joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10072e92
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1014880f
call fcn.1014399c
sub esp, 0x50
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov esi, edx
mov dword [ebp - 0x20], edi
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [ebp - 4], eax
mov ecx, eax
mov dword [ebp - 0x1c], 1
mov ebx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], 0xde137300
mov dword [ebp - 0x3c], 0xd8458609
mov dword [ebp - 0x38], 0xbf90085b
mov dword [ebp - 0x34], 0xc15afa8e
mov dword [ebp - 0x30], 0x33cda8a3
mov word [ebp - 0x2c], 0x131
mov byte [ebp - 0x2a], 0x65
cmp ecx, 2
jne 0x10072f00
push 0x13
pop ebx
push ebx
pop ecx
jmp 0x10072f2a
movzx eax, byte [ebp + ecx - 0x3f]
lea edx, [ebx - 1]
sub eax, ecx
add edx, eax
jns 0x10072f20
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x40]
mov word [ebp + eax*2 - 0x28], dx
add ecx, 2
cmp ecx, 0x17
jb 0x10072ef4
xor eax, eax
lea ecx, [ebp - 0x58]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x28]
push eax
call fcn.100140d4
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x58]
xor ebx, ebx
cmp dword [ebp - 0x44], 8
mov dword [ebp - 0x28], ebx
cmovae ecx, dword [ebp - 0x58]
cmp dword [esi + 0x14], 8
mov word [ebp - 0x24], bx
jb 0x10072f69
mov eax, dword [esi]
jmp 0x10072f6b
mov eax, esi
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10125905
mov ecx, eax
add esp, 0xc
cmp ecx, 0xd
jne 0x10072fa8
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
cmp dword [esi + 0x14], 8
jb 0x10072f93
mov esi, dword [esi]
push eax
push esi
call fcn.101258f0
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], eax
test eax, eax
sete cl
jmp 0x10072fab
mov eax, dword [ebp - 0x18]
test ecx, ecx
jne 0x1007301f
test eax, eax
je 0x1007301f
push 2
push ebx
push eax
call fcn.10126d1e
push dword [ebp - 0x18]
call fcn.10126c23
push ebx
push ebx
push dword [ebp - 0x18]
mov esi, eax
call fcn.10126d1e
add esp, 0x1c
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x11]
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
push eax
lea eax, [esi + 1]
push eax
call fcn.10039b7f
mov byte [ebp - 4], 2
push dword [ebp - 0x18]
push esi
push 1
push dword [ebp - 0x38]
call fcn.1012658d
push dword [ebp - 0x18]
call fcn.10126e0d
add esp, 0x14
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.1004b298
lea ecx, [ebp - 0x38]
call fcn.1001496d
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.10014706
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10084f3a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dl, dl
je 0x10084f45
mov dword [ecx], 0xa
ret
xor cl, cl
jmp fcn.1008903f

Function at 0x10085125
Capabilities:
Create thread

Disassembly:
test cl, cl
je 0x10085130
mov dword [edx], 0x12
ret
xor eax, eax
push eax
push 0x2043
push eax
push eax
push 0x1014
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1008cded
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1008cddc
Function at 0x100ac299
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
mov bl, 1
push edi
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100ac437
mov edx, 0x10000000
cmp eax, 0x7c
je 0x100ac437
cmp eax, 0x29
jne 0x100ac2d4
cmp dword [esi + 0x10], 0
jne 0x100ac437
test dword [esi + 0x50], edx
je 0x100ac43d
cmp eax, 0x2e
jne 0x100ac2ef
push 5
lea ecx, [esi + 0x24]
call fcn.100ac522
mov ecx, esi
call fcn.100ac270
jmp 0x100ac41f
cmp eax, 0x5c
jne 0x100ac34a
mov ecx, esi
call fcn.100ac270
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x100ac321
cmp byte [esi + 0x48], 0x62
jne 0x100ac321
push 4
lea ecx, [esi + 0x24]
call fcn.100ac522
mov ecx, esi
call fcn.100ac270
jmp 0x100ac426
test eax, eax
je 0x100ac33e
cmp byte [esi + 0x48], 0x42
jne 0x100ac33e
push 4
lea ecx, [esi + 0x24]
call fcn.100ac522
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100ac315
mov ecx, esi
call fcn.100acfa1
jmp 0x100ac41f
cmp eax, 0x5b
jne 0x100ac3aa
mov ecx, esi
call fcn.100ac270
lea ecx, [esi + 0x24]
call fcn.100ad6c3
cmp dword [esi + 0x4c], 0x5e
jne 0x100ac372
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.100ac270
test dword [esi + 0x50], 0x20000000
je 0x100ac392
cmp dword [esi + 0x4c], 0x5d
jne 0x100ac392
push 0x5d
lea ecx, [esi + 0x24]
call fcn.100ad70d
mov ecx, esi
call fcn.100ac270
mov ecx, esi
call fcn.100ad49d
cmp dword [esi + 0x4c], 0x5d
je 0x100ac2e3
push 4
jmp 0x100ac43f
cmp eax, 0x28
jne 0x100ac3c7
mov ecx, esi
call fcn.100ac270
mov ecx, esi
call fcn.100ad07d
cmp dword [esi + 0x4c], 0x29
mov bl, al
je 0x100ac414
jmp 0x100ac43d
cmp eax, 0x5e
jne 0x100ac3d3
push 2
jmp 0x100ac30d
cmp eax, 0x24
jne 0x100ac3df
push 3
jmp 0x100ac30d
cmp eax, 0x2a
je 0x100ac433
cmp eax, 0x2b
je 0x100ac433
cmp eax, 0x3f
je 0x100ac433
cmp eax, 0x7b
je 0x100ac433
cmp eax, 0x7d
jne 0x100ac3fd
test dword [esi + 0x50], edx
je 0x100ac42f
cmp eax, 0x5d
jne 0x100ac407
test dword [esi + 0x50], edx
je 0x100ac3a3
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.100ad1f1
mov ecx, esi
call fcn.100ac270
test bl, bl
je 0x100ac426
mov ecx, esi
call fcn.100ad12d
mov cl, 1
mov bl, cl
jmp 0x100ac2a2
push 6
jmp 0x100ac43f
push 0xa
jmp 0x100ac43f
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.1010e0f8
int3
Function at 0x100d5585
Capabilities:
Allocate thread local storage
Connect pipe
Contain obfuscated stackstrings
Create pipe
Delete file
Delete registry key
Get common file path
Get graphical window text
Get keyboard layout
Get memory capacity
Get session user name
Get thread local storage value
Log keystrokes via polling
Query environment variable
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
mov eax, ecx
push ebx
push esi
push edi
je 0x100d55bd
call fcn.100d52ea
test al, al
jne 0x100d55fe
mov ecx, 0x2121
call fcn.10015a01
cmp eax, 2
jne 0x100d55b4
call fcn.100703da
test al, al
je 0x100d55fe
pop edi
pop esi
pop ebx
pop ebp
jmp section..eOA
mov edi, dword [edx]
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x100d55f5
mov edx, dword [eax]
xor eax, eax
mov esi, dword [edi + 4]
cmp ecx, dword [edx + 8]
sete al
xor ebx, ebx
cmp eax, 0xfffffffb
setg bl
imul ebx, ecx
xor ecx, ecx
cmp esi, dword [edx]
sete cl
xor eax, eax
cmp esi, ecx
setle al
cmp eax, ebx
jg 0x100d55f5
xor ecx, ecx
inc ecx
jmp 0x100d55f7
xor ecx, ecx
mov eax, dword [edi]
imul eax, ecx
mov dword [edi], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100def3c
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
mov bl, 1
push edi
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100df0dc
mov edx, 0x10000000
cmp eax, 0x7c
je 0x100df0dc
cmp eax, 0x29
jne 0x100def77
cmp dword [esi + 0x10], 0
jne 0x100df0dc
test dword [esi + 0x50], edx
je 0x100df0e2
cmp eax, 0x2e
jne 0x100def92
push 5
lea ecx, [esi + 0x24]
call fcn.100ac522
mov ecx, esi
call fcn.100def11
jmp 0x100df0c4
cmp eax, 0x5c
jne 0x100defef
mov ecx, esi
call fcn.100def11
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x100defc5
cmp word [esi + 0x48], 0x62
jne 0x100defc5
push 4
lea ecx, [esi + 0x24]
call fcn.100ac522
mov ecx, esi
call fcn.100def11
jmp 0x100df0cb
test eax, eax
je 0x100defe3
cmp word [esi + 0x48], 0x42
jne 0x100defe3
push 4
lea ecx, [esi + 0x24]
call fcn.100ac522
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100defb9
mov ecx, esi
call fcn.100df845
jmp 0x100df0c4
cmp eax, 0x5b
jne 0x100df04f
mov ecx, esi
call fcn.100def11
lea ecx, [esi + 0x24]
call fcn.100e0108
cmp dword [esi + 0x4c], 0x5e
jne 0x100df017
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.100def11
test dword [esi + 0x50], 0x20000000
je 0x100df037
cmp dword [esi + 0x4c], 0x5d
jne 0x100df037
push 0x5d
lea ecx, [esi + 0x24]
call fcn.100e0152
mov ecx, esi
call fcn.100def11
mov ecx, esi
call fcn.100dfee6
cmp dword [esi + 0x4c], 0x5d
je 0x100def86
push 4
jmp 0x100df0e4
cmp eax, 0x28
jne 0x100df06c
mov ecx, esi
call fcn.100def11
mov ecx, esi
call fcn.100df921
cmp dword [esi + 0x4c], 0x29
mov bl, al
je 0x100df0b9
jmp 0x100df0e2
cmp eax, 0x5e
jne 0x100df078
push 2
jmp 0x100defb1
cmp eax, 0x24
jne 0x100df084
push 3
jmp 0x100defb1
cmp eax, 0x2a
je 0x100df0d8
cmp eax, 0x2b
je 0x100df0d8
cmp eax, 0x3f
je 0x100df0d8
cmp eax, 0x7b
je 0x100df0d8
cmp eax, 0x7d
jne 0x100df0a2
test dword [esi + 0x50], edx
je 0x100df0d4
cmp eax, 0x5d
jne 0x100df0ac
test dword [esi + 0x50], edx
je 0x100df048
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.100dfa95
mov ecx, esi
call fcn.100def11
test bl, bl
je 0x100df0cb
mov ecx, esi
call fcn.100df9d1
mov cl, 1
mov bl, cl
jmp 0x100def45
push 6
jmp 0x100df0e4
push 0xa
jmp 0x100df0e4
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.1010e0f8
int3
Function at 0x100e0cb1
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x24], ecx
jle 0x100e0e7c
mov edx, dword [ebp + 8]
push ebx
push esi
add edx, 2
push edi
xor esi, esi
movzx ecx, byte [edx - 2]
movzx eax, byte [edx - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
add edx, 4
or ecx, eax
mov dword [ebp + esi*4 - 0x12c], ecx
inc esi
cmp esi, 0x10
jl 0x100e0cd2
lea eax, [ebp - 0xf4]
mov dword [ebp - 0x2c], edx
mov dword [ebp + 8], eax
mov dword [ebp - 0x28], 0x30
mov ecx, dword [eax]
mov esi, ecx
mov ebx, dword [eax - 0x34]
mov edx, ecx
rol edx, 0xd
rol ecx, 0xf
shr esi, 0xa
call fcn.1007a981
mov edx, esi
mov ecx, eax
call fcn.1007a981
mov esi, ebx
mov edx, ebx
ror ebx, 7
mov edi, eax
rol edx, 0xe
mov ecx, ebx
shr esi, 3
call fcn.1007a981
mov edx, esi
mov ecx, eax
call fcn.1007a981
add edi, eax
mov eax, dword [ebp + 8]
add edi, dword [eax - 0x38]
add edi, dword [eax - 0x14]
mov dword [eax + 8], edi
add eax, 4
dec dword [ebp - 0x28]
mov dword [ebp + 8], eax
jne 0x100e0d13
mov esi, dword [ebp - 0x24]
lea edi, [ebp - 0x20]
push 8
add esi, 0x88
and dword [ebp + 8], 0
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x20]
mov edx, eax
mov ecx, eax
mov esi, eax
ror edx, 0xb
ror ecx, 6
rol esi, 7
call fcn.1007a981
mov edx, esi
mov ecx, eax
call fcn.1007a981
mov edx, dword [ebp - 0x10]
mov ebx, eax
mov ecx, dword [ebp - 0xc]
not edx
and edx, dword [ebp - 8]
and ecx, dword [ebp - 0x10]
call fcn.1007a981
add ebx, eax
mov edx, edi
mov eax, dword [ebp + 8]
mov ecx, edi
mov esi, edi
ror edx, 0xd
ror ecx, 2
rol esi, 0xa
add ebx, dword [eax + 0x1000d550]
add ebx, dword [ebp + eax - 0x12c]
add ebx, dword [ebp - 4]
call fcn.1007a981
mov edx, esi
mov ecx, eax
call fcn.1007a981
mov esi, dword [ebp - 0x18]
mov edi, eax
mov ecx, dword [ebp - 0x1c]
and esi, ecx
mov edx, dword [ebp - 0x18]
and edx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x20]
call fcn.1007a981
mov edx, esi
mov ecx, eax
call fcn.1007a981
mov ecx, dword [ebp - 0x18]
add edi, eax
mov eax, dword [ebp - 8]
add edi, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
add eax, ebx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 8]
add ecx, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], edi
mov dword [ebp + 8], ecx
cmp ecx, 0x100
jl 0x100e0d86
mov edx, dword [ebp - 0x24]
xor ecx, ecx
add edx, 0x88
mov eax, dword [ebp + ecx*4 - 0x20]
add dword [edx], eax
inc ecx
lea edx, [edx + 4]
cmp ecx, 8
jl 0x100e0e5e
dec dword [ebp + 0xc]
mov edx, dword [ebp - 0x2c]
jne 0x100e0cd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100e74a1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x101507c1
call fcn.1014399c
sub esp, 0x158
and dword [ebp - 0xa0], 0
push ebx
push esi
push edi
push 2
mov edi, ecx
mov byte [ebp - 0x11], dl
pop ebx
xor ecx, ecx
mov dword [ebp - 0x9c], 0x6c323640
mov dword [ebp - 0x98], 0x74313838
xor esi, esi
mov dword [ebp - 0x94], 0x7e155323
mov dword [ebp - 0x90], 0x470c5707
mov dword [ebp - 0x8c], 0x85254410
mov dword [ebp - 0x88], 0x611b7e1a
mov dword [ebp - 0x84], 0x7a214c2c
mov dword [ebp - 0x80], 0x891e6205
mov dword [ebp - 0x7c], 0x6d2f8b12
mov dword [ebp - 0x78], 0x710f7439
mov dword [ebp - 0x74], 0x5f247635
mov dword [ebp - 0x70], 0x64307629
mov dword [ebp - 0x6c], 0x9c0e7b1f
mov dword [ebp - 0x68], 0x81336d3c
mov dword [ebp - 0x64], 0x8527a226
mov dword [ebp - 0x60], 0x6f208f01
mov dword [ebp - 0x5c], 0xad3eab2a
mov dword [ebp - 0x58], 0xb1068f17
mov dword [ebp - 0x54], 0xb809821c
mov dword [ebp - 0x50], 0xbd2d9713
mov dword [ebp - 0x4c], 0x9d378214
mov dword [ebp - 0x48], 0x89349f1d
mov dword [ebp - 0x44], 0xa53b8e08
mov dword [ebp - 0x40], 0xc82ed10d
mov dword [ebp - 0x3c], 0xcc0aab3f
mov dword [ebp - 0x38], 0xb73dcf3a
mov dword [ebp - 0x34], 0xb52bd216
mov dword [ebp - 0x30], 0xb90ba518
mov dword [ebp - 0x2c], 0xdd36d011
mov word [ebp - 0x28], 0xbf03
mov byte [ebp - 0x26], bl
mov dword [ebp - 0x25], 0x4ac28e1
mov dword [ebp - 0x21], 0x22ed19ab
mov dword [ebp - 0x1d], 0x3ae00e9
mov word [ebp - 0x19], 0xbf3d
cmp ecx, 0x82
jne 0x100e75d9
push 3
pop esi
inc ecx
jmp 0x100e760b
movzx eax, byte [ebp + ecx - 0x9b]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100e75fc
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x9c]
mov byte [ebp + eax - 0x164], dl
add ecx, ebx
cmp ecx, 0x85
jb 0x100e75cb
lea ecx, [ebp - 0xd0]
mov byte [ebp - 0x123], 0
call fcn.100e7022
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x100]
call fcn.1001b5bd
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb8]
call fcn.10063857
pop ecx
push 0
push 1
lea ecx, [ebp - 0x100]
call fcn.10016cae
push 0
push 1
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 4
call fcn.10016cae
push 0x42
lea eax, [ebp - 0x164]
push 0
push eax
call fcn.10123950
add esp, 0xc
cmp byte [ebp - 0x11], 0
je 0x100e76a3
lea edx, [ebp - 0xb8]
lea ecx, [ebp - 0xe8]
call fcn.100e6fb0
xor ebx, ebx
inc ebx
jmp 0x100e76b5
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x118]
call fcn.10018f9d
push eax
mov ecx, edi
call fcn.10016b48
or ebx, 4
test bl, 2
je 0x100e76d7
push 0
push 1
lea ecx, [ebp - 0x118]
and ebx, 0xfffffffd
call fcn.10016cae
test bl, 1
je 0x100e76eb
push 0
push 1
lea ecx, [ebp - 0xe8]
call fcn.10016cae
push 0
push 1
lea ecx, [ebp - 0xb8]
call fcn.10016cae
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10100f40
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
and ecx, 0xf
movzx edx, byte [0x105d75ca]
or ecx, edx
mov byte [ebp - 1], cl
movzx ax, byte [ebp - 1]
movzx ecx, ax
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
push ecx
push 0x105d7710
call fcn.1002225f
add esp, 8
mov esp, ebp
pop ebp
ret 4

Function at 0x1010dd80
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10169620]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20], ax
xor ecx, ecx
mov word [ebp - 0x1e], cx
cmp dword [ebp + 8], 0xffffffff
jne 0x1010dda4
jmp 0x1010de13
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1010ddb8
jmp 0x1010de13
movsx ecx, word [ebp - 0x1c]
movsx edx, word [ebp - 0x1a]
imul ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
jne 0x1010dde4
jmp 0x1010de13
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x1010de05
jmp 0x1010de13
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call main
mov esp, ebp
pop ebp
ret
Function at 0x101399d4
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10169620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1012c686
mov dword [ebp - 0x14], eax
cmp dword [0x105d85dc], esi
jne 0x10139ac7
push 0x800
push esi
push 0x10007978
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10139a54
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10139ba7
push esi
push esi
push 0x10007978
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10139ba7
push 0x10007990
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10139ba7
push eax
call ebx
push 0x1000799c
push edi
mov dword [0x105d85dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100079ac
push edi
mov dword [0x105d85e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100079c0
push edi
mov dword [0x105d85e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x105d85ec], eax
test eax, eax
je 0x10139ac4
push 0x100079dc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x105d85e8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10139aec
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10139adf
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10139b01
push 4
pop eax
jmp 0x10139ba9
cmp dword [ebp - 0x14], esi
je 0x10139b01
push dword [0x105d85dc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10139ae6
mov eax, dword [0x105d85e8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10139b5f
cmp dword [0x105d85ec], edi
je 0x10139b5f
push eax
call ebx
push dword [0x105d85ec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10139b5f
test eax, eax
je 0x10139b5f
call ecx
test eax, eax
je 0x10139b54
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10139b54
test byte [ebp - 8], 1
jne 0x10139b5f
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10139b8f
mov eax, dword [0x105d85e0]
cmp eax, edi
je 0x10139b8c
push eax
call ebx
test eax, eax
je 0x10139b8c
call eax
mov esi, eax
test esi, esi
je 0x10139b8c
mov eax, dword [0x105d85e4]
cmp eax, edi
je 0x10139b8c
push eax
call ebx
test eax, eax
je 0x10139b8c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x105d85dc]
call ebx
test eax, eax
je 0x10139ba7
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10139ba9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x10013e8b
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10013ee3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x10013ebb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 2
jg 0x10013ee1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10013edf
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10013eb0
jmp 0x10013f2e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10013f11
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10013f2e
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1001866d
mov dword [eax], 0x36d0
jmp 0x10013f06
mov esp, ebp
pop ebp
ret
Function at 0x1001f4af
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001f4e8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001f4e3
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x1001f5fc
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x1001f5d1
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 0x964
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx]
jl 0x1001f537
mov eax, dword [ebp - 4]
cmp dword [eax], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xe11a
jle 0x1001f553
mov dword [ebp - 0xc], 1
jmp 0x1001f557
and dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0xc921
jle 0x1001f569
mov dword [ebp - 0x10], 1
jmp 0x1001f56d
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jge 0x1001f580
mov dword [ebp - 0x14], 1
jmp 0x1001f584
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jg 0x1001f597
mov dword [ebp - 0x18], 1
jmp 0x1001f59b
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [eax]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax]
jg 0x1001f5b3
mov dword [ebp - 0x20], 1
jmp 0x1001f5b7
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x20]
jle 0x1001f5d1
and dword [ebp - 0x24], 0
jmp 0x1001f5d8
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jle 0x1001f5f0
mov dword [ebp - 0x28], 1
jmp 0x1001f5f4
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret