joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7340
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push esi
mov esi, ecx
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4a73ec
mov dword [esp + 0xc], eax
xorps xmm0, xmm0
mov dword [esp + 0x34], eax
lea eax, [esp + 8]
push eax
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x2c], xmm0
mov dword [esp + 0xc], 0x30
mov dword [esp + 0x20], 0x400000
mov dword [esp + 0x34], str.XDSTMgeTmWnd
mov dword [esp + 0x14], 0x4a7580
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [esp + 0x20]
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x58]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a73f6
push esi
push 0xffffffffffffffeb
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a7ae0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d10
call fcn.004b4910
mov eax, dword [0x655140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x2d10], eax
test eax, eax
je 0x4a7c37
push ebx
push esi
push edi
xor esi, esi
nop dword [eax]
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.004a75e0
add esp, 0x10
lea eax, [ebp - 0x204]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
xor ebx, ebx
cmp edi, 0xffffffff
je 0x4a7bfb
push 0x2710
lea eax, [ebp - 0x2cfc]
mov dword [ebp - 0x2d0c], ebx
push ebx
push eax
mov dword [ebp - 0x2d00], ebx
mov dword [ebp - 0x2d08], ebx
mov dword [ebp - 0x2d04], ebx
call fcn.004b69d0
add esp, 0xc
lea eax, [ebp - 0x2d0c]
push ebx
push eax
push 0x2710
lea eax, [ebp - 0x2cfc]
push eax
push 0xc
lea eax, [ebp - 0x2d08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4a7bf4
push 0x3e8
lea eax, [ebp - 0x5ec]
push ebx
push eax
call fcn.004b69d0
mov edx, dword [ebp - 0x2ce4]
lea eax, [ebp - 0x5ec]
add esp, 0xc
push eax
push ecx
lea ecx, [ebp - 0x2cfc]
call fcn.004ac070
mov ecx, dword [ebp - 0x2d10]
lea eax, [ebp - 0x5ec]
add esp, 8
lea edx, [ebx + 0x64]
push eax
call fcn.0048af70
test eax, eax
je 0x4a7c18
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, 0x10
jl 0x4a7b10
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3f1a
mov esp, ebp
pop ebp
ret
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3f1a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004b3f1a
mov esp, ebp
pop ebp
ret
Function at 0x4aaf00
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db8f6
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x655140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x228], eax
call fcn.00402de0
mov ecx, eax
test ecx, ecx
je 0x4ab133
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
push 0x63dd94
push str.Windows
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push str.SoftwareMicrosoft_sCurrentVersion_s
push eax
call fcn.00409210
add esp, 0x10
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
push 0x2001f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
mov edi, dword [ebp - 0x21c]
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00419f30
or ebx, 0xffffffff
test eax, eax
mov eax, dword [ebp - 0x234]
jne 0x4ab0ea
call fcn.00402de0
mov ecx, eax
test ecx, ecx
je 0x4ab13d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x224]
push dword [esi + 8]
push dword [esi]
push 0x63db30
push eax
call fcn.00409210
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004b69d0
add esp, 0x1c
mov dword [ebp - 0x220], 0x208
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x238]
push eax
push 0
push dword [ebp - 0x228]
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ab071
mov eax, dword [ebp - 0x238]
cmp eax, 1
je 0x4ab05f
cmp eax, 2
jne 0x4ab071
cmp dword [ebp - 0x220], 0
jne 0x4ab071
xor eax, eax
mov word [ebp - 0x218], ax
mov esi, dword [ebp - 0x224]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.004c0ad1
add esp, 8
test eax, eax
je 0x4ab0c2
test esi, esi
je 0x4ab0c2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ab094
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp - 0x228]
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4ab0dd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x234]
mov esi, 1
jmp 0x4ab0ec
xor esi, esi
test eax, eax
je 0x4ab0f7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4ab113
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b3f1a
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00402a80
push 0x80004005
call fcn.00402a80
int3
Function at 0x4ab150
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db92d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x655140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp word [0x67aac0], 0
jne 0x4ab196
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x67aac0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.00402de0
mov ecx, eax
test ecx, ecx
je 0x4ab200
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
push 0x67aac0
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00408c10
test al, al
jne 0x4ab1ec
mov ecx, 0x67aac0
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ab1d0
sub ecx, edx
sar ecx, 1
push ecx
push 0x67aac0
mov ecx, esi
call fcn.00408fa0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402a80
int3

Function at 0x4ab330
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x655140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov edi, dword [ebp + 8]
lea edx, [esi + 0x16]
nop dword [eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ebp + eax - 0xc], cl
movzx ecx, byte [edx - 5]
mov byte [ebp + eax - 0xb], cl
movzx ecx, byte [edx - 4]
mov byte [ebp + eax - 0xa], cl
movzx ecx, byte [edx - 3]
mov byte [ebp + eax - 9], cl
add eax, 4
cmp eax, 8
jb 0x4ab350
mov edx, dword [esi + 0x14]
lea ebx, [esi + 0x5c]
shr edx, 3
mov ecx, 0x78
and edx, 0x3f
mov eax, 0x38
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
mov ecx, esi
push eax
push ebx
call fcn.004ab250
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.004ab250
lea ecx, [edi + 2]
mov edi, 4
lea edx, [esi + 6]
nop dword [eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 2], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 5], al
movzx eax, byte [edx - 4]
mov byte [ecx - 4], al
movzx eax, byte [edx - 3]
mov byte [ecx - 3], al
sub edi, 1
jne 0x4ab3c0
push 0x9c
push edi
push esi
call fcn.004b69d0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 4], 0x67452301
xor ecx, ebp
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
pop edi
mov dword [esi + 0x10], 0x10325476
pop esi
mov byte [ebx], 0x80
pop ebx
call fcn.004b3f1a
mov esp, ebp
pop ebp
ret 4
Function at 0x4ac440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4ac471
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4ac460
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x4ad940
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x4adb49
push ebx
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x4adb48
cmp eax, 0x29
jne 0x4ad978
cmp dword [esi + 0x10], 0
jne 0x4adb48
test dword [esi + 0x50], 0x10000000
je 0x4adb4d
cmp eax, 0x2e
jne 0x4ad9cf
push 5
lea ecx, [esi + 0x24]
call fcn.004af120
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x4ad9c3
cmp byte [eax], 0x5c
jne 0x4ad9c1
inc eax
cmp eax, ecx
je 0x4ad9c1
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x4ad9ae
mov dl, byte [eax]
cmp dl, 0x28
je 0x4ad9bf
cmp dl, 0x29
je 0x4ad9bf
test cl, 0x10
jne 0x4ad9c1
mov cl, byte [eax]
cmp cl, 0x7b
je 0x4ad9bf
cmp cl, 0x7d
jne 0x4ad9c1
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.004af3b0
jmp 0x4adb35
cmp eax, 0x5c
jne 0x4ada74
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x4ada14
cmp byte [eax], 0x5c
jne 0x4ada12
inc eax
cmp eax, ecx
je 0x4ada12
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x4ad9ff
mov dl, byte [eax]
cmp dl, 0x28
je 0x4ada10
cmp dl, 0x29
je 0x4ada10
test cl, 0x10
jne 0x4ada12
mov cl, byte [eax]
cmp cl, 0x7b
je 0x4ada10
cmp cl, 0x7d
jne 0x4ada12
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.004af3b0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x4ada41
cmp byte [esi + 0x48], 0x62
jne 0x4ada41
push 4
lea ecx, [esi + 0x24]
call fcn.004af120
mov ecx, esi
call fcn.004af190
jmp 0x4adb3c
test eax, eax
je 0x4ada68
cmp byte [esi + 0x48], 0x42
jne 0x4ada68
push 4
lea ecx, [esi + 0x24]
call fcn.004af120
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.004af190
jmp 0x4adb3c
mov ecx, esi
call fcn.004adbe0
jmp 0x4adb35
cmp eax, 0x5b
jne 0x4ada97
mov ecx, esi
call fcn.004af190
mov ecx, esi
call fcn.004adfd0
push 4
push 0x5d
mov ecx, esi
call fcn.004aee30
jmp 0x4adb35
cmp eax, 0x28
jne 0x4adac1
mov ecx, esi
call fcn.004af190
mov ecx, esi
call fcn.004af560
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.004aee30
test bl, bl
je 0x4adb3c
jmp 0x4adb35
cmp eax, 0x5e
jne 0x4adad9
push 2
lea ecx, [esi + 0x24]
call fcn.004af120
mov ecx, esi
call fcn.004af190
jmp 0x4adb3c
cmp eax, 0x24
jne 0x4adaf1
push 3
lea ecx, [esi + 0x24]
call fcn.004af120
mov ecx, esi
call fcn.004af190
jmp 0x4adb3c
cmp eax, 0x2a
je 0x4adb62
cmp eax, 0x2b
je 0x4adb62
cmp eax, 0x3f
je 0x4adb62
cmp eax, 0x7b
je 0x4adb62
cmp eax, 0x7d
jne 0x4adb13
test dword [esi + 0x50], 0x10000000
je 0x4adb54
cmp eax, 0x5d
jne 0x4adb21
test dword [esi + 0x50], 0x10000000
je 0x4adb5b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004aced0
mov ecx, esi
call fcn.004af190
mov ecx, esi
call fcn.004af1e0
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x4ad950
pop ebx
mov al, cl
pop esi
ret
push 5
call fcn.004b2937
push 6
call fcn.004b2937
push 4
call fcn.004b2937
push 0xa
call fcn.004b2937
int3
Function at 0x4b19a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
nop dword [eax + eax]
mov ecx, esi
xor eax, eax
and ecx, 1
mov edx, esi
or ecx, eax
je 0x4b19d0
shrd edx, eax, 1
shr eax, 1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
jmp 0x4b19d6
shrd edx, eax, 1
shr eax, 1
mov ecx, edx
and ecx, 1
or ecx, 0
je 0x4b19f3
shrd edx, eax, 1
shr eax, 1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
jmp 0x4b19f9
shrd edx, eax, 1
shr eax, 1
mov ecx, edx
and ecx, 1
or ecx, 0
je 0x4b1a16
shrd edx, eax, 1
shr eax, 1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
jmp 0x4b1a1c
shrd edx, eax, 1
shr eax, 1
mov ecx, edx
and ecx, 1
or ecx, 0
je 0x4b1a39
shrd edx, eax, 1
shr eax, 1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
jmp 0x4b1a3f
shrd edx, eax, 1
shr eax, 1
mov ecx, edx
and ecx, 1
or ecx, 0
je 0x4b1a5c
shrd edx, eax, 1
shr eax, 1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
jmp 0x4b1a62
shrd edx, eax, 1
shr eax, 1
mov ecx, edx
and ecx, 1
or ecx, 0
je 0x4b1a7f
shrd edx, eax, 1
shr eax, 1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
jmp 0x4b1a85
shrd edx, eax, 1
shr eax, 1
mov ecx, edx
and ecx, 1
or ecx, 0
je 0x4b1aa2
shrd edx, eax, 1
shr eax, 1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
jmp 0x4b1aa8
shrd edx, eax, 1
shr eax, 1
mov ecx, edx
and ecx, 1
or ecx, 0
je 0x4b1ac5
shrd edx, eax, 1
shr eax, 1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
jmp 0x4b1acb
shrd edx, eax, 1
shr eax, 1
mov dword [edi + esi*8], edx
mov dword [edi + esi*8 + 4], eax
inc esi
cmp esi, 0x100
jb 0x4b19b0
lea esi, [edi + 0x1000]
mov ebx, 0x100
nop word [eax + eax]
mov edx, dword [esi - 0x1000]
lea esi, [esi + 8]
mov ecx, dword [esi - 0x1004]
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor ecx, dword [edi + eax*8 + 4]
xor edx, dword [edi + eax*8]
mov dword [esi - 0x804], ecx
mov dword [esi - 0x808], edx
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor ecx, dword [edi + eax*8 + 4]
xor edx, dword [edi + eax*8]
mov dword [esi - 4], ecx
mov dword [esi - 8], edx
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor ecx, dword [edi + eax*8 + 4]
xor edx, dword [edi + eax*8]
mov dword [esi + 0x7fc], ecx
mov dword [esi + 0x7f8], edx
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor ecx, dword [edi + eax*8 + 4]
xor edx, dword [edi + eax*8]
mov dword [esi + 0xffc], ecx
mov dword [esi + 0xff8], edx
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor ecx, dword [edi + eax*8 + 4]
xor edx, dword [edi + eax*8]
mov dword [esi + 0x17fc], ecx
mov dword [esi + 0x17f8], edx
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor ecx, dword [edi + eax*8 + 4]
xor edx, dword [edi + eax*8]
mov dword [esi + 0x1ffc], ecx
mov dword [esi + 0x1ff8], edx
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor edx, dword [edi + eax*8]
xor ecx, dword [edi + eax*8 + 4]
mov dword [esi + 0x27f8], edx
mov dword [esi + 0x27fc], ecx
sub ebx, 1
jne 0x4b1af0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4b51e0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4b521f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b521f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b521f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4b521f
cmp dword [ecx + 0x74], 0xe
jbe 0x4b521f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4ca94f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004b4910
mov eax, dword [0x655140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004cb24d
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4ca991
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4caaed
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004b4940
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x667758]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004d84d7
mov ecx, dword [esi*4 + 0x667758]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x4caae6
cmp eax, dword [ecx + edi + 0x24]
jne 0x4caae6
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4caae6
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004d84d7
add esp, 0x14
test edx, edx
jl 0x4caae6
jg 0x4caa5c
test eax, eax
jb 0x4caae6
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4caae6
jl 0x4caa76
cmp dword [ebp - 0x1008], eax
ja 0x4caae6
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4caa94
test ebx, ebx
je 0x4caacd
cmp ecx, edi
jae 0x4caacd
mov al, byte [ecx]
cmp al, 0xd
jne 0x4caaae
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4caaba
cmp byte [ecx + 1], 0xa
jne 0x4caaba
inc ecx
jmp 0x4caaba
movzx eax, al
movsx eax, byte [eax + 0x655430]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4caa94
cmp edx, ebx
jne 0x4caa94
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4caaeb
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004b3f1a
leave
ret
Function at 0x4d0581
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x655140]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x5e1dcc
push esi
call fcn.004dbf01
pop ecx
pop ecx
test eax, eax
jne 0x4d05af
xor al, al
jmp 0x4d062c
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.004d0283
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x4d05e9
push dword [ebp - 0x210]
call fcn.004c0fcf
xor al, al
jmp 0x4d062a
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4d05ef
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x4d060f
push edx
call fcn.004d04b8
pop ecx
test al, al
je 0x4d05da
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4d061d
mov bl, 1
push dword [ebp - 0x210]
call fcn.004c0fcf
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b3f1a
leave
ret

Function at 0x4d7351
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5e3774
push 0x5e376c
push str.FlsAlloc
push 0x1f
call fcn.004d717c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4d7385
push dword [ebp + 8]
mov ecx, esi
call dword [0x5dd7cc]
call esi
jmp 0x4d738b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4d73cf
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5e3784
push 0x5e377c
push str.FlsGetValue
push 0x21
call fcn.004d717c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4d7406
push dword [ebp + 8]
mov ecx, esi
call dword [0x5dd7cc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4d740e
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5e378c
push 0x5e3784
push str.FlsSetValue
push 0x22
call fcn.004d717c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4d7448
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5dd7cc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4d8553
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x667758]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4d8593
cmp byte [ebx], 0xa
jne 0x4d8593
or byte [edi + eax + 0x28], 4
jmp 0x4d8598
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x4d8697
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4d867a
inc eax
cmp dl, 0xd
je 0x4d85c4
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x4d85ea
cmp eax, ecx
jae 0x4d85f8
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x4d85ac
jmp 0x4d8697
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4d8675
cmp dword [ebp - 0x10], 0
je 0x4d8675
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x667758]
test byte [eax + edi + 0x28], 0x48
je 0x4d864f
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4d863a
mov byte [esi], dl
jmp 0x4d864b
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x667758]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4d8697
cmp byte [ebp - 1], 0xa
jne 0x4d865e
cmp esi, ebx
jne 0x4d865e
mov byte [esi], 0xa
jmp 0x4d8696
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004d84f5
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4d8697
mov byte [esi], 0xd
jmp 0x4d8696
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x667758]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4d8694
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4d8697
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret