0x41bc71
mov eax, ebp
test eax, eax
je 0x41bc38
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, 2
jl 0x41bcad
inc ebx
mov esi, 2
movzx edi, word [ebp + esi*2 - 2]
mov eax, edi
call fcn.0040d620
test al, al
jne 0x41bc65
cmp di, 0x5f
je 0x41bc65
cmp di, 0x2e
je 0x41bc65
xor eax, eax
jmp 0x41bc67
mov al, 1
test al, al
je 0x41bcb1
inc esi
dec ebx
jne 0x41bc45
jmp 0x41bcad
mov eax, ebp
test eax, eax
je 0x41bc7c
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, 2
jl 0x41bcad
inc ebx
mov esi, 2
movzx edi, word [ebp + esi*2 - 2]
mov eax, edi
call fcn.0040d620
test al, al
jne 0x41bca3
cmp di, 0x5f
je 0x41bca3
xor eax, eax
jmp 0x41bca5
mov al, 1
test al, al
je 0x41bcb1
inc esi
dec ebx
jne 0x41bc89
mov byte [esp], 1
movzx eax, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41c624
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x41c758
push dword fs:[eax]
mov dword fs:[eax], esp
movzx ebx, byte [0x41c768]
mov dl, 1
mov eax, esi
call fcn.0041cabc
test al, al
jne 0x41c675
mov dl, 1
mov eax, esi
call fcn.0041ca24
test al, al
je 0x41c70b
lea edx, [ebp - 0x424]
mov eax, esi
call fcn.0041d1e8
mov eax, dword [ebp - 0x424]
lea edx, [ebp - 4]
call fcn.004230bc
push 0x104
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 4]
call fcn.00407794
mov esi, eax
push esi
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x41c706
test byte [ebp - 0xc], 1
je 0x41c6d1
or bl, 1
test byte [ebp - 0xc], 2
je 0x41c6da
or bl, 2
test byte [ebp - 0xc], 0x80
je 0x41c6e3
or bl, 0x20
push esi
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
je 0x41c6f7
dec eax
je 0x41c6fc
dec eax
je 0x41c701
dec eax
jne 0x41c732
or bl, 0x10
jmp 0x41c732
or bl, 4
jmp 0x41c732
or bl, 8
jmp 0x41c732
call fcn.00423a60
lea edx, [ebp - 0x428]
mov eax, dword [0x4bf840]
call fcn.0040a574
mov ecx, dword [ebp - 0x428]
mov dl, 1
mov eax, dword [0x4179ec]
call fcn.00421f9c
call fcn.004061a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c75f
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.00406b88
lea eax, [ebp - 4]
call fcn.00406b28
ret
Function at 0x421e4c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x421f71
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00421c54
mov esi, eax
mov eax, dword [0x4bf7b8]
cmp byte [eax], 0
je 0x421f19
mov eax, dword [0x4bf564]
call fcn.004049e8
call fcn.0040462c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x421e1c]
call fcn.00408ab8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x421f8c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x421f55
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4bf514]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4c2c50]
call fcn.00408b7c
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421f78
lea eax, [ebp - 4]
mov edx, dword [0x421e1c]
call fcn.00408ac4
ret

Function at 0x423904
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040702c
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a608
mov edi, eax
cmp edi, 0x104
jbe 0x4238ab
mov eax, edi
add eax, eax
call fcn.004044d8
mov esi, eax
jmp 0x4238ad
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a608
mov eax, esi
push eax
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4238e8
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4238d2
mov eax, esp
cmp esi, eax
je 0x4238f5
mov eax, esi
call fcn.004044f4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x423930
cmp bl, 0
je 0x42392c
cmp bl, 0x41
jl 0x423927
cmp bl, 0x5a
jg 0x423927
or bl, 0x20
xor al, bl
inc esi
jmp 0x42390b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42386c

Function at 0x424130
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00407840
add esp, 0x800
pop ebx
ret