joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004519c
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
add edi, eax
and cl, 0x5f
shl ch, cl
mov ebx, dword [edx + 0x20]
test edx, 0x361b80eb
btr cx, di
shld cx, sp, 0xa
add ebx, eax
sbb ch, 0x24
setg ch
mov dword [ebp - 8], 0
setg cl
mov ecx, 0x4f25eaea
stc
clc
mov ecx, dword [edx + 0x18]
lea esp, [esp + 8]
je 0x10041ff6
lea ecx, [esi + 0x1527f1f8]
jmp 0x10044d11
adc cx, bx
shld cx, sp, 0xe
add edx, eax
bswap ecx
mov ecx, dword [esi + 0x7c]
pushal
pushal
cmp ebp, edi
add ecx, edx
lea esp, [esp + 0x40]
jo 0x1004089f
mov dword [ebp - 0x10], ecx
btc cx, 0xe
mov ecx, dword [ebp + 0xc]
stc
pushfd
cmp bh, 0xa4
cmp ecx, 0xffff
pushal
push 0x2c4b4ca6
mov word [esp + 0x14], 0x633
lea esp, [esp + 0x28]
jbe 0x1003d987
sal ebx, 0x12
bsr di, cx
inc edi
mov edi, dword [edx + 0x24]
xor ch, dh
jmp 0x1003e1eb
pushfd
jmp 0x100418f0
Function at 0x4011f0
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov eax, 0x1008
call fcn.004050d0
push ebx
push ebp
push esi
push edi
push 0
push 0
push 0
push 1
push str.Downloader
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
test ebx, ebx
jne 0x401224
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1008
ret
mov eax, dword [esp + 0x101c]
push 0
push 0x80000000
push 0
push 0
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
jne 0x401258
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1008
ret
mov ecx, dword [esp + 0x1020]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401298
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1008
ret
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0x1000
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4012ee
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x4012ee
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x20]
push eax
push edx
push edi
call ebp
test eax, eax
je 0x40130e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push 0x1000
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x4012b8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x1008
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1008
ret

Function at 0x401330
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x4013c7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ShellExecute_failed:
push 0x43cba8
call fcn.004020c0
add esp, 8
mov ecx, eax
call fcn.004018b0
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00401c30
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test cl, 6
lea eax, [edx + esi]
jne 0x4013a1
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x4013a1
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x4013c2
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, edi
test edx, edx
jne 0x4013ba
or al, 4
push 0
push eax
call fcn.00412878
pop edi
xor al, al
pop esi
ret
mov al, 1
ret
Function at 0x418c6f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x418cb1
call fcn.004289b7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x418cb1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x418ca8
xor eax, eax
jmp 0x418cb9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00418cbf
pop edi
pop esi
pop ebx
ret 4

Function at 0x41a06b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x42a898
call fcn.00405990
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.004289b7
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x41a0aa
call fcn.004289b7
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41a0b8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41a0c6
or eax, 0xffffffff
jmp 0x41a1ae
mov ecx, esi
call fcn.00419fe1
mov dword [ebp - 0x14], eax
call fcn.00416f7d
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x41a0fd
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41a0fd
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.00416f31
push dword [ebp - 0x14]
call fcn.00416a63
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00419d79
cmp eax, edi
je 0x41a170
test byte [esi + 0x24], 0x10
je 0x41a13e
push 4
mov ecx, esi
pop ebx
call fcn.004194a8
test ah, 1
je 0x41a136
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.00418ec6
cmp dword [esi + 0x1c], edi
je 0x41a170
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00419594
jmp 0x41a170
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x41a184
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x41a19d
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x41a19d
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0041a01b
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x428ea4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x428ed2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x428ef0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00428e0a
jmp 0x428ef0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x428ef0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00428e0a
test edi, edi
mov eax, edi
jne 0x428eda
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x405c8e
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax - 0x29], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
sti
xchg dword [eax], eax
cmpsd dword [esi], dword es:[edi]
and eax, 0x4281aa
push 0x210400
push dword [ebp + eax*2 + 0x50]
push dword [esp - 0x40]
push dword [edx + 0x429238]
jmp dword [esi + 0xe981b8]

Function at 0x405d74
Capabilities:
Delete file
Encode data using xor

Disassembly:
das
in al, dx
sub esp, 0x75000258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
inc ebp
mov edi, dword [ebp + 8]
add ebx, eax
and eax, 4
push edi
movsd dword es:[edi], dword [esi]
inc ebp
cld
call fcn.0040603f
not byte [esi]
or byte [ebp - 0x606307bb], bh
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
neg eax
sbb ecx, dword [eax - 0x7ffa10c0]
mov byte [0x7d910042], al
add dword [eax], eax
add byte [ebp + 0x6583085d], dh
or byte [ecx], al
mov bh, 0xe
test eax, eax
je 0xc1405ede
test bl, 2
invalid

Function at 0x406133
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
Function at 0x10001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x20]
mov dl, 0x6e
xor ebx, ebx
push eax
push ecx
mov dword [esi], 0x1001719c
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], bl
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push ebx
push ebx
mov edi, eax
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 4], 0x3e8
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [esi + 4]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x28], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi], eax
mov eax, dword [esi + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x20], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi + 8], eax
add esp, 0x10
add edi, 4
dec ebp
jne 0x100010d6
lea eax, [esi + 0x46]
xor ecx, ecx
mov edx, eax
pop edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov word [eax], 0x31
mov word [esi + 0x48], 1
mov dword [esi + 0x4a], 0x1f40
mov dword [esi + 0x4e], 0x659
mov word [esi + 0x52], 0x41
mov word [esi + 0x54], bx
mov word [esi + 0x56], 2
mov word [esi + 0x58], 0x140
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10001180
Capabilities:
Link many functions at runtime
Terminate thread

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
mov edi, ecx
push str.CloseHandle
push str.kernel32.dll
mov dword [edi], 0x1001719c
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov ebx, dword [sym.imp.MSVCRT.dll_puts]
push 0x1001a170
mov dword [esp + 0x30], eax
call ebx
add esp, 4
push str.waveInReset
push str.WINMM.dll
call ebp
push eax
call esi
push 0x1001a170
mov dword [esp + 0x18], eax
call ebx
add esp, 4
push str.waveInStop
push str.WINMM.dll
call ebp
push eax
call esi
push 0x1001a170
mov dword [esp + 0x14], eax
call ebx
add esp, 4
push str.waveInClose
push str.WINMM.dll
call ebp
push eax
call esi
push 0x1001a170
mov dword [esp + 0x20], eax
call ebx
add esp, 4
push str.waveInUnprepareHeader
push str.WINMM.dll
call ebp
push eax
call esi
push 0x1001a170
mov dword [esp + 0x1c], eax
call ebx
add esp, 4
push str.waveOutReset
push str.WINMM.dll
call ebp
push eax
call esi
push 0x1001a170
mov dword [esp + 0x24], eax
call ebx
add esp, 4
push str.waveOutClose
push str.WINMM.dll
call ebp
push eax
call esi
push 0x1001a170
mov dword [esp + 0x2c], eax
call ebx
add esp, 4
push str.waveOutUnprepareHeader
push str.WINMM.dll
call ebp
push eax
call esi
mov dword [esp + 0x24], eax
mov al, byte [edi + 0x44]
test al, al
je 0x100012c5
mov eax, dword [edi + 0x18]
push eax
call dword [esp + 0x14]
mov ecx, dword [edi + 0x18]
push ecx
call dword [esp + 0x18]
lea esi, [edi + 0x30]
mov ebx, 2
mov edx, dword [esi]
mov eax, dword [edi + 0x18]
push 0x20
push edx
push eax
call dword [esp + 0x24]
add esi, 4
dec ebx
jne 0x1000129e
mov ecx, dword [edi + 0x18]
push ecx
call dword [esp + 0x20]
mov edx, dword [edi + 0x2c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, byte [edi + 0x45]
test al, al
je 0x100012f7
mov eax, dword [edi + 0x40]
push eax
call dword [esp + 0x24]
lea esi, [edi + 0x30]
mov ebx, 2
mov ecx, dword [esi]
mov edx, dword [edi + 0x40]
push 0x20
push ecx
push edx
call dword [esp + 0x30]
add esi, 4
dec ebx
jne 0x100012dc
mov eax, dword [edi + 0x40]
push eax
call dword [esp + 0x2c]
lea esi, [edi + 0x30]
mov ebx, 2
mov ecx, dword [esi - 0x28]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esi]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi - 0x20]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esi + 8]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
add esi, 4
dec ebx
jne 0x100012ff
mov edx, dword [edi + 0x24]
mov esi, dword [esp + 0x2c]
push edx
call esi
mov eax, dword [edi + 0x28]
push eax
call esi
mov ecx, dword [edi + 0x2c]
push ecx
call esi
push str.WINMM.dll
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10001460
Capabilities:
Create thread
Link many functions at runtime
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.waveInGetNumDevs
mov edi, ecx
push str.WINMM.dll
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
nop
nop
nop
nop
nop
nop
nop
nop
call eax
test eax, eax
jne 0x1000149d
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push str.waveInOpen
push str.WINMM.dll
call esi
push eax
call ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 4
push edi
push 0x10001680
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
push 0x20000
push 0
lea edx, [edi + 0x46]
push ecx
lea ebx, [edi + 0x18]
push edx
push 0xffff
push ebx
mov dword [edi + 0x2c], eax
call dword [ebp - 8]
test eax, eax
je 0x100014f7
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push str.waveInPrepareHeader
push str.WINMM.dll
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
lea esi, [edi + 0x30]
mov dword [ebp - 8], 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov ecx, dword [ebx]
push eax
push ecx
call dword [ebp - 0xc]
mov eax, dword [ebp - 8]
add esi, 4
dec eax
mov dword [ebp - 8], eax
jne 0x10001517
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.waveInAddBuffer
push str.WINMM.dll
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [edi + 0x1c]
push 0x20
mov ecx, dword [edi + edx*4 + 0x30]
mov edx, dword [ebx]
push ecx
push edx
call eax
mov eax, dword [edi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push str.waveInStart
push str.WINMM.dll
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebx]
push ecx
call eax
mov al, 1
mov byte [edi + 0x44], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002090
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x100165c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 4]
call fcn.10001a50
xor ebx, ebx
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1d0], ebx
call fcn.10001a50
lea ecx, [esi + 0x54]
mov byte [esp + 0x1d0], 1
call fcn.10001a50
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1d0], 2
call fcn.10001a50
mov al, 0x65
mov cl, 0x6c
mov byte [esp + 0x29], al
mov byte [esp + 0x2c], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0x2d], cl
mov byte [esp + 0x32], cl
mov byte [esp + 0x33], cl
lea eax, [esp + 0x18]
lea ecx, [esp + 0x28]
mov dl, 0x6e
push eax
push ecx
mov byte [esp + 0x1d8], 3
mov dword [esi], 0x100171b8
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], dl
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3c], bl
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x24], 0x74
mov byte [esp + 0x26], 0x45
mov byte [esp + 0x27], 0x76
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x74
mov byte [esp + 0x2b], 0x41
mov byte [esp + 0x2c], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x38]
mov edi, eax
push edx
push 0x202
call dword [0x1001cbdc]
mov ebp, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call ebp
add esp, 4
push ebx
push ebx
push 1
push ebx
call edi
push 0x30
mov dword [esi + 0xac], eax
call ebp
add esp, 4
mov byte [esi + 0xb5], bl
mov dword [esi + 0xa8], 0xffffffff
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x11], 0x68
mov byte [esp + 0x12], 0x30
mov byte [esp + 0x13], 0x73
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0xb0]
mov al, 0x74
pop edi
mov dword [ecx], edx
mov byte [ecx + 4], al
mov ecx, dword [esp + 0x1c4]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c4
ret
Function at 0x100045d0
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x794
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.GetDriveTypeA
mov dword [esp + 0x40], ecx
push str.kernel32.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x144]
push eax
push 0x100
mov byte [esp + 0x3ac], 0x67
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor eax, eax
push str.Shell32.dll
lea ebp, [esp + 0x148]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call edi
mov esi, eax
push str.SHGetFileInfoA
push esi
mov dword [esp + 0x30], esi
call ebx
push str.GetVolumeInformationA
push str.kernel32.dll
mov dword [esp + 0x3c], eax
call edi
push eax
call ebx
mov dword [esp + 0x38], eax
mov al, byte [esp + 0x144]
test al, al
mov ebx, 1
je 0x100047b0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x40]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x44]
push ecx
push eax
push eax
push eax
push eax
push eax
push ebp
call dword [esp + 0x58]
push 0x410
lea edx, [esp + 0x248]
push 0x160
push edx
push 0x80
push ebp
call dword [esp + 0x48]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x354]
push eax
call esi
mov edi, eax
lea ecx, [esp + 0x40]
inc edi
push ecx
mov dword [esp + 0x34], edi
call esi
inc eax
mov dword [esp + 0x10], eax
mov al, byte [ebp]
cmp al, 0x41
je 0x1000471f
cmp al, 0x42
je 0x1000471f
lea edx, [esp + 0x20]
push 0
lea eax, [esp + 0x1c]
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x1000471f
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, 0x14
call fcn.10015f10
mov edx, dword [esp + 0x1c]
mov esi, eax
mov eax, dword [esp + 0x18]
mov ecx, 0x14
call fcn.10015f10
mov dword [esp + 0x14], eax
jmp 0x10004725
xor esi, esi
mov dword [esp + 0x14], esi
mov cl, byte [ebp]
push ebp
mov byte [esp + ebx + 0x3a8], cl
call dword [esp + 0x30]
mov edx, dword [esp + 0x14]
mov ecx, edi
mov byte [esp + ebx + 0x3a5], al
mov eax, ecx
mov dword [esp + ebx + 0x3a6], esi
lea esi, [esp + 0x354]
lea edi, [esp + ebx + 0x3ae]
mov dword [esp + ebx + 0x3aa], edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x30]
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [eax + ebx]
lea esi, [esp + 0x44]
lea edi, [esp + edx + 0x3b2]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
add ecx, eax
lea ebx, [ebx + ecx + 0xa]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebp, [eax + ebp + 1]
cmp byte [ebp], 0
jne 0x10004671
mov esi, dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x3a4]
push ebx
push edx
call fcn.10008840
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x794
ret
Function at 0x100049f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x480
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.DeleteFileA
mov ebp, ecx
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov cl, 0x6c
mov dword [esp + 0x3c], eax
mov al, 0x65
mov byte [esp + 0x1d], cl
mov byte [esp + 0x22], cl
mov byte [esp + 0x23], cl
mov cl, 0x6f
mov byte [esp + 0x19], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x29], al
mov byte [esp + 0x2d], al
mov byte [esp + 0x31], al
mov byte [esp + 0x2b], cl
mov byte [esp + 0x34], cl
lea eax, [esp + 0x28]
lea ecx, [esp + 0x18]
mov dl, 0x72
xor bl, bl
push eax
push ecx
mov byte [esp + 0x20], 0x6b
mov byte [esp + 0x22], dl
mov byte [esp + 0x23], 0x6e
mov byte [esp + 0x26], 0x33
mov byte [esp + 0x27], 0x32
mov byte [esp + 0x28], 0x2e
mov byte [esp + 0x29], 0x64
mov byte [esp + 0x2c], bl
mov byte [esp + 0x30], 0x52
mov byte [esp + 0x32], 0x6d
mov byte [esp + 0x34], 0x76
mov byte [esp + 0x36], 0x44
mov byte [esp + 0x37], 0x69
mov byte [esp + 0x38], dl
mov byte [esp + 0x3a], 0x63
mov byte [esp + 0x3b], 0x74
mov byte [esp + 0x3d], dl
mov byte [esp + 0x3e], 0x79
mov byte [esp + 0x3f], 0x41
mov byte [esp + 0x40], bl
call esi
push eax
call edi
mov esi, dword [esp + 0x494]
mov dword [esp + 0x40], eax
mov al, 0x2a
lea edx, [esp + 0x10]
mov byte [esp + 0x13], al
mov byte [esp + 0x15], al
push esi
lea eax, [esp + 0x188]
push edx
push eax
mov byte [esp + 0x1c], 0x25
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x22], bl
call dword [0x1001cc38]
add esp, 0xc
lea ecx, [esp + 0x44]
lea edx, [esp + 0x184]
push ecx
push edx
call dword [0x1001cc3c]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10004b28
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x480
ret 4
mov bl, 0x10
cmp byte [esp + 0x70], 0x2e
je 0x10004b81
test byte [esp + 0x44], bl
lea eax, [esp + 0x70]
push eax
push esi
push str._s_s
je 0x10004b64
lea ecx, [esp + 0x398]
push ecx
call dword [0x1001cc38]
add esp, 0x10
lea edx, [esp + 0x38c]
mov ecx, ebp
push edx
call fcn.100049f0
jmp 0x10004b81
lea ecx, [esp + 0x294]
push ecx
call dword [0x1001cc38]
add esp, 0x10
lea edx, [esp + 0x288]
push edx
call dword [esp + 0x40]
lea eax, [esp + 0x44]
push eax
push edi
call dword [0x1001cc40]
test eax, eax
jne 0x10004b2a
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [esp + 0x44]
pop edi
pop esi
test eax, eax
pop ebp
pop ebx
setne al
add esp, 0x480
ret 4