joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e2c8
Capabilities:
Get disk information via ioctl

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov byte [esp + 4], dl
mov dword [esp], eax
mov byte [esp + 5], 0
movzx eax, byte [esp + 4]
call fcn.0046d850
mov ebp, dword [0x669904]
dec ebp
test ebp, ebp
jl 0x46e3f6
inc ebp
xor ebx, ebx
or esi, 0xffffffff
imul edi, ebx, 0x299
mov eax, dword [0x669908]
cmp byte [eax + edi*8 + 0x1400], 0
je 0x46e3ee
mov eax, dword [0x669908]
movzx eax, byte [eax + edi*8 + 0x1408]
xor al, 1
or al, byte [esp + 4]
je 0x46e37f
mov eax, ebx
call fcn.0046df24
test al, al
jne 0x46e3ee
mov eax, ebx
call fcn.0046dc2c
mov esi, eax
cmp esi, 0xffffffff
je 0x46e3ee
push 0
lea eax, [esp + 0xc]
push eax
push 0xc
mov eax, dword [0x669908]
lea eax, [eax + edi*8 + 0x1409]
push eax
push 0
push 0
push 0x2d1080
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x46e37f
mov eax, dword [0x669908]
mov byte [eax + edi*8 + 0x1408], 1
imul eax, ebx, 0x299
mov edx, dword [0x669908]
cmp byte [edx + eax*8 + 0x1408], 0
je 0x46e3c3
mov edx, dword [0x669908]
cmp dword [edx + eax*8 + 0x1409], 7
jne 0x46e3c3
cmp dword [esp], 0xffffffff
je 0x46e3d1
imul eax, ebx, 0x299
mov edx, dword [0x669908]
mov eax, dword [edx + eax*8 + 0x140d]
cmp eax, dword [esp]
je 0x46e3d1
cmp esi, 0xffffffff
je 0x46e3ee
mov eax, ebx
call fcn.0046da64
jmp 0x46e3ee
movzx edx, byte [esp + 4]
mov eax, ebx
call fcn.0046df68
cmp esi, 0xffffffff
je 0x46e3e9
mov eax, ebx
call fcn.0046da64
mov byte [esp + 5], 1
inc ebx
dec ebp
jne 0x46e2f7
movzx eax, byte [esp + 5]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46e404
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
mov dword [edi], eax
mov eax, dword [ebp + 8]
mov byte [eax], 0
imul eax, ebx, 0x299
mov edx, dword [0x669908]
mov eax, dword [edx + eax*8 + 0x14a8]
mov dword [ebp - 8], eax
test eax, eax
je 0x46e441
mov eax, dword [eax]
mov dword [edi], eax
jmp 0x46e5eb
mov eax, ebx
call fcn.0046df24
test al, al
jne 0x46e5eb
mov eax, ebx
call fcn.0046dc2c
mov esi, eax
cmp esi, 0xffffffff
jne 0x46e469
mov eax, dword [ebp + 8]
mov byte [eax], 1
jmp 0x46e5eb
mov eax, 0xc008
call fcn.0040d864
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0xc008
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x560000
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x46e4a6
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jbe 0x46e4a6
cmp dword [ebp - 0x10], 0x20
jae 0x46e4b9
lea eax, [ebp - 0xc]
call fcn.0040d7e8
mov eax, dword [ebp + 8]
mov byte [eax], 1
jmp 0x46e5eb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax + eax*2]
add eax, 0x20
cmp eax, dword [ebp - 0x10]
jbe 0x46e4e5
mov eax, dword [ebp - 0x10]
sub eax, 0x20
mov ecx, 0x18
xor edx, edx
div ecx
inc eax
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x800
jb 0x46e511
mov eax, dword [ebp - 0xc]
mov dword [eax], 0x800
imul eax, ebx, 0x299
mov edx, dword [0x669908]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*8 + 0x14a8], ecx
jmp 0x46e572
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax + eax*2]
add eax, 0x20
call fcn.0040d7d8
imul edx, ebx, 0x299
mov ecx, dword [0x669908]
mov dword [ecx + edx*8 + 0x14a8], eax
imul eax, ebx, 0x299
mov edx, dword [0x669908]
mov edx, dword [edx + eax*8 + 0x14a8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
add ecx, ecx
lea ecx, [ecx + ecx*2]
add ecx, 0x20
mov eax, dword [ebp - 0xc]
call fcn.00402da0
lea eax, [ebp - 0xc]
call fcn.0040d7e8
cmp byte [ebp - 1], 0
je 0x46e5d1
imul eax, ebx, 0x299
mov edx, dword [0x669908]
cmp byte [edx + eax*8 + 0x1408], 0
jne 0x46e5d1
push 0
lea eax, [ebp - 0x10]
push eax
push 0xc
imul eax, ebx, 0x299
mov edx, dword [0x669908]
lea eax, [edx + eax*8 + 0x1409]
push eax
push 0
push 0
push 0x2d1080
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x46e5d1
imul eax, ebx, 0x299
mov edx, dword [0x669908]
mov byte [edx + eax*8 + 0x1408], 1
imul eax, ebx, 0x299
mov edx, dword [0x669908]
mov eax, dword [edx + eax*8 + 0x14a8]
mov edx, dword [eax]
mov dword [edi], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4708a4
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffff7fc
imul eax, eax, 0x83
mov edx, dword [0x66d350]
mov edx, dword [edx + eax*8 + 0x414]
mov eax, esp
mov ecx, 0x3ff
call fcn.0040da74
mov word [esp + eax*2], 0x5c
mov word [esp + eax*2 + 2], 0
push esp
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 3
sete al
add esp, 0x804
ret

Function at 0x470cd0
Capabilities:
Get disk information via ioctl

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
xor ebx, ebx
push 0
push 0
push 3
push 0
push 0
push 0
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x470cf5
test esi, esi
jne 0x470d07
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], 0xffffffff
xor eax, eax
mov dword [edi + 8], eax
jmp 0x470d75
mov bl, 1
xor eax, eax
mov dword [esp], eax
mov eax, edi
xor ecx, ecx
mov edx, 0xc
call fcn.004032f4
push 0
push 0
mov dl, 1
mov eax, 0x1310
call fcn.004426b4
push 0
lea eax, [esp + 4]
push eax
push 0xc
push edi
push 0
push 0
push 0x2d1080
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x470d4f
cmp dword [esp], 0xc
jae 0x470d5f
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], 0xffffffff
xor eax, eax
mov dword [edi + 8], eax
push 0
push 0
xor edx, edx
mov eax, 0x1310
call fcn.004426b4
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4821f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff394
push ebx
push esi
push edi
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], eax
lea edi, [ebp - 0x44]
mov dword [ebp - 0x5c], 0xc
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], 0xffffffff
mov dword [edi], 0x44
xor eax, eax
mov dword [edi + 4], eax
xor eax, eax
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi + 0x10], eax
xor eax, eax
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [edi + 0x18], eax
xor eax, eax
mov dword [edi + 0x1c], eax
xor eax, eax
mov dword [edi + 0x20], eax
xor eax, eax
mov dword [edi + 0x24], eax
xor eax, eax
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [edi + 0x2c], eax
mov word [edi + 0x30], 0
mov word [edi + 0x32], 0
xor eax, eax
mov dword [edi + 0x34], eax
xor eax, eax
mov dword [edi + 0x38], eax
xor eax, eax
mov dword [edi + 0x3c], eax
xor eax, eax
mov dword [edi + 0x40], eax
xor esi, esi
cmp byte [ebp + 8], 0
je 0x48228a
mov esi, 0x8000000
mov ebx, dword [0x66d818]
movzx ebx, byte [ebx]
lea eax, [ebp - 0x46c]
mov ecx, 0x1ff
mov edx, dword [ebp - 0x48]
call fcn.00414414
lea eax, [ebp - 0x86c]
mov ecx, 0x1ff
mov edx, dword [ebp - 0x4c]
call fcn.00414414
test bl, bl
jne 0x482314
lea edx, [ebp - 0xa6c]
lea eax, [ebp - 0x46c]
mov ecx, 0x1ff
call fcn.00414408
lea edx, [ebp - 0xc6c]
lea eax, [ebp - 0x86c]
mov ecx, 0x1ff
call fcn.00414408
lea eax, [ebp - 0x6c]
push eax
push edi
push 0
push 0
push esi
push 0
push 0
push 0
lea eax, [ebp - 0xc6c]
push eax
lea eax, [ebp - 0xa6c]
push eax
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x48233d
lea eax, [ebp - 0x6c]
push eax
push edi
push 0
push 0
push esi
push 0
push 0
push 0
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x46c]
push eax
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x482347
cmp dword [ebp - 0x6c], 0
jne 0x48234c
or ebx, 0xffffffff
jmp 0x482381
push 0xffffffffffffffff
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x482371
cmp dword [ebp - 0x50], 0x103
jne 0x482376
or ebx, 0xffffffff
jmp 0x482379
mov ebx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x6c]
call fcn.00416794
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x482a0c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
cmp dword [ebp - 8], 0
jne 0x482a2f
mov byte [ebp - 9], 1
jmp 0x482b9f
movzx ebx, byte [esi + 0x281d]
xor bl, 1
cmp dword [ebp - 8], 0xcbe
jne 0x482afc
test bl, bl
jne 0x482a56
mov dword [ebp - 8], 0x501
jmp 0x482afc
mov dword [ebp - 0x50], 0xfe00
mov dword [ebp - 0x4c], 0xcc0
mov dword [ebp - 0x48], 0xcc1
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], 0xffffffff
push 0
push 0
push 0x5c00
push 0
lea eax, [ebp - 0x50]
push eax
push 2
push 3
push 2
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0044226c
dec eax
jne 0x482b9f
cmp dword [ebp - 0x10], 0
jl 0x482b9f
cmp dword [ebp - 0x10], 0
jne 0x482abf
mov byte [ebp - 9], 1
jmp 0x482b9f
cmp dword [ebp - 0x10], 1
jne 0x482b9f
test esi, esi
je 0x482b9f
cmp dword [esi + 0x3180], 0
je 0x482b9f
movzx eax, byte [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, esi
mov eax, dword [ebp - 4]
call dword [esi + 0x3180]
cmp ax, 1
jne 0x482a77
jmp 0x482b9f
mov dword [ebp - 0x30], 0xfe00
mov eax, dword [0x66d838]
xor edx, edx
call fcn.0041479c
mov dword [ebp - 0x2c], eax
mov eax, dword [0x66d838]
mov edx, 1
call fcn.0041479c
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x311
test bl, bl
je 0x482b4c
mov dword [ebp - 0x24], 0x444
or dword [ebp - 0x14], 0x400
push 0
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043e188
mov ebx, eax
cmp bx, 6
jne 0x482b71
mov byte [ebp - 9], 1
jmp 0x482b9f
cmp bx, 1
jne 0x482b9f
test byte [ebp - 0x13], 4
je 0x482b4c
test esi, esi
je 0x482b4c
cmp dword [esi + 0x3180], 0
je 0x482b4c
movzx eax, byte [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, esi
mov eax, dword [ebp - 4]
call dword [esi + 0x3180]
jmp 0x482b4c
movzx eax, byte [ebp - 9]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x482e24
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov esi, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0xce9], 0
je 0x482eec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xc]
cmp dword [eax + 0x64], 0
jbe 0x482e61
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx - 4]
cmp byte [eax + 0xce8], 0
je 0x482e65
xor eax, eax
jmp 0x482e67
mov al, 1
mov byte [edx], al
cmp byte [edx], 0
jne 0x482e8c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
cmp byte [eax + 0x26a], 0
je 0x482eec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
cmp dword [eax + 0x26c], 0
jbe 0x482eec
cmp byte [edx], 0
je 0x482e9f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov esi, dword [eax + 0x270]
jmp 0x482eab
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov esi, dword [eax + 0x26c]
call fcn.00442e20
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0xcec]
cmp eax, edx
jb 0x482ee8
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx - 4]
mov ecx, eax
sub ecx, edx
cmp esi, ecx
jbe 0x482ee8
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx - 4]
sub eax, edx
sub esi, eax
cmp ebx, 0xffffffff
je 0x482ee4
cmp ebx, esi
jbe 0x482eea
mov ebx, esi
jmp 0x482eea
xor ebx, ebx
mov esi, ebx
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x4883e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, ecx
dec ebx
test ebx, ebx
jl 0x4883fe
inc ebx
xor ecx, ecx
mov esi, dword [edx + ecx*4]
xor dword [eax + ecx*4], esi
inc ecx
dec ebx
jne 0x4883f4
pop esi
pop ebx
ret
Function at 0x48c970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov byte [esp + 5], cl
mov byte [esp + 4], dl
mov dword [esp], eax
mov byte [esp + 6], 0
xor eax, eax
mov dword [esp + 0x10], eax
cmp byte [esp + 4], 0
je 0x48c99e
mov dword [esp + 0x14], 0x1000
jmp 0x48c9a4
xor eax, eax
mov dword [esp + 0x14], eax
mov ebx, dword [esp]
cmp word [ebx + 0x1fe], 0xaa55
jne 0x48cb93
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor esi, esi
mov eax, esi
add eax, eax
cmp byte [ebx + eax*8 + 0x1c2], 0
je 0x48cb69
cmp byte [ebx + eax*8 + 0x1be], 0
je 0x48ca08
mov eax, esi
add eax, eax
test byte [ebx + eax*8 + 0x1be], 0x7f
je 0x48c9f9
cmp byte [esp + 4], 0
je 0x48cb93
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 5
jge 0x48cb93
test esi, esi
jle 0x48caf8
mov ecx, esi
dec ecx
test ecx, ecx
jl 0x48caf8
inc ecx
xor edi, edi
mov ebp, edi
add ebp, ebp
cmp byte [ebx + ebp*8 + 0x1c2], 0
je 0x48caf0
mov eax, esi
add eax, eax
mov eax, dword [ebx + eax*8 + 0x1c6]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x1c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebx + ebp*8 + 0x1c6]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + ebp*8 + 0x1ca]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
cmp edx, dword [esp + 4]
jne 0x48ca7d
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x48caf0
jmp 0x48ca81
pop edx
pop eax
jle 0x48caf0
mov eax, esi
add eax, eax
mov eax, dword [ebx + eax*8 + 0x1c6]
xor edx, edx
push edx
push eax
mov eax, esi
add eax, eax
mov eax, dword [ebx + eax*8 + 0x1ca]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebx + ebp*8 + 0x1c6]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x24]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
cmp edx, dword [esp + 4]
jne 0x48cad2
cmp eax, dword [esp]
pop edx
pop eax
jae 0x48caf0
jmp 0x48cad6
pop edx
pop eax
jge 0x48caf0
cmp byte [esp + 4], 0
je 0x48cb93
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 5
jge 0x48cb93
inc edi
dec ecx
jne 0x48ca1e
mov edi, esi
add edi, edi
movzx eax, word [ebx + edi*8 + 0x1c0]
and ax, 0x3f
cmp ax, 1
jne 0x48cb18
cmp byte [ebx + edi*8 + 0x1bf], 1
jbe 0x48cb61
movzx eax, byte [ebx + edi*8 + 0x1bf]
mov edx, eax
shl eax, 6
sub eax, edx
mov edx, esi
add edx, edx
movzx edx, word [ebx + edx*8 + 0x1c0]
and dx, 0x3f
movzx edx, dx
add eax, edx
dec eax
cdq
push edx
push eax
mov eax, dword [ebx + edi*8 + 0x1c6]
mov ecx, 0x3ec1
xor edx, edx
div ecx
mov eax, edx
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x48cb5d
cmp eax, dword [esp]
pop edx
pop eax
jne 0x48cb65
inc dword [esp + 0xc]
inc dword [esp + 8]
inc esi
cmp esi, 4
jne 0x48c9c4
movzx eax, byte [esp + 4]
xor al, 1
and al, byte [esp + 5]
je 0x48cb87
cmp dword [esp + 0xc], 0
je 0x48cb93
cmp dword [esp + 8], 0
je 0x48cb93
mov byte [esp + 6], 1
movzx eax, byte [esp + 6]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48f6a8
Capabilities:
Get disk information

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004670cc
test al, al
je 0x48f6c0
xor eax, eax
jmp 0x48f714
cmp dword [ebx + 0xcc0], 0xd
jne 0x48f6cd
xor eax, eax
jmp 0x48f714
cmp dword [ebx], 0
jne 0x48f6e2
mov eax, dword [ebx + 4]
call fcn.004706dc
test al, al
je 0x48f6e2
mov al, 1
jmp 0x48f714
lea edx, [ebx + 0x494]
mov eax, esp
mov ecx, 0x103
call fcn.0040da74
mov ecx, 0x103
sub ecx, eax
mov edx, 0x48f71c
lea eax, [esp + eax*2]
call fcn.00414414
push esp
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 5
sete al
add esp, 0x208
pop ebx
ret

Function at 0x48f720
Capabilities:
Get disk information

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004670cc
test al, al
je 0x48f738
xor eax, eax
jmp 0x48f78e
cmp dword [ebx + 0xcc0], 0xd
jne 0x48f74d
cmp dword [ebx + 4], 0x80
setge al
jmp 0x48f78e
cmp dword [ebx], 0
jne 0x48f75c
mov eax, dword [ebx + 4]
call fcn.004708a4
jmp 0x48f78e
lea edx, [ebx + 0x494]
mov eax, esp
mov ecx, 0x103
call fcn.0040da74
mov ecx, 0x103
sub ecx, eax
mov edx, 0x48f798
lea eax, [esp + eax*2]
call fcn.00414414
push esp
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 3
sete al
add esp, 0x208
pop ebx
ret
Function at 0x53b304
Capabilities:
Encode data using xor

Disassembly:
push ebp
push eax
mov ebp, esp
pushal
mov edi, 0x27428347
pushfd
pushfd
pop eax
mov ebx, eax
mov ecx, 0x200000
xor eax, ecx
push eax
popfd
pushfd
pop eax
popfd
xor eax, ebx
test eax, ecx
je 0x53b37c
xor eax, eax
cpuid
mov eax, edx
rol eax, 1
xor eax, ebx
rol eax, 1
xor eax, ecx
mov edi, eax
xor eax, eax
inc eax
push eax
cpuid
and eax, 0xfff3fff
and edx, 0xdfeffbff
and ecx, 0xe7fefe77
xor eax, ecx
xor eax, edx
xor edi, eax
pop eax
ror eax, 1
push eax
cpuid
pop ecx
mov cl, 4
cmp eax, ecx
jb 0x53b37c
mov eax, ecx
dec eax
dec eax
push eax
cpuid
rol eax, 1
xor eax, ebx
rol eax, 1
xor eax, ecx
rol eax, 1
xor eax, edx
xor edi, eax
rol edi, 1
pop eax
inc eax
cmp al, 5
jb 0x53b363
mov dword [ebp], edi
popal
pop eax
pop ebp
ret

Function at 0x53bd0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
push eax
mov ebp, esp
pushal
mov edi, 0x27428347
pushfd
pushfd
pop eax
mov ebx, eax
mov ecx, 0x200000
xor eax, ecx
push eax
popfd
pushfd
pop eax
popfd
xor eax, ebx
test eax, ecx
je 0x53bd84
xor eax, eax
cpuid
mov eax, edx
rol eax, 1
xor eax, ebx
rol eax, 1
xor eax, ecx
mov edi, eax
xor eax, eax
inc eax
push eax
cpuid
and eax, 0xfff3fff
and edx, 0xdfeffbff
and ecx, 0xe7fefe77
xor eax, ecx
xor eax, edx
xor edi, eax
pop eax
ror eax, 1
push eax
cpuid
pop ecx
mov cl, 4
cmp eax, ecx
jb 0x53bd84
mov eax, ecx
dec eax
dec eax
push eax
cpuid
rol eax, 1
xor eax, ebx
rol eax, 1
xor eax, ecx
rol eax, 1
xor eax, edx
xor edi, eax
rol edi, 1
pop eax
inc eax
cmp al, 5
jb 0x53bd6b
mov dword [ebp], edi
popal
pop eax
pop ebp
ret
Function at 0x55b1e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push eax
mov ebp, esp
pushal
mov edi, 0x27428347
pushfd
pushfd
pop eax
mov ebx, eax
mov ecx, 0x200000
xor eax, ecx
push eax
popfd
pushfd
pop eax
popfd
xor eax, ebx
test eax, ecx
je 0x55b25c
xor eax, eax
cpuid
mov eax, edx
rol eax, 1
xor eax, ebx
rol eax, 1
xor eax, ecx
mov edi, eax
xor eax, eax
inc eax
push eax
cpuid
and eax, 0xfff3fff
and edx, 0xdfeffbff
and ecx, 0xe7fefe77
xor eax, ecx
xor eax, edx
xor edi, eax
pop eax
ror eax, 1
push eax
cpuid
pop ecx
mov cl, 4
cmp eax, ecx
jb 0x55b25c
mov eax, ecx
dec eax
dec eax
push eax
cpuid
rol eax, 1
xor eax, ebx
rol eax, 1
xor eax, ecx
rol eax, 1
xor eax, edx
xor edi, eax
rol edi, 1
pop eax
inc eax
cmp al, 5
jb 0x55b243
mov dword [ebp], edi
popal
pop eax
pop ebp
ret

Function at 0x55b348
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
xor ebx, ebx
mov esi, edx
and esi, 0x10000000
test esi, esi
jne 0x55b36a
test edx, 0x20000000
jne 0x55b365
or ebx, 1
jmp 0x55b37a
or ebx, 4
jmp 0x55b37a
test edx, 0x20000000
jne 0x55b377
or ebx, 2
jmp 0x55b37a
or ebx, 8
test esi, esi
je 0x55b381
or ebx, 0x10
test edx, 0x20000000
je 0x55b38c
or ebx, 0x20
test edx, 0x80000000
je 0x55b39a
or ebx, 0x8000000
test edx, 0x4000000
je 0x55b3a5
or ebx, 0x40
test edx, 0x40000000
je 0x55b3b5
or ebx, 0x1000000
jmp 0x55b3c9
mov esi, ecx
and esi, 0x70000000
test esi, esi
je 0x55b3c9
shr esi, 0x1c
shl esi, 0xc
or ebx, esi
cmp eax, 1
jne 0x55b3d6
or ebx, 0x80000000
jmp 0x55b3e9
cmp eax, 2
jne 0x55b3e9
test edx, 0x8000000
je 0x55b3e9
or ebx, 0x80000000
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x56ecec
Capabilities:
Encode data using xor

Disassembly:
push ebp
push eax
mov ebp, esp
pushal
mov edi, 0x27428347
pushfd
pushfd
pop eax
mov ebx, eax
mov ecx, 0x200000
xor eax, ecx
push eax
popfd
pushfd
pop eax
popfd
xor eax, ebx
test eax, ecx
je 0x56ed64
xor eax, eax
cpuid
mov eax, edx
rol eax, 1
xor eax, ebx
rol eax, 1
xor eax, ecx
mov edi, eax
xor eax, eax
inc eax
push eax
cpuid
and eax, 0xfff3fff
and edx, 0xdfeffbff
and ecx, 0xe7fefe77
xor eax, ecx
xor eax, edx
xor edi, eax
pop eax
ror eax, 1
push eax
cpuid
pop ecx
mov cl, 4
cmp eax, ecx
jb 0x56ed64
mov eax, ecx
dec eax
dec eax
push eax
cpuid
rol eax, 1
xor eax, ebx
rol eax, 1
xor eax, ecx
rol eax, 1
xor eax, edx
xor edi, eax
rol edi, 1
pop eax
inc eax
cmp al, 5
jb 0x56ed4b
mov dword [ebp], edi
popal
pop eax
pop ebp
ret

Function at 0x56f388
Capabilities:
Encode data using xor

Disassembly:
push ebp
push eax
mov ebp, esp
pushal
mov edi, 0x27428347
pushfd
pushfd
pop eax
mov ebx, eax
mov ecx, 0x200000
xor eax, ecx
push eax
popfd
pushfd
pop eax
popfd
xor eax, ebx
test eax, ecx
je 0x56f400
xor eax, eax
cpuid
mov eax, edx
rol eax, 1
xor eax, ebx
rol eax, 1
xor eax, ecx
mov edi, eax
xor eax, eax
inc eax
push eax
cpuid
and eax, 0xfff3fff
and edx, 0xdfeffbff
and ecx, 0xe7fefe77
xor eax, ecx
xor eax, edx
xor edi, eax
pop eax
ror eax, 1
push eax
cpuid
pop ecx
mov cl, 4
cmp eax, ecx
jb 0x56f400
mov eax, ecx
dec eax
dec eax
push eax
cpuid
rol eax, 1
xor eax, ebx
rol eax, 1
xor eax, ecx
rol eax, 1
xor eax, edx
xor edi, eax
rol edi, 1
pop eax
inc eax
cmp al, 5
jb 0x56f3e7
mov dword [ebp], edi
popal
pop eax
pop ebp
ret
Function at 0x5d0788
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov byte [esp + 4], cl
mov dword [esp], edx
mov ebp, eax
mov byte [esp + 5], 0
xor edi, edi
xor esi, esi
jmp 0x5d07d0
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x12]
push eax
lea ecx, [esp + 0x10]
mov edx, esi
mov eax, dword [esp + 8]
call fcn.005ce080
mov edi, eax
test edi, edi
jne 0x5d07d8
cmp dword [ebp + 0x68], 0
jne 0x5d07cf
mov dword [ebp + 0x68], 0x8005
inc esi
mov eax, dword [esp]
cmp esi, dword [eax + 0x18]
jl 0x5d07a3
test edi, edi
jne 0x5d0800
cmp byte [esp + 4], 0
je 0x5d07ea
mov eax, esp
call fcn.005ce614
cmp dword [ebp + 0x68], 0
jne 0x5d08be
mov dword [ebp + 0x68], 0x8005
jmp 0x5d08be
mov eax, dword [esp]
add eax, 0x38
test byte [eax + 0x20], 2
setne al
mov ebx, eax
xor bl, 1
test bl, bl
je 0x5d0839
mov eax, dword [esp + 8]
mov edx, dword [eax]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
jmp 0x5d0849
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
push ebx
movzx eax, byte [esp + 8]
push eax
mov eax, ebp
mov ecx, esi
mov edx, dword [esp + 8]
call fcn.005d0628
test al, al
jne 0x5d087e
cmp byte [esp + 4], 0
je 0x5d086f
mov eax, esp
call fcn.005ce614
cmp dword [ebp + 0x68], 0
jne 0x5d08be
mov dword [ebp + 0x68], 0x8005
jmp 0x5d08be
mov dword [ebp + 0x44], edi
mov eax, dword [esp + 8]
mov dword [ebp + 0x48], eax
movzx eax, word [esp + 0xc]
mov word [ebp + 0x4c], ax
movzx eax, word [esp + 0xe]
mov word [ebp + 0x4e], ax
mov eax, dword [esp + 0x10]
mov dword [ebp + 0x50], eax
mov eax, dword [esp + 0x14]
mov dword [ebp + 0x54], eax
mov eax, ebp
call fcn.005d06e8
cmp dword [ebp + 0x3c], 0
sete al
mov byte [ebp + 0x6c], al
mov byte [esp + 5], 1
movzx eax, byte [esp + 5]
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x60957c
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x30], eax
movzx eax, word [ebx + 4]
mov dword [esi + 0xc], eax
movzx eax, word [ebx + 6]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x24], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x2c], eax
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x1c], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x20], eax
cmp dword [ebx + 0x24], 0
jne 0x6095ec
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
call fcn.00405158
mov dword [esi], eax
mov dword [esi + 4], edx
jmp 0x6095f7
mov eax, dword [ebx + 0x1c]
mov dword [esi], eax
mov eax, dword [ebx + 0x20]
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
ret