joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x708644ec
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x52573737
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x9301f4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9301fa
pop ebp
sub ebp, 6
sub ebp, 0x5301f4
jmp 0x930258
jmp 0x930261
mov eax, 0x5301f4
add eax, ebp
add eax, 0x93
mov ecx, 0x637
mov edx, 0xca53db40
xor byte [eax], dl
inc eax
dec ecx
jne 0x930278
jmp 0x93028b
sub al, byte [eax]
sub byte [eax + 0x50], al
inc eax
inc eax
sub byte [eax - 0x74], al
insb byte es:[edi], dx
inc eax
sal dword [eax - 0x2e777d73], 0xc1
mov al, 0x8d
or byte [eax + 0x108073d1], 0xbf
aad 0x38
add dword [ecx], ecx
inc eax
adc bl, cl
invalid
Function at 0x405848
Capabilities:
Get geographical location

Disassembly:
push ecx
push 2
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
mov al, byte [esp]
pop edx
ret

Function at 0x405f58
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 4
jle 0x405f79
cmp dword [esp + 0x10], 2
je 0x405f7d
xor eax, eax
jmp 0x405f7f
mov al, 1
mov byte [0x424110], al
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x405f94
cmp dword [esp + 8], 1
jge 0x405f9d
cmp eax, 5
jg 0x405f9d
xor edx, edx
jmp 0x405f9f
mov dl, 1
mov byte [0x424111], dl
cmp eax, 6
setge byte [0x424112]
add esp, 0x94
ret

Function at 0x40612c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4061ca
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x424128], 0
jne 0x4061ae
lea eax, [ebp - 4]
mov edx, 0x4061e4
call fcn.00402eec
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403294
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
mov eax, esi
call fcn.004022ac
mov ebx, eax
push ebx
push esi
mov eax, dword [ebp - 8]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4061f4
push ebx
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x424128], eax
mov eax, ebx
call fcn.004022c4
mov ebx, dword [0x424128]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4061d1
lea eax, [ebp - 4]
call fcn.00402e54

Function at 0x409cbc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x409cc2
ret

Function at 0x411f44
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4241f4
cmp dword [edi], 0
jne 0x411fc0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4241f0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x423348
mov ecx, 2
call fcn.0040236c
mov edx, 0x411f1c
lea eax, [esi + 5]
call fcn.00411f3c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00411f3c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x411f95
mov dword [0x4241f0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x411ff0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x412040]
test si, 4
je 0x412004
or bl, 1
test si, 8
je 0x41200e
or bl, 4
test si, 1
je 0x412018
or bl, 8
test si, 2
je 0x412022
or bl, 0x10
test si, 0x10
je 0x41202c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41203b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x412044
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41207c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41205d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41206c
or bl, 4
test esi, 0x20000000
je 0x412077
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x413768
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4241d0]
cmp dword [eax + 0x1c], 0
je 0x4137f7
cmp dword [ebx + 0x30], 0
jne 0x4137f4
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4136fc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x2c]
cmp dword [eax + 4], 0
je 0x4137f4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4137c4
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x2c]
mov esi, dword [eax + 4]
dec esi
cmp esi, 0
jl 0x4137f4
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x14]
mov eax, dword [eax + esi*4]
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4137d0
inc dword [ebx + 0x30]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x419504
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
xor eax, eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x15c]
mov edx, dword [0x404510]
call fcn.004035e0
xor eax, eax
push ebp
push 0x419650
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00419288
lea eax, [ebp - 0x160]
mov ecx, 0x419664
mov edx, dword [ebp - 4]
call fcn.0040311c
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
mov edx, 0x3f
call fcn.00404d68
test eax, eax
jne 0x419608
lea eax, [ebp - 0x160]
call fcn.004193ac
mov eax, dword [ebp - 0x160]
mov edx, dword [ebp - 0x150]
call fcn.004033b8
dec eax
jne 0x4195f5
test byte [ebp - 0x154], 0x10
je 0x4195bf
lea eax, [ebp - 0x160]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 4]
call fcn.0040311c
mov eax, dword [ebp - 0x160]
call fcn.00419e58
jmp 0x4195f5
lea eax, [ebp - 0x160]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 4]
call fcn.0040311c
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x164]
call fcn.00404b3c
mov eax, dword [ebp - 0x164]
call fcn.00403568
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x15c]
call fcn.00404db4
test eax, eax
je 0x419576
lea eax, [ebp - 0x15c]
call fcn.00404dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419657
lea eax, [ebp - 0x164]
call fcn.0040347c
lea eax, [ebp - 0x160]
call fcn.00402e54
lea eax, [ebp - 0x15c]
mov edx, dword [0x404510]
call fcn.004036a8
lea eax, [ebp - 4]
call fcn.00402e54
ret

Function at 0x419668
Capabilities:
Get disk size
Set current directory

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
call fcn.004191d0
mov eax, ebx
call fcn.00403294
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0
call sub.kernel32.dll_GetDiskFreeSpaceA
call fcn.00419234
mov eax, dword [esp]
imul dword [esp + 4]
add esp, 0x10
pop ebx
ret

Function at 0x4196ac
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x419712
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 1
push 0
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00404b3c
mov eax, dword [ebp - 4]
call fcn.00403568
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419719
lea eax, [ebp - 4]
call fcn.0040347c
ret
Function at 0x4199f0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403284
xor eax, eax
push ebp
push 0x419a65
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004191d0
lea eax, [ebp - 4]
call fcn.00419148
mov eax, dword [ebp - 4]
call fcn.00403294
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [ebp - 8]
call fcn.00419194
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004192e8
mov ebx, eax
call fcn.00419234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419a6c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402e78

Function at 0x419b6c
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x240], edx
mov esi, eax
xor eax, eax
push ebp
push 0x419cb5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
call fcn.00419b10
cmp eax, 2
jne 0x419bb1
mov bl, 1
jmp 0x419c8c
cmp eax, 3
jne 0x419c8c
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea edx, [ebp - 0x240]
mov eax, esi
call fcn.00404e9c
mov ecx, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
mov edx, 0x419cd0
call fcn.0040311c
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.00404b3c
mov eax, dword [ebp - 0x238]
call fcn.00403568
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x419c8c
lea eax, [ebp - 0x228]
mov edx, 0x224
call fcn.004043e0
mov dword [ebp - 0x224], 0x224
xor eax, eax
mov dword [ebp - 0x234], eax
xor eax, eax
mov dword [ebp - 0x230], eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
push 0xc
lea eax, [ebp - 0x234]
push eax
push 0x2d1400
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x419c86
mov edi, dword [ebp - 0x20c]
cmp edi, 4
je 0x419c84
cmp edi, 7
je 0x419c84
cmp byte [ebp - 0x21e], 0
je 0x419c86
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419cbc
lea eax, [ebp - 0x240]
mov edx, 2
call fcn.00402e78
lea eax, [ebp - 0x238]
call fcn.0040347c
ret
Function at 0x419cd8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x419da7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004199f0
test al, al
jne 0x419d84
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00402eec
mov eax, dword [ebp - 4]
call fcn.0041a15c
cmp al, 0x5c
jne 0x419d20
lea eax, [ebp - 4]
call fcn.0041a17c
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00404e68
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00402eec
mov eax, dword [ebp - 4]
call fcn.004030d0
mov esi, eax
mov eax, ebx
call fcn.004030d0
cmp esi, eax
jge 0x419d53
mov eax, dword [ebp - 4]
call fcn.00419cd8
push 0
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00404b3c
mov eax, dword [ebp - 0xc]
call fcn.00403568
push eax
call sub.kernel32.dll_CreateDirectoryW
lea eax, [ebp - 8]
mov ecx, ebx
mov edx, 0x419dbc
call fcn.0040311c
mov eax, dword [ebp - 8]
call fcn.0041a1dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419dae
lea eax, [ebp - 0xc]
call fcn.0040347c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402e78
ret

Function at 0x419dc8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x419e4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x8000080
push 2
push 0
push 1
push 0xc0000000
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00404b3c
mov eax, dword [ebp - 8]
call fcn.00403568
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.004030d0
push eax
mov eax, esi
call fcn.00403294
push eax
push ebx
call sub.kernel32.dll_WriteFile
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419e52
lea eax, [ebp - 8]
call fcn.0040347c
ret
Function at 0x419e58
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
xor edx, edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403284
lea eax, [ebp - 0x15c]
mov edx, dword [0x404510]
call fcn.004035e0
xor eax, eax
push ebp
push 0x419fd0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00419148
lea eax, [ebp - 0x160]
mov ecx, 0x419fe4
mov edx, dword [ebp - 4]
call fcn.0040311c
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
mov edx, 0x3f
call fcn.00404d68
test eax, eax
jne 0x419f69
mov eax, dword [ebp - 0x150]
mov edx, 0x419ff0
call fcn.004031e0
je 0x419f56
mov eax, dword [ebp - 0x150]
mov edx, 0x419ffc
call fcn.004031e0
je 0x419f56
test byte [ebp - 0x154], 0x10
jne 0x419f37
lea eax, [ebp - 0x160]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 4]
call fcn.0040311c
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x164]
call fcn.00404b3c
mov eax, dword [ebp - 0x164]
call fcn.00403568
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x419f56
lea eax, [ebp - 0x160]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 4]
call fcn.0040311c
mov eax, dword [ebp - 0x160]
call fcn.00419e58
lea eax, [ebp - 0x15c]
call fcn.00404db4
test eax, eax
je 0x419ed2
lea eax, [ebp - 0x15c]
call fcn.00404dd8
lea edx, [ebp - 0x164]
mov eax, dword [ebp - 4]
call fcn.00404b3c
mov eax, dword [ebp - 0x164]
call fcn.00403568
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419fd7
lea eax, [ebp - 0x164]
call fcn.0040347c
lea eax, [ebp - 0x160]
call fcn.00402e54
lea eax, [ebp - 0x15c]
mov edx, dword [0x404510]
call fcn.004036a8
lea eax, [ebp - 4]
call fcn.00402e54
ret
Function at 0x41a7c4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41a91c
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41a8fc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00402ff8
lea eax, [ebp - 0x118]
mov edx, 0x41a934
call fcn.004030d8
mov eax, dword [ebp - 0x118]
call fcn.00403294
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x41a869
lea eax, [ebp - 0x111]
call fcn.00405064
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00402f38
jmp 0x41a870
mov eax, esi
call fcn.00402e54
cmp bl, 0x61
jae 0x41a891
lea edx, [ebp - 0x118]
mov eax, dword [esi]
call fcn.0041a540
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.00402eec
jmp 0x41a8ab
lea edx, [ebp - 0x118]
mov eax, dword [esi]
call fcn.0041a5d0
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.00402eec
cmp dword [esi], 0
je 0x41a8e5
lea eax, [ebp - 0x118]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0xb
lea edx, [ebp - 0x120]
xor ecx, ecx
mov eax, 0x41a940
call fcn.004053f8
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.00402eec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a903
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x41aab0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41abbe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040f704
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x140], ebx
mov esi, ebx
mov ebx, 2
mov eax, ebx
cmp eax, 0x1f
ja 0x41aafa
bt esi, eax
jae 0x41ab99
mov eax, ebx
add al, 0x61
mov byte [ebp - 5], al
lea eax, [ebp - 0x10]
mov dl, byte [ebp - 5]
call fcn.00402ff8
lea eax, [ebp - 0x10]
mov edx, 0x41abd4
call fcn.004030d8
mov eax, dword [ebp - 0x10]
call fcn.00403294
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp al, 5
je 0x41ab99
cmp al, 4
jne 0x41ab42
lea edx, [ebp - 0xc]
mov al, byte [ebp - 5]
call fcn.0041a948
jmp 0x41ab4d
lea edx, [ebp - 0xc]
mov al, byte [ebp - 5]
call fcn.0041a7c4
lea eax, [ebp - 0x10]
mov dl, byte [ebp - 5]
call fcn.00402ff8
lea eax, [ebp - 0x10]
mov edx, 0x41abd4
call fcn.004030d8
mov eax, dword [ebp - 0x10]
call fcn.00419b6c
test al, al
je 0x41ab86
push ebp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x13c]
mov eax, dword [ebp - 0xc]
call fcn.0041aa1c
pop ecx
jmp 0x41ab99
push ebp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x138]
mov eax, dword [ebp - 0xc]
call fcn.0041aa1c
pop ecx
inc ebx
cmp ebx, 0x1a
jne 0x41aaf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41abc5
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00402e78
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x80d6e81
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x25430003
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp fcn.00431219
Function at 0x401933
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x444
mov eax, dword [ebp + 0x14]
mov byte [ebp - 0x41c], al
cmp byte [ebp - 0x41c], 0x74
jne 0x4019d3
mov dword [ebp - 0xc], 0
jmp 0x4019c6
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x410]
mov dword [esp], eax
call sym._fgets
mov eax, dword [ebp - 0xc]
imul edx, eax, 0x2c
mov eax, dword [ebp + 8]
add eax, edx
lea edx, [eax + 0x28]
mov eax, dword [ebp - 0xc]
imul ecx, eax, 0x2c
mov eax, dword [ebp + 8]
add eax, ecx
add eax, 0x14
mov ecx, dword [ebp - 0xc]
imul ebx, ecx, 0x2c
mov ecx, dword [ebp + 8]
add ecx, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], str._s__s__d
lea eax, [ebp - 0x410]
mov dword [esp], eax
call sym._sscanf
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jl 0x40195c
jmp 0x401a82
cmp byte [ebp - 0x41c], 0x62
jne 0x401a82
mov dword [ebp - 0x10], 0
jmp 0x401a76
mov eax, dword [ebp - 0x10]
imul edx, eax, 0x2c
mov eax, dword [ebp + 8]
add eax, edx
mov edx, eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x14
mov dword [esp + 4], 1
mov dword [esp], edx
call sym._fread
mov eax, dword [ebp - 0x10]
imul edx, eax, 0x2c
mov eax, dword [ebp + 8]
add eax, edx
lea edx, [eax + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x14
mov dword [esp + 4], 1
mov dword [esp], edx
call sym._fread
mov eax, dword [ebp - 0x10]
imul edx, eax, 0x2c
mov eax, dword [ebp + 8]
add eax, edx
lea edx, [eax + 0x28]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], edx
call sym._fread
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jl 0x4019ec
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], sym._hand_alphabet_sort
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._qsort
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._fclose
nop
add esp, 0x444
pop ebx
pop ebp
ret