joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453ea0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x453ece
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 8
jae 0x45404a
push 4
mov eax, dword [ebp - 0x10]
push eax
call fcn.00453e80
add esp, 8
mov ecx, dword [ebp - 4]
shl ecx, 2
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0x3f
mov ecx, dword [ebp - 0x14]
shr ecx, 8
and ecx, 0x3f
mov edx, dword [eax*4 + 0x4a8500]
xor edx, dword [ecx*4 + 0x4a8300]
mov eax, dword [ebp - 0x14]
shr eax, 0x10
and eax, 0x3f
xor edx, dword [eax*4 + 0x4a8100]
mov ecx, dword [ebp - 0x14]
shr ecx, 0x18
and ecx, 0x3f
xor edx, dword [ecx*4 + 0x4a7f00]
xor edx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
shl edx, 2
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor ecx, dword [eax + edx*4 + 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
and edx, 0x3f
mov eax, dword [ebp - 0x14]
shr eax, 8
and eax, 0x3f
mov ecx, dword [edx*4 + 0x4a8600]
xor ecx, dword [eax*4 + 0x4a8400]
mov edx, dword [ebp - 0x14]
shr edx, 0x10
and edx, 0x3f
xor ecx, dword [edx*4 + 0x4a8200]
mov eax, dword [ebp - 0x14]
shr eax, 0x18
and eax, 0x3f
xor ecx, dword [eax*4 + 0x4a8000]
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
push 4
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00453e80
add esp, 8
mov edx, dword [ebp - 4]
shl edx, 2
mov ecx, dword [ebp - 8]
xor eax, dword [ecx + edx*4 + 8]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 0x3f
mov eax, dword [ebp - 0x14]
shr eax, 8
and eax, 0x3f
mov ecx, dword [edx*4 + 0x4a8500]
xor ecx, dword [eax*4 + 0x4a8300]
mov edx, dword [ebp - 0x14]
shr edx, 0x10
and edx, 0x3f
xor ecx, dword [edx*4 + 0x4a8100]
mov eax, dword [ebp - 0x14]
shr eax, 0x18
and eax, 0x3f
xor ecx, dword [eax*4 + 0x4a7f00]
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 4]
shl ecx, 2
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4 + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
and ecx, 0x3f
mov edx, dword [ebp - 0x14]
shr edx, 8
and edx, 0x3f
mov eax, dword [ecx*4 + 0x4a8600]
xor eax, dword [edx*4 + 0x4a8400]
mov ecx, dword [ebp - 0x14]
shr ecx, 0x10
and ecx, 0x3f
xor eax, dword [ecx*4 + 0x4a8200]
mov edx, dword [ebp - 0x14]
shr edx, 0x18
and edx, 0x3f
xor eax, dword [edx*4 + 0x4a8000]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x453ec5
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov esp, ebp
pop ebp
ret
Function at 0x4557d0
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
add eax, 0x90
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
push 0x48
push 0x4aa700
mov edx, dword [ebp - 8]
push edx
call fcn.00469d40
add esp, 0xc
push 0x1000
push 0x4aa748
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00469d40
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x455838
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x12
jae 0x455899
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
jmp 0x455857
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 4
jae 0x455882
mov ecx, dword [ebp - 0x10]
shl ecx, 8
mov eax, dword [ebp - 0x20]
xor edx, edx
div dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
movzx edx, byte [eax + edx]
or ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
jmp 0x45584e
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4]
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
jmp 0x45582f
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00455980
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4558bf
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jae 0x4558e8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + ecx*4 + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + ecx*4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00455980
add esp, 0xc
jmp 0x4558b6
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
add eax, 0x40
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00455980
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x455911
mov edx, dword [ebp - 4]
add edx, 2
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x3fe
jae 0x45593d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + eax*4 + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + eax*4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00455980
add esp, 0xc
jmp 0x455908
mov dword [ebp - 4], 0
jmp 0x45594f
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x12
jae 0x45596f
mov edx, 0x11
sub edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov ecx, dword [esi + ecx*4]
mov dword [eax + edx*4 + 0x48], ecx
jmp 0x455946
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45ce70
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0xc3d2e1f0
mov byte [0x4c4308], 0x80
pop ebp
ret
Function at 0x461390
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edi, dword [ebp + 8]
add edi, 8
mov ecx, 8
mov esi, 0x4ab868
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
ret
Function at 0x464af0
Capabilities:
Hash data using sha384

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov edi, dword [ebp + 8]
add edi, 0x10
mov ecx, 0x10
mov esi, 0x4abb08
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
ret

Function at 0x464e50
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov edi, dword [ebp + 8]
add edi, 0x10
mov ecx, 0x10
mov esi, 0x4abd88
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
ret

Function at 0x464f00
Capabilities:
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe0
ja 0x464f42
cmp dword [ebp - 4], 0xe0
je case.0x464f3b.0
mov ecx, dword [ebp - 4]
sub ecx, 0x1c
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x24
ja case.0x464f3b.1
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x465084]
jmp dword [eax*4 + 0x465070]
cmp dword [ebp - 4], 0x100
je case.0x464f3b.4
cmp dword [ebp - 4], 0x180
je case.0x464f3b.20
cmp dword [ebp - 4], 0x200
je case.0x464f3b.36
jmp case.0x464f3b.1
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
mov edi, dword [ebp + 0xc]
add edi, 8
mov ecx, 8
mov esi, 0x4ab848
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0xd0], 0x1c
xor eax, eax
jmp 0x465069
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
mov edi, dword [ebp + 0xc]
add edi, 8
mov ecx, 8
mov esi, 0x4ab868
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0xd0], 0x20
xor eax, eax
jmp 0x465069
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
mov dword [edx + 4], 0
mov edi, dword [ebp + 0xc]
add edi, 0x10
mov ecx, 0x10
mov esi, 0x4abb08
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0xd0], 0x30
xor eax, eax
jmp 0x465069
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
mov dword [edx + 4], 0
mov edi, dword [ebp + 0xc]
add edi, 0x10
mov ecx, 0x10
mov esi, 0x4abd88
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0xd0], 0x40
xor eax, eax
jmp 0x465069
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x468590
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret

Function at 0x468d3d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4ee120], 0
push esi
jne 0x468cab
call fcn.00468bbf
test eax, eax
je 0x468cee
mov eax, dword [0x4ee120]
cmp eax, 1
jne 0x468ccc
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x468cee
pop esi
ret
push eax
call dword [0x4ee128]
test eax, eax
jne 0x468d36
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x468cf2
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4ee120]
call dword [0x4ee128]
mov edi, eax
test edi, edi
je 0x468d17
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x468d33
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4ee120]
call dword [0x4ee124]
add edi, 0x10
cmp edi, esi
jb 0x468d1f
mov eax, edi
pop edi
pop esi
ret
jmp 0x468c98

Function at 0x46a1be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c437c]
jne 0x46a1c8
repz ret
jmp fcn.004735c0

Function at 0x46cdb8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x46cde9
call fcn.0046d07a
mov dword [eax], esi
call fcn.0046d067
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0046ab6f
add esp, 0x14
push 0x16
pop eax
jmp 0x46ce3e
test dword [ebp + 0xc], 0xfffffff9
jne 0x46cdc5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x46ce16
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0046d08d
pop ecx
call fcn.0046d067
mov eax, dword [eax]
jmp 0x46ce3e
test al, 0x10
jne 0x46ce3c
test al, 1
je 0x46ce3c
test byte [ebp + 0xc], 2
je 0x46ce3c
call fcn.0046d07a
mov dword [eax], 5
call fcn.0046d067
mov dword [eax], 0xd
jmp 0x46ce0d
xor eax, eax
pop esi
pop ebp
ret
Function at 0x46d150
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x46d181
call fcn.0046d07a
mov dword [eax], esi
call fcn.0046d067
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0046ab6f
add esp, 0x14
or eax, 0xffffffff
jmp 0x46d1bc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x46d19e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0046d08d
pop ecx
jmp 0x46d17c
test byte [ebp + 0xc], 0x80
je 0x46d1a9
and eax, 0xfffffffe
jmp 0x46d1ac
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x46d18f
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4868cc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00471b22
and dword [ebp - 4], 0
cmp dword [0x4eec54], 0
mov ebx, eax
jne 0x48697d
push 0x4b68dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x486a2e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b68d0
push edi
call esi
test eax, eax
je 0x486a2e
push eax
call fcn.00471ab0
mov dword [esp], 0x4b68c0
push edi
mov dword [0x4eec54], eax
call esi
push eax
call fcn.00471ab0
mov dword [esp], 0x4b68ac
push edi
mov dword [0x4eec58], eax
call esi
push eax
call fcn.00471ab0
mov dword [esp], 0x4b6890
push edi
mov dword [0x4eec5c], eax
call esi
push eax
call fcn.00471ab0
pop ecx
mov dword [0x4eec64], eax
test eax, eax
je 0x48697d
push 0x4b6878
push edi
call esi
push eax
call fcn.00471ab0
pop ecx
mov dword [0x4eec60], eax
mov eax, dword [0x4eec60]
cmp eax, ebx
je 0x4869d5
cmp dword [0x4eec64], ebx
je 0x4869d5
push eax
call fcn.00471b2b
push dword [0x4eec64]
mov esi, eax
call fcn.00471b2b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4869d5
test edi, edi
je 0x4869d5
call esi
test eax, eax
je 0x4869cc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4869cc
test byte [ebp - 0xc], 1
jne 0x4869d5
or dword [ebp + 0x10], 0x200000
jmp 0x486a0e
mov eax, dword [0x4eec58]
cmp eax, ebx
je 0x486a0e
push eax
call fcn.00471b2b
pop ecx
test eax, eax
je 0x486a0e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x486a0e
mov eax, dword [0x4eec5c]
cmp eax, ebx
je 0x486a0e
push eax
call fcn.00471b2b
pop ecx
test eax, eax
je 0x486a0e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4eec54]
call fcn.00471b2b
pop ecx
test eax, eax
je 0x486a2e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x486a30
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49cf30
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx]
sub eax, dword [edx + 8]
mov ecx, dword [ecx + 4]
sbb ecx, dword [edx + 0xc]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ecx
mov esp, ebp
pop ebp
ret

Function at 0x49d160
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x4eeffc]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [0x4eeffc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x49d1c5
xor eax, eax
jmp 0x49d207
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x49d1ee
xor eax, eax
jmp 0x49d207
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x49d370
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49d386
call fcn.00425cd0
mov dword [ebp - 8], eax
jmp 0x49d38c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0xffffffff
jne 0x49d3a4
mov dword [ebp - 4], 0xfffffffe
or eax, 0xffffffff
jmp 0x49d3cc
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov byte [0x4eeff9], 1
movzx eax, byte [0x4eeff9]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0049d210
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x49d3d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0x49d290
call fcn.0046cc01
add esp, 0xc
call fcn.0042e1e0
pop ebp
ret
Function at 0x49d500
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x49d54a
mov dword [ebp - 0x74], 0
lea ecx, [ebp + 8]
call fcn.00401580
mov eax, dword [ebp - 0x74]
jmp 0x49d5cf
mov dword [ebp - 0x70], 0x44
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x34], edx
xor eax, eax
mov word [ebp - 0x40], ax
mov dword [ebp - 0x44], 0x101
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x70]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push 0
lea ecx, [ebp + 8]
call fcn.00401820
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x49d5b3
mov dword [ebp - 0x78], 0
lea ecx, [ebp + 8]
call fcn.00401580
mov eax, dword [ebp - 0x78]
jmp 0x49d5cf
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x7c], 1
lea ecx, [ebp + 8]
call fcn.00401580
mov eax, dword [ebp - 0x7c]
mov esp, ebp
pop ebp
ret

Function at 0x49d640
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0x8004
jne 0x49d6ec
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 2
je 0x49d6e6
cmp dword [ebp - 0x1c], 5
je 0x49d670
jmp 0x49d6ec
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
cmp dword [0x4ef004], 0
je 0x49d689
mov dword [0x4ef004], 0
push 0x4ef020
lea ecx, [ebp - 0x10]
call fcn.004018e0
push 2
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00401720
push eax
lea ecx, [ebp - 0x10]
call fcn.004015a0
lea ecx, [ebp - 0x14]
call fcn.00401580
lea ecx, [ebp - 0x10]
call fcn.004017d0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x49d6dc
mov dword [ebp - 0x18], 0x1a
lea ecx, [ebp - 0x10]
call fcn.00401580
mov eax, dword [ebp - 0x18]
jmp 0x49d6ee
lea ecx, [ebp - 0x10]
call fcn.00401580
jmp 0x49d6ec
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x49d820
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
lea eax, [ebp - 4]
push eax
call fcn.0049d5e0
add esp, 8
lea ecx, [ebp - 4]
call fcn.004017d0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
call fcn.00401580
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x49d860
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
lea ecx, [ebp - 4]
call fcn.00401520
push 0x104
push 0x104
lea ecx, [ebp - 4]
call fcn.00401840
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.00401890
push 0x5c
lea ecx, [ebp - 4]
call fcn.00401680
add eax, 1
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 4]
call fcn.00401720
push eax
lea ecx, [ebp - 4]
call fcn.004015a0
lea ecx, [ebp - 0x414]
call fcn.00401580
push str.LenovoLockerConfig
lea ecx, [ebp - 4]
call fcn.004015e0
push 0x4b8b7c
lea ecx, [ebp - 4]
call fcn.004015e0
push str.xxxxxx_lenovo.dat
lea ecx, [ebp - 4]
call fcn.004015e0
lea ecx, [ebp - 4]
call fcn.004017d0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x49d91f
mov dword [ebp - 0x418], 0
lea ecx, [ebp - 4]
call fcn.00401580
mov eax, dword [ebp - 0x418]
jmp 0x49da23
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 4]
call fcn.004017d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0xffffffff
jne 0x49d969
mov dword [ebp - 0x41c], 0
lea ecx, [ebp - 4]
call fcn.00401580
mov eax, dword [ebp - 0x41c]
jmp 0x49da23
mov byte [ebp - 0x408], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x407]
push ecx
call fcn.00469be0
add esp, 0xc
mov dword [ebp - 0x410], 0
push 0
lea edx, [ebp - 0x410]
push edx
push 0x400
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49d9fe
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x408]
push eax
push 0x4b8938
push 0x4ef014
call fcn.004024e0
add esp, 0xc
push 0
mov ecx, 0x4ef014
call fcn.00401820
mov dword [ebp - 0x420], eax
lea ecx, [ebp - 4]
call fcn.00401580
mov eax, dword [ebp - 0x420]
jmp 0x49da23
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x424], 0
lea ecx, [ebp - 4]
call fcn.00401580
mov eax, dword [ebp - 0x424]
mov esp, ebp
pop ebp
ret