joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496130
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x68cdd8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49631a
sub esp, 0x48
mov eax, dword [0x665944]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.00492e40
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.0046d5fe
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.0046d5fe
call fcn.00492ac0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.0045faa0
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x496207
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x496221
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x496298
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x49626e
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x49626a
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x496263
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x496270
mov ebx, 0x1d
jmp 0x49628e
mov ebp, eax
jmp 0x496270
mov ebp, eax
cmp ebp, 0xd
jae 0x49630d
lea eax, [ebp - 1]
lea edx, [0x65d960]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x496303
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x496298
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x4962ca
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x4962d2
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call fcn.0046cf40
mov eax, ebp
mov ecx, 0xd
call fcn.0046cf40
nop
call fcn.0046bac0
jmp fcn.00496130
Function at 0x4e1070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x68cdd8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e1217
sub esp, 0x30
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.004e13f0
movzx eax, byte [esp + 0xc]
test al, al
je 0x4e10ff
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4e10ff
mov edx, dword [esp + 0x24]
cmp eax, 1
je 0x4e10f2
movzx ebx, byte [edx]
test bl, bl
jne 0x4e10e4
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x4e10ff
cmp bl, 0xff
jne 0x4e10f2
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x4e10ff
cmp eax, 8
jg 0x4e1108
mov ebx, dword [esp + 0x38]
xor ecx, ecx
jmp 0x4e1133
mov byte [esp + 0x3c], 0
add esp, 0x30
ret
jg 0x4e10ff
mov byte [esp + 0x3c], 1
add esp, 0x30
ret
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
movzx esi, byte [edx + ecx]
or esi, ebp
mov dword [ebx], esi
inc ecx
cmp ecx, eax
jl 0x4e1113
mov dword [esp + 0x14], eax
mov edx, dword [ebx]
mov dword [esp + 0x20], edx
mov ebp, dword [ebx + 4]
shl eax, 3
lea ecx, [eax - 0x40]
neg ecx
mov byte [esp + 0x13], cl
shl ebp, cl
mov dword [esp + 0x1c], ebp
mov edi, edx
shl edx, cl
add eax, 0xffffffe0
mov byte [esp + 0x12], al
mov ecx, eax
shr edi, cl
mov dword [esp + 0x18], edi
neg eax
mov ecx, eax
mov esi, dword [esp + 0x20]
shl esi, cl
movzx edi, byte [esp + 0x13]
xchg edi, eax
shr al, 5
xchg edi, eax
xchg edi, eax
movzx eax, al
xchg edi, eax
mov dword [esp + 0x20], edi
cmp al, 0x20
sbb edi, edi
sbb ebp, ebp
and edi, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
or ebp, eax
xchg ebp, eax
mov byte [esp + 0x11], al
xchg ebp, eax
movzx ecx, byte [esp + 0x13]
cmp cl, 0x20
sbb eax, eax
sbb esi, esi
and edx, esi
mov dword [ebx], edx
mov ebp, dword [esp + 0x1c]
and ebp, esi
not eax
or eax, ecx
mov byte [esp + 0x13], al
shr edx, cl
and edx, esi
mov esi, dword [esp + 0x20]
cmp esi, 1
sbb esi, esi
xor esi, 0xffffffff
mov dword [esp + 0x20], esi
movzx ecx, byte [esp + 0x12]
cmp cl, 0x20
sbb eax, eax
mov esi, dword [esp + 0x18]
and esi, eax
or ebp, esi
or ebp, edi
mov dword [ebx + 4], ebp
mov esi, ebp
shl ebp, cl
and ebp, eax
or edx, ebp
movzx ecx, byte [esp + 0x11]
mov eax, esi
sar esi, cl
mov ebp, dword [esp + 0x20]
and ebp, esi
or ebp, edx
mov dword [ebx], ebp
movzx ecx, byte [esp + 0x13]
sar eax, cl
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x4e1108
call fcn.0046bac0
jmp fcn.004e1070
Function at 0x4010e0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x90c
mov eax, dword [0x40d204]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x40a1d0
mov dword [esp + 0x914], eax
mov eax, dword [0x40d8a0]
push 0x3ea
push eax
call edi
mov ecx, dword [0x40d8a0]
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x147
push 0x3e9
push ecx
call esi
test eax, eax
jl 0x4011e8
mov edx, dword [0x40d8a0]
push 0
push eax
push 0x150
push 0x3e9
push edx
call esi
test eax, eax
jl 0x4011e8
lea ecx, [esp + 0x140]
push ecx
push eax
call fcn.00403550
add esp, 8
test eax, eax
je 0x4011e8
xor eax, eax
lea ecx, [esp + 0x894]
cmp byte [ecx], 0
jne 0x401194
inc eax
add ecx, 0x20
cmp eax, 4
jl 0x401171
pop edi
pop esi
mov ecx, dword [esp + 0x908]
call fcn.00403e52
add esp, 0x90c
ret
shl eax, 5
mov al, byte [esp + eax + 0x894]
test al, al
je 0x4011e8
push 0
push 0
push 0
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
mov byte [esp + 0x2c], al
push edx
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x35], 0x3a
mov byte [esp + 0x36], 0x5c
mov byte [esp + 0x37], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4011e8
mov edx, dword [0x40d8a0]
lea ecx, [esp + 8]
push ecx
push 0x3ea
push edx
call edi
mov ecx, dword [esp + 0x910]
pop edi
pop esi
call fcn.00403e52
add esp, 0x90c
ret

Function at 0x401200
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x208
mov eax, dword [0x40d204]
push esi
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x210]
push 0
push eax
call fcn.00402d60
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x401255
push 0
lea ecx, [esp + 8]
push ecx
push 0x200
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 4], 0x200
je 0x40126b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x204]
call fcn.00403e52
add esp, 0x208
ret
push 0x1c2
lea eax, [esp + 0x4a]
push 0x40d040
push eax
call fcn.00403e60
add esp, 0xc
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [esp + 8]
push ecx
push 0x200
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 4], 0x200
push esi
jne 0x40124f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x208]
mov eax, 1
pop esi
call fcn.00403e52
add esp, 0x208
ret
Function at 0x401660
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x40d204]
mov ecx, dword [str.IO.SYS]
mov dx, word [0x40a218]
push esi
push 0
push 0
push 3
push 0
mov dword [esp + 0x38], eax
mov al, byte [esp + 0x40]
push 1
mov dword [esp + 0x1f], ecx
mov byte [esp + 0x1c], al
mov al, byte [0x40a21a]
push 0xc0000000
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x25], 0x3a
mov byte [esp + 0x26], 0x5c
mov word [esp + 0x2b], dx
mov byte [esp + 0x2d], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4016cf
xor eax, eax
pop esi
mov ecx, dword [esp + 0x24]
call fcn.00403e52
add esp, 0x28
ret
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0x3aa
push esi
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [esp + 0x14]
push edx
push 1
lea eax, [esp + 0x48]
push eax
push esi
mov byte [esp + 0x50], 0xeb
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
mov ecx, dword [str.COMMAND.COM]
mov edx, dword [0x40a20c]
mov eax, dword [0x40a210]
push 0
push 0
push 3
push 0
push 1
mov dword [esp + 0x2b], ecx
push 0xc0000000
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x37], edx
mov dword [esp + 0x3b], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40175a
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x24]
call fcn.00403e52
add esp, 0x28
ret
push 0
push 0
push 0x6510
push esi
call edi
push 0
lea edx, [esp + 0x14]
push edx
push 1
lea eax, [esp + 0x48]
push eax
push esi
mov byte [esp + 0x50], 0xeb
call ebp
push esi
call ebx
mov ecx, dword [esp + 0x34]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
call fcn.00403e52
add esp, 0x28
ret

Function at 0x4021c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push esi
push ebp
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov esi, eax
test esi, esi
jne 0x4021e4
pop esi
pop ebp
add esp, 8
ret
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
jne 0x4021f9
pop ebx
pop esi
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x1c]
push edi
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402240
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], esi
jne 0x402239
mov dword [esp + 0x10], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
Function at 0x4025d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesDiskEnum
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4025f9
or eax, 0xffffffff
add esp, 0x10
ret
push esi
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push str.Count
push ecx
or esi, 0xffffffff
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40262e
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x402640
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2c
mov eax, dword [0x40d204]
push esi
mov esi, dword [esp + 0x34]
test esi, esi
mov dword [esp + 0x2c], eax
jge 0x402665
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
call fcn.00403e52
add esp, 0x2c
ret
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesDiskEnum
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402655
push 0xa
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.00409006
add esp, 0xc
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 8]
push 0x40daa0
lea eax, [esp + 0x10]
push eax
push 0
lea ecx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x4c], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2c]
xor eax, eax
test esi, esi
setne al
pop esi
dec eax
and eax, 0x40daa0
call fcn.00403e52
add esp, 0x2c
ret

Function at 0x4026f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
test eax, eax
jge 0x402701
xor eax, eax
add esp, 0xc
ret
push esi
push eax
call fcn.00402640
mov esi, eax
add esp, 4
test esi, esi
jne 0x402716
pop esi
add esp, 0xc
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetEnum
push 0x80000002
call edi
test eax, eax
je 0x402741
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 0x18]
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
push esi
push edx
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
call edi
test esi, esi
jne 0x402739
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x40de90
lea edx, [esp + 0x18]
push edx
push esi
push str.FriendlyName
push eax
mov dword [esp + 0x24], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call edi
xor eax, eax
test esi, esi
setne al
pop edi
pop esi
dec eax
and eax, 0x40de90
add esp, 0xc
ret
Function at 0x4027b0
Capabilities:
Get disk information

Disassembly:
push ebx
mov bl, byte [esp + 8]
push esi
movsx esi, bl
push esi
call fcn.0040431d
add esp, 4
test eax, eax
jne 0x4027c9
pop esi
pop ebx
ret
push esi
call fcn.0040434b
add esp, 4
test eax, eax
jne 0x4027d9
or bl, 0x20
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ecx, ecx
mov cl, bl
pop esi
pop ebx
sub ecx, 0x41
shr eax, cl
movzx eax, al
and eax, 1
ret

Function at 0x402940
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
sub esp, 0x268
mov eax, dword [0x40d204]
push ebx
mov bl, byte [esp + 0x270]
push esi
movsx esi, bl
push esi
mov dword [esp + 0x270], eax
call fcn.0040431d
add esp, 4
test eax, eax
je 0x40298e
push esi
call fcn.0040434b
add esp, 4
test eax, eax
jne 0x40297b
or bl, 0x20
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ecx, ecx
mov cl, bl
sub ecx, 0x41
shr eax, cl
test al, 1
jne 0x4029a5
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x264]
call fcn.00403e52
add esp, 0x268
ret
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SYSTEMMountedDevices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40298e
push esi
push str.DosDevices_C:
lea ecx, [esp + 0x1c]
push 0x64
push ecx
call fcn.00402810
add esp, 0x10
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x7c]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x24], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40298e
push 0x10
lea edx, [esp + 0x7c]
push str.__FDC
push edx
call fcn.00409030
mov ecx, dword [esp + 0x278]
add esp, 0xc
neg eax
sbb eax, eax
pop esi
inc eax
pop ebx
call fcn.00403e52
add esp, 0x268
ret

Function at 0x402a50
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7ec
mov eax, dword [0x40d204]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x7f4], eax
mov ecx, 0x1f4
mov esi, ebx
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi*4]
shl eax, 2
mov dl, byte [esp + eax + 0x718]
shl esi, 5
xor ecx, ecx
cmp dl, 0x80
mov dl, byte [esp + eax + 0x71e]
mov eax, dword [esp + eax + 0x728]
sete cl
mov byte [esp + esi + 0x775], dl
mov edx, 0x200
mul edx
mov dword [esp + esi + 0x770], ecx
mov cl, byte [ebp + 0xc]
mov dword [esp + esi + 0x778], eax
movsx eax, cl
push eax
push str._C:_
mov byte [esp + esi + 0x77c], cl
lea ecx, [esp + 0x14]
push 4
push ecx
mov dword [esp + esi + 0x78c], edx
call fcn.00402810
add esp, 0x10
push 0
push 0
push 0
push 0
lea edx, [esp + esi + 0x79c]
push edx
push 0xc
lea edi, [esp + esi + 0x798]
push edi
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x402b14
mov byte [edi], al
mov byte [esp + esi + 0x78b], 0
mov ecx, 0x1f4
lea esi, [esp + 0x20]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x7f4]
call fcn.00403e52
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402b40
Capabilities:
Get disk information

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x40d204]
push esi
push edi
mov edi, dword [esp + 0x1ac]
test edi, edi
mov dword [esp + 0x1a4], eax
jl 0x402ce0
mov esi, dword [esp + 0x1b0]
test esi, esi
jl 0x402ce0
cmp esi, 3
jg 0x402ce0
push ebx
mov bl, byte [esp + 0x1b8]
test bl, bl
jne 0x402bd7
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, eax
shr ecx, 3
mov al, 0x44
test cl, 1
je 0x402bb9
shr ecx, 1
inc al
cmp al, 0x5b
jl 0x402b94
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x19c]
call fcn.00403e52
add esp, 0x1a0
ret
test al, al
mov byte [esp + 0x14], al
jne 0x402c0d
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x19c]
call fcn.00403e52
add esp, 0x1a0
ret
movsx eax, bl
push eax
call fcn.0040431d
add esp, 4
test eax, eax
jne 0x402c07
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x19c]
call fcn.00403e52
add esp, 0x1a0
ret
mov al, bl
mov byte [esp + 0x14], al
push esi
push edi
mov cl, 0x3a
push str.deviceharddisk_dpartition_d
mov byte [esp + 0x19], cl
mov byte [esp + 0x1d], cl
lea ecx, [esp + 0x24]
push 0x64
push ecx
mov byte [esp + 0x20], al
mov byte [esp + 0x22], 0
mov byte [esp + 0x24], al
mov byte [esp + 0x26], 0x5c
mov byte [esp + 0x27], 0
call fcn.00402810
add esp, 0x14
push 0x12c
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x402ba1
mov edi, dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
push 9
call edi
test eax, eax
je 0x402ba1
push 0x12c
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
lea edx, [esp + 0x18]
mov esi, eax
push edx
lea eax, [esp + 0x10]
push eax
push 0xb
call edi
test esi, esi
je 0x402ba1
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
mov ecx, dword [esp + 0x14]
neg eax
sbb al, al
pop ebx
pop edi
pop esi
and eax, ecx
mov ecx, dword [esp + 0x19c]
call fcn.00403e52
add esp, 0x1a0
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x1a4]
pop edi
xor al, al
pop esi
call fcn.00403e52
add esp, 0x1a0
ret
Function at 0x403150
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
sub esp, 0x220
mov eax, dword [0x40d204]
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x224]
test eax, eax
push esi
jl 0x4032d9
mov esi, dword [esp + 0x22c]
test esi, esi
je 0x4032d9
push ebp
push eax
push str..PHYSICALDRIVE_d
lea eax, [esp + 0x18]
push 0x14
push eax
mov dword [esp + 0x18], 0
call fcn.00402810
add esp, 0x10
push 0
push 0xa0000000
push 3
push 0
push 3
push 0xc0000000
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4032c0
push ebx
push edi
push 0x1be
lea edx, [esp + 0x30]
push esi
push edx
call fcn.00403e60
push 2
lea eax, [esi + 0x210]
push eax
lea ecx, [esp + 0x23e]
push ecx
call fcn.00403e60
add esp, 0x18
lea edi, [esp + 0x1eb]
add esi, 0x1c4
mov ebx, 4
mov dl, byte [esi - 4]
mov al, byte [esi]
mov cl, byte [esi - 2]
mov byte [edi - 1], dl
xor edx, edx
mov dx, word [esi - 2]
mov byte [edi], al
mov al, byte [esi + 1]
shr cl, 2
xor cl, al
mov al, byte [esi - 2]
and cl, 0x3f
shr edx, 2
xor cl, dl
mov dl, byte [esi + 6]
mov byte [edi + 1], cl
mov cl, byte [esi + 2]
mov byte [edi + 3], cl
mov byte [edi + 2], al
mov al, byte [esi + 4]
xor ecx, ecx
mov cx, word [esi + 4]
shr al, 2
mov byte [edi + 4], dl
xor al, byte [esi + 7]
mov dl, byte [esi + 4]
and al, 0x3f
shr ecx, 2
xor al, cl
mov byte [edi + 5], al
push 4
lea eax, [esi + 8]
push eax
lea ecx, [edi + 7]
push ecx
mov byte [edi + 6], dl
call fcn.00403e60
push 4
lea edx, [esi + 0xc]
push edx
lea eax, [edi + 0xb]
push eax
call fcn.00403e60
add esp, 0x18
add edi, 0x10
add esi, 0x14
dec ebx
jne 0x403204
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x200
lea edx, [esp + 0x38]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop edi
pop ebx
je 0x4032b9
cmp dword [esp + 0xc], 0x200
jne 0x4032b9
mov dword [esp + 8], 1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop ebp
pop esi
mov ecx, dword [esp + 0x21c]
call fcn.00403e52
add esp, 0x220
ret
mov ecx, dword [esp + 0x220]
xor eax, eax
pop esi
call fcn.00403e52
add esp, 0x220
ret
Function at 0x4032f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40330c
movsx eax, byte [esi]
push eax
call fcn.0040431d
add esp, 4
test eax, eax
jne 0x403313
xor eax, eax
pop esi
add esp, 0xc
ret
push ebp
mov ebp, dword [esp + 0x1c]
test ebp, ebp
push edi
jl 0x4033b6
mov edi, dword [esp + 0x24]
test edi, edi
jl 0x4033b6
push ebx
mov ebx, dword [esp + 0x2c]
test ebx, ebx
jne 0x403340
pop ebx
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 0xc
ret
xor ecx, ecx
mov cl, byte [esi]
push 1
mov dword [esp + 0x24], 0
push ecx
call fcn.00402d60
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x4033aa
mov eax, ebp
mov edx, 0x200
mul edx
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
push esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x14]
push edx
shl edi, 9
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4033a3
cmp dword [esp + 0x10], edi
jne 0x4033a3
mov dword [esp + 0x20], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
pop ebx
pop edi
pop ebp
pop esi
add esp, 0xc
ret
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x4033c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4033dc
movsx eax, byte [esi]
push eax
call fcn.0040431d
add esp, 4
test eax, eax
jne 0x4033e3
xor eax, eax
pop esi
add esp, 0xc
ret
push ebp
mov ebp, dword [esp + 0x1c]
test ebp, ebp
push edi
jl 0x403486
mov edi, dword [esp + 0x24]
test edi, edi
jl 0x403486
push ebx
mov ebx, dword [esp + 0x2c]
test ebx, ebx
jne 0x403410
pop ebx
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 0xc
ret
xor ecx, ecx
mov cl, byte [esi]
push 0
mov dword [esp + 0x24], 0
push ecx
call fcn.00402d60
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x40347a
mov eax, ebp
mov edx, 0x200
mul edx
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
push esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x14]
push edx
shl edi, 9
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403473
cmp dword [esp + 0x10], edi
jne 0x403473
mov dword [esp + 0x20], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
pop ebx
pop edi
pop ebp
pop esi
add esp, 0xc
ret
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 0xc
ret