joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d1ab73e
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x2c
mov eax, 0x6d1c5150
call fcn.6d1c0d15
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
call fcn.6d1acfff
call fcn.6d180d61
push 0x10002
push dword [0x6d20b1cc]
call sub.java.dll__JNU_GetEnv_8
push dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
call fcn.6d1a7de2
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
pop ecx
push 1
mov dword [esi - 0x44], eax
call edi
mov ebx, 0xff00
test bx, ax
jne 0x6d1ab322
push 4
call edi
test bx, ax
jne 0x6d1ab322
push 2
call edi
push 0x10
call edi
push 0x11
call edi
push 0x12
call edi
call fcn.6d17c5fd
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call dword [sym.imp.USER32.dll_WindowFromPoint]
xor ecx, ecx
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [esi - 0x4c], eax
sete cl
mov dword [ebp - 0x38], ecx
cmp ecx, edi
je 0x6d1ab384
cmp dword [esi - 0x48], edi
jne 0x6d1ab378
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [esi - 0x58]
push dword [ebp - 0x30]
call fcn.6d1aa4ac
add esp, 0x10
mov dword [esi - 0x4c], edi
mov dword [esi - 0x48], 1
jmp 0x6d1ab3af
cmp eax, edi
je 0x6d1ab3af
mov eax, 0x6d1aa311
cmp dword [esi - 0x48], edi
jne 0x6d1ab397
mov eax, 0x6d1aa39a
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push ebx
push dword [esi - 0x44]
push dword [esi - 0x58]
push dword [ebp - 0x30]
call eax
add esp, 0x18
mov dword [esi - 0x48], edi
mov eax, dword [esi - 0x4c]
cmp eax, edi
je 0x6d1ab40d
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x24]
push eax
push dword [esi - 0x4c]
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [ebp - 0x30]
lea eax, [ebp - 0x24]
push dword [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x6d1ab3ff
mov eax, dword [ebp - 0x34]
mov dword [esi - 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esi - 0x10], edi
mov dword [esi - 0x14], eax
jmp 0x6d1ab41a
mov eax, dword [ebp - 0x2c]
mov dword [esi - 0x18], eax
mov eax, dword [ebp - 0x28]
mov dword [esi - 0x14], eax
jmp 0x6d1ab413
mov dword [esi - 0x18], edi
mov dword [esi - 0x14], edi
mov dword [esi - 0x10], 1
mov eax, dword [ebp - 0x38]
lea ecx, [esi - 0x60]
mov dword [esi - 0xc], eax
call fcn.6d1aa092
jmp 0x6d1ab444
call fcn.6d1c0d71
ret 8
mov ecx, dword [esp + 4]
sub ecx, dword [ecx - 4]
mov dword [esp + 4], ecx
jmp 0x6d1ab2c5
Function at 0x6d1ae171
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0x10]
sub esp, 0x1c
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov edi, ecx
movzx ecx, word [ebp + 0xc]
push dword [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push dword [0x6d20b68c]
push eax
call fcn.6d180d61
mov ebx, dword [ebp + 0x14]
add esp, 0x18
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.6d17c694
pop ecx
push eax
push ebx
call fcn.6d17c694
cmp eax, 3
sete al
movzx eax, al
pop ecx
push eax
push dword [0x6d20b6a8]
call fcn.6d17c5fd
mov esi, dword [sym.imp.kernel32.dll_GetTickCount]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
push eax
call fcn.6d17c35b
pop ecx
push edx
push eax
push 0x1f6
mov ecx, edi
call fcn.6d180d61
push ebx
call fcn.6d17c6c3
pop ecx
test dword [edi + 0x3e4], eax
je 0x6d1ae238
push 0
push ebx
call fcn.6d17c694
pop ecx
push eax
push 0
push dword [0x6d20b6a8]
call fcn.6d17c5fd
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
push eax
call fcn.6d17c35b
pop ecx
push edx
push eax
push 0x1f4
mov ecx, edi
call fcn.6d180d61
push ebx
call fcn.6d17c6c3
pop ecx
push 2
not eax
and dword [edi + 0x3e4], eax
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x6d1ae35f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.kernel32.dll_GetTickCount]
push edi
mov ebx, ecx
call esi
push eax
call fcn.6d17c35b
mov edi, eax
pop ecx
mov dword [ebp - 4], edx
cmp dword [0x6d20b6e0], edi
jne 0x6d1ae38e
cmp dword [0x6d20b6e4], edx
je 0x6d1ae3d8
push dword [ebp + 0x10]
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
push dword [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push dword [0x6d20b68c]
push eax
call fcn.6d180d61
lea eax, [ebp - 0x24]
add esp, 0x18
push eax
call fcn.6d17c5fd
push eax
call esi
push eax
call fcn.6d17c35b
pop ecx
push edx
push eax
push 0x3e9
mov ecx, ebx
call fcn.6d180d61
mov eax, dword [ebp - 4]
push 2
mov dword [0x6d20b6e4], eax
pop eax
mov dword [0x6d20b6e0], edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x6d1b4600
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x6d208610]
xor eax, esp
mov dword [esp + 0x11c], eax
cmp word [0x6d20b7c0], 0
push ebx
jne 0x6d1b4822
push esi
push 0x11c
lea eax, [esp + 0xc]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x11c
call dword [sym.imp.kernel32.dll_GetVersionExW]
push str._I__OS_Version_
push 0
push 3
mov esi, eax
call fcn.6d180d61
add esp, 0xc
test esi, esi
pop esi
je 0x6d1b4806
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
cmp eax, 2
jne 0x6d1b47f1
cmp ecx, 4
jbe 0x6d1b47f1
mov eax, dword [esp + 0xc]
mov ebx, 1
cmp ecx, 6
jb 0x6d1b4728
test eax, eax
jne 0x6d1b46de
cmp byte [esp + 0x11e], bl
jne 0x6d1b46bc
push str.OS_VISTA_n
push eax
push 3
call fcn.6d180d61
add esp, 0xc
mov word [0x6d20b7c0], bx
jmp 0x6d1b4822
push str.OS_WINSERV_2008_n
push 0
push 3
call fcn.6d180d61
mov edx, 2
add esp, 0xc
mov word [0x6d20b7c0], dx
jmp 0x6d1b4822
cmp eax, ebx
jb 0x6d1b4728
cmp byte [esp + 0x11e], bl
jne 0x6d1b4706
push str.OS_WINDOWS7_or_newer_n
push 0
push 3
call fcn.6d180d61
add esp, 0xc
mov eax, 0x20
jmp 0x6d1b481c
push str.OS_WINSERV_2008R2_or_newer_n
push 0
push 3
call fcn.6d180d61
mov ecx, 0x40
add esp, 0xc
mov word [0x6d20b7c0], cx
jmp 0x6d1b4822
cmp ecx, 5
jne 0x6d1b47d0
cmp eax, 2
jne 0x6d1b477c
cmp byte [esp + 0x11e], bl
jne 0x6d1b4761
push str.OS_WINXP_64_n
push 0
push 3
call fcn.6d180d61
mov edx, 8
add esp, 0xc
mov word [0x6d20b7c0], dx
jmp 0x6d1b4822
push str.OS_WINSERV_2003_n
push 0
push 3
call fcn.6d180d61
add esp, 0xc
mov eax, 0x10
jmp 0x6d1b481c
cmp eax, ebx
jne 0x6d1b47d0
push str.OS_WINXP
push 0
push 3
call fcn.6d180d61
add esp, 0xc
test dword [esp + 0x11c], 0x200
mov ecx, 4
mov word [0x6d20b7c0], cx
je 0x6d1b47bd
push str.Home_n
push 0
push 3
call fcn.6d180d61
add esp, 0xc
jmp 0x6d1b4822
push str.Pro_n
push 0
push 3
call fcn.6d180d61
add esp, 0xc
jmp 0x6d1b4822
push eax
push ecx
push str.OS_UNKNOWN:_dwMajorVersion_d_dwMinorVersion_d_n
push 0
push 3
call fcn.6d180d61
mov edx, 0xff80
add esp, 0x14
mov word [0x6d20b7c0], dx
jmp 0x6d1b4822
push ecx
push eax
push str.OS_UNKNOWN:_dwPlatformId_d_dwMajorVersion_d_n
push 0
push 3
call fcn.6d180d61
add esp, 0x14
jmp 0x6d1b4817
push str.OS_UNKNOWN:_GetVersionEx_failed_n
push 0
push 3
call fcn.6d180d61
add esp, 0xc
mov eax, 0xff80
mov word [0x6d20b7c0], ax
movzx ecx, word [esp + 0x128]
movzx eax, word [0x6d20b7c0]
and eax, ecx
mov ecx, dword [esp + 0x120]
pop ebx
xor ecx, esp
call fcn.6d1c0acb
add esp, 0x120
ret
Function at 0x6d1b4990
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push str.J2D_D3D_RASTERIZER
call dword [sym.imp.MSVCR100.dll_getenv]
mov esi, eax
add esp, 4
mov ebx, 1
test esi, esi
je 0x6d1b4a79
push edi
push str._W__D3DPPLM::SelectDeviceType:
push 0
push 2
call fcn.6d180d61
mov edi, dword [sym.imp.MSVCR100.dll_strncmp]
push 3
push 0x6d1e33d4
push esi
call edi
add esp, 0x18
test eax, eax
je 0x6d1b4a51
push 3
push 0x6d1c70a4
push esi
call edi
add esp, 0xc
test eax, eax
je 0x6d1b4a51
push 3
push 0x6d1e33d0
push esi
call edi
add esp, 0xc
test eax, eax
je 0x6d1b4a41
push 3
push 0x6d1e33cc
push esi
call edi
add esp, 0xc
test eax, eax
je 0x6d1b4a41
push 3
push 0x6d1e33c8
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x6d1b4a2d
push str.nullref_rasterizer_selected
push eax
push 2
call fcn.6d180d61
mov ebx, 4
jmp 0x6d1b4a64
push esi
push str.unknown_rasterizer:__s__only__refhalnul__supported__hal_selected_instead
push 0
push 2
call fcn.6d180d61
add esp, 0x10
jmp 0x6d1b4a67
push str.hal_rasterizer_selected
push 0
push 2
call fcn.6d180d61
jmp 0x6d1b4a64
push str.ref_rasterizer_selected
push 0
push 2
call fcn.6d180d61
mov ebx, 2
add esp, 0xc
push 0x6d1c71b8
push 0
push 2
call fcn.6d180d61
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x6d1b5380
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_GetVersion]
call esi
cmp al, 5
ja 0x6d1b539c
call esi
cmp al, 5
jne 0x6d1b53aa
call esi
shr eax, 8
cmp al, 1
jb 0x6d1b53aa
push 0x52
call fcn.6d1b4600
add esp, 4
test eax, eax
je 0x6d1b53d5
push str.D3DPPLM::CheckOSVersion:_Windows_2000_or_earlier__or_a_server__OS_detected__failed
push 1
push 1
call fcn.6d180d61
add esp, 0xc
cmp dword [0x6d20b7bc], 0
je 0x6d1b53d9
push str.__OS_check_overridden_via_J2D_D3D_NO_HWCHECK
push 1
push 2
call fcn.6d180d61
add esp, 0xc
xor eax, eax
pop esi
ret
mov eax, 0x80004005
pop esi
ret
Function at 0x6d1be316
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x1fd0]
mov eax, 0x2050
call fcn.6d1c0be0
mov eax, dword [0x6d208610]
xor eax, ebp
mov dword [ebp + 0x1fcc], eax
mov ecx, dword [ebp + 0x1fe4]
mov eax, dword [ebp + 0x1fd8]
push ebx
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x1fe0]
push ecx
push eax
xor ebx, ebx
call dword [0x6d20b810]
test eax, eax
je 0x6d1be472
push esi
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x64], eax
cmp eax, ebx
je 0x6d1be461
push edi
push 0x2c
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [ebp + 0x1fe8]
add esp, 0xc
mov eax, edi
neg eax
mov dword [ebp - 0x58], eax
push 0x20
xor eax, eax
inc eax
mov word [ebp - 0x54], ax
pop eax
push ebx
mov word [ebp - 0x52], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
push dword [ebp - 0x70]
mov esi, edi
push dword [ebp - 0x64]
imul esi, edi
mov dword [ebp - 0x60], 0x28
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x50], ebx
call dword [sym.imp.GDI32.dll_GetDIBits]
mov ebx, dword [sym.imp.kernel32.dll_GetVersion]
call ebx
cmp al, 5
jb 0x6d1be3df
call ebx
shr eax, 8
cmp al, 1
jae 0x6d1be3e5
call ebx
cmp al, 5
jbe 0x6d1be3fa
xor eax, eax
test esi, esi
jle 0x6d1be3fa
test dword [ebp + eax*4 - 0x34], 0xff000000
jne 0x6d1be435
inc eax
cmp eax, esi
jl 0x6d1be3eb
push 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0xfcc]
push eax
push edi
push 0
push dword [ebp - 0x74]
push dword [ebp - 0x64]
call dword [sym.imp.GDI32.dll_GetDIBits]
xor ecx, ecx
test esi, esi
jle 0x6d1be435
cmp dword [ebp + ecx*4 + 0xfcc], 0
jne 0x6d1be430
lea eax, [ebp + ecx*4 - 0x34]
or dword [eax], 0xff000000
inc ecx
cmp ecx, esi
jl 0x6d1be41c
push dword [ebp - 0x64]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edi, dword [ebp - 0x6c]
mov eax, dword [edi]
push esi
push edi
call dword [eax + 0x2cc]
lea ecx, [ebp - 0x34]
push ecx
push esi
mov ebx, eax
mov eax, dword [edi]
push 0
push ebx
push edi
call dword [eax + 0x34c]
pop edi
push dword [ebp - 0x70]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0x74]
call esi
pop esi
mov ecx, dword [ebp + 0x1fcc]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.6d1c0acb
add ebp, 0x1fd0
leave
ret 0x14

Function at 0x6d1bf4b0
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_GetVersion]
call esi
cmp al, 5
jb 0x6d1bf4c6
call esi
shr eax, 8
cmp al, 1
jae 0x6d1bf4cc
call esi
cmp al, 5
jbe 0x6d1bf4e4
push 0
push dword [esp + 0x10]
push 0x6d1bf464
push dword [esp + 0x14]
call sub.COMCTL32.dll_SetWindowSubclass
xor eax, eax
jmp 0x6d1bf4f4
push dword [esp + 0xc]
push 0xfffffffffffffffc
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop esi
ret 8
Function at 0x6d1bf4f8
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_GetVersion]
call esi
cmp al, 5
jb 0x6d1bf50e
call esi
shr eax, 8
cmp al, 1
jae 0x6d1bf514
call esi
cmp al, 5
jbe 0x6d1bf528
push dword [esp + 0xc]
push 0x6d1bf464
push dword [esp + 0x10]
call sub.COMCTL32.dll_RemoveWindowSubclass
jmp 0x6d1bf538
push dword [esp + 0x10]
push 0xfffffffffffffffc
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop esi
ret 0xc

Function at 0x6d1c0acb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d208610]
jne 0x6d1c0ad5
repz ret
jmp fcn.6d1c1354
Function at 0x402b40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebx + 0x18], edx
call fcn.00404140
add eax, edi
mov dword [ebp - 8], eax
jmp 0x402b8e
cmp edi, 0xffffffff
je 0x402b7b
call fcn.00404140
cmp eax, dword [ebp - 8]
jl 0x402b7b
mov eax, 0xfffffff8
jmp 0x402bc7
push ebx
mov edx, dword [ebx + 0x80]
call dword [edx]
mov esi, eax
test eax, eax
jge 0x402b8e
mov eax, esi
jmp 0x402bc7
push ebx
call dword [ebx + 0x50]
test eax, eax
je 0x402b65
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call dword [ebx + 0x5c]
mov eax, dword [ebx + 0x18]
add dword [ebp - 4], eax
sub dword [ebp + 0x10], eax
add dword [ebp + 0xc], eax
mov edx, dword [ebp - 4]
mov dword [ebx + 0x18], edx
cmp dword [ebp + 0x10], 0
jne 0x402bbe
xor eax, eax
jmp 0x402bc7
mov eax, dword [ebx + 0xc]
test eax, eax
jl 0x402bc7
jmp 0x402b8e
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x10

Function at 0x402c2c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov edx, dword [ebx + 0xc]
mov dword [ebp - 8], edx
call fcn.00404140
add eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov dword [ebx + 0xc], ecx
push edi
mov eax, dword [ebp + 0xc]
push eax
push ebx
call dword [ebx + 0x58]
mov esi, eax
test esi, esi
jge 0x402c6a
mov dword [ebx + 0xc], esi
jmp 0x402c70
mov eax, dword [ebp - 8]
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 4], eax
add dword [ebp + 0xc], eax
sub edi, eax
mov edx, dword [ebp - 4]
cmp esi, 0xfffffff7
mov dword [ebx + 0x18], edx
je 0x402c8b
cmp esi, 0xffffffdc
jne 0x402ca0
cmp dword [ebp + 0x14], 0xffffffff
je 0x402ca9
call fcn.00404140
cmp eax, dword [ebp - 0xc]
jl 0x402ca9
mov eax, dword [ebx + 0xc]
jmp 0x402cc5
test esi, esi
jge 0x402ca9
mov eax, dword [ebx + 0xc]
jmp 0x402cc5
test edi, edi
jne 0x402cb1
xor eax, eax
jmp 0x402cc5
push ebx
mov edx, dword [ebx + 0x80]
call dword [edx]
mov esi, eax
test eax, eax
jge 0x402c51
mov dword [ebx + 0xc], esi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402d40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.00404140
add eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebx + 0x18], eax
cmp dword [ebp + 0x10], 0xff
jg 0x402d6b
cmp dword [ebp + 0x10], 0xfffffffe
jge 0x402d7a
mov edx, 0xfffffff9
mov dword [ebx + 0xc], edx
mov eax, edx
jmp 0x402e54
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004110b4
mov edi, eax
mov eax, dword [ebx + 0xc]
pop ecx
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebx + 0xc], edx
push edi
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call dword [ebx + 0x58]
mov esi, eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 4], eax
add dword [ebp + 0xc], eax
sub edi, eax
mov edx, dword [ebp - 4]
cmp esi, 0xfffffff7
mov dword [ebx + 0x18], edx
je 0x402dc2
cmp esi, 0xffffffdc
jne 0x402dd6
cmp dword [ebp + 0x14], 0xffffffff
je 0x402dde
call fcn.00404140
cmp eax, dword [ebp - 0xc]
jl 0x402dde
mov eax, esi
jmp 0x402e54
test esi, esi
jge 0x402dde
mov eax, esi
jmp 0x402e54
test edi, edi
je 0x402df5
push ebx
mov edx, dword [ebx + 0x80]
call dword [edx]
mov esi, eax
test eax, eax
jge 0x402d91
mov eax, esi
jmp 0x402e54
cmp dword [ebp + 0x10], 0
jl 0x402e1f
cmp dword [ebp + 0x14], 0xffffffff
jne 0x402e06
or edx, 0xffffffff
jmp 0x402e10
call fcn.00404140
mov edx, dword [ebp - 0xc]
sub edx, eax
push edx
mov eax, dword [ebp + 0x10]
push eax
push ebx
call fcn.00402cd0
mov esi, eax
jmp 0x402e52
cmp dword [ebp + 0x10], 0xfffffffe
jne 0x402e52
cmp dword [ebp + 0x14], 0xffffffff
mov edi, dword [ebx + 0x18]
jne 0x402e33
or eax, 0xffffffff
jmp 0x402e3f
call fcn.00404140
push eax
mov eax, dword [ebp - 0xc]
pop edx
sub eax, edx
push eax
push 2
push 0x41c050
push ebx
call fcn.00402c2c
mov esi, eax
mov dword [ebx + 0x18], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40379c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebx + 0x48]
push ecx
call sub.KERNEL32.dll_ClearCommError
mov eax, dword [ebp - 4]
or dword [ebx + 0x24], eax
mov edi, dword [ebx + 4]
sub edi, dword [ebp - 0xc]
cmp edi, dword [ebp + 0x10]
jbe 0x4037cf
mov edi, dword [ebp + 0x10]
lea eax, [ebx + 0x60]
push eax
lea edx, [ebp - 8]
push edx
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebx + 0x48]
push eax
call sub.KERNEL32.dll_WriteFile
mov edx, dword [ebp - 8]
test eax, eax
mov dword [esi + 0x18], edx
jne 0x40381c
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 4], eax
cmp eax, 0x3e5
je 0x403819
lea edx, [ebp - 0x14]
lea ecx, [ebp - 4]
push edx
push ecx
mov eax, dword [ebx + 0x48]
push eax
call sub.KERNEL32.dll_ClearCommError
mov edx, dword [esi]
mov ecx, dword [ebp - 4]
or dword [edx + 0x24], ecx
jmp 0x40381c
mov dword [esi + 0x18], edi
mov eax, dword [esi + 0x18]
cmp eax, dword [ebp + 0x10]
jae 0x403830
mov edx, 0xfffffff7
mov dword [esi + 0xc], edx
mov eax, edx
jmp 0x403832
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4038cc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebx + 0x48]
push ecx
call sub.KERNEL32.dll_ClearCommError
cmp dword [ebp - 4], 0
jbe 0x4038fa
mov eax, dword [ebp - 4]
or dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jbe 0x403980
cmp edi, eax
ja 0x403907
mov eax, edi
lea edx, [ebx + 0x60]
push edx
lea ecx, [ebp - 8]
push ecx
push eax
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebx + 0x48]
push edx
call sub.KERNEL32.dll_ReadFile
mov ecx, dword [ebp - 8]
test eax, eax
mov dword [esi + 0x18], ecx
jne 0x40394f
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 4], eax
cmp eax, 0x3e5
je 0x40394f
lea edx, [ebp - 0x14]
lea ecx, [ebp - 4]
push edx
push ecx
mov eax, dword [ebx + 0x48]
push eax
call sub.KERNEL32.dll_ClearCommError
mov edx, dword [esi]
mov ecx, dword [ebp - 4]
or dword [edx + 0x24], ecx
cmp edi, dword [esi + 0x18]
jbe 0x40397c
push 1
lea eax, [ebp - 8]
push eax
lea edx, [ebx + 0x60]
push edx
mov ecx, dword [ebx + 0x48]
push ecx
call sub.KERNEL32.dll_GetOverlappedResult
test eax, eax
je 0x403975
mov eax, dword [ebp - 8]
mov dword [esi + 0x18], eax
xor eax, eax
jmp 0x40398a
mov eax, 0xfffffff8
jmp 0x40398a
xor eax, eax
jmp 0x40398a
xor edx, edx
mov eax, 0xfffffff8
mov dword [esi + 0x18], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x406680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
cmp ebx, eax
jle 0x40669d
xor cx, word [edx]
add edx, 2
inc eax
cmp ebx, eax
jg 0x406692
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x41409c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xff
mov eax, dword [ebp + 8]
push eax
push 0x41f284
call fcn.00415b24
add esp, 0xc
lea edx, [ebp - 8]
push 0
push 0
push 0
push edx
push 0x41f284
call fcn.004142d8
add esp, 0x14
push 0x41dad0
lea ecx, [ebp - 8]
push ecx
call fcn.00410fa8
add esp, 8
mov byte [0x41f284], 0
push 0
push 0
push 0
push 0
push 0
push 0xff
push 0x41f284
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
je 0x41410f
mov eax, 0x41f284
jmp 0x414111
xor eax, eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x414118
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
test byte [ebx + 8], 8
je 0x41413d
cmp dword [ebx + 4], 0xfffffffe
jne 0x41413d
or eax, 0xffffffff
jmp 0x414275
test byte [ebx + 8], 8
je 0x4141aa
cmp dword [ebx + 4], 0xffffffff
jne 0x4141aa
mov dword [esi + 8], 8
mov edx, dword [ebx + 0xc]
push edx
call fcn.0041409c
pop ecx
mov edi, eax
test edi, edi
je 0x414192
add esi, 0x10
xor eax, eax
push esi
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx + 4], 0xfffffffe
xor eax, eax
jmp 0x414275
call fcn.00415ee0
test eax, eax
jne 0x4141a2
xor eax, eax
jmp 0x414275
or eax, 0xffffffff
jmp 0x414275
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x4141b7
cmp eax, 0xfffffffe
jne 0x4141de
mov dword [ebx + 4], 0xffffffff
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
mov dword [ebx + 4], edi
cmp edi, 0xffffffff
setne al
and eax, 1
jmp 0x4141ee
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 4]
push ecx
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x414204
call fcn.00415ee0
test eax, eax
jne 0x4141ff
xor eax, eax
jmp 0x414275
or eax, 0xffffffff
jmp 0x414275
mov eax, dword [ebp - 0x148]
test al, 0x16
je 0x414218
mov edx, dword [ebx + 8]
and edx, eax
test dl, 0x16
je 0x4141aa
mov ecx, dword [ebp - 0x148]
mov dword [esi + 8], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.dll_FileTimeToLocalFileTime
lea ecx, [esi + 0xc]
push ecx
lea eax, [esi + 0xe]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.dll_FileTimeToDosDateTime
mov ecx, dword [ebp - 0x128]
xor eax, eax
mov dword [esi + 4], ecx
add esi, 0x10
push esi
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret