joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x401c66
pop dword [ebp - 0x10]
mov eax, 0xa285bcf8
add eax, 0x5dba5f6e
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xec2b1fde
sub dword [ebp - 0x20], 0x9dd8da93
mov dword [ebp - 0x1c], 0x76d61e2f
add dword [ebp - 0x1c], 0xbb5d2e16
mov dword [ebp - 0x18], 0xd01efcbb
sub dword [ebp - 0x18], 0x83d2b88d
mov dword [ebp - 0x14], 0xdaeed02
sub dword [ebp - 0x14], 0xdaeed02
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x85cbf624
add dword [ebp - 0x20], 0xeea67332
mov dword [ebp - 0x1c], 0x5c7bd29c
sub dword [ebp - 0x1c], 0x1b0f7127
mov dword [ebp - 0x18], 0xc57e9055
add dword [ebp - 0x18], 0x9df0dc17
mov dword [ebp - 0x14], 0xf81c24f1
sub dword [ebp - 0x14], 0xf81c24f1
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x1e1d5e5d
add eax, 0xe222d1cf
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3655e
push 0
call eax
mov ecx, 0xf9237afa
add ecx, 0x6dccc71
xor edi, edi
add edi, eax
mov edx, 0x407000
add edx, dword [ebp - 0x10]
mov esi, 0x4973a143
sub esi, 0xa34e1047
mov ebx, dword [edx]
sub dword [ebp - 0xc], 0x898f4ffd
xor ebx, esi
mov dword [edi], ebx
add edi, 0x17f3b42d
add edi, 0xe80c4bd7
add edx, 0x3b3c1c6e
sub edx, 0x3b3c1c6a
loop 0x401d7f
add eax, 0x1107f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3318c45d
sub ecx, 0x32d8c45d
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x10007ce2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10007cf1
pop dword [ebp - 0x50]
mov eax, 0xc1736ce9
sub eax, 0xb172eff8
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x578ca307
add dword [ebp - 0x60], 0xf6c5a244
mov dword [ebp - 0x5c], 0x31b45863
add dword [ebp - 0x5c], 0x7ef3e2
mov dword [ebp - 0x58], 0x2270e971
sub dword [ebp - 0x58], 0xd624a543
mov dword [ebp - 0x54], 0x194bc894
add dword [ebp - 0x54], 0xe6b4376c
lea eax, [ebp - 0x60]
push eax
mov eax, 0x87ac7cc2
sub eax, 0x77ac6bc6
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xc4a868c6
add dword [ebp - 0x60], 0xafca0090
mov dword [ebp - 0x5c], 0x1684e902
sub dword [ebp - 0x5c], 0xd518878d
mov dword [ebp - 0x58], 0xd4b51b9f
add dword [ebp - 0x58], 0x8eba50cd
mov dword [ebp - 0x54], 0x28ffc1d
add dword [ebp - 0x54], 0xfd7003e3
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3804b
push 0
call eax
mov ecx, 0x140ee55b
add ecx, 0xebf15eb4
xor edx, edx
add edx, eax
mov edi, 0x21de1888
sub edi, 0x11dd3088
add edi, dword [ebp - 0x50]
mov esi, 0xd819139d
sub dword [ebp - 0x18], edi
mov ebx, dword [edi]
xor dword [ebp - 0x4c], ecx
add ebx, esi
xor dword [ebp - 0x24], 0xc6f954fe
mov dword [edx], ebx
xor dword [ebp - 0x4c], 0x7af3808
add edx, 0x58feef93
sub edx, 0x58feef8f
add edi, 0x98d302e0
sub edi, 0x98d302dc
loop 0x10007e0a
add eax, 0x4935f5cf
sub eax, 0x4934f2c0
mov ebx, eax
add eax, 5
mov ecx, 0x9b41a214
add ecx, 0x74be5dec
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x348b335a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x348b3369
pop dword [ebp - 0x38]
mov eax, 0x348b3369
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x53693b95
add dword [ebp - 0x48], 0xfae909b6
mov dword [ebp - 0x44], 0xc8860eb4
add dword [ebp - 0x44], 0x69ad3d91
mov dword [ebp - 0x40], 0xdeda6573
sub dword [ebp - 0x40], 0x928e2145
mov dword [ebp - 0x3c], 0xe2b60353
add dword [ebp - 0x3c], 0x1d49fcad
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x4a8a701c
sub dword [ebp - 0x48], 0xd61806c6
mov dword [ebp - 0x44], 0x4edd0083
sub dword [ebp - 0x44], 0xd709f0e
mov dword [ebp - 0x40], 0xb88fa5e4
add dword [ebp - 0x40], 0xaadfc688
mov dword [ebp - 0x3c], 0x19e398a
add dword [ebp - 0x3c], 0xfe61c676
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x729f75ce
sub eax, 0x3e1664ae
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x38685
push 0
call eax
mov ecx, 0x6f87c31a
sub ecx, 0x6f877634
xor ebx, ebx
add ebx, eax
mov esi, 0xd5ea3aa1
sub esi, 0xa15b4aa1
add esi, dword [ebp - 0x38]
mov edx, 0xee203c7d
sub edx, 0x4ba980dc
xor dword [ebp - 0x10], eax
mov edi, dword [esi]
xor dword [ebp - 0x18], 0xa8236e9d
sub edi, edx
sub dword [ebp - 8], edi
mov dword [ebx], edi
xor dword [ebp - 0x10], 0xc29c296b
add ebx, 0x410cb99b
add ebx, 0xbef34669
add esi, 4
loop 0x348b3483
add eax, 0x1266b
mov ebx, eax
add eax, 5
mov ecx, 0x34890000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401320
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
lea eax, [ebp - 4]
push eax
push 4
mov ecx, dword [ebp - 8]
push ecx
push 0x401300
push 0
push 0
call fcn.0040404e
add esp, 0x18
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x401357
xor al, al
jmp 0x401366
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x403c87
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x449464]
jne 0x403c91
repz ret
jmp fcn.0040b9b5

Function at 0x4173ee
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040beff
and dword [ebp - 4], 0
cmp dword [0x44e818], 0
mov ebx, eax
jne 0x41749f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x417550
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x417550
push eax
call fcn.0040be8d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44e818], eax
call esi
push eax
call fcn.0040be8d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44e81c], eax
call esi
push eax
call fcn.0040be8d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44e820], eax
call esi
push eax
call fcn.0040be8d
pop ecx
mov dword [0x44e828], eax
test eax, eax
je 0x41749f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040be8d
pop ecx
mov dword [0x44e824], eax
mov eax, dword [0x44e824]
cmp eax, ebx
je 0x4174f7
cmp dword [0x44e828], ebx
je 0x4174f7
push eax
call fcn.0040bf08
push dword [0x44e828]
mov esi, eax
call fcn.0040bf08
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4174f7
test edi, edi
je 0x4174f7
call esi
test eax, eax
je 0x4174ee
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4174ee
test byte [ebp - 0xc], 1
jne 0x4174f7
or dword [ebp + 0x10], 0x200000
jmp 0x417530
mov eax, dword [0x44e81c]
cmp eax, ebx
je 0x417530
push eax
call fcn.0040bf08
pop ecx
test eax, eax
je 0x417530
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x417530
mov eax, dword [0x44e820]
cmp eax, ebx
je 0x417530
push eax
call fcn.0040bf08
pop ecx
test eax, eax
je 0x417530
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44e818]
call fcn.0040bf08
pop ecx
test eax, eax
je 0x417550
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x417552
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41aa5e
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41aa8f
call fcn.0040984b
mov dword [eax], esi
call fcn.00409838
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040486c
add esp, 0x14
or eax, 0xffffffff
jmp 0x41aaca
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41aaac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040985e
pop ecx
jmp 0x41aa8a
test byte [ebp + 0xc], 0x80
je 0x41aab7
and eax, 0xfffffffe
jmp 0x41aaba
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x41aa9d
xor eax, eax
pop esi
pop ebp
ret

Function at 0x41e270
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x400
call fcn.004067ff
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41e28e
jmp 0x41e306
mov dword [ebp - 4], 0
jmp 0x41e2a0
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jge 0x41e2fd
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 8
jmp 0x41e2c1
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x41e2ef
mov eax, dword [ebp - 0x10]
and eax, 1
je 0x41e2df
mov ecx, dword [ebp - 0x10]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 0x14], ecx
jmp 0x41e2e7
mov edx, dword [ebp - 0x10]
shr edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x41e2b8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov dword [edx + ecx*4], eax
jmp 0x41e297
mov ecx, dword [ebp - 8]
mov dword [0x44ecbc], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41e850
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x44ecac], 0
je 0x41e869
mov eax, 1
jmp 0x41e930
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41e885
xor eax, eax
jmp 0x41e930
mov eax, dword [ebp - 4]
push eax
push 0x44ecb0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41e8d3
mov ecx, dword [ebp - 8]
push ecx
push 0x44ecb0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x44ecac]
jmp 0x41e930
cmp dword [0x44ecac], 0
jne 0x41e90a
push 0x44ffc0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x120
push 0
push 0x44fea0
call fcn.00408e40
add esp, 0xc
call fcn.0041e650
mov dword [0x44ecac], 1
push 0
push 0x44ecb0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x427970
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
add eax, dword [0x520108]
mov ecx, dword [ebp + 0xc]
adc ecx, dword [0x52010c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
push 0
push 0x2000
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00414310
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
sbb edx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0x14], 0
jg 0x427a0a
jl 0x4279c8
cmp dword [ebp - 0x18], 0
jae 0x427a0a
push 1
push str.___please_check_that_you_have_transferred_or_created_the_zipfile_in_the_n__appropriate_BINARY_mode_and_that_you_have_compiled_UnZip_properly__n
mov eax, dword [0x5200ec]
push eax
push str.error___s_:__attempt_to_seek_before_beginning_of_zipfile_n_s
push 0x5100c4
call fcn.00405f89
add esp, 0x10
push eax
push 0x5100c4
push 0x44ffe0
call dword [0x52040c]
add esp, 0x10
mov eax, 3
jmp 0x427ac1
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [0x520100]
jne 0x427a20
mov edx, dword [ebp - 0xc]
cmp edx, dword [0x520104]
je 0x427a93
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [0x5200f0]
push edx
call fcn.0040a3b6
add esp, 0x10
mov dword [0x520100], eax
mov dword [0x520104], edx
push 0x2000
mov eax, dword [0x5200cc]
push eax
mov ecx, dword [0x5200f0]
push ecx
call fcn.0041925a
add esp, 0xc
mov dword [0x5200d4], eax
cmp dword [0x5200d4], 0
jg 0x427a73
mov eax, 0x33
jmp 0x427ac1
mov edx, dword [ebp - 8]
mov eax, dword [0x5200d4]
sub eax, edx
mov dword [0x5200d4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [0x5200cc]
mov dword [0x5200d0], ecx
jmp 0x427abf
mov edx, dword [0x5200d0]
sub edx, dword [0x5200cc]
mov eax, dword [ebp - 8]
sub edx, eax
add edx, dword [0x5200d4]
mov dword [0x5200d4], edx
mov ecx, dword [ebp - 8]
add ecx, dword [0x5200cc]
mov dword [0x5200d0], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x427ad0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
je 0x427bf5
cmp dword [0x5200d4], 0
jg 0x427b89
push 0x2000
mov ecx, dword [0x5200cc]
push ecx
mov edx, dword [0x5200f0]
push edx
call fcn.0041925a
add esp, 0xc
mov dword [0x5200d4], eax
cmp dword [0x5200d4], 0
jne 0x427b29
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 0xc]
jmp 0x427bf8
cmp dword [0x5200d4], 0
jge 0x427b5f
push 0x401
push str.error:__zipfile_read_error_n
call fcn.00403da0
add esp, 4
push eax
push str.error:__zipfile_read_error_n
push 0x44ffe0
call dword [0x52040c]
add esp, 0x10
xor eax, eax
jmp 0x427bf8
mov eax, dword [0x520100]
add eax, 0x2000
mov ecx, dword [0x520104]
adc ecx, 0
mov dword [0x520100], eax
mov dword [0x520104], ecx
mov edx, dword [0x5200cc]
mov dword [0x5200d0], edx
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x5200d4]
jae 0x427b9c
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
jmp 0x427ba5
mov edx, dword [0x5200d4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x5200d0]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004043d0
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov dword [ebp + 8], ecx
mov edx, dword [0x5200d0]
add edx, dword [ebp - 4]
mov dword [0x5200d0], edx
mov eax, dword [0x5200d4]
sub eax, dword [ebp - 4]
mov dword [0x5200d4], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 4]
mov dword [ebp + 0xc], ecx
jmp 0x427adc
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x428560
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5201e8], 0
je 0x428577
or eax, 0xffffffff
jmp 0x428704
cmp dword [0x45009c], 0
jg 0x4285b9
jl 0x42858b
cmp dword [0x450098], 0
ja 0x4285b9
mov eax, dword [0x450098]
sub eax, 1
mov ecx, dword [0x45009c]
sbb ecx, 0
mov dword [0x450098], eax
mov dword [0x45009c], ecx
mov dword [0x5200d4], 0
or eax, 0xffffffff
jmp 0x428704
cmp dword [0x5200d4], 0
jg 0x42867d
push 0x2000
mov edx, dword [0x5200cc]
push edx
mov eax, dword [0x5200f0]
push eax
call fcn.0041925a
add esp, 0xc
mov dword [0x5200d4], eax
cmp dword [0x5200d4], 0
jne 0x4285f8
or eax, 0xffffffff
jmp 0x428704
cmp dword [0x5200d4], 0
jge 0x42862e
push 0x401
push str.error:__zipfile_read_error_n
call fcn.00403da0
add esp, 4
push eax
push str.error:__zipfile_read_error_n
push 0x44ffe0
call dword [0x52040c]
add esp, 0x10
push 3
call fcn.0040af55
mov eax, dword [0x5200d4]
cdq
add eax, dword [0x5206a8]
mov ecx, dword [0x5206ac]
adc ecx, edx
mov dword [0x5206a8], eax
mov dword [0x5206ac], ecx
mov edx, dword [0x520100]
add edx, 0x2000
mov eax, dword [0x520104]
adc eax, 0
mov dword [0x520100], edx
mov dword [0x520104], eax
mov ecx, dword [0x5200cc]
mov dword [0x5200d0], ecx
call fcn.00427c00
mov edx, dword [0x5100c0]
mov eax, dword [edx + 0x28]
and eax, 1
je 0x4286db
mov ecx, dword [0x5200d4]
mov dword [ebp - 8], ecx
mov edx, dword [0x5200d0]
mov dword [ebp - 4], edx
jmp 0x4286a8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
test ecx, ecx
je 0x4286db
call fcn.0041dd70
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx]
xor edx, eax
mov eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx]
push edx
call fcn.0041dcf0
add esp, 4
jmp 0x42869f
mov eax, dword [0x5200d4]
sub eax, 1
mov dword [0x5200d4], eax
mov ecx, dword [0x5200d0]
mov dl, byte [ecx]
mov byte [ebp - 9], dl
mov eax, dword [0x5200d0]
add eax, 1
mov dword [0x5200d0], eax
movzx eax, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x429ea0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], 0xffffffff
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
push str.CONIN_
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x429edf
or eax, 0xffffffff
jmp 0x429f72
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x429efd
push 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
lea eax, [ebp - 4]
push eax
push 1
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x429f24
cmp dword [ebp - 4], 1
jne 0x429f24
movzx eax, byte [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xa
jne 0x429f51
push 0
lea ecx, [ebp - 4]
push ecx
push 1
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x429f51
cmp dword [ebp - 4], 1
jne 0x429f51
movzx ecx, byte [ebp - 0x10]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 0xffffffff
je 0x429f65
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x42a080
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x1d
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x42a0aa
movsx ecx, byte [ebp - 4]
test ecx, ecx
je 0x42a0aa
mov al, byte [ebp - 4]
jmp 0x42a0ac
mov al, 0x2d
mov esp, ebp
pop ebp
ret

Function at 0x42a0b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 2
lea eax, [ebp - 4]
push eax
push 0x21
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x42a0f9
mov cl, byte [ebp - 4]
mov byte [ebp - 8], cl
cmp byte [ebp - 8], 0x30
je 0x42a0e7
cmp byte [ebp - 8], 0x31
je 0x42a0eb
cmp byte [ebp - 8], 0x32
je 0x42a0f2
jmp 0x42a0f9
xor eax, eax
jmp 0x42a0fb
mov eax, 1
jmp 0x42a0fb
mov eax, 2
jmp 0x42a0fb
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42a470
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x449464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 2
push 0x44a654
mov eax, dword [ebp + 8]
push eax
call fcn.00406b9a
add esp, 0xc
test eax, eax
je 0x42a4b1
push 2
push 0x44a658
mov ecx, dword [ebp + 8]
push ecx
call fcn.00406b9a
add esp, 0xc
test eax, eax
jne 0x42a4db
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 2]
test eax, eax
je 0x42a4db
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 2]
cmp edx, 0x2f
je 0x42a4db
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 2]
cmp ecx, 0x5c
je 0x42a4db
xor eax, eax
jmp 0x42a64d
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
push eax
call fcn.00408725
add esp, 4
test eax, eax
je 0x42a505
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 1]
cmp edx, 0x3a
jne 0x42a505
mov eax, dword [ebp + 8]
mov dword [ebp - 0x224], eax
jmp 0x42a539
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0x104
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x42a52d
xor eax, eax
jmp 0x42a64d
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x224], ecx
push 2
mov edx, dword [ebp - 0x224]
push edx
push 0x520444
call fcn.00406b9a
add esp, 0xc
test eax, eax
je 0x42a648
push 2
mov eax, dword [ebp - 0x224]
push eax
push 0x520444
call fcn.00408a30
add esp, 0xc
mov byte [0x520446], 0x2f
mov byte [0x520447], 0
push 0x104
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x104
lea edx, [ebp - 0x220]
push edx
push 0x520444
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x42a5bc
mov byte [0x520444], 0
xor eax, eax
jmp 0x42a64d
mov eax, 0xc
cmp eax, dword [ebp - 0xc]
sbb ecx, ecx
add ecx, 1
mov dword [0x520448], ecx
push 4
push str.VFAT
lea edx, [ebp - 0x118]
push edx
call fcn.0041a9c7
add esp, 4
push eax
call fcn.00406b9a
add esp, 0xc
test eax, eax
je 0x42a632
push 4
push str.HPFS
lea eax, [ebp - 0x118]
push eax
call fcn.00406b9a
add esp, 0xc
test eax, eax
je 0x42a632
push 3
push 0x44a66c
lea ecx, [ebp - 0x118]
push ecx
call fcn.00406b9a
add esp, 0xc
test eax, eax
je 0x42a632
mov dword [ebp - 0x228], 0
jmp 0x42a63c
mov dword [ebp - 0x228], 1
mov edx, dword [ebp - 0x228]
mov dword [0x52044c], edx
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403c87
mov esp, ebp
pop ebp
ret

Function at 0x42a660
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
add eax, 0x40
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2f
mov byte [ebp - 1], 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor edx, edx
cmp eax, 2
sete dl
mov eax, edx
mov esp, ebp
pop ebp
ret
Function at 0x4341c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0xffffffff
je 0x4341fe
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov cl, 0x20
call fcn.0043c5e0
mov ecx, dword [ebp - 4]
xor esi, esi
or eax, ecx
or edx, esi
jmp 0x434202
xor eax, eax
xor edx, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4343b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0xffffffff
je 0x4343e7
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x4343f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0xffffffff
je 0x434427
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4