joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ddc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x1000ddcf
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x100271f8]
test eax, eax
je 0x1000dddd
call fcn.1000dd60
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
cmp edx, 8
push ebx
not eax
jb 0x1000dedf
push edi
mov edi, edx
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x10029e74]
sub edx, 8
xor eax, ebx
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x10029e74]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x10029e74]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x10029e74]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x10029e74]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x10029e74]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x10029e74]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x10029e74]
xor eax, ecx
inc esi
dec edi
jne 0x1000ddf7
pop edi
test edx, edx
je 0x1000df01
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x10029e74]
xor eax, ecx
inc esi
dec edx
jne 0x1000dee3
pop ebx
pop esi
not eax
ret 0xc
Function at 0x10014ae1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10014b01
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100139b5
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x10014b24
test byte [esp + 8], 2
je 0x10014b24
call fcn.10013a28
mov dword [eax], 0xd
call fcn.10013a31
mov dword [eax], 5
jmp 0x10014afd
xor eax, eax
ret

Function at 0x100198f3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10028aa0
cmp edx, dword [eax]
je 0x10019915
add eax, 8
inc ecx
cmp eax, 0x10028b30
jl 0x10019906
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10028aa0]
jne 0x10019a43
mov eax, dword [0x1002a29c]
cmp eax, 1
je 0x10019a1d
test eax, eax
jne 0x10019946
cmp dword [0x1002a2a0], 1
je 0x10019a1d
cmp edx, 0xfc
je 0x10019a43
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001997d
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.10017a10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10017b00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x100199c0
lea eax, [ebp - 0x1a4]
push eax
call fcn.10017b00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1002245c
push edi
call fcn.1001a100
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.10017a10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10017a20
lea eax, [ebp - 0xa0]
push 0x1002243c
push eax
call fcn.10017a20
push dword [esi + 0x10028aa4]
lea eax, [ebp - 0xa0]
push eax
call fcn.10017a20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1001aa2f
add esp, 0x2c
pop edi
jmp 0x10019a43
lea eax, [ebp + 8]
lea esi, [esi + 0x10028aa4]
push 0
push eax
push dword [esi]
call fcn.10017b00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4012a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.004eba30
mov eax, dword [0x53f4a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0x52a074
push eax
lea eax, [ebp - 0x2008]
push eax
call fcn.004ed9ec
add esp, 0xc
test eax, eax
jne 0x401303
push 0x52a07c
lea ecx, [ebp - 0x200c]
push esi
push ecx
call fcn.004ed9ec
add esp, 0xc
test eax, eax
je 0x401315
mov edx, dword [ebp - 0x2008]
push edx
call fcn.004ed6af
add esp, 4
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2008]
push eax
push 0x1000
push 1
lea ecx, [ebp - 0x2004]
push 0x1000
push ecx
call fcn.004ef2d0
add esp, 0x14
test eax, eax
jbe 0x4013ae
jmp 0x401340
lea edx, [ebp - 0x2010]
push edx
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x2004]
push ecx
mov eax, edi
call fcn.004010c0
add esp, 0x14
test eax, eax
je 0x401388
mov edx, dword [ebp - 0x200c]
mov eax, dword [ebp - 0x2010]
push edx
push eax
lea ecx, [ebp - 0x1004]
push 1
push ecx
call fcn.004ed88d
add esp, 0x10
mov edx, dword [ebp - 0x2008]
push edx
push 0x1000
push 1
lea eax, [ebp - 0x2004]
push 0x1000
push eax
call fcn.004ef2d0
add esp, 0x14
test eax, eax
ja 0x401340
mov ecx, dword [ebp - 0x2008]
push ecx
call fcn.004ed6af
mov edx, dword [ebp - 0x200c]
push edx
call fcn.004ed6af
mov ecx, dword [ebp - 4]
add esp, 8
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret

Function at 0x4026c0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.004eba30
mov eax, dword [0x53f4a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push ecx
push eax
lea eax, [ebp - 0x2004]
push str.SELECT_sval_FROM_settingint_WHERE_hkey____s__AND_sect____s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
sub esp, 0xc
mov ecx, esp
xor edx, edx
lea eax, [ebp - 0x2004]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
mov dword [ebp - 0x2008], esp
mov word [ecx + 4], dx
lea edi, [eax + 2]
lea ecx, [ecx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x402720
sub eax, edi
sar eax, 1
push eax
lea eax, [ebp - 0x2004]
push eax
call fcn.00403060
push esi
call fcn.00402410
cmp dword [esi + 0x20], 0
je 0x40278a
cmp dword [esi + 0x3c], 0x10
jb 0x40276c
mov esi, dword [esi + 0x28]
push esi
call fcn.004ebaec
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret 0xc
add esi, 0x28
push esi
call fcn.004ebaec
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402840
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.004eba30
mov eax, dword [0x53f4a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x10]
push ecx
push eax
lea eax, [ebp - 0x2004]
push str.SELECT_vstring_FROM_settingstring_WHERE_hkey____s__AND_sect____s_
xor ebx, ebx
push eax
mov dword [ebp - 0x200c], edx
mov dword [ebp - 0x2008], ebx
call dword [sym.imp.USER32.dll_wsprintfW]
sub esp, 0xc
mov ecx, esp
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
lea eax, [ebp - 0x2004]
mov word [ecx + 4], dx
lea edx, [eax + 2]
mov dword [ebp - 0x2008], esp
mov dword [ebp - 0x2008], edx
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x4028b4
sub eax, dword [ebp - 0x2008]
sar eax, 1
push eax
lea eax, [ebp - 0x2004]
push eax
call fcn.00403060
push edi
call fcn.00402410
cmp dword [edi + 0x20], ebx
je 0x402913
cmp dword [edi + 0x38], ebx
jbe 0x402913
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x200c], esp
push 0xffffffffffffffff
lea eax, [edi + 0x24]
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.004015f0
push esi
call fcn.004be7e0
add esp, 0x20
jmp 0x402958
mov edx, dword [ebp - 0x200c]
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
cmp edx, ebx
je 0x402945
xor ecx, ecx
mov eax, edx
mov word [esi + 4], cx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402932
sub eax, edi
sar eax, 1
push eax
push edx
jmp 0x402951
xor edx, edx
push ebx
mov word [esi + 4], dx
push 0x52a4dc
mov ecx, esi
call fcn.00403060
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4097f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x40981d
push esi
push edi
jmp 0x409800
movzx esi, byte [edx]
movzx esi, byte [esi + 0x526b78]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x409800
pop edi
pop esi
ret
Function at 0x409880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi*8]
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x400
jbe 0x4098a2
mov esi, 0x80
cmp esi, dword [edi]
jne 0x4098af
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x54394c]
test eax, eax
je 0x4098ba
call eax
lea ecx, [esi*8]
push ecx
call fcn.004065a0
mov esi, eax
mov eax, dword [0x543950]
add esp, 4
mov dword [ebp - 4], esi
test eax, eax
je 0x4098da
call eax
test esi, esi
je 0x4098a6
mov edx, dword [edi + 0xc]
push edx
call fcn.00406880
add esp, 4
push esi
mov dword [edi + 0xc], esi
call dword [0x540c64]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [ebp + 0xc], ebx
mov dword [edi], ebx
call fcn.004eb2d0
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x4099bf
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x409953
movzx edi, byte [esi]
movzx edi, byte [edi + 0x526b78]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc esi
test edx, edx
jg 0x409932
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
xor edx, edx
div ebx
mov eax, dword [ebp - 4]
lea eax, [eax + edx*8]
test eax, eax
je 0x40999b
mov esi, dword [eax]
test esi, esi
je 0x409971
mov edx, dword [eax + 4]
jmp 0x409973
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x40999b
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x409993
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x4099b4
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x4099b4
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x4099aa
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x409926
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a080
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 8]
lea eax, [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a0b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40a0b3
mov dword [edi + 0x10], eax
pop edi
mov eax, 0x70a
pop esi
pop ebp
ret
mov edx, dword [ebp + 8]
push 1
push 0
push 0
push edx
call fcn.00507750
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40ae90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x53f4a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x543a40]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x320], edi
test eax, eax
je 0x40aed6
push eax
push 0x52b35c
lea eax, [ebp - 0x110]
push eax
push 0xe6
call fcn.00407f90
add esp, 0x10
jmp 0x40af73
call fcn.00409c00
test eax, eax
je 0x40af18
lea ecx, [ebp - 0x318]
push ecx
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [ebp - 0x318]
call fcn.00409cc0
mov esi, eax
test esi, esi
jne 0x40af53
mov eax, 7
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x218]
push ecx
call fcn.00409d20
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40af02
call fcn.00409cc0
push ebx
mov esi, eax
call fcn.004ea5c2
add esp, 4
test esi, esi
je 0x40af02
push esi
push 0x52b35c
lea edx, [ebp - 0x110]
push edx
push 0xe6
call fcn.00407f90
push esi
call fcn.004ea5c2
add esp, 0x14
mov dl, byte [ebp - 0x110]
lea eax, [ebp - 0x110]
test dl, dl
je 0x40af89
inc eax
cmp byte [eax], 0
jne 0x40af83
lea ecx, [ebp - 0x110]
sub eax, ecx
and eax, 0x3fffffff
mov ecx, str.etilqs_
jmp 0x40afa0
inc ecx
cmp byte [ecx], 0
jne 0x40afa0
sub ecx, str.etilqs_
and ecx, 0x3fffffff
lea eax, [ecx + eax + 0x11]
cmp eax, 0x105
jl 0x40afd3
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x110]
test dl, dl
je 0x40afe6
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x40afe0
lea ecx, [ebp - 0x110]
sub eax, ecx
and eax, 0x3fffffff
jbe 0x40b001
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x40b001
sub eax, 1
jne 0x40aff6
lea edx, [ebp - 0x110]
push edx
push str._setilqs_
push edi
push 0xf4
mov byte [ebp + eax - 0x110], 0
call fcn.00407f90
add esp, 0x10
mov eax, edi
test edi, edi
je 0x40b03d
cmp byte [edi], 0
je 0x40b036
mov edi, edi
inc eax
cmp byte [eax], 0
jne 0x40b030
sub eax, edi
and eax, 0x3fffffff
add edi, eax
cmp dword [0x540c44], 0
mov esi, eax
mov ebx, 0xf
jne 0x40b05b
mov dword [ebp - 0x31c], 0
jmp 0x40b080
push 5
call dword [0x540c80]
add esp, 4
mov dword [ebp - 0x31c], eax
test eax, eax
je 0x40b080
push eax
call dword [0x540c88]
add esp, 4
lea ebx, [ebx]
dec ebx
call fcn.00408110
mov byte [edi], al
inc edi
test ebx, ebx
jne 0x40b080
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x40b0a1
push eax
call dword [0x540c90]
add esp, 4
mov edi, 0xf
jmp 0x40b0b0
mov ecx, dword [ebp - 0x320]
movzx eax, byte [ecx + esi]
xor edx, edx
mov ebx, 0x3e
div ebx
inc esi
sub edi, 1
mov dl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [ecx + esi - 1], dl
jne 0x40b0b0
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
mov byte [eax + esi], 0
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret
Function at 0x40b410
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.00409c00
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x40b436
call fcn.00409c60
mov ebx, eax
jmp 0x40b452
call fcn.00409c60
mov esi, eax
cmp esi, edi
je 0x40b456
push esi
call fcn.00409d90
push esi
mov ebx, eax
call fcn.004ea5c2
add esp, 8
cmp ebx, edi
jne 0x40b462
pop edi
pop esi
mov eax, 7
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00409c00
test eax, eax
je 0x40b4a6
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b490
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp eax, 5
jne 0x40b4e5
mov eax, dword [ebp - 4]
inc eax
cmp eax, 5
mov dword [ebp - 4], eax
jge 0x40b4e5
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b471
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea esp, [esp]
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b4cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp eax, 5
jne 0x40b4e5
mov eax, dword [ebp - 4]
inc eax
cmp eax, 5
mov dword [ebp - 4], eax
jge 0x40b4e5
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b4b0
push ebx
call fcn.004ea5c2
add esp, 4
cmp esi, 0xffffffff
jne 0x40b502
cmp dword [ebp - 8], 2
jne 0x40b502
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xa0a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b760
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x53f4a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x110]
push ecx
push 0x104
push eax
push edx
mov dword [ebp - 0x118], 0x200
call fcn.0040b630
add esp, 0x10
test eax, eax
jne 0x40b8de
call fcn.00409c00
test eax, eax
je 0x40b7bc
lea ebx, [ebp - 0x110]
call fcn.00409c60
mov esi, eax
jmp 0x40b83c
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x110]
push eax
push 0
push 0xfde9
call ebx
mov edi, eax
lea ecx, [edi + edi]
push ecx
call fcn.004eb1f9
mov esi, eax
add esp, 4
test esi, esi
je 0x40b8c8
push edi
push esi
push 0xffffffffffffffff
lea edx, [ebp - 0x110]
push edx
push 0
push 0xfde9
call ebx
push esi
test eax, eax
jne 0x40b827
call fcn.004ea5c2
add esp, 4
mov eax, 0x200
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret
call fcn.00409d90
add esp, 4
push esi
mov edi, eax
call fcn.004ea5c2
add esp, 4
mov esi, edi
test esi, esi
je 0x40b8c8
call fcn.00409c00
test eax, eax
mov eax, esi
je 0x40b886
cmp word [esi], 0
je 0x40b86b
cmp word [eax], 0x5c
je 0x40b866
add eax, 2
cmp word [eax], 0
jne 0x40b855
jmp 0x40b86b
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x114]
push edx
mov eax, edx
push eax
lea ecx, [ebp - 0x118]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x40b8b9
cmp byte [esi], 0
je 0x40b8a0
jmp 0x40b890
cmp byte [eax], 0x5c
je 0x40b89d
inc eax
cmp byte [eax], 0
jne 0x40b890
jmp 0x40b8a0
mov byte [eax], 0
lea eax, [ebp - 0x114]
push eax
mov ecx, eax
push ecx
lea edx, [ebp - 0x118]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.004ea5c2
add esp, 4
test edi, edi
jne 0x40b8de
mov eax, 0x200
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x118]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret
Function at 0x42d200
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x42d21a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov ecx, 0x44
call fcn.00406b00
mov edi, eax
test edi, edi
je 0x42d211
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
push eax
push ecx
push esi
call fcn.0042ce00
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov dword [edi], eax
mov eax, dword [ebx + 8]
push edx
push eax
push esi
call fcn.0042cef0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
push ecx
push eax
push esi
call fcn.0042cb80
mov edx, dword [ebp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
push edx
push eax
push esi
call fcn.0042ce00
mov ecx, dword [ebp + 0x10]
add esp, 0x1c
push 0
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
push ecx
push eax
push esi
call fcn.0042cb80
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
push edx
push eax
push esi
call fcn.0042ce00
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
mov cl, byte [ebx + 4]
add esp, 0x1c
mov byte [edi + 4], cl
mov eax, dword [ebx + 0x1c]
push edx
push eax
push esi
call fcn.0042d200
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x28]
push ecx
push eax
push esi
call fcn.0042cb80
mov edx, dword [ebp + 0x10]
push 0
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
push edx
push eax
push esi
call fcn.0042cb80
mov dword [edi + 0x2c], eax
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov cx, word [ebx + 6]
mov edx, 0xfff7
add esp, 0x20
and cx, dx
mov dword [edi + 0x24], eax
or eax, 0xffffffff
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov word [edi + 6], cx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4345f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, edi
test edi, edi
jne 0x43460e
xor ebx, ebx
mov dword [ebp - 8], ebx
jmp 0x434624
cmp byte [edi], al
je 0x434617
inc ecx
cmp byte [ecx], al
jne 0x434612
sub ecx, edi
and ecx, 0x3fffffff
mov ebx, ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ecx
test ecx, ecx
jle 0x434723
jmp 0x434643
mov edi, dword [ebp + 0xc]
cmp esi, 2
jge 0x43464b
xor esi, 1
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4346ab
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov edx, esi
shl edx, 4
mov edi, dword [edx + eax]
mov dl, byte [ecx]
test dl, dl
je 0x43468d
jmp 0x434670
movzx eax, byte [edi]
movzx edx, dl
mov dl, byte [edx + 0x526b78]
cmp dl, byte [eax + 0x526b78]
jne 0x43468d
mov dl, byte [ecx + 1]
inc ecx
inc edi
test dl, dl
jne 0x434670
movzx ecx, byte [ecx]
movzx edx, byte [edi]
movzx edx, byte [edx + 0x526b78]
movzx ecx, byte [ecx + 0x526b78]
sub ecx, edx
mov eax, dword [ebp - 4]
jne 0x434713
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
shl esi, 4
mov esi, dword [esi + eax + 0xc]
add esi, 4
cmp dword [esi + 0xc], 0
je 0x4346f7
xor eax, eax
mov edx, ebx
mov ecx, edi
test ebx, ebx
jle 0x4346ee
jmp 0x4346d0
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x526b78]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x4346d0
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
xor edx, edx
div dword [esi]
jmp 0x4346f9
xor edx, edx
push ebx
push edi
mov eax, esi
call fcn.004099d0
add esp, 8
test eax, eax
je 0x43472a
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x434723
mov esi, dword [ebp - 0xc]
inc esi
cmp esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], esi
jl 0x434640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x434713