joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426d00
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x426d26
xor eax, eax
pop ebx
ret
push esi
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [esp + 0x14]
mov dword [edi], eax
inc eax
push eax
call fcn.0046bc89
mov esi, eax
add esp, 4
test esi, esi
jne 0x426d54
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [edi]
inc ecx
push ecx
push 0
push esi
call fcn.00469be0
mov edx, dword [edi]
add esp, 0xc
push 0
push edi
push edx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x426d80
push esi
call fcn.0046a248
add esp, 4
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x426f70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x4c437c]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x426fba
movsx ecx, byte [esp]
push ecx
call fcn.0046da3e
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0046a1be
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor al, al
call fcn.0046a1be
add esp, 0x108
ret

Function at 0x4275e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesMountMgr
push SysStringLen
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x427640
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.NoAutoMount
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
ret

Function at 0x427a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x427a7a
test al, 1
je 0x427a7a
mov eax, 1
ret
xor eax, eax
ret

Function at 0x427a80
Capabilities:
Get disk information

Disassembly:
sub esp, 0x110
mov eax, dword [0x4c437c]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
push 0x104
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
test eax, eax
jne 0x427ac7
xor eax, eax
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0046a1be
add esp, 0x110
ret
push 0
push 0
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x427ab0
mov eax, dword [esp]
mov ecx, dword [esp + 0x10c]
shr eax, 0x13
xor ecx, esp
and eax, 1
call fcn.0046a1be
add esp, 0x110
ret
Function at 0x429750
Capabilities:
Create service
Start service

Disassembly:
push ebx
push ebp
push esi
push edi
push 0xf003f
xor ebp, ebp
push ebp
push ebp
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x4297da
call fcn.004273b0
test eax, eax
mov eax, str.System32LxUDisk01.sys
je 0x429784
mov eax, str.SysWOW64LxUDisk64.sys
push 0
push 0
push 0
push 0
push 0
push eax
push 1
push 1
push 1
push 0xf01ff
push 0x4a51f0
push 0x4a51f0
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
je 0x4297da
push esi
call ebx
push 0xf01ff
push 0x4a51f0
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4297da
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4297f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x4297f6
mov eax, dword [esp + 0x14]
push eax
call fcn.004293d0
add esp, 4
jmp 0x4297fb
mov ebp, 1
test esi, esi
je 0x429802
push esi
call ebx
test edi, edi
je 0x429809
push edi
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x429810
Capabilities:
Create service
Delete service
Get common file path
Start service

Disassembly:
sub esp, 0x34c
mov eax, dword [0x4c437c]
xor eax, esp
mov dword [esp + 0x348], eax
push esi
push edi
push 0x208
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0x148]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x429841
mov cx, word [0x4b8b7c]
mov word [edi], cx
call fcn.004273b0
test eax, eax
mov eax, str.System32LxUDisk01.sys
je 0x429866
mov eax, str.SysWOW64LxUDisk64.sys
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429868
lea edi, [esp + 0x148]
sub eax, edx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x429880
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x4298cc
pop edi
mov eax, 0x1c
pop esi
mov ecx, dword [esp + 0x348]
xor ecx, esp
call fcn.0046a1be
add esp, 0x34c
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x429912
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
neg eax
sbb eax, eax
and eax, 0xffffffe5
pop edi
add eax, 0x1c
pop esi
mov ecx, dword [esp + 0x348]
xor ecx, esp
call fcn.0046a1be
add esp, 0x34c
ret
push ebx
push 0xf01ff
push 0x4a51f0
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x429945
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x160]
push ecx
push 1
push 3
push 1
push 0xf01ff
push 0x4a51f0
push 0x4a51f0
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x429997
push edi
call ebx
pop ebx
pop edi
lea eax, [esi + 1]
pop esi
mov ecx, dword [esp + 0x348]
xor ecx, esp
call fcn.0046a1be
add esp, 0x34c
ret
push ebp
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call ebx
push esi
call ebx
mov ecx, dword [esp + 0x358]
xor eax, eax
test ebp, ebp
pop ebp
pop ebx
pop edi
sete al
pop esi
xor ecx, esp
call fcn.0046a1be
add esp, 0x34c
ret
Function at 0x4299e0
Capabilities:
Query service status

Disassembly:
mov eax, 0x36a0
call fcn.0046a970
mov eax, dword [0x4c2cd0]
mov dword [esp], 0
cmp eax, 0xffffffff
jne 0x429a07
mov eax, 1
add esp, 0x36a0
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0x222028
push eax
call esi
test eax, eax
jne 0x429a5e
mov edx, dword [0x4c2cd0]
push eax
lea eax, [esp + 0x10]
push eax
push 0x3674
lea ecx, [esp + 0x3c]
push ecx
push 0
push 0
push 0x72004
push edx
call esi
test eax, eax
je 0x429b6a
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x429a6f
xor eax, eax
pop esi
add esp, 0x36a0
ret
push ebx
call fcn.00426b30
mov ebx, 1
cmp eax, ebx
jg 0x429b5f
mov ecx, dword [0x4c2cd0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xf003f
push 0
push 0
mov dword [0x4c2cd0], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x429b5f
push edi
push 0xf01ff
push 0x4a51f0
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x429b38
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea edx, [esp + 0x20]
push edx
push edi
call ebp
cmp eax, ebx
jne 0x429b2c
cmp dword [esp + 0x24], ebx
je 0x429b28
lea eax, [esp + 0x20]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea esp, [esp]
lea ecx, [esp + 0x20]
push ecx
push edi
call ebp
cmp eax, 1
jne 0x429b2c
cmp dword [esp + 0x24], eax
je 0x429b22
push 0xc8
call ebx
inc esi
cmp esi, 0xa
jl 0x429b00
jmp 0x429b2c
mov dword [esp + 0x10], eax
jmp 0x429b2c
mov dword [esp + 0x10], ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [esp + 0x1c]
pop ebp
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [esp + 0xc], 0
pop edi
je 0x429b5f
pop ebx
mov dword [0x4c2cd0], 0xffffffff
mov eax, 1
pop esi
add esp, 0x36a0
ret
pop ebx
xor eax, eax
pop esi
add esp, 0x36a0
ret
mov eax, 1
pop esi
add esp, 0x36a0
ret

Function at 0x42c250
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x4e9ec4]
mov dword [esp], 1
mov dword [esp + 8], 4
test eax, eax
jg 0x42c277
mov byte [0], 0
mov eax, dword [0x4e9ec4]
shl eax, 8
or eax, dword [0x4e9ec8]
shl eax, 8
or eax, dword [0x4e9ecc]
cmp eax, 0x60000
jge 0x42c296
xor eax, eax
add esp, 0xc
ret
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42c2e8
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 4]
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.EnableLUA
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42c2dd
mov dword [esp], 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp], eax
setne al
add esp, 0xc
ret
Function at 0x42c390
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4c437c]
xor eax, esp
mov dword [esp + 0x210], eax
cmp dword [0x4e9ed8], 0
jne 0x42c4e3
mov eax, dword [0x4c2cd0]
push 0
cmp eax, 0xffffffff
je 0x42c3fd
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
push 0
push 0x222064
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x42c52d
mov eax, 1
mov dword [0x4e9ed8], eax
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0046a1be
add esp, 0x214
ret
push 0
push 3
push 0
push 0
push 0
push str..TrueCrypt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x42c4fd
push 0x207
lea edx, [esp + 0xd]
push 0
push edx
mov byte [esp + 0x14], 0
call fcn.00469be0
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x42c4e3
lea eax, [esp + 8]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42c454
mov ecx, dword [str.TrueCrypt_]
mov edx, dword [0x4a4f2c]
mov dword [eax], ecx
mov ecx, dword [0x4a4f30]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
lea eax, [esp + 8]
dec eax
jmp 0x42c480
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42c480
mov edx, dword [str.System_Encryption.xml]
mov ecx, dword [0x4a5474]
mov dword [eax], edx
mov edx, dword [0x4a5478]
mov dword [eax + 4], ecx
mov ecx, dword [0x4a547c]
mov dword [eax + 8], edx
mov edx, dword [0x4a5480]
mov dword [eax + 0xc], ecx
mov cx, word [0x4a5484]
mov dword [eax + 0x10], edx
lea edx, [esp + 8]
push edx
mov word [eax + 0x14], cx
call fcn.004267a0
add esp, 4
test eax, eax
je 0x42c4e3
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x42c52d
call fcn.0042c250
test eax, eax
je 0x42c52d
mov eax, 1
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0046a1be
add esp, 0x214
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp]
push eax
push 0x20019
push 0
push 0x4a5430
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42c4e3
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
xor ecx, esp
xor eax, eax
call fcn.0046a1be
add esp, 0x214
ret
Function at 0x42ca30
Capabilities:
Create directory
Get common file path

Disassembly:
push esi
push edi
call fcn.0042c390
test eax, eax
je 0x42ca95
push 0x208
push 0x4ea188
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x4ea188
call fcn.0046d630
mov byte [eax + 1], 0
mov eax, dword [esp + 0x14]
add esp, 8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42ca66
mov edi, 0x4ea188
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x42ca77
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, 0x4ea188
pop esi
ret
push 0x4ea188
push 0
push 0
push 0x801a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x42cb1f
mov eax, 0x4ea188
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42cab5
mov ecx, dword [str.TrueCrypt_]
mov edx, dword [0x4a4f2c]
mov dword [eax], ecx
mov ecx, dword [0x4a4f30]
push 0
mov dword [eax + 4], edx
push 0x4ea188
mov dword [eax + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esp + 0xc]
mov ecx, eax
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42caf0
mov edi, 0x4ea188
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x42cb01
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, 0x4ea188
pop esi
ret
pop edi
mov byte [0x4ea188], 0
mov eax, 0x4ea188
pop esi
ret
Function at 0x42e770
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push str..TrueCrypt
call edi
mov dword [0x4c2cd0], eax
cmp eax, 0xffffffff
jne 0x42e873
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call fcn.0042e3c0
mov eax, dword [0x4e9efc]
add esp, 4
test eax, eax
jne 0x42e8f5
push str.GlobalTrueCrypt_Driver_Setup
push 1
push ebx
call esi
mov dword [0x4e9efc], eax
mov ecx, dword [0x4e9efc]
test ecx, ecx
je 0x42e802
call ebp
cmp eax, 0xb7
jne 0x42e8f5
mov edx, dword [0x4e9efc]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x4e9efc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4e9efc], ebx
mov ecx, dword [0x4e9efc]
test ecx, ecx
jne 0x42e857
push str.GlobalTrueCrypt_Driver_Setup
push 1
push ebx
call esi
mov dword [0x4e9efc], eax
mov edx, dword [0x4e9efc]
test edx, edx
je 0x42e84d
call ebp
cmp eax, 0xb7
jne 0x42e857
mov eax, dword [0x4e9efc]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [0x4e9efc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4e9efc], ebx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42e802
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push str..TrueCrypt
call edi
mov dword [0x4c2cd0], eax
cmp eax, 0xffffffff
je 0x42e7a7
mov eax, dword [0x4e9efc]
test eax, eax
je 0x42e8a4
mov ecx, dword [0x4e9efc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x42e8a4
mov edx, dword [0x4e9efc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42e8a4
mov dword [0x4e9efc], ebx
mov eax, dword [0x4c2cd0]
cmp eax, 0xffffffff
je 0x42e8eb
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
lea ecx, [esp + 0x14]
push ecx
push 4
push 0x4c694c
push ebx
push ebx
push 0x222004
push eax
call esi
test eax, eax
jne 0x42e8eb
mov eax, dword [0x4c2cd0]
push ebx
lea edx, [esp + 0x14]
push edx
push 4
push 0x4c694c
push ebx
push ebx
push 0x72018
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [0x4e9f0c], ebx
je 0x42e934
push ebx
call fcn.00429750
add esp, 4
test eax, eax
je 0x42e928
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push str..TrueCrypt
call edi
mov dword [0x4c2cd0], eax
call fcn.00429620
mov eax, dword [0x4c2cd0]
jmp 0x42e96b
call fcn.00429810
mov esi, eax
call fcn.00429620
cmp esi, ebx
je 0x42e94e
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push str..TrueCrypt
mov dword [0x4e9ed8], 1
call edi
mov dword [0x4c2cd0], eax
cmp dword [0x4e9ed8], ebx
je 0x42e993
cmp eax, 0xffffffff
je 0x42e99c
push ebx
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push ebx
push ebx
push 0x222068
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x4c2cd0]
cmp eax, 0xffffffff
jne 0x42e873
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x42e9b0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x4c437c]
xor eax, esp
mov dword [esp + 0x104], eax
call fcn.0042c390
test eax, eax
jne 0x42e9e3
lea eax, [esp]
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x42ea07
push 0x104
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp]
push 0x5c
push eax
call fcn.0046d630
add esp, 8
mov byte [eax + 1], 0
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0046a1be
add esp, 0x108
ret

Function at 0x431320
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x4004
call fcn.0046a970
mov eax, dword [0x4c437c]
xor eax, esp
mov dword [esp + 0x4000], eax
cmp dword [0x4e9ee0], 0
push ebx
mov ebx, dword [esp + 0x400c]
mov eax, str.PASSWORD_OR_KEYFILE_WRONG
jne 0x431353
mov eax, str.PASSWORD_WRONG
push eax
call fcn.004399e0
push eax
lea eax, [esp + 0xc]
push eax
call fcn.00402600
add esp, 0xc
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x4313be
push str.PASSWORD_WRONG_CAPSLOCK_ON
call fcn.004399e0
add esp, 4
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x431382
push esi
push edi
lea edi, [esp + 0xc]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4313a0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4313a0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
xor ecx, ecx
lea eax, [esp + 4]
mov dword [ebx + 0x18], 7
mov dword [ebx + 0x14], 0
mov word [ebx + 4], cx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4313e0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 8]
push edx
mov ecx, ebx
call fcn.00417c60
mov ecx, dword [esp + 0x4004]
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0046a1be
add esp, 0x4004
ret
Function at 0x435d40
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x864
mov eax, dword [0x4c437c]
xor eax, esp
mov dword [esp + 0x860], eax
mov eax, dword [0x4e9f34]
push ebx
push esi
mov esi, dword [esp + 0x870]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x87c]
mov dword [esp + 0xc], ebx
test eax, eax
jne 0x435d85
push 0x7f8a
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x4e9f34], eax
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [0x4e9f34]
mov dword [0x4e9f08], eax
cmp dword [esp + 0x878], ebx
je 0x435dd1
lea ecx, [esp + 0x2c]
push ecx
mov ebx, 3
call fcn.00435810
push eax
lea edx, [esp + 0x18]
push str.os
push edx
call fcn.00430c80
add esp, 0x10
cmp dword [eax + 0x18], 0x10
jb 0x435dcc
mov eax, dword [eax + 4]
jmp 0x435dd6
add eax, 4
jmp 0x435dd6
mov eax, 0x4b8a2f
push esi
push edi
push eax
push str.http:__www.truecrypt.org_applink_version6.3a_s_sdest_s
lea eax, [esp + 0x58]
push 0x824
push eax
call fcn.0046c8f5
add esp, 0x18
test bl, 2
je 0x435e21
and ebx, 0xfffffffd
cmp dword [esp + 0x28], 0x10
jb 0x435e0c
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00469bc3
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
pop edi
pop esi
test bl, 1
pop ebx
je 0x435e3d
cmp dword [esp + 0x38], 0x10
jb 0x435e3d
mov edx, dword [esp + 0x24]
push edx
call fcn.00469bc3
add esp, 4
push 1
push 0
push 0
lea eax, [esp + 0x48]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4e9f30]
test eax, eax
jne 0x435e7a
push 0x7f00
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x4e9f30], eax
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [esp + 0x860]
xor ecx, esp
mov dword [0x4e9f08], 0
call fcn.0046a1be
add esp, 0x864
ret
Function at 0x43dfc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x220
mov eax, dword [0x4c437c]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [0x4c3a98]
test eax, eax
je 0x43e1fa
mov eax, dword [0x4c3a90]
sub eax, 1
push esi
je 0x43e00a
sub eax, 1
je 0x43e003
sub eax, 1
je 0x43e003
mov esi, dword [esp + 4]
mov byte [0], 0
jmp 0x43e00f
mov esi, 0x40
jmp 0x43e00f
mov esi, 0x14
mov eax, 0x280
cdq
idiv esi
test edx, edx
je 0x43e022
mov byte [0], 0
push edi
xor edi, edi
jmp 0x43e030
mov eax, dword [0x4c3a90]
sub eax, 1
je 0x43e0c4
sub eax, 1
je 0x43e090
sub eax, 1
je 0x43e054
mov byte [0], 0
jmp 0x43e101
lea ecx, [esp + 0x13c]
push ecx
call fcn.004652a0
mov eax, dword [0x4eaca8]
lea edx, [esp + 0x140]
push edx
push 0x1400
push eax
call fcn.00465310
lea ecx, [esp + 0x1f4]
push ecx
lea edx, [esp + 0x150]
push edx
call fcn.00466c40
jmp 0x43e0fe
lea eax, [esp + 0xc]
push eax
call fcn.00464e50
mov edx, dword [0x4eaca8]
lea ecx, [esp + 0x10]
push ecx
push 0x280
push edx
call fcn.004648f0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1f8]
push ecx
call fcn.00464e90
jmp 0x43e0fe
lea edx, [esp + 0xdc]
push edx
call fcn.0045ce70
mov eax, dword [0x4eaca8]
push 0x280
push eax
lea ecx, [esp + 0xe8]
push ecx
call fcn.0045cec0
lea edx, [esp + 0xec]
push edx
lea eax, [esp + 0x1f8]
push eax
call fcn.0045d000
add esp, 0x18
xor eax, eax
test esi, esi
jle 0x43e11f
mov ecx, dword [0x4eaca8]
add ecx, edi
nop
mov dl, byte [esp + eax + 0x1e4]
xor byte [ecx + eax], dl
inc eax
cmp eax, esi
jl 0x43e110
add edi, esi
cmp edi, 0x280
jl 0x43e030
lea edx, [esp + 0x1e4]
mov ecx, 0x40
mov esi, ecx
mov eax, edx
pop edi
mov edi, edi
mov byte [eax], 0
inc eax
sub esi, 1
jne 0x43e140
lea esp, [esp]
dec ecx
mov byte [edx], 0
inc edx
test ecx, ecx
jne 0x43e150
mov eax, dword [0x4c3a90]
sub eax, 1
je 0x43e1cb
sub eax, 1
je 0x43e19c
sub eax, 1
je 0x43e178
mov byte [0], cl
jmp 0x43e1f9
lea edx, [esp + 0x138]
mov ecx, 0xa8
mov esi, ecx
mov eax, edx
mov byte [eax], 0
inc eax
sub esi, 1
jne 0x43e188
dec ecx
mov byte [edx], 0
inc edx
test ecx, ecx
jne 0x43e191
jmp 0x43e1f9
lea edx, [esp + 8]
mov ecx, 0xd0
mov esi, ecx
mov eax, edx
lea esp, [esp]
mov byte [eax], 0
inc eax
sub esi, 1
jne 0x43e1b0
lea esp, [esp]
dec ecx
mov byte [edx], 0
inc edx
test ecx, ecx
jne 0x43e1c0
jmp 0x43e1f9
lea edx, [esp + 0xd8]
mov ecx, 0x60
mov esi, ecx
mov eax, edx
jmp 0x43e1e0
mov byte [eax], 0
inc eax
sub esi, 1
jne 0x43e1e0
lea esp, [esp]
dec ecx
mov byte [edx], 0
inc edx
test ecx, ecx
jne 0x43e1f0
pop esi
mov ecx, dword [esp + 0x21c]
xor ecx, esp
mov eax, 1
call fcn.0046a1be
add esp, 0x220
ret