joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498358
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x49836a
add eax, 0x7ff
sar eax, 0xb
imul edx, eax, 0x930
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
add ecx, 0x24
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x46464952
push dword [ebp + 8]
push 1
push 4
lea eax, [ebp - 4]
push eax
call fcn.0045da3c
add esp, 0x10
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
push dword [ebp + 8]
push 1
push 4
lea ecx, [ebp - 4]
push ecx
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x41584443
push dword [ebp + 8]
push 1
push 4
lea eax, [ebp - 4]
push eax
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x20746d66
push dword [ebp + 8]
push 1
push 4
lea edx, [ebp - 4]
push edx
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x10
push dword [ebp + 8]
push 1
push 4
lea ecx, [ebp - 4]
push ecx
call fcn.0045da3c
add esp, 0x10
xor eax, eax
mov dword [ebp - 4], eax
push dword [ebp + 8]
push 1
push 4
lea edx, [ebp - 4]
push edx
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x41585515
push dword [ebp + 8]
push 1
push 4
lea ecx, [ebp - 4]
push ecx
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 1
push dword [ebp + 8]
push 1
push 4
lea eax, [ebp - 4]
push eax
call fcn.0045da3c
add esp, 0x10
xor edx, edx
mov dword [ebp - 4], edx
push dword [ebp + 8]
push 1
push 4
lea ecx, [ebp - 4]
push ecx
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x61746164
push dword [ebp + 8]
push 1
push 4
lea eax, [ebp - 4]
push eax
call fcn.0045da3c
add esp, 0x10
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
push dword [ebp + 8]
push 1
push 4
lea ecx, [ebp - 4]
push ecx
call fcn.0045da3c
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x498774
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov word [ebp - 0x18], 1
mov word [ebp - 0x16], 2
mov dword [ebp - 0x14], 0xac44
mov word [ebp - 0xa], 0x10
movzx eax, word [ebp - 0xa]
test eax, eax
jns 0x49879e
add eax, 7
sar eax, 3
imul dword [ebp - 0x14]
movzx edx, word [ebp - 0x16]
imul edx
mov dword [ebp - 0x10], eax
movzx ecx, word [ebp - 0xa]
test ecx, ecx
jns 0x4987b8
add ecx, 7
sar ecx, 3
movzx eax, word [ebp - 0x16]
imul ecx, eax
mov word [ebp - 0xc], cx
mov edx, dword [ebp + 0xc]
sub edx, 0x14
sub edx, 0x10
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0x46464952
push dword [ebp + 8]
push 1
push 4
lea ecx, [ebp - 4]
push ecx
call fcn.0045da3c
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp + 8]
push 1
push 4
lea edx, [ebp - 4]
push edx
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x45564157
push dword [ebp + 8]
push 1
push 4
lea ecx, [ebp - 4]
push ecx
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x20746d66
push dword [ebp + 8]
push 1
push 4
lea eax, [ebp - 4]
push eax
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x10
push dword [ebp + 8]
push 1
push 4
lea edx, [ebp - 4]
push edx
call fcn.0045da3c
add esp, 0x10
push dword [ebp + 8]
push 1
push dword [ebp - 4]
lea ecx, [ebp - 0x18]
push ecx
call fcn.0045da3c
add esp, 0x10
mov dword [ebp - 4], 0x61746164
push dword [ebp + 8]
push 1
push 4
lea eax, [ebp - 4]
push eax
call fcn.0045da3c
add esp, 0x10
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
push dword [ebp + 8]
push 1
push 4
lea ecx, [ebp - 4]
push ecx
call fcn.0045da3c
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4996cc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [0xa18ec0]
mov dword [ebp - 0x14], edx
mov ecx, dword [0xa18ebc]
mov dword [ebp - 0x18], ecx
mov eax, dword [0xa18ec0]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
jne 0x499700
mov eax, dword [ebp - 0x18]
jmp 0x499721
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
sub edx, ecx
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0066c820
add esp, 0xc
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
sub edx, ecx
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [0xa18ec0]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x1c]
mov dword [0xa18ec0], edx
push 0x514
push 0
push 0x75ff2c
call fcn.0066c86c
add esp, 0xc
mov byte [ebp - 1], 0
xor ecx, ecx
mov cl, byte [ebp - 1]
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
mov dword [eax*8 + 0x75ff38], 0xffffffff
xor edx, edx
mov dl, byte [ebp - 1]
mov ecx, dword [0x6e70ec]
cmp edx, ecx
jl 0x4997e1
mov al, byte [ebp - 1]
add al, 0x41
movsx edx, al
push edx
push 0x7605f4
lea ecx, [ebp - 8]
push ecx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
cmp edx, 5
jne 0x4997e1
xor ecx, ecx
mov cl, byte [ebp - 1]
mov eax, ecx
shl eax, 4
lea eax, [eax + eax*2]
add eax, 0x75ff30
push eax
mov dl, byte [ebp - 1]
push edx
call fcn.00499c74
add esp, 8
xor ecx, ecx
mov cl, byte [ebp - 1]
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
mov edx, dword [eax*8 + 0x75ff34]
test edx, edx
je 0x4997e1
inc dword [ebp - 0x10]
inc byte [ebp - 1]
mov cl, byte [ebp - 1]
cmp cl, 0x1a
jb 0x499753
call fcn.00499870
mov byte [0x75ff2c], al
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x49a868
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff4c
mov eax, dword [0x76053c]
mov dword [ebp - 0x20], eax
mov eax, dword [0x760540]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x760544]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], SysStringLen
mov dword [ebp - 8], 1
xor edx, edx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x49aa02
mov eax, dword [0x760548]
cmp eax, 0xffffffff
je 0x49a8c9
push dword [0x760548]
call sub.KERNEL32.DLL_CloseHandle
mov dword [0x760548], 0xffffffff
push 0x94
push 0
lea edx, [ebp - 0xb4]
push edx
call fcn.0066c86c
add esp, 0xc
push 0xc
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.0066c86c
add esp, 0xc
mov dword [ebp - 0xb4], 0x94
lea eax, [ebp - 0xb4]
push eax
call sub.KERNEL32.DLL_GetVersionExA
mov edx, dword [ebp - 0xa4]
cmp edx, 2
jne 0x49a926
mov ecx, dword [ebp - 0xb0]
cmp ecx, 4
jbe 0x49a926
or dword [ebp - 4], 0x40000000
or dword [ebp - 8], 2
mov al, byte [ebp + 8]
add al, 0x41
movsx edx, al
push edx
push 0x76062b
lea ecx, [ebp - 0x20]
push ecx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
push 0
push 0x80
push 3
push 0
push dword [ebp - 8]
push dword [ebp - 4]
lea eax, [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [0x760548], eax
mov edx, dword [0x760548]
cmp edx, 0xffffffff
jne 0x49a994
xor dword [ebp - 4], 0x40000000
xor dword [ebp - 8], 2
push 0
push 0x80
push 3
push 0
push dword [ebp - 8]
push dword [ebp - 4]
lea ecx, [ebp - 0x20]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov dword [0x760548], eax
mov eax, dword [0x760548]
cmp eax, 0xffffffff
jne 0x49a9a5
xor eax, eax
jmp 0x49aa2c
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 0x14], eax
push 0
lea edx, [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
push 0x90018
push dword [0x760548]
call sub.KERNEL32.DLL_DeviceIoControl
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x49a9f8
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0x90020
push dword [0x760548]
call sub.KERNEL32.DLL_DeviceIoControl
mov dword [ebp - 0xc], eax
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_SetErrorMode
jmp 0x49aa29
mov edx, dword [0x760548]
cmp edx, 0xffffffff
je 0x49aa22
push dword [0x760548]
call sub.KERNEL32.DLL_CloseHandle
mov dword [0x760548], 0xffffffff
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x49b880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [ebp + 8]
add eax, 0x810
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov word [ebp - 0x14], cx
mov word [ebp - 0x12], cx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x13
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx]
mov edx, dword [ebp - 0xc]
shl edx, 9
lea ecx, [edx + 0x7618d8]
mov ax, word [ecx + eax*2]
xor word [ebp - 0x12], ax
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [edx]
mov eax, dword [ebp - 0xc]
shl eax, 9
lea edx, [eax + 0x7618d8]
mov cx, word [edx + ecx*2]
xor word [ebp - 0x14], cx
add dword [ebp - 4], 0x55
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, 0x2b
jl 0x49b8ad
movzx edx, word [ebp - 0x12]
sar edx, 8
mov ecx, dword [ebp - 8]
mov byte [ecx], dl
mov al, byte [ebp - 0x12]
mov edx, dword [ebp - 8]
mov byte [edx + 0x56], al
movzx ecx, word [ebp - 0x14]
sar ecx, 8
mov eax, dword [ebp - 8]
mov byte [eax + 1], cl
mov dl, byte [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov byte [ecx + 0x57], dl
add dword [ebp - 8], 2
add dword [ebp + 8], 2
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 0x2b
jl 0x49b896
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x49e73c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
mov eax, dword [ebp + 8]
test eax, eax
je 0x49e755
mov edx, dword [ebp + 8]
mov cl, byte [edx]
test cl, cl
jne 0x49e75c
xor eax, eax
jmp 0x49e8fe
mov dword [ebp - 0x10], 0x3e76f499
xor dword [ebp - 0x10], 0x20060624
push dword [ebp - 0x10]
push 0x767baf
lea edx, [ebp - 0xc]
push edx
call fcn.00670e94
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [eax*4 + 0x767894]
mov cl, byte [ebp + edx - 0xc]
mov eax, dword [ebp - 0x14]
mov dl, byte [eax + 0x7678b4]
xor cl, dl
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x120], cl
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jl 0x49e783
push dword [ebp + 8]
call fcn.0066ca1c
pop ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x40
jle 0x49e7cc
mov dword [ebp - 0x1c], 0x40
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
jge 0x49e81b
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov al, byte [edx + ecx]
mov edx, dword [ebp - 0x18]
mov cl, byte [ebp + edx - 0x120]
xor al, cl
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov byte [edx + ecx], al
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 8
jl 0x49e80e
xor eax, eax
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
jl 0x49e7e0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
mov byte [eax + edx], 0
mov cl, byte [ebp - 0x1c]
not cl
mov al, byte [ebp - 0x11b]
xor cl, al
xor edx, edx
mov dl, cl
push edx
push 0x767bb3
lea ecx, [ebp - 0x120]
push ecx
call fcn.00670e94
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
jge 0x49e88e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax + edx]
push ecx
push 0x767bb8
mov eax, dword [ebp - 0x14]
add eax, eax
lea edx, [ebp - 0x11e]
add eax, edx
push eax
call fcn.00670e94
add esp, 0xc
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
jl 0x49e85a
mov edx, dword [ebp - 0x14]
cmp edx, 0x40
jge 0x49e8e7
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
mov al, byte [ecx + edx]
mov edx, dword [ebp - 0x14]
and edx, 0x80000007
jns 0x49e8b3
dec edx
or edx, 0xfffffff8
inc edx
mov cl, byte [edx + 0x7678b4]
xor al, cl
and eax, 0xff
push eax
push 0x767bbd
mov edx, dword [ebp - 0x14]
add edx, edx
lea ecx, [ebp - 0x11e]
add edx, ecx
push edx
call fcn.00670e94
add esp, 0xc
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x40
jl 0x49e896
lea edx, [ebp - 0x120]
push edx
push dword [ebp + 0xc]
call fcn.0066c9ec
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4a4504
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
mov dword [ebp - 0x2c], eax
mov eax, 0x76a55c
call fcn.0066ce04
mov dx, word [0x767978]
mov word [ebp - 0x3c], dx
mov dl, byte [0x76797a]
mov byte [ebp - 0x3a], dl
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 0x438]
add eax, 0x23c
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov eax, dword [edx]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4a4569
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 0x438]
add eax, 0x23c
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
mov edx, dword [eax]
call dword [edx + 0x44]
push 0x104
push 0
lea ecx, [ebp - 0x164]
push ecx
call fcn.0066c86c
add esp, 0xc
lea eax, [ebp - 0x164]
push eax
push 0x104
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
mov dword [ebp - 0x38], eax
xor edx, edx
mov dword [ebp - 0x34], edx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
cmp eax, edx
jge 0x4a45fc
mov ecx, dword [ebp - 0x30]
mov al, byte [ebp + ecx - 0x164]
mov byte [ebp - 0x39], al
mov dl, byte [ebp - 0x39]
cmp dl, 0x61
jb 0x4a45c8
mov cl, byte [ebp - 0x39]
cmp cl, 0x7a
ja 0x4a45c8
add byte [ebp - 0x39], 0xe0
mov al, byte [ebp - 0x39]
cmp al, 0x42
jbe 0x4a45e1
mov edx, dword [ebp - 0x34]
mov cl, byte [ebp - 0x39]
mov byte [ebp + edx - 0x60], cl
inc dword [ebp - 0x34]
jmp 0x4a45e1
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dl, byte [ebp + eax - 0x164]
test dl, dl
jne 0x4a45de
inc dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
jl 0x4a45a7
mov edx, dword [ebp - 0x34]
mov byte [ebp + edx - 0x60], 0
mov dword [ebp - 0x30], 2
mov cl, byte [ebp - 0x30]
add cl, 0x41
mov byte [ebp - 0x39], cl
xor eax, eax
mov al, byte [ebp - 0x39]
push eax
lea edx, [ebp - 0x60]
push edx
call fcn.0066cb29
add esp, 8
test eax, eax
jne 0x4a4669
mov cl, byte [ebp - 0x39]
mov byte [ebp - 0x3c], cl
mov word [ebp - 0x18], 8
lea edx, [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.0067ceb4
inc dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x438]
xor ecx, ecx
mov ebx, dword [eax]
call dword [ebx + 0xd0]
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0067d0a0
inc dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
cmp ecx, 0x1a
jl 0x4a460b
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x438]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a7f30
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 8]
test edx, edx
je 0x4a7f4b
mov ecx, dword [ebp + 8]
mov al, byte [ecx]
test al, al
jne 0x4a7f52
xor eax, eax
jmp 0x4a7ffc
push 0x44
push 0
lea edx, [ebp - 0x60]
push edx
call fcn.0066c86c
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x101
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x24], eax
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x28], eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x20], eax
mov word [ebp - 0x30], 0
lea ecx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push dword [ebp + 8]
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x4a7fba
xor eax, eax
jmp 0x4a7ffc
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
push 0x1388
push dword [ebp - 0x1c]
call sub.KERNEL32.DLL_WaitForSingleObject
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
test edx, edx
jne 0x4a7ff1
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x1c]
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
je 0x4a7ff1
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4aedc0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
mov eax, 0x76c440
call fcn.0066ce04
mov edx, dword [ebp + 8]
test edx, edx
jne 0x4aedec
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x4aefcc
mov edx, dword [ebp + 8]
add edx, 0x23c
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4aee17
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x4aefcc
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov dword [ebp - 0x34], ecx
jmp 0x4aef94
mov word [ebp - 0x1c], 8
mov eax, dword [ebp + 8]
add eax, 0x23c
mov dword [ebp - 0x50], eax
xor edx, edx
mov dword [ebp - 4], edx
lea ecx, [ebp - 4]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov edx, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4aee64
mov edx, dword [ebp - 4]
jmp 0x4aee69
mov edx, 0x76bed1
push edx
lea eax, [ebp - 0x158]
push eax
call fcn.0066c9ec
add esp, 8
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0067d0a0
movsx ecx, byte [ebp - 0x158]
push ecx
push 0x76bed2
lea eax, [ebp - 0x16c]
push eax
call fcn.00670e94
add esp, 0xc
mov dl, byte [ebp - 0x158]
mov byte [ebp - 0x2d], dl
mov cl, byte [ebp - 0x2d]
cmp cl, 0x61
jb 0x4aeec1
mov al, byte [ebp - 0x2d]
cmp al, 0x7a
ja 0x4aeec1
add byte [ebp - 0x2d], 0xe0
xor edx, edx
mov dl, byte [ebp - 0x2d]
movsx ecx, byte [ebp + 0xc]
cmp edx, ecx
jne 0x4aef91
mov byte [ebp - 0x270], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4aef06
push 0
push 0
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x38]
push ecx
push 0
push 0x104
lea eax, [ebp - 0x270]
push eax
lea edx, [ebp - 0x16c]
push edx
call sub.KERNEL32.DLL_GetVolumeInformationA
mov cl, byte [ebp - 0x270]
test cl, cl
je 0x4aef33
lea eax, [ebp - 0x270]
push eax
xor edx, edx
mov dl, byte [ebp - 0x2d]
push edx
push 0x76bed7
lea ecx, [ebp - 0x158]
push ecx
call fcn.00670e94
add esp, 0x10
jmp 0x4aef4d
xor eax, eax
mov al, byte [ebp - 0x2d]
push eax
push 0x76bedd
lea edx, [ebp - 0x158]
push edx
call fcn.00670e94
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x23c
mov dword [ebp - 0x54], ecx
mov word [ebp - 0x1c], 0x14
lea edx, [ebp - 0x158]
lea eax, [ebp - 8]
call fcn.0067ceb4
inc dword [ebp - 0x10]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov edx, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x20]
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0067d0a0
jmp 0x4aefb5
inc dword [ebp - 0x34]
mov ecx, dword [ebp + 8]
add ecx, 0x23c
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ecx, dword [ebp - 0x34]
cmp eax, ecx
jg 0x4aee2f
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 0x2c]
mov dword fs:[0], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b71e4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], edx
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
pop ebp
ret

Function at 0x4b7790
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff764
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x4b77c2
xor eax, eax
jmp 0x4b78a3
lea edx, [ebp - 0x89c]
push edx
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileInformationByHandle
test eax, eax
jne 0x4b77e4
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4b78a3
mov eax, dword [ebp - 0x87c]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x878]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
lea ecx, [ebp - 0x68]
push ecx
call fcn.004b71e4
pop ecx
jmp 0x4b7867
push 0
lea eax, [ebp - 0x10]
push eax
push 0x800
lea edx, [ebp - 0x868]
push edx
push dword [ebp - 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x4b7877
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4b7877
push dword [ebp - 0x10]
lea eax, [ebp - 0x868]
push eax
lea edx, [ebp - 0x68]
push edx
call fcn.004b7220
add esp, 0xc
mov eax, dword [ebp - 0x10]
xor edx, edx
sub dword [ebp - 0xc], eax
sbb dword [ebp - 8], edx
inc dword [0x7d5cd0]
call fcn.004fcec8
cmp dword [ebp - 8], 0
jne 0x4b7875
cmp dword [ebp - 0xc], 0
ja 0x4b7816
jmp 0x4b7877
jg 0x4b7816
lea ecx, [ebp - 0x68]
push ecx
push dword [ebp + 8]
call fcn.004b7308
add esp, 8
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 8], 0
jne 0x4b78a1
cmp dword [ebp - 0xc], 0
jne 0x4b78a1
mov eax, 1
jmp 0x4b78a3
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4b7ac4
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7b4
mov dword [ebp - 8], 0xffffffff
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x4b7afd
xor eax, eax
jmp 0x4b7c09
lea edx, [ebp - 0x84c]
push edx
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileInformationByHandle
test eax, eax
jne 0x4b7b1f
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4b7c09
mov eax, dword [ebp - 0x82c]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x828]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x4b7bca
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0x800
lea eax, [ebp - 0x818]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x4b7be2
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x4b7be2
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jae 0x4b7bb4
mov ecx, dword [ebp - 8]
shr ecx, 8
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ebp + eax - 0x818]
mov eax, dword [ebp - 8]
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x76e108]
xor ecx, edx
mov dword [ebp - 8], ecx
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
jb 0x4b7b7e
mov eax, dword [ebp - 0x18]
xor edx, edx
sub dword [ebp - 0x10], eax
sbb dword [ebp - 0xc], edx
inc dword [0x7d5cd0]
call fcn.004fcec8
cmp dword [ebp - 0xc], 0
jne 0x4b7bdc
cmp dword [ebp - 0x10], 0
ja 0x4b7b4a
jmp 0x4b7be2
jg 0x4b7b4a
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 8]
not ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
cmp dword [ebp - 0xc], 0
jne 0x4b7c07
cmp dword [ebp - 0x10], 0
jne 0x4b7c07
mov eax, 1
jmp 0x4b7c09
xor eax, eax
mov esp, ebp
pop ebp
ret