joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f2630]
push edi
test eax, eax
je 0x47c879
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x47c879
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x47c879
push esi
mov esi, dword [ebp + 0xc]
push 5
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x47c861
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47c861
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x47c861
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
pop esi
pop edi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x54]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0x18
xor eax, eax
pop edi
pop ebp
ret 0x18

Function at 0x47c880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f2630]
push edi
test eax, eax
je 0x47c8f9
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x47c8f9
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x47c8f9
push esi
mov esi, dword [ebp + 0xc]
push 5
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x47c8e1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47c8e1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x47c8e1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
pop esi
pop edi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x58]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0x18
xor eax, eax
pop edi
pop ebp
ret 0x18

Function at 0x47c900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f2630]
push edi
test eax, eax
je 0x47c979
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x47c979
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x47c979
push esi
mov esi, dword [ebp + 0xc]
push 5
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x47c961
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47c961
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x47c961
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
pop esi
pop edi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x4c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0x18
xor eax, eax
pop edi
pop ebp
ret 0x18
Function at 0x47c980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f2630]
push edi
test eax, eax
je 0x47c9f9
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x47c9f9
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x47c9f9
push esi
mov esi, dword [ebp + 0xc]
push 5
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x47c9e1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47c9e1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x47c9e1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop esi
pop edi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0x18
xor eax, eax
pop edi
pop ebp
ret 0x18

Function at 0x47cc80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f2630]
push edi
test eax, eax
je 0x47cce4
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x47cce4
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x47cce4
push esi
mov esi, dword [ebp + 0xc]
push 4
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x47ccd5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47ccd5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x47ccd5
push eax
call dword [sym.imp.USER32.dll_LoadMenuIndirectW]
test eax, eax
jne 0x47ccde
push dword [ebp + 0x10]
mov eax, dword [edi + 0x3c]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0xc
xor eax, eax
pop edi
pop ebp
ret 0xc

Function at 0x47ccf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f2630]
push edi
test eax, eax
je 0x47cd54
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x47cd54
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x47cd54
push esi
mov esi, dword [ebp + 0xc]
push 4
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x47cd45
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47cd45
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x47cd45
push eax
call dword [sym.imp.USER32.dll_LoadMenuIndirectW]
test eax, eax
jne 0x47cd4e
push dword [ebp + 0x10]
mov eax, dword [edi + 0x40]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0xc
xor eax, eax
pop edi
pop ebp
ret 0xc
Function at 0x483ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
mov eax, dword [0x4efca4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x604]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x600
push 0
push eax
call fcn.00489e90
lea eax, [ebp - 0x608]
mov dword [ebp - 0x608], 0x5fe
push eax
lea eax, [ebp - 0x604]
push eax
push dword [ebp + 0x10]
push esi
call fcn.00483c60
add esp, 0x1c
mov dword [ebp - 0x608], eax
test eax, eax
jne 0x483ba8
test edi, edi
mov edx, 0x4d5ab5
cmovne edx, edi
mov esi, edx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x483b23
sub esi, ecx
lea ecx, [ebp - 0x604]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x483b35
sub ecx, edi
mov word [ebp + ecx - 0x604], 0xa0d
lea edi, [ecx + 2]
test ebx, ebx
je 0x483b8d
push ebx
push esi
push 1
push edx
call fcn.004b2578
add esp, 0x10
cmp eax, esi
jne 0x483b77
push ebx
push edi
lea eax, [ebp - 0x604]
push 1
push eax
call fcn.004b2578
add esp, 0x10
cmp eax, edi
je 0x483ba2
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00488295
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x604]
push eax
push edx
push str._s_s
call fcn.00483dc0
add esp, 0xc
mov eax, dword [ebp - 0x608]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00488295
mov esp, ebp
pop ebp
ret

Function at 0x484dd0
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x40
push 0x36
lea ebx, [esi + 0x5c]
push ebx
call fcn.00489e90
push 0x40
lea edi, [esi + 0x9c]
push 0x5c
push edi
call fcn.00489e90
mov edx, dword [ebp + 0x10]
add esp, 0x18
xor eax, eax
test edx, edx
jle 0x484e21
mov ebx, dword [ebp + 0xc]
cmp eax, 0x40
jge 0x484e1e
movzx ecx, byte [eax + ebx]
xor byte [edi + eax - 0x40], cl
movzx ecx, byte [eax + ebx]
xor byte [edi + eax], cl
inc eax
cmp eax, edx
jl 0x484e05
lea ebx, [esi + 0x5c]
push esi
call fcn.00485f80
push 0x40
push ebx
push esi
call fcn.00485fc0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x485f80
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret

Function at 0x486080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
mov ecx, dword [eax + 0x404]
mov ebx, dword [eax + 0x400]
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x10], edi
jle 0x4860d9
push esi
inc bl
movzx ebx, bl
mov edx, dword [eax + ebx*4]
mov cl, dl
add cl, byte [ebp - 4]
mov eax, dword [ebp + 8]
movzx ecx, cl
mov dword [ebp - 4], ecx
mov esi, dword [ebp - 4]
mov ecx, dword [eax + ecx*4]
mov dword [eax + ebx*4], ecx
mov dword [eax + esi*4], edx
add dl, cl
movzx ecx, dl
mov edx, dword [ebp + 0xc]
mov cl, byte [eax + ecx*4]
xor byte [edi + edx], cl
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x4860a0
mov ecx, esi
pop esi
pop edi
mov dword [eax + 0x400], ebx
mov dword [eax + 0x404], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a6718
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a6479

Function at 0x4c297f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c2584

Function at 0x4c298a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c2705

Function at 0x4c436c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c3b51

Function at 0x4c4377
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c3d8c

Function at 0x4c4f0e
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c4c95
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0xc363bd
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00c363bd
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x4f1562ce
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x783f3daf
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20019
mov ebx, ecx
mov dword [ebp - 4], edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
push 0x80000001
mov dword [ebx + 0x14], 0x60
mov dword [ebx + 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4014a2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
xor esi, esi
push eax
push edi
push edi
push str.AppsUseLightTheme
push dword [ebp - 4]
inc esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401499
cmp dword [ebp - 8], edi
jne 0x401499
mov dword [ebx + 0x10], esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call esi
push 0x65
push edi
mov dword [ebp - 0x24], eax
call esi
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
cmp dword [ebx + 0x10], edi
mov ecx, 0x333333
mov dword [ebp - 0x20], eax
mov eax, 0xf7f7f7
cmovne eax, ecx
mov dword [ebp - 0x1c], edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], str.AMORCE
call dword [sym.imp.USER32.dll_RegisterClassW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebx + 0xc], edi
call esi
mov edi, eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push edi
mov dword [ebx + 0x14], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4028af
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
cmp dword [esp + 0x24], 0
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x20], ebp
je 0x4028cd
mov eax, dword [ebp]
push dword [esp + 0x34]
call dword [eax + 8]
xorps xmm0, xmm0
xor esi, esi
cmp dword [esp + 0x30], 8
movlpd qword [esp + 0x18], xmm0
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x34], esi
jb 0x402977
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x1c]
push 8
pop ecx
sub ecx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], ecx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [edx]
xor edi, dword [edx + 4]
xor ecx, ebx
xor ebx, ebx
mov dword [esp + 0x14], eax
mov edx, dword [eax + 4]
inc ebx
add edi, dword [eax]
add edx, ecx
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x18], eax
cmp eax, ebx
jl 0x402950
mov ebp, dword [esp + 0x14]
mov esi, eax
xor edi, edx
mov ecx, edx
and ecx, 0x1f
rol edi, cl
add edi, dword [ebp + ebx*8]
xor edx, edi
mov ecx, edi
and ecx, 0x1f
rol edx, cl
add edx, dword [ebp + ebx*8 + 4]
inc ebx
cmp ebx, esi
jle 0x402929
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
xor ebx, ebx
or ebx, edx
add esi, 8
mov edx, dword [esp + 0x10]
mov dword [esp + 0x34], esi
mov dword [edx], ebx
mov dword [edx + 4], edi
add edx, 8
add eax, edx
mov dword [esp + 0x10], edx
cmp eax, dword [esp + 0x30]
jbe 0x402900
cmp esi, dword [esp + 0x30]
jae 0x402a1c
mov edi, dword [esp + 0x2c]
mov al, byte [esi + edi]
xor al, bl
mov dword [esp + 0x24], 1
mov byte [esi + edi], al
mov bl, al
mov ecx, dword [ebp + 0x1c]
shr bl, 4
mov ah, byte [ecx + 4]
add bl, byte [ecx]
add ah, al
and bl, 0xf
and ah, 0xf
cmp dword [ebp + 0x18], 1
jl 0x402a05
mov esi, dword [esp + 0x24]
mov edi, ecx
mov dl, ah
mov al, ah
xor dl, bl
and al, 3
mov bl, dl
mov cl, 4
sub cl, al
shr bl, cl
movzx ecx, ah
and ecx, 3
shl dl, cl
mov cl, 4
or bl, dl
mov dl, ah
add bl, byte [edi + esi*8]
and bl, 0xf
xor dl, bl
mov al, bl
and al, 3
mov ah, dl
sub cl, al
shr ah, cl
movzx ecx, bl
and ecx, 3
shl dl, cl
or ah, dl
add ah, byte [edi + esi*8 + 4]
and ah, 0xf
inc esi
cmp esi, dword [ebp + 0x18]
jle 0x4029b6
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x2c]
shl bl, 4
add bl, ah
mov byte [esi + edi], bl
inc esi
mov dword [esp + 0x34], esi
cmp esi, dword [esp + 0x30]
jb 0x402985
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x402a26
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
cmp dword [esp + 0x24], 0
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
je 0x402a43
mov eax, dword [esi]
push dword [esp + 0x34]
call dword [eax + 8]
mov ebp, dword [esp + 0x2c]
xorps xmm0, xmm0
xor edi, edi
movlpd qword [esp + 0x20], xmm0
cmp dword [esp + 0x30], 8
jb 0x402af1
push 8
pop eax
sub eax, ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x18]
mov edx, dword [ebp]
mov ebx, dword [ebp + 4]
test eax, eax
jle 0x402aae
mov ecx, dword [esi + 0x1c]
mov esi, ecx
mov dword [esp + 0x18], ecx
sub edx, dword [esi + eax*8 + 4]
mov ecx, ebx
and ecx, 0x1f
ror edx, cl
xor edx, ebx
sub ebx, dword [esi + eax*8]
mov ecx, edx
and ecx, 0x1f
ror ebx, cl
xor ebx, edx
dec eax
test eax, eax
jg 0x402a8c
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x1c]
xor ecx, ecx
add edi, 8
sub ebx, dword [eax]
sub edx, dword [eax + 4]
or ecx, ebx
mov eax, dword [ebp]
xor edx, dword [esp + 0x34]
xor ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov dword [ebp], edx
mov dword [ebp + 4], ecx
add ebp, 8
add eax, ebp
cmp eax, dword [esp + 0x30]
jbe 0x402a76
mov ebp, dword [esp + 0x2c]
jmp 0x402b8d
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
jmp 0x402b8d
mov bl, byte [edi + ebp]
mov eax, dword [esi + 0x18]
mov dh, bl
shr dh, 4
mov cl, bl
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x402b71
mov eax, dword [esi + 0x1c]
mov esi, eax
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
sub bl, byte [esi + ebp*8 + 4]
movzx eax, dh
and bl, 0xf
and eax, 3
mov dl, bl
push 4
pop ecx
sub ecx, eax
shl bl, cl
mov cl, dh
and cl, 3
shr dl, cl
or bl, dl
xor bl, dh
sub dh, byte [esi + ebp*8]
and dh, 0xf
movzx eax, bl
and eax, 3
mov dl, dh
push 4
pop ecx
sub ecx, eax
shl dh, cl
mov cl, bl
and cl, 3
shr dl, cl
or dh, dl
xor dh, bl
dec ebp
test ebp, ebp
jg 0x402b20
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x14]
mov cl, byte [edi + ebp]
mov eax, dword [esi + 0x1c]
sub bl, byte [eax + 4]
sub dh, byte [eax]
and bl, 0xf
shl dh, 4
add bl, dh
xor bl, byte [esp + 0x34]
mov byte [edi + ebp], bl
inc edi
mov byte [esp + 0x34], cl
cmp edi, dword [esp + 0x30]
jb 0x402afe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x402db1
Capabilities:
Encrypt data using rc6

Disassembly:
sub esp, 0x1c
movsd xmm0, qword [0x43f4f8]
push ebx
push ebp
push esi
push edi
push ecx
push ecx
mov edi, ecx
movsd qword [esp], xmm0
call fcn.0041e550
pop ecx
fstp qword [esp + 0x28]
movsd xmm0, qword [esp + 0x28]
pop ecx
call fcn.0042dff1
mov esi, eax
mov dword [esp + 0x20], eax
shl esi, 2
push esi
call fcn.0041e3fb
push esi
mov ebp, eax
xor ebx, ebx
push ebx
push ebp
mov dword [esp + 0x2c], ebp
call fcn.004193f0
push 0x10
lea ecx, [edi + 8]
push ecx
push ebp
call fcn.00419550
mov eax, dword [edi + 0x18]
add esp, 0x1c
lea esi, [eax*2 + 2]
cmp dword [edi + 0x1c], ebx
je 0x402e25
push dword [edi + 0x1c]
call fcn.0041e3f6
pop ecx
mov eax, esi
shl eax, 2
push eax
call fcn.0041e3fb
mov dword [edi + 0x1c], eax
pop ecx
test eax, eax
je 0x402ed7
xor edx, edx
mov dword [eax], 0xb7e15163
inc edx
cmp esi, edx
jbe 0x402e5d
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx + edx*4 - 4]
sub eax, 0x61c88647
mov dword [ecx + edx*4], eax
inc edx
cmp edx, esi
jb 0x402e49
imul eax, esi, 3
mov edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
test eax, eax
je 0x402ecd
mov ecx, dword [edi + 0x1c]
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x10]
mov eax, dword [ecx + eax*4]
add eax, edx
add eax, dword [esp + 0x14]
rol eax, 3
mov dword [ecx + ebp*4], eax
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
lea ecx, [edx + eax]
add edx, eax
mov eax, dword [esp + 0x10]
and ecx, 0x1f
add edx, dword [ebp + ebx*4]
rol edx, cl
inc eax
mov dword [ebp + ebx*4], edx
mov dword [esp + 0x24], edx
xor edx, edx
div esi
lea eax, [ebx + 1]
mov dword [esp + 0x10], edx
xor edx, edx
div dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ebx, edx
mov edx, dword [esp + 0x24]
jne 0x402e72
push ebp
call fcn.0041e3f6
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x40331f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 0xc]
mov eax, dword [ecx + 0x20c]
test eax, eax
cmovne ecx, eax
call fcn.004056dc
test eax, eax
jne 0x403467
push 0x43d8f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x403467
push str.NtQueryInformationFile
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x403467
push 0x20e
xor ebx, ebx
lea eax, [ebp - 0x258]
push ebx
push eax
call fcn.004193f0
add esp, 0xc
lea eax, [ebp - 0x258]
push 9
push 0x20c
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x21c]
call esi
test eax, eax
js 0x403467
mov eax, dword [ebp - 0x258]
xor ecx, ecx
shr eax, 1
mov word [ebp + eax*2 - 0x254], cx
lea eax, [ebp - 0x48]
push eax
push dword [edi + 0x21c]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x403467
push 0x410
lea eax, [ebp - 0x668]
push ebx
push eax
call fcn.004193f0
add esp, 0xc
lea eax, [ebp - 0x668]
push eax
push 0x207
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov eax, dword [0x43d920]
lea esi, [ebp - 0x668]
mov dword [ebp - 0xc], eax
mov eax, dword [0x43d924]
mov dword [ebp - 8], eax
movzx eax, word [ebp - 0x668]
mov word [ebp - 0xc], ax
cmp ax, 0x41
je 0x403454
cmp ax, 0x42
je 0x403454
lea ecx, [ebp - 0xc]
call fcn.0040541d
cmp eax, 3
jne 0x403454
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x2c]
je 0x403470
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x403454
movzx eax, word [esi]
test ax, ax
jne 0x403418
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push 2
push eax
push esi
call fcn.0041c2b4
push 0x102
lea eax, [ebp - 0x254]
push eax
lea eax, [esi + 4]
push eax
call fcn.0041c2b4
xor eax, eax
add esp, 0x18
inc eax
jmp 0x403469