joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1174600
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
sub esp, 0x800
test eax, eax
je 0x1174615
mov byte [eax], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
xor bl, bl
call fcn.01165630
test eax, eax
je 0x117467a
test esi, esi
je 0x117467a
cmp word [esi], 0
je 0x117467a
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x1174779
test bl, bl
jne 0x1174734
mov bl, 1
test esi, esi
je 0x117468e
cmp word [esi], 0
je 0x117468e
lea eax, [ebp - 0x800]
cmp eax, esi
je 0x11746bd
push 0x400
mov ecx, eax
push esi
push ecx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x11746bd
test edi, edi
je 0x1174779
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jmp 0x1174642
test edi, edi
je 0x11746b4
push 0x400
lea eax, [ebp - 0x800]
push eax
push 0xffffffffffffffff
xor edx, edx
push edi
push edx
push edx
mov word [ebp - 0x800], dx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
jmp 0x11746bd
xor ecx, ecx
mov word [ebp - 0x800], cx
lea eax, [ebp - 0x800]
xor edx, edx
push eax
mov word [ebp - 2], dx
call fcn.01172920
test al, al
je 0x1174734
test edi, edi
je 0x11746fc
cmp byte [edi], 0
je 0x11746fc
push 0
push 0
push 0x1000000
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x800]
push ecx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
test esi, esi
je 0x1174620
cmp word [esi], 0
je 0x1174620
lea eax, [ebp - 0x800]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1174720
jmp 0x1174620
mov eax, dword [ebp + 0x18]
xor bl, bl
cmp eax, 2
je 0x1174760
cmp eax, 3
jne 0x1174779
push esi
push edi
call fcn.0116c9a0
test al, al
jne 0x1174620
mov dword [ebp + 0x18], 0
jmp 0x1174620
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x1174818
pop edi
pop esi
mov byte [eax], 1
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x117479a
push 1
push esi
push edi
mov ecx, ebx
call fcn.011689b0
test al, al
je 0x117479a
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x24
call fcn.01165630
test eax, eax
je 0x11747b8
test esi, esi
je 0x11747b8
cmp word [esi], 0
je 0x11747b8
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
jmp 0x11747c5
test edi, edi
je 0x11747c5
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test esi, esi
je 0x11747d9
cmp word [esi], 0
je 0x11747d9
push 1
push esi
call fcn.0116cd70
jmp 0x11747ea
test edi, edi
je 0x11747ea
cmp byte [edi], 0
je 0x11747ea
push 1
push edi
call fcn.0116cc50
test ebx, ebx
je 0x1174802
push 1
push esi
push edi
mov ecx, ebx
call fcn.011689b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
test edi, edi
je 0x1174818
push edi
call dword [sym.imp.msvcrt.dll_remove]
add esp, 4
test eax, eax
je 0x117478f
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x1178811
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x117c590
call fcn.01179544
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1184018
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedCompareExchange]
test eax, eax
je 0x11785c8
cmp eax, esi
jne 0x11785bb
xor esi, esi
inc esi
mov ebx, esi
jmp 0x11785cb
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x11785a2
xor esi, esi
inc esi
mov eax, dword [0x1184014]
cmp eax, esi
jne 0x11785de
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x117860d
mov eax, dword [0x1184014]
test eax, eax
jne 0x1178607
mov dword [0x1184014], esi
push 0x1001800
push 0x10017f0
call fcn.01178507
pop ecx
pop ecx
test eax, eax
je 0x117860d
jmp 0x1178735
mov dword [0x1183ce4], esi
mov eax, dword [0x1184014]
cmp eax, esi
jne 0x1178631
push 0x10017ec
push 0x10017d8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1184014], 2
test ebx, ebx
jne 0x117863d
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp dword [0x1184028], 0
je 0x1178661
push 0x1184028
call fcn.011794b9
pop ecx
test eax, eax
je 0x1178661
push 0
push 2
push 0
call dword [0x1184028]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x11786bd
test al, al
je 0x117867b
cmp dword [ebp - 0x1c], 0
jne 0x11786bd
mov al, byte [esi]
test al, al
je 0x117868b
cmp al, 0x20
ja 0x117868b
inc esi
mov dword [ebp - 0x20], esi
jmp 0x117867b
test byte [ebp - 0x3c], 1
je 0x1178697
movzx eax, word [ebp - 0x38]
jmp 0x117869a
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1183ce0], eax
cmp dword [0x1183cd4], 0
jne 0x1178711
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x11786cc
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x11786df
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1178668
cmp dword [0x1183ce4], 0
jne 0x1178720
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1183ce0]
jmp 0x1178741
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01179589
ret
call fcn.01179691
jmp 0x1178568
Function at 0x117abf0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x117ac1f
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.01178e9c
add esp, 0x14
jmp 0x117acfd
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x117acfd
test al, 0x40
jne 0x117acfd
test al, 2
je 0x117ac41
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x117acfd
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x117ac01
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x117aced
cmp eax, 0xffffffff
je 0x117aced
test byte [esi + 0xc], 0x82
jne 0x117acc2
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x117acad
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x117acad
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x117acb2
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x117acc2
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x117ace0
mov eax, dword [esi + 0xc]
test al, 8
je 0x117ace0
test eax, 0x400
jne 0x117ace0
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x117ad00
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401c57
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0xa440c0]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x401ca0
push str.SetDefaultDllDirectories
push 0xa11570
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401ca0
push 0xc00
call eax
test eax, eax
jne 0x401d3c
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x401d3c
cmp eax, 0x104
ja 0x401d3c
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x401cd7
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
mov cl, byte [str.userenv]
push esi
mov esi, str.userenv
test cl, cl
je 0x401d3b
push ebx
push edi
lea edi, [ebp - 0x2d4]
push 0x6c
lea edi, [edi + eax*2]
pop ebx
mov edx, edi
inc esi
movzx eax, cl
mov cl, byte [esi]
inc esi
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x401cf8
push 0x2e
pop eax
push 0x64
mov word [edx], ax
pop eax
mov word [edx + 2], ax
xor eax, eax
push 8
push eax
mov word [edx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov word [edx + 4], bx
mov word [edx + 6], bx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov cl, byte [esi]
test cl, cl
jne 0x401cf5
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00997151
leave
ret
Function at 0x4053f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
xor edx, edx
xor eax, eax
push ebx
push esi
mov esi, dword [ebp + 8]
inc eax
push edi
push 0x20
pop ecx
or dword [esi + 0x90], 0xffffffff
lea ebx, [esi + 0xc8]
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
cmp eax, ecx
mov dword [esi + 0x78], edx
cmova eax, ecx
mov dword [esi + 0x7c], edx
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], edx
mov dword [esi + 0x70], edx
mov dword [esi + 0x88], edx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], edx
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edx
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], edx
mov dword [esi + 0x58], edx
cmp eax, dword [esi + 0x20]
je 0x4054a8
mov edi, ebx
mov dword [ebp - 4], ecx
mov eax, ecx
cmp dword [edi + 8], edx
je 0x405484
push edi
call fcn.004053c5
mov eax, dword [ebp - 4]
xor edx, edx
add edi, 0x28
sub eax, 1
mov dword [ebp - 4], eax
jne 0x405474
cmp dword [esi + 0x5c], 0
je 0x4054a3
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
and dword [esi + 0x5c], 0
mov eax, dword [esi]
mov dword [esi + 0x20], eax
push dword [esi + 0x10]
lea eax, [esi + 0x98]
push eax
call fcn.0040639a
mov ecx, dword [esi + 0x58]
and dword [esi + 0x24], 0
and dword [esi + 0x28], 0
lea eax, [ecx + 5]
imul edx, eax, 0x28
lea eax, [ecx + 1]
mov dword [esi + 0x58], eax
add edx, esi
push edx
mov dword [ebp - 4], edx
call fcn.0040539f
mov edi, eax
test edi, edi
jne 0x405529
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
call fcn.0040652c
mov edi, eax
test edi, edi
jne 0x405529
mov eax, dword [ebp - 4]
add eax, 0x1c
push eax
call fcn.0040652c
mov edi, eax
test edi, edi
jne 0x405529
push dword [ebp - 4]
call fcn.00406311
mov edi, eax
test edi, edi
je 0x405529
and dword [esi + 0x44], 0
push 0x20
pop esi
push ebx
call fcn.00405321
add ebx, 0x28
sub esi, 1
jne 0x405518
mov esi, dword [ebp + 8]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
test eax, eax
je 0x40553d
mov dword [esi + 0x40], eax
xor edx, edx
cmp dword [esi + 0x38], edx
jne 0x405551
cmp dword [esi + 0x40], edx
jne 0x405551
cmp dword [esi + 0x3c], edx
jne 0x405551
mov dword [esi + 0x44], edx
xor ecx, ecx
cmp dword [esi + 0x44], edx
pop edi
pop esi
cmovne eax, ecx
pop ebx
leave
ret 4

Function at 0x406639
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.009ef88b
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x406665
call fcn.0040654b
mov esi, eax
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x408108
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0xa0e20b
call fcn.009973fa
cmp byte [0xa45f54], 0
mov edi, dword [ebp + 8]
jne 0x408155
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.004076e2
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.009973c4
pop ecx
test esi, esi
jne 0x408163
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x408167
xor al, al
jmp 0x40819c
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x408144
mov al, 1
jmp 0x40819c
lea ecx, [ebp - 0x50]
call fcn.0040898f
lea ecx, [ebp - 0x28]
call fcn.00406b2f
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.00408b57
test al, al
je 0x408191
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.009973c4
pop ecx
mov al, bl
call fcn.009973d7
ret 4

Function at 0x4081a4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0xa45f54], 0
jne 0x4081e2
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004076e2
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.009973c4
pop ecx
test esi, esi
pop esi
jne 0x4081de
xor al, al
jmp 0x4081f2
mov al, 1
jmp 0x4081f2
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
leave
ret 4

Function at 0x408368
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00409168
cmp eax, 0xffffffff
je 0x408395
mov ecx, eax
and cl, 0x11
cmp cl, 1
jne 0x408395
and eax, 0xfffffffe
push eax
push esi
call fcn.004088fe
test al, al
je 0x4083bf
cmp byte [0xa45f54], 0
push esi
jne 0x4083c7
lea eax, [ebp - 0xc]
push eax
call fcn.004076e2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.009973c4
pop ecx
test esi, esi
jne 0x4083c3
xor al, al
jmp 0x4083d2
mov al, 1
jmp 0x4083d2
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop esi
leave
ret 4

Function at 0x408646
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0xa45f54], 0
jne 0x408682
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004076e2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.009973c4
pop ecx
test esi, esi
pop esi
jne 0x40867e
xor al, al
jmp 0x408690
mov al, 1
jmp 0x408690
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
leave
ret 4
Function at 0x408858
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0xa45f54], 0
jne 0x40888c
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004076e2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.009973c4
pop ecx
test esi, esi
pop esi
jmp 0x408897
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne al
leave
ret 4

Function at 0x4088fe
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0xa45f54], 0
jne 0x40893d
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004076e2
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.009973c4
pop ecx
test esi, esi
pop esi
jne 0x408939
xor al, al
jmp 0x40894e
mov al, 1
jmp 0x40894e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
leave
ret 8

Function at 0x409168
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0xa45f54], 0
jne 0x40919c
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004076e2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.009973c4
pop ecx
mov eax, esi
pop esi
jmp 0x4091af
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
leave
ret 4

Function at 0x4093a5
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4093cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4093cf
xor al, al
jmp 0x4093e3
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x41652b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa0f04a
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0xa440c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0xa8]
call fcn.004165dd
lea ecx, [esi + 0x78]
call fcn.004165dd
push dword [esi + 0x30]
call fcn.009973c4
push dword [esi + 0x24]
call fcn.009973c4
push dword [esi + 0x18]
call fcn.009973c4
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41658f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x4165a3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 4]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x4165b7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4165ca
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x419716
Capabilities:
Hide graphical window

Disassembly:
push 0x10
mov eax, 0xa0e073
call fcn.009973fa
mov esi, ecx
push 0
push dword [ebp + 0xc]
lea ecx, [esi + 0x68]
push dword [ebp + 8]
call fcn.0041928c
push 0xce4
lea eax, [ebp - 0x1c]
push eax
call fcn.0040a06a
push dword [ebp - 0x1c]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.0040a381
push dword [ebp - 0x1c]
call fcn.009973c4
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.009973d7
ret 8
Function at 0x41cb8e
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0xa0f8e4
call fcn.009973fa
mov edi, ecx
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.0041cbfb
xor ecx, ecx
add esp, 0xc
mov ebx, dword [eax]
mov dword [eax], ecx
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], ecx
je 0x41cbcd
push 8
push dword [ebp + 0xc]
call fcn.009973ad
pop ecx
pop ecx
xor ecx, ecx
lea esi, [edi + 4]
push esi
push ecx
push ebx
push 0x41cb39
push ecx
push ecx
call fcn.009ef88b
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x41cbf0
call fcn.009973d7
ret 8
and dword [esi], 0
push 6
call fcn.00998af4
int3
Function at 0x43a487
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0xa0f8e4
call fcn.009973fa
mov edi, ecx
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.0041cbfb
xor ecx, ecx
add esp, 0xc
mov ebx, dword [eax]
mov dword [eax], ecx
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], ecx
je 0x43a4c6
push 8
push dword [ebp + 0xc]
call fcn.009973ad
pop ecx
pop ecx
xor ecx, ecx
lea esi, [edi + 4]
push esi
push ecx
push ebx
push 0x43a431
push ecx
push ecx
call fcn.009ef88b
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x43a4e9
call fcn.009973d7
ret 8
and dword [esi], 0
push 6
call fcn.00998af4
int3
Function at 0x49570d
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0xa440c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
or esi, 0xffffffff
xor ecx, ecx
push ecx
push ecx
push 3
push ecx
push 3
push ecx
push eax
call dword [ebx + 0x18]
mov edi, eax
cmp edi, esi
je 0x495761
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push ecx
push ecx
push 0x2d1080
push edi
call dword [ebx + 8]
test eax, eax
push edi
cmovne esi, dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00997151
leave
ret 4

Function at 0x95554a
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x9780d2
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
push eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], eax
add ecx, 0x14
push 0xa13a92
call fcn.0043a279
ret
Function at 0x99452b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, ecx
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [eax]
push edi
mov dword [ebp - 4], edx
xor edi, edi
test eax, eax
jle 0x994564
mov ebx, dword [ebp + 0xc]
add ebx, edx
mov edx, dword [ebp - 8]
mov ecx, dword [esi]
mov al, byte [ebx]
lea ebx, [ebx + 4]
xor byte [ecx + edi], al
inc edi
mov eax, dword [edx]
cmp edi, eax
jl 0x994550
mov edx, dword [ebp - 4]
inc edx
add esi, 4
mov dword [ebp - 4], edx
cmp edx, 4
jl 0x994542
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x994a39
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov bl, 1
dec esi
test esi, esi
jle 0x994a62
mov dl, bl
add dl, dl
mov al, dl
xor al, 0x1b
test bl, bl
movzx ecx, al
movzx eax, dl
cmovns ecx, eax
mov bl, cl
sub esi, 1
jne 0x994a48
mov eax, dword [ebp + 8]
xor ecx, ecx
pop esi
mov byte [eax], bl
mov word [eax + 2], cx
mov byte [eax + 1], cl
pop ebx
pop ebp
ret 8

Function at 0x996ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x996f09
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
sub esi, ecx
sub edi, ecx
mov al, byte [esi + ecx]
xor al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
sub edx, 1
jne 0x996ef9
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x996f0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
sub edx, ecx
push edi
push 4
sub esi, ecx
pop edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
sub edi, 1
jne 0x996f22
pop edi
pop esi
pop ebp
ret 0xc