joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100222a3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10046ac0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100222e9
cmp word [ebx], dx
jne 0x100222e9
or byte [eax + edi + 0x28], 4
jmp 0x100222ee
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10022451
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10022431
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1002232f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10022365
cmp eax, edx
jae 0x10022373
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1002230a
jmp 0x10022451
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002242c
cmp dword [ebp - 0x18], 0
je 0x1002242c
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10046ac0]
test byte [eax + edi + 0x28], 0x48
je 0x10022402
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x100223c6
mov word [esi], cx
jmp 0x100223fd
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10046ac0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10046ac0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10046ac0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10022451
pop eax
cmp word [ebp - 4], ax
jne 0x10022412
cmp esi, ebx
jne 0x10022412
mov word [esi], ax
jmp 0x1002244e
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10022cdc
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10022451
push 0xd
pop eax
jmp 0x1002240d
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10046ac0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1002244b
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10022451
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1002713f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100271dc
push ebx
push esi
call fcn.10027108
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10025f45
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10027189
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100271db
push edi
push eax
call fcn.10022d3a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100271a9
call fcn.10020be2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100271da
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10025f45
add esp, 0x20
test eax, eax
jne 0x100271c8
push edi
call fcn.10020be2
jmp 0x100271d0
push ebx
call fcn.10020be2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100297b4
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1001e41b
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10029823
cmp esi, dword [ebp - 4]
je 0x1002981e
cmp dword [ebp + 0xc], 0
je 0x1002981e
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100297fb
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10029306
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10029825
xor eax, eax
inc eax
jmp 0x10029825
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1002988a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10045080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1001e41b
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1001e41b
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10029901
cmp word [ecx], dx
je 0x10029901
mov eax, dword [0x1003658c]
push edi
dec eax
push eax
push 0x10036478
call fcn.10029829
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10029974
cmp word [eax], dx
je 0x10029974
mov eax, dword [edi]
test eax, eax
je 0x10029925
cmp word [eax], dx
je 0x10029925
lea eax, [ebp - 0x10]
push eax
call fcn.1002920c
jmp 0x1002992e
lea eax, [ebp - 0x10]
push eax
call fcn.100292a7
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1002999e
mov eax, dword [0x10036474]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10036168
call fcn.10029829
add esp, 0xc
test al, al
je 0x1002999e
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10029969
cmp word [eax], di
je 0x10029969
lea eax, [ebp - 0x10]
push eax
call fcn.1002920c
pop ecx
jmp 0x100299a0
lea eax, [ebp - 0x10]
push eax
call fcn.100292a7
jmp 0x10029966
mov eax, dword [edi]
test eax, eax
je 0x1002998b
cmp word [eax], dx
je 0x1002998b
lea eax, [ebp - 0x10]
push eax
call fcn.100291c1
pop ecx
jmp 0x1002999e
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10029a69
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100296ae
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10029a69
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10029a69
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10029a69
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100299f6
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10021797
test ebx, ebx
je 0x10029a64
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10021797
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10029a69
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10029a69
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1002d10a
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10029a6b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100126ab
leave
ret
Function at 0x1002d9a1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1002d91d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1002db10
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1002db10
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1002dac5
jg 0x1002d9fd
test eax, eax
je 0x1002dabb
push 1
push 0x1000
call fcn.10021160
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1002da20
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1002dab2
push 0x8000
push ebx
call fcn.1002d84e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1002da49
jg 0x1002da44
cmp ecx, 0x1000
jb 0x1002da49
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100209c6
add esp, 0x10
cmp eax, 0xffffffff
je 0x1002da8e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1002da44
jl 0x1002da75
test ecx, ecx
jne 0x1002da36
push dword [ebp - 0xc]
push ebx
call fcn.1002d84e
push esi
call fcn.10020be2
add esp, 0xc
xor ebx, ebx
jmp 0x1002db1e
cmp byte [edi + 0x24], 0
je 0x1002daa5
cmp dword [edi + 0x20], 5
jne 0x1002daa5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1002dab0
mov ebx, dword [edi + 0x18]
jmp 0x1002dab2
xor ebx, ebx
push esi
call fcn.10020be2
pop ecx
jmp 0x1002db1e
test ecx, ecx
jg 0x1002da87
jl 0x1002dac5
test eax, eax
jae 0x1002da87
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10022cdc
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1002dae5
cmp byte [edi + 0x1c], 0
je 0x1002da87
jmp 0x1002db16
push ebx
call fcn.1002772c
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1002da87
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1002db1e
cmp byte [edi + 0x1c], 0
je 0x1002db1b
mov ebx, dword [edi + 0x18]
jmp 0x1002db1e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10022cdc
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002f0d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002f0fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002f0fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x12de01f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x12da110]
jne 0x12de029
repz ret
jmp fcn.012de2ab

Function at 0x12e1e11
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x12da110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.012de3b1
and dword [ebp - 0x14], 0
cmp dword [0x12dd224], 0
mov dword [ebp - 0x18], eax
jne 0x12e1ec4
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x12e1f6c
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x12e1f6c
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x12dd224], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x12dd228], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x12dd22c], eax
call edi
push eax
call esi
mov dword [0x12dd234], eax
test eax, eax
je 0x12e1ec4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x12dd230], eax
mov eax, dword [0x12dd230]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x12e1f1d
cmp dword [0x12dd234], ecx
je 0x12e1f1d
push eax
call esi
push dword [0x12dd234]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x12e1f1d
test ebx, ebx
je 0x12e1f1d
call edi
test eax, eax
je 0x12e1f14
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x12e1f14
test byte [ebp - 8], 1
jne 0x12e1f1d
or dword [ebp + 0x10], 0x200000
jmp 0x12e1f50
mov eax, dword [0x12dd228]
cmp eax, dword [ebp - 0x18]
je 0x12e1f50
push eax
call esi
test eax, eax
je 0x12e1f50
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x12e1f50
mov eax, dword [0x12dd22c]
cmp eax, dword [ebp - 0x18]
je 0x12e1f50
push eax
call esi
test eax, eax
je 0x12e1f50
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x12dd224]
call esi
test eax, eax
je 0x12e1f6c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x12e1f6e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.012de01f
leave
ret
Function at 0x404271
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 4
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
push 0
push eax
call fcn.00495f40
mov edx, dword [ebp + 8]
add esp, 0xc
cmp byte [edx], 0xff
jne 0x4042de
mov cl, byte [edx + 1]
mov al, cl
and al, 0xe0
cmp al, 0xe0
jne 0x4042de
movzx edx, byte [edx + 2]
movzx esi, cl
mov eax, edx
mov ecx, edx
and eax, 0xc
and ecx, 2
and edx, 0xfffff8f0
shl ecx, 3
or ecx, eax
mov eax, esi
shl ecx, 6
and eax, 6
or ecx, eax
and esi, 0x18
mov eax, dword [ebp - 4]
or ecx, edx
shl ecx, 4
and eax, 0xff8087ff
or ecx, esi
shl ecx, 8
or ecx, eax
jmp 0x4042e1
mov ecx, dword [ebp - 4]
mov edi, ecx
mov esi, ecx
shr edi, 0xb
mov eax, ecx
and edi, 3
shr esi, 0xd
mov ebx, edi
shr eax, 0x10
shl ebx, 2
and esi, 3
and eax, 0xf
lea edx, [ebx + esi]
shl edx, 4
add edx, eax
mov edx, dword [edx*4 + 0x4bf600]
mov dword [ebp + 8], edx
test edx, edx
je 0x40439b
mov eax, ecx
shr eax, 0x14
and eax, 3
add eax, ebx
mov ebx, dword [eax*4 + 0x4bfa00]
test ebx, ebx
je 0x40439b
cmp esi, 1
jne 0x40433f
cmp edi, 3
je 0x404344
imul eax, edx, 0x11940
jmp 0x40434a
cmp esi, 2
jne 0x40435c
imul eax, edx, 0x23280
xor edx, edx
div ebx
mov esi, eax
mov eax, ecx
shr eax, 0x16
and eax, 1
add esi, eax
jmp 0x404375
imul eax, edx, 0x2ee0
xor edx, edx
div ebx
mov esi, eax
mov eax, ecx
shr eax, 0x16
and eax, 1
add esi, eax
shl esi, 2
push 0x48
pop eax
cmp edi, 3
lea edx, [eax + 0x48]
cmove eax, edx
xor edx, edx
imul eax, dword [ebp + 8]
shr ecx, 0x16
and ecx, 1
div ebx
add eax, ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov eax, esi
jmp 0x40439e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4166fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov cl, byte [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], 0x5c7c2a3f
mov dword [ebp - 8], 0x3c223a2f
mov byte [ebp - 4], 0x3e
cmp byte [ebp + eax - 0xc], cl
je 0x416728
inc eax
cmp eax, 9
jl 0x416718
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x4180e9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x18]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0x14]
mov ebx, dword [esi + 0x28]
mov eax, ebx
mov edx, dword [esi + 0x2c]
or eax, edx
jne 0x41812c
mov eax, dword [esi + 8]
push 0
push dword [eax + 0x1b0]
push dword [eax + 0x154]
push dword [eax + 0x150]
call fcn.00493250
mov ebx, eax
mov dword [esi + 0x2c], edx
mov dword [esi + 0x28], ebx
cmp dword [ebp + 0x10], edx
ja 0x4181bd
mov ecx, dword [ebp + 0xc]
jb 0x41813e
cmp ecx, ebx
jae 0x4181bd
mov eax, ecx
add eax, edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
adc eax, dword [ebp + 0x18]
cmp eax, edx
jb 0x41815a
ja 0x418156
cmp dword [ebp - 4], ebx
jbe 0x41815a
mov edi, ebx
sub edi, ecx
push dword [ebp + 0x10]
xor ebx, ebx
push ecx
push ebx
push dword [ebp + 0x1c]
call fcn.00493400
mov dword [esi + 0x30], eax
mov eax, edx
mov dword [ebp + 0x10], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x34], edx
cmp eax, 0xffffffff
je 0x4181bd
test eax, eax
je 0x4181bd
push ebx
lea ecx, [ebp + 0x10]
push ecx
push dword [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp + 0x18]
push eax
mov eax, edi
imul eax, dword [ebp + 0x1c]
push eax
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, eax
xor edx, edx
mov eax, dword [ebp + 0x18]
div dword [ebp + 0x1c]
cmp eax, edi
jne 0x4181bd
test ecx, ecx
je 0x4181bd
mov al, 1
jmp 0x4181bf
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x418c48
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x659300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x114]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x104
push ebx
push eax
call fcn.00495f40
push str.CDeviceControllerHarddiskDmVolumes_
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.0049dc74
push esi
mov esi, 0x104
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0049dcce
push 0x4c0870
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0049dcce
push edi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0049dcce
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00495f40
add esp, 0x48
lea eax, [ebx + 0x41]
mov byte [ebp - 0x219], al
movsx eax, al
push eax
lea eax, [ebp - 0x10]
push 0x4c0874
push eax
call fcn.00418b6f
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00498510
pop ecx
pop ecx
test eax, eax
je 0x418d25
inc ebx
cmp ebx, 0x1a
jl 0x418cd2
xor al, al
jmp 0x418d2b
mov al, byte [ebp - 0x219]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00492f9a
leave
ret

Function at 0x41b278
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
shld esi, ecx, 9
push edi
shl ecx, 9
xor edi, edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], ecx
test esi, esi
jb 0x41b2f8
ja 0x41b29e
test ecx, ecx
je 0x41b2f8
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and dword [ebp + 0x14], 0
mov byte [eax + edi], 0
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
test eax, 0xfffffffc
jle 0x41b2e9
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov byte [ebp + 0xf], 0
mov eax, dword [edx + ecx*4]
mov al, byte [eax + edi]
xor al, byte [ebp + 0xf]
inc ecx
mov byte [esi + edi], al
mov edx, dword [ebx]
mov byte [ebp + 0xf], al
mov eax, dword [ebx + 4]
sub eax, edx
sar eax, 2
cmp ecx, eax
jl 0x41b2c5
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
inc edi
mov eax, edi
cdq
cmp edx, esi
jb 0x41b2a2
ja 0x41b2f7
cmp eax, ecx
jb 0x41b2a2
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x41eaa5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x659300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
lea edi, [ebp - 0x10]
xor esi, esi
stosd dword es:[edi], eax
push esi
push ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call edi
test eax, eax
jne 0x41eb4d
push 0x820
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.00495f40
add esp, 0xc
inc esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41eb60
lea eax, [ebp - 0x830]
push ebx
push eax
call fcn.0049ec37
push esi
push 0x4c0bc0
lea eax, [ebp - 0x10]
push 5
push eax
call fcn.0042087c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.0049ec06
add esp, 0x20
lea eax, [ebp - 0x830]
push 0
push eax
call edi
test eax, eax
je 0x41eaec
lea eax, [ebp - 0x830]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.0049eac9
add esp, 0xc
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00492f9a
leave
ret 8
xor al, al
jmp 0x41eb4f
Function at 0x4203b8
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x659300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0x20c]
push dword [edi + 0x10]
push dword [0x61dba4]
push 0x4c0b64
push 0x104
push eax
call fcn.0042087c
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x420411
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 0x14]
mov ecx, edi
push dword [edi + 0x10]
call fcn.0041f160
mov dword [edi + 8], eax
test esi, esi
je 0x420433
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 8], 0
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop edi
pop esi
call fcn.00492f9a
leave
ret
Function at 0x430a76
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, 0x82564557
cmp dword [esi], eax
jne 0x430b29
cmp dword [esi + 0x84], eax
jne 0x430b29
cmp dword [ebp + 0x14], 0
je 0x430aa9
movzx eax, word [esi + 0x8a]
cmp eax, dword [ebp + 0x1c]
ja 0x430b24
movzx edx, word [esi + 0x8a]
xor ebx, ebx
shl edx, 4
mov ecx, esi
add edx, 0x94
mov dword [ebp + 0xc], ebx
add edx, esi
cmp esi, edx
jae 0x430b29
mov ax, bx
xor ax, word [ecx]
add ecx, 2
cmp ecx, edx
jb 0x430ac9
test ax, ax
je 0x430b29
xor eax, eax
cmp ax, word [esi + 0x8a]
jae 0x430b24
push edi
lea edi, [esi + 0x98]
cmp byte [edi + 8], 0
jbe 0x430b14
cmp dword [ebp + 0x14], 0
jle 0x430b14
push dword [edi]
push dword [ebp + 8]
call fcn.0040be2a
mov ecx, dword [edi - 4]
mov eax, dword [edi]
dec ecx
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0040be2a
add esp, 0x10
movzx eax, word [esi + 0x8a]
inc ebx
add edi, 0x10
cmp ebx, eax
jb 0x430aea
pop edi
xor eax, eax
inc eax
jmp 0x430b2b
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x430eff
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
cmp dword [ebp + 0xc], esi
jbe 0x430f2a
movzx eax, byte [edi + esi]
xor eax, edx
shr edx, 8
movzx ecx, al
xor edx, dword [ecx*4 + 0x4c1338]
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x430f11
pop edi
mov eax, edx
pop esi
pop ebp
ret