joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495317
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
lea eax, [esp + 0x10]
push ebx
push esi
push eax
push dword [esp + 0x78]
xor esi, esi
mov ebx, esi
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x4954ae
push dword [esp + 0x28]
call fcn.00412877
test eax, eax
je 0x495357
push dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x4954ae
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x49549b
push ebp
mov ebp, dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [esp + 0x34]
push eax
push 0x18
push dword [esp + 0x38]
call ebp
cmp eax, 0x18
jne 0x495493
push 0x2c
lea eax, [esp + 0x50]
push esi
push eax
call fcn.004016e0
mov eax, dword [esp + 0x44]
add esp, 0xc
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x54], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x50], 0x28
mov word [esp + 0x5c], ax
pop eax
push esi
push esi
mov word [esp + 0x62], ax
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x5c]
mov dword [esp + 0x6c], esi
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x495493
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push edi
call esi
push 2
xor eax, eax
push eax
push eax
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x90]
push eax
push eax
push edi
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [esp + 0x2c]
push edi
call esi
lea eax, [esp + 0x34]
push eax
push 0x18
push dword [esp + 0x38]
call ebp
cmp eax, 0x18
jne 0x495493
mov ebp, dword [esp + 0x38]
xor esi, esi
mov edx, dword [esp + 0x3c]
mov eax, ebp
shl eax, 2
mov dword [esp + 0x10], eax
test edx, edx
jle 0x495493
mov eax, dword [sym.imp.GDI32.dll_GetPixel]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov ecx, edx
sub ecx, esi
add eax, 3
dec ecx
xor ebx, ebx
imul ecx, dword [esp + 0x10]
add eax, ecx
mov dword [esp + 0x7c], eax
test ebp, ebp
jle 0x49548a
push esi
push ebx
push edi
call dword [esp + 0x24]
mov ecx, dword [esp + 0x7c]
test eax, eax
setne al
dec al
mov byte [ecx], al
add ecx, 4
mov ebp, dword [esp + 0x38]
inc ebx
mov dword [esp + 0x7c], ecx
cmp ebx, ebp
jl 0x495462
mov edx, dword [esp + 0x3c]
inc esi
cmp esi, edx
jl 0x495445
mov ebx, dword [esp + 0x1c]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop ebp
push dword [esp + 0x28]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [esp + 0x2c]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x68
ret 4
Function at 0x49f0f4
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x638048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0044f53c
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0044f53c
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x49f16b
cmp word [ecx], dx
je 0x49f16b
mov eax, dword [0x508d9c]
push edi
dec eax
push eax
push 0x508c88
call fcn.0049f2e4
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x49f1de
cmp word [eax], dx
je 0x49f1de
mov eax, dword [edi]
test eax, eax
je 0x49f18f
cmp word [eax], dx
je 0x49f18f
lea eax, [ebp - 0x10]
push eax
call fcn.0049f345
jmp 0x49f198
lea eax, [ebp - 0x10]
push eax
call fcn.0049f633
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x49f208
mov eax, dword [0x508c84]
push dword [ebp - 0x14]
dec eax
push eax
push 0x508978
call fcn.0049f2e4
add esp, 0xc
test al, al
je 0x49f208
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x49f1d3
cmp word [eax], di
je 0x49f1d3
lea eax, [ebp - 0x10]
push eax
call fcn.0049f345
pop ecx
jmp 0x49f20a
lea eax, [ebp - 0x10]
push eax
call fcn.0049f633
jmp 0x49f1d0
mov eax, dword [edi]
test eax, eax
je 0x49f1f5
cmp word [eax], dx
je 0x49f1f5
lea eax, [ebp - 0x10]
push eax
call fcn.0049f767
pop ecx
jmp 0x49f208
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x49f2d3
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0049f859
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x49f2d3
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x49f2d3
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x49f2d3
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x49f260
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0044ffcf
test ebx, ebx
je 0x49f2ce
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0044ffcf
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x49f2d3
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x49f2d3
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00449cd5
add esp, 0x10
xor eax, eax
inc eax
jmp 0x49f2d5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d4e4
leave
ret
Function at 0x49f95f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0044f53c
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x49f9ce
cmp esi, dword [ebp - 4]
je 0x49f9c9
cmp dword [ebp + 0xc], 0
je 0x49f9c9
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x49f9a6
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0049fa28
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x49f9d0
xor eax, eax
inc eax
jmp 0x49f9d0
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x49fa60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49fa8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49fa8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4be030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov ebx, dword [eax + 0xa4]
push edi
mov dword [esp + 0x24], ebx
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x20], eax
push dword [eax + 0x10]
call fcn.00463880
mov ecx, edx
mov dword [esp + 0x1c], eax
add esp, 4
mov dword [esp + 0x14], ecx
test ecx, ecx
jg 0x4be074
jl 0x4be06c
cmp eax, 0x40
jae 0x4be074
mov ebp, eax
mov dword [esp + 0x10], eax
jmp 0x4be07d
mov ebp, 0x40
mov dword [esp + 0x10], ebp
mov eax, dword [ebx + 0x154]
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x4be095
cmp ecx, ebp
jb 0x4be095
mov edi, dword [esp + 0x30]
jmp 0x4be0d2
cmp eax, ebp
jge 0x4be0cc
mov esi, 0x40
sub esi, eax
cmp esi, ecx
cmova esi, ecx
add eax, 0x114
push esi
push dword [esp + 0x34]
add eax, ebx
push eax
call fcn.004174c0
add dword [ebx + 0x154], esi
add esp, 0xc
cmp dword [ebx + 0x154], ebp
jl 0x4be228
lea edi, [ebx + 0x114]
and dword [ebx + 0x110], 0xfffffffe
mov eax, dword [edi]
cmp eax, dword [0x509ef0]
jne 0x4be228
mov eax, dword [edi + 4]
cmp eax, dword [0x509ef4]
jne 0x4be228
movzx ebx, byte [edi + 0xb]
movzx eax, byte [edi + 0xa]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 9]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 8]
shl ebx, 8
or ebx, eax
cmp ebx, 0x18
jb 0x4be228
cmp byte [edi + 0xc], 4
jne 0x4be228
mov cl, byte [edi + 0xd]
mov byte [esp + 0x2c], cl
lea eax, [ecx - 7]
cmp al, 0x17
ja 0x4be228
xor eax, eax
movzx esi, cl
xor edx, edx
mov ecx, esi
bts eax, ecx
cmp ecx, 0x20
cmovae edx, eax
xor eax, edx
cmp ecx, 0x40
cmovae edx, eax
add eax, ebx
adc edx, 0
sub eax, 1
sbb edx, 0
call fcn.0044e4b0
cmp dword [esp + 0x14], 0
mov dword [esp + 0x1c], eax
lea ebp, [eax*4 + 0x14]
jl 0x4be228
jg 0x4be186
cmp dword [esp + 0x18], ebp
jb 0x4be228
mov ecx, dword [esp + 0x10]
lea esi, [edi + 0x10]
add ecx, edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
test edi, edi
je 0x4be20b
nop dword [eax + eax]
lea eax, [esi + 8]
cmp eax, ecx
ja 0x4be20b
movzx edx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi]
shl edx, 8
or edx, eax
cmp edx, ebp
jne 0x4be228
movzx eax, byte [esi + 7]
add esi, 4
shl eax, 8
movzx ecx, byte [esi + 2]
or eax, ecx
movzx ecx, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi]
shl eax, 8
or eax, ecx
cmp eax, edx
jb 0x4be228
xor ecx, ecx
cmp ecx, dword [esp + 0x14]
jg 0x4be228
jl 0x4be1fe
cmp eax, dword [esp + 0x18]
ja 0x4be228
mov ecx, dword [esp + 0x10]
sub eax, edx
add ebp, eax
sub edi, 1
jne 0x4be1a0
mov eax, dword [esp + 0x20]
mov cl, byte [esp + 0x2c]
mov dword [eax + 0x78], ebx
mov byte [eax + 0x74], 4
mov byte [eax + 0x75], cl
mov eax, dword [esp + 0x24]
and dword [eax + 0x110], 0xfffffffd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4ce909
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ce914
Function at 0x4e11d5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4e1272
push ebx
push esi
call fcn.004e12c3
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0049c1e6
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4e121f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4e1271
push edi
push eax
call fcn.0044edd7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4e123f
call fcn.0044ed9d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4e1270
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0049c1e6
add esp, 0x20
test eax, eax
jne 0x4e125e
push edi
call fcn.0044ed9d
jmp 0x4e1266
push ebx
call fcn.0044ed9d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4e1275
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4e1286
pop esi
ret
push ebx
push edi
push esi
call fcn.004e12c3
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0044edd7
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4e12ae
push ebx
push esi
push edi
call fcn.004174c0
add esp, 0xc
push 0
call fcn.0044ed9d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4e1305
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e1570

Function at 0x4e4110
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x6b4fac], 0
push esi
push edi
jne 0x4e41cc
mov byte [0x6b4fac], 1
xor esi, esi
mov ecx, esi
mov eax, esi
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [esi*4 + 0x6b4fc0], eax
inc esi
cmp esi, 0x100
jb 0x4e4128
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
not eax
test edi, edi
je 0x4e41fa
mov esi, dword [esp + 0xc]
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x6b4fc0]
sub edi, 1
jne 0x4e41e0
pop edi
not eax
pop esi
ret
Function at 0x4e4200
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x6b4fac], 0
jne 0x4e42bc
push esi
mov byte [0x6b4fac], 1
xor esi, esi
mov ecx, esi
mov eax, esi
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [esi*4 + 0x6b4fc0], eax
inc esi
cmp esi, 0x100
jb 0x4e4217
pop esi
ret

Function at 0x4e42c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x6b5bc0], 0
push ebx
push esi
push edi
jne 0x4e43d7
mov byte [0x6b5bc0], 1
xor esi, esi
nop dword [eax]
xor eax, eax
mov edx, esi
shrd edx, eax, 1
mov ecx, esi
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4e42ff
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x4e431a
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov edx, ecx
and ecx, 1
shrd edx, eax, 1
shr eax, 1
or ecx, 0
je 0x4e4335
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x4e4350
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov edx, ecx
and ecx, 1
shrd edx, eax, 1
shr eax, 1
or ecx, 0
je 0x4e436b
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x4e4386
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov edx, ecx
and ecx, 1
shrd edx, eax, 1
shr eax, 1
or ecx, 0
je 0x4e43a1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x4e43bc
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov dword [esi*8 + 0x6b53c0], ecx
mov dword [esi*8 + 0x6b53c4], eax
inc esi
cmp esi, 0x100
jb 0x4e42e0
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
not ebx
mov edi, dword [esp + 0x14]
not edx
test edi, edi
je 0x4e4415
mov esi, dword [esp + 0x10]
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
shrd ebx, edx, 8
xor ecx, eax
shr edx, 8
xor ebx, dword [ecx*8 + 0x6b53c0]
xor edx, dword [ecx*8 + 0x6b53c4]
sub edi, 1
jne 0x4e43f0
pop edi
not ebx
not edx
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x4e75c0
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004e7757
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4e772f
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4e772f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4e76e4
jg 0x4e761c
test eax, eax
je 0x4e76da
push 1
push 0x1000
call fcn.0044ed40
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4e763f
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4e76d1
push 0x8000
push ebx
call fcn.004c8faf
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4e7668
jg 0x4e7663
cmp ecx, 0x1000
jb 0x4e7668
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004cfd70
add esp, 0x10
cmp eax, 0xffffffff
je 0x4e76ad
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4e7663
jl 0x4e7694
test ecx, ecx
jne 0x4e7655
push dword [ebp - 0xc]
push ebx
call fcn.004c8faf
push esi
call fcn.0044ed9d
add esp, 0xc
xor ebx, ebx
jmp 0x4e773d
cmp byte [edi + 0x24], 0
je 0x4e76c4
cmp dword [edi + 0x20], 5
jne 0x4e76c4
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4e76cf
mov ebx, dword [edi + 0x18]
jmp 0x4e76d1
xor ebx, ebx
push esi
call fcn.0044ed9d
pop ecx
jmp 0x4e773d
test ecx, ecx
jg 0x4e76a6
jl 0x4e76e4
test eax, eax
jae 0x4e76a6
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00480f33
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4e7704
cmp byte [edi + 0x1c], 0
je 0x4e76a6
jmp 0x4e7735
push ebx
call fcn.004a2656
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4e76a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4e773d
cmp byte [edi + 0x1c], 0
je 0x4e773a
mov ebx, dword [edi + 0x18]
jmp 0x4e773d
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00480f33
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e9ac0
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0xf0000000
push dword [esp + 0x14]
lea edi, [esi + 4]
mov dword [esi], 0
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4e9b09
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4e9b2a
push 8
push dword [esp + 0x14]
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4e9b2a
lea eax, [esi + 8]
push eax
push 0
push 0
push dword [esp + 0x20]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4e9b32
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, 0xffffffe7
pop esi
ret
pop edi
mov dword [esi], 1
xor eax, eax
pop esi
ret

Function at 0x4e9d83
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x638048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x4e9dc6
call fcn.0045c197
mov dword [eax], 0xf
call fcn.0045c184
mov dword [eax], 0xd
call fcn.0044ead7
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d4e4
leave
ret
test eax, eax
jne 0x4e9dcd
inc eax
jmp 0x4e9dba
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x4e9db8
xor eax, eax
cmp ecx, 1
setne al
jmp 0x4e9dba
Function at 0x4ebf60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
xor esi, esi
mov edi, dword [ebx + 0x4804]
mov dword [ebx + eax*4 + 0x4808], edi
movzx ecx, word [ebx]
mov eax, ecx
mov dword [esp + 0xc], edi
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x511490]
movzx edx, byte [ecx + 0x511490]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x10], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x511490]
add eax, edx
mov dword [esp + 0x14], eax
movzx eax, byte [ecx + 0x511490]
mov ecx, dword [esp + 0x28]
add eax, edx
mov dword [esp + 0x1c], eax
imul eax, ecx, 0x440
add eax, 0x404
add eax, ebx
mov dword [esp + 0x24], eax
test edi, edi
je 0x4ec10c
lea eax, [ecx*8]
push ebp
mov dword [esp + 0x1c], eax
mov ebp, eax
nop dword [eax + eax]
cmp esi, 8
jae 0x4ec05d
xor edi, edi
lea edx, [esi + 8]
lea ebp, [ecx*8]
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 4]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x511490]
add edi, eax
cmp edx, 1
jne 0x4ec011
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add eax, edi
mov edi, dword [esp + 0x10]
mov dword [ecx + esi*4], eax
inc esi
mov ecx, dword [esp + 0x2c]
cmp esi, edi
jb 0x4ec000
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
cmp esi, edi
jae 0x4ec10b
cmp esi, 0x10
jae 0x4ec0bd
xor edi, edi
mov edx, esi
nop
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 0x104]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x511490]
add edi, eax
cmp edx, 1
jne 0x4ec070
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [esp + 0x10]
jb 0x4ec065
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov ebp, dword [esp + 0x28]
xor edi, edi
lea eax, [esi + 0xf0]
nop dword [eax]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x204]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x511490]
add edi, ecx
cmp eax, 1
jne 0x4ec0d0
mov eax, dword [esp + 0x20]
add eax, edi
mov dword [ebp + esi*4], eax
inc esi
cmp esi, dword [esp + 0x10]
jb 0x4ec0c1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret