joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c600
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [0x46e818]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push ebx
push eax
call fcn.00446c6a
add esp, 4
movzx ebx, ax
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x2dc], ebx
mov dword [ebp - 0x1b4], 0x114
push eax
call dword [0x46f0b8]
cmp dword [ebp - 0x1a4], 2
jne 0x41c875
push esi
push edi
movzx eax, bx
push eax
lea eax, [ebp - 0x44]
push str.._c:
push eax
call fcn.00415400
add esp, 0xc
lea eax, [ebp - 0x44]
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [0x46f068]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
cmp esi, 0xffffffff
je 0x41c6ab
push 0
lea eax, [ebp - 0x2e0]
push eax
push 0
push 0
push 0
push 0
push 0x90020
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2d4], 0
push ebx
call fcn.00446c6a
add esp, 4
movzx ebx, ax
lea eax, [ebp - 0x2c8]
mov dword [ebp - 0x2c8], 0x114
push eax
call dword [0x46f0b8]
cmp dword [ebp - 0x2b8], 2
jne 0x41c74d
push ebx
lea eax, [ebp - 0x84]
push str.._c:
push eax
call fcn.00415400
add esp, 0xc
lea eax, [ebp - 0x84]
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [0x46f068]
mov esi, eax
cmp esi, 0xffffffff
je 0x41c83e
push 0
lea eax, [ebp - 0x2d8]
push eax
push 0
push 0
push 0
push 0
push 0x90018
push esi
call edi
test eax, eax
jne 0x41c839
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
jmp 0x41c839
xor edi, edi
push edi
push 0x4000000
push edi
push edi
push edi
push edi
push 0x45a854
mov dword [ebp - 0x2d0], edi
call dword [0x46f068]
mov esi, eax
cmp esi, 0xffffffff
je 0x41c833
mov eax, ebx
mov dword [ebp - 0x2cc], eax
lea ebx, [eax - 0x40]
mov dword [ebp - 0x94], 0x440d
mov dword [ebp - 0x98], 0x84a
mov dword [ebp - 0x88], 1
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], 0
test edi, edi
je 0x41c7bc
mov dword [ebp - 0x9c], 4
push 0
lea eax, [ebp - 0x2d8]
push eax
push 0x1c
lea eax, [ebp - 0xa0]
push eax
push 0x1c
push eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41c7fd
test byte [ebp - 0x88], 1
jne 0x41c7fd
inc edi
cmp edi, 1
ja 0x41c7f3
cmp dword [ebp + 0xc], 0
jne 0x41c780
mov dword [ebp - 0x2d0], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
shl esi, 8
add esi, dword [ebp - 0x2cc]
cmp dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2cc], esi
jne 0x41c833
lea eax, [ebp - 0x2cc]
push eax
call fcn.0041cc80
mov esi, dword [ebp - 0x2cc]
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp esi, 0xffffffff
jne 0x41c862
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2d4]
mov ebx, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2d4], eax
cmp eax, 5
jb 0x41c6b5
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
push dword [ebp + 0xc]
push ebx
call fcn.0041ca20
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop ebx
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
Function at 0x41c890
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x46e818]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x46f0b8]
lea eax, [ebp - 0x118]
push esi
mov esi, dword [ebp + 8]
push eax
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x118], 0x114
call ebx
cmp dword [ebp - 0x108], 2
jne 0x41c9b2
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push esi
call dword [0x46f068]
mov esi, eax
cmp esi, 0xffffffff
je 0x41c915
push 0
lea eax, [ebp - 0x234]
push eax
push 0
push 0
push 0
push 0
push 0x90020
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
xor edi, edi
nop dword [eax + eax]
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0x114
push eax
or esi, 0xffffffff
call ebx
cmp dword [ebp - 0x21c], 2
jne 0x41c98c
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push dword [ebp - 0x230]
call dword [0x46f068]
mov esi, eax
cmp esi, 0xffffffff
je 0x41c991
push 0
lea eax, [ebp - 0x238]
push eax
push 0
push 0
push 0
push 0
push 0x90018
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x41c98c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
cmp esi, 0xffffffff
jne 0x41c99f
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 3
jb 0x41c920
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
xor ecx, ebp
pop ebx
call fcn.00442e5e
mov esp, ebp
pop ebp
ret

Function at 0x41c9d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x41c9e8
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
ret
push eax
call fcn.0041c580
add esp, 4
test eax, eax
je 0x41ca0c
push edi
call fcn.0041cc80
add esp, 4
mov esi, eax
cmp dword [ebp + 0xc], 0
je 0x41ca0c
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x41ce00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
call fcn.0041cc80
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x429ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
test esi, esi
je 0x429f23
push edi
mov edi, dword [ebp + 8]
movzx ecx, byte [edi]
lea edi, [edi + 1]
movzx edx, ax
shr edx, 8
xor edx, ecx
shl eax, 8
xor ax, word [edx*2 + 0x46c148]
movzx eax, ax
sub esi, 1
jne 0x429f01
pop edi
pop esi
pop ebp
ret

Function at 0x429f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x429f9f
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push edi
nop dword [eax]
dec ebx
xor ecx, ecx
mov esi, edx
mov edi, eax
test edx, edx
je 0x429f87
nop dword [eax + eax]
movzx eax, byte [edi]
lea edi, [edi + 1]
movzx edx, cx
shr edx, 8
xor edx, eax
shl ecx, 8
xor cx, word [edx*2 + 0x46c148]
movzx ecx, cx
sub esi, 1
jne 0x429f60
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp - 4]
add eax, edx
movzx ecx, cx
add esi, ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], esi
test ebx, ebx
jne 0x429f50
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42a590
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push dword [ebp + 8]
test ecx, ecx
je 0x42a5ac
call fcn.0041f140
neg eax
sbb eax, eax
inc eax
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebp
ret

Function at 0x42a740
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x46e818]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x250]
push edi
mov edi, dword [ebp + 0xc]
push eax
push ebx
call fcn.0042b710
mov eax, dword [ebp - 0x250]
add esp, 8
cmp word [eax], 0x2e
jne 0x42a78c
movzx ecx, word [eax + 2]
test cx, cx
je 0x42a7aa
cmp ecx, 0x2e
jne 0x42a78c
cmp word [eax + 4], 0
je 0x42a7aa
push edi
lea eax, [ebp - 0x24c]
push eax
push ebx
call fcn.0042a6f0
add esp, 0xc
test eax, eax
jne 0x42a7d4
test byte [ebp - 0x24c], 0x10
je 0x42a7bf
pop edi
mov eax, 0x57
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x4b
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
test edi, edi
je 0x42a7ff
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax + 0x78]
test eax, eax
je 0x42a812
mov esi, 0x4d
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
mov ecx, 0x4d
cmove esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
Function at 0x42c560
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46e818]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [eax*4 + 0x46c018], 0
je 0x42c582
inc eax
cmp eax, 0xffffffff
jb 0x42c572
push 0
mov dword [0x473a6c], eax
call dword [0x46f09c]
mov dword [0x46f1a4], eax
mov dword [0x46f1a0], eax
mov eax, dword [0x473a70]
test eax, eax
je 0x42c5a9
push 0x459ca4
call eax
push 0xa
lea eax, [ebp - 0x18]
mov dword [ebp - 8], 0
push eax
push 0x59
xorps xmm0, xmm0
push 0x400
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42c5de
lea eax, [ebp - 0x18]
push eax
call fcn.0042c6c0
add esp, 4
mov ecx, eax
jmp 0x42c5e4
mov ecx, dword [0x46c348]
cmp ecx, dword [0x473a6c]
push 0
sbb eax, eax
mov dword [ebp - 0x24], 0
and eax, ecx
mov dword [ebp - 0x20], 0
push 0x459e58
mov dword [0x46c348], eax
mov dword [ebp - 0x1c], 0
call fcn.0042c330
add esp, 8
lea ecx, [ebp - 0x24]
push eax
call fcn.00439010
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x42c681
push eax
call dword [0x46f0c8]
test eax, eax
je 0x42c639
mov dword [0x46f1a0], eax
jmp 0x42c681
mov eax, dword [0x46c348]
test eax, eax
je 0x42c679
cmp eax, dword [0x473a6c]
jae 0x42c679
push str.Language
push dword [eax*4 + 0x46c018]
call fcn.0042c330
add esp, 8
lea ecx, [ebp - 0x24]
push eax
call fcn.00439010
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x42c681
push eax
call dword [0x46f0c8]
test eax, eax
jne 0x42c632
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x46f1a0]
cmp eax, dword [0x46f1a4]
push ebx
push dword [ebp - 0x1c]
setne bl
call fcn.00442e59
push dword [ebp - 0x24]
call fcn.00442e59
mov ecx, dword [ebp - 4]
add esp, 8
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
Function at 0x42cb10
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x46e818]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x124], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x128], eax
mov eax, esi
push edi
xor edi, edi
and eax, 3
jne 0x42cb5d
mov edi, SysReAllocString
jmp 0x42cb74
cmp eax, 1
jne 0x42cb69
mov edi, 0x40000000
jmp 0x42cb74
cmp eax, 2
mov ecx, 0xc0000000
cmove edi, ecx
mov eax, esi
xor edx, edx
and eax, 0x30000000
cmp eax, 0x10000000
je 0x42cbca
cmp eax, 0x20000000
je 0x42cbc5
cmp eax, 0x30000000
je 0x42cbbe
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [0x46f0b8]
xor edx, edx
cmp dword [ebp - 0x108], 2
sete dl
lea edx, [edx*4 + 3]
jmp 0x42cbca
mov edx, 2
jmp 0x42cbca
mov edx, 1
mov ecx, esi
mov eax, esi
and ecx, 0x10
shl ecx, 0x18
mov ebx, ecx
or ebx, 0x8000000
and al, 0x20
cmove ebx, ecx
test esi, 0x100
je 0x42cc0a
test esi, 0x400
je 0x42cbf8
mov esi, 1
jmp 0x42cc1a
and esi, 0x200
neg esi
sbb esi, esi
and esi, 0xfffffffe
add esi, 4
jmp 0x42cc1a
and esi, 0x200
neg esi
sbb esi, esi
and esi, 2
add esi, 3
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], edi
mov eax, dword [ebp - 0x120]
pop edi
mov dword [eax], edx
mov eax, dword [ebp - 0x124]
mov dword [eax], esi
mov eax, dword [ebp - 0x128]
pop esi
mov dword [eax], ebx
pop ebx
call fcn.00442e5e
mov esp, ebp
pop ebp
ret

Function at 0x42d840
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x46e818]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0xffffffff
lea eax, [ebp - 0x14]
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x28
cmovne esi, dword [ebp + 0x10]
push 0
push eax
push esi
push edi
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0
push eax
push 0x2d1400
push ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x42d8be
cmp dword [ebp - 0x14], 0x28
jae 0x42d8a3
cmp esi, 0x28
jae 0x42d8be
cmp dword [edi + 4], 0x24
jb 0x42d8be
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442e5e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00442e5e
mov esp, ebp
pop ebp
ret

Function at 0x42eb90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x42ebbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42ebbb
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x435600
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
mov eax, ebx
cmovne edx, ebx
sub eax, dword [ebp + 8]
neg ebx
mov dword [ebp - 4], edx
push edi
mov edi, ecx
sbb ebx, ebx
and ebx, eax
mov eax, dword [edi + 0x14]
add eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x20]
cmp eax, ecx
cmovbe ecx, eax
mov dword [ebp + 0x10], ecx
cmp edx, ecx
jb 0x435648
xor eax, eax
xor ecx, ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 8], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi]
xor edx, edx
mov eax, dword [ebp + 0xc]
dec eax
push esi
movzx esi, word [ecx + 6]
add eax, esi
div esi
mov edx, dword [ebp - 4]
sub dword [ebp + 0x10], edx
mov edx, dword [edi + 0xc]
sub edx, ebx
cmp dword [ebp + 0x10], edx
push ecx
cmovbe edx, dword [ebp + 0x10]
cmp eax, edx
cmovbe edx, eax
mov eax, ebx
imul eax, esi
push edx
mov dword [ebp + 0x10], edx
add eax, dword [edi + 4]
push eax
push 0
push dword [ebp - 4]
call fcn.00416f60
add esp, 0x14
pop esi
test eax, eax
jne 0x4356a3
mov dword [edi + 0x10], eax
mov dword [edi + 8], eax
mov eax, 0x12
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
add ecx, ebx
mov dword [edi + 0x10], ecx
mov dword [edi + 8], eax
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x436310
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, 1
xor ebx, ebx
call fcn.004163d0
mov edi, eax
add esp, 4
test edi, edi
je 0x43640b
lea eax, [ebp - 4]
push eax
push edi
call fcn.0042b7c0
mov edx, dword [ebp - 4]
add esp, 8
movzx eax, word [edx]
cmp eax, 0x5c
je 0x436352
cmp eax, 0x2f
jne 0x436358
add edx, 2
mov dword [ebp - 4], edx
cmp word [edx], bx
je 0x436400
movzx eax, word [edx]
test ax, ax
je 0x43638c
nop dword [eax]
cmp ax, 0x5c
je 0x43638c
cmp ax, 0x2f
je 0x43638c
add edx, 2
mov dword [ebp - 4], edx
movzx ecx, word [edx]
mov eax, ecx
test cx, cx
jne 0x436370
movzx esi, word [edx]
xor eax, eax
mov word [edx], ax
lea eax, [ebp - 8]
push eax
push edi
call fcn.0043c1a0
add esp, 8
test eax, eax
je 0x4363b2
cmp dword [ebp - 8], 0
je 0x4363fe
mov ebx, 1
jmp 0x4363c0
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4363fe
mov eax, dword [ebp - 4]
mov word [eax], si
cmp esi, 0x5c
je 0x4363db
mov eax, dword [ebp - 4]
mov word [eax], si
cmp esi, 0x2f
je 0x4363db
mov edx, dword [ebp - 4]
jmp 0x4363e4
mov edx, dword [ebp - 4]
add edx, 2
mov dword [ebp - 4], edx
cmp word [edx], 0
jne 0x436361
push edi
mov esi, 1
call fcn.00442e59
add esp, 4
jmp 0x43640d
xor esi, esi
push edi
call fcn.00442e59
add esp, 4
jmp 0x43640d
xor esi, esi
mov ecx, dword [ebp + 0xc]
mov eax, esi
test ecx, ecx
je 0x436418
mov dword [ecx], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439110
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x43911e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
test esi, esi
je 0x43914a
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x45cf60]
sub esi, 1
jne 0x439130
not eax
pop esi
pop ebp
ret

Function at 0x439810
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
movzx eax, word [edi + 6]
cdq
mov esi, eax
add esi, ecx
mov ecx, edx
push edx
adc ecx, dword [ebp - 4]
sub esi, 1
push eax
sbb ecx, 0
push ecx
push esi
call fcn.00443310
test edx, edx
jl 0x439857
jg 0x439851
test eax, eax
je 0x439857
sub eax, 1
sbb edx, 0
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x439860
mov dword [ecx], edx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x439869
mov dword [ecx], eax
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x439876
movzx eax, word [edi + 6]
mov dword [ecx], eax
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x439890
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 0x18]
push 0xffffffffffffffff
mov dword [ebp - 4], 0
movzx esi, word [edi + 6]
push dword [edi + 0x28]
imul esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
movzx eax, word [edi + 6]
push dword [ebp + 8]
cdq
push edx
push eax
call fcn.004433c0
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push eax
push dword [edi + 0x24]
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4398ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x439924
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x18]
push 0
push eax
push esi
push ebx
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x439923
mov eax, dword [ebp + 0x18]
cmp eax, esi
jae 0x43991c
sub esi, eax
add eax, ebx
push esi
push 0
push eax
call fcn.00444360
add esp, 0xc
mov dword [ebp - 4], 1
pop ebx
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x439940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
xor esi, esi
push 0xffffffffffffffff
movzx ebx, word [edi + 6]
push dword [edi + 0x28]
imul ebx, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
movzx eax, word [edi + 6]
push dword [ebp + 8]
cdq
push edx
push eax
call fcn.004433c0
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
push ecx
push eax
push dword [edi + 0x24]
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x439997
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4399b9
push 0
lea eax, [ebp + 0x18]
push eax
push ebx
push dword [ebp + 0x10]
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4399b9
cmp dword [ebp + 0x18], ebx
mov eax, 1
cmove esi, eax
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e3f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
mov edx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
mov ebx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub ebx, dword [edi + 0x6c]
add eax, esi
sub ebx, edx
cmp dword [edi + 0x6c], eax
jb 0x43e498
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.004448a0
mov eax, dword [edi + 0x4c]
add esp, 0xc
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x44]
mov edi, dword [ebp - 4]
lea edx, [eax + edi*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x43e442
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x40]
mov edi, esi
lea edx, [eax + esi*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x43e470
mov edi, dword [ebp + 8]
add ebx, esi
mov ecx, dword [edi]
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x43e553
mov ecx, dword [edi + 0x6c]
mov edx, dword [edi + 0x74]
add ecx, edx
add ecx, dword [edi + 0x38]
cmp eax, ebx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
cmovbe ebx, eax
test ebx, ebx
jne 0x43e4c6
xor ebx, ebx
jmp 0x43e512
sub eax, ebx
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x43e4e3
push ebx
push dword [ecx]
push dword [ecx + 0x30]
call fcn.00441c60
jmp 0x43e4f3
cmp eax, 2
jne 0x43e4f9
push ebx
push dword [ecx]
push dword [ecx + 0x30]
call fcn.00441ee0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], eax
push ebx
push dword [ecx]
push dword [ebp - 8]
call fcn.004448a0
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [eax], ebx
add dword [eax + 8], ebx
mov edx, dword [edi + 0x74]
add edx, ebx
mov dword [ebp - 8], edx
mov dword [edi + 0x74], edx
cmp edx, 3
jb 0x43e53f
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
mov edx, dword [ebp - 8]
cmp edx, 0x106
jae 0x43e553
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x43e402
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452440
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00452100