joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp eax, 0x9c9a7d1
inc eax
nop
nop
mov eax, ecx
inc eax
mov eax, ecx
cmp eax, 0x7258fba8
cmp eax, 0xffffff8e
inc eax
cmp eax, 0x23
nop
mov eax, ecx
cmp eax, 0xc43963a7
cmp eax, 0x63
mov eax, 0xc644c0e6
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
mov eax, 0xa0d49683
nop
mov eax, ebx
nop
cmp eax, 0x27
mov eax, ecx
cmp eax, 0x63
inc eax
inc eax
mov eax, ecx
cmp eax, 0xffffff98
mov eax, ecx
cmp eax, 0xa2000921
cmp eax, 0x89120c42
mov eax, 0x243ecde7
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop
cmp eax, 0xa7e7b26
mov eax, ecx
mov eax, ecx
mov eax, 0x24417863
mov eax, 0x3f99659e
inc eax
cmp eax, 0x970fdac1
mov eax, ebx
inc eax
mov eax, 0xe54b0284
nop
inc eax
inc eax
mov eax, ebx
inc eax
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
inc eax
mov eax, 0xe52bab6c
mov eax, ecx
mov eax, ecx
cmp eax, 0xaeb6aa0e
mov eax, ebx
inc eax
mov eax, ebx
nop
nop
inc eax
cmp eax, 0xd84f6b68
cmp eax, 0xff10537a
inc eax
cmp eax, 0xe6cfcc79
inc eax
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
cmp eax, 0xe70d4215
inc eax
cmp eax, 0x15bc8e55
cmp eax, 0x3d
mov eax, ebx
mov eax, ebx
mov eax, ebx
mov eax, 0x2c2ea9a3
cmp eax, 0x3e
nop
mov eax, ecx
cmp eax, 0xffffffea
mov eax, ebx
nop
mov eax, 0xe4095a8e
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
inc eax
mov eax, ebx
cmp eax, 0x1bb4cb48
mov eax, 0x209c0c44
inc eax
inc eax
nop
cmp eax, 0xf148d4e
cmp eax, 0xb51be5ef
mov eax, ecx
mov eax, ebx
inc eax
inc eax
mov eax, ecx
cmp eax, 0x67ffa7b3
mov eax, ecx
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001e770
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001e5e6

Function at 0x1002df80
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1002e144
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
or ebp, 0xffffffff
jmp 0x1002dfaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1002dfb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1002dfa0
mov eax, 1
add ebx, ebx
jne 0x1002dfc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1002dfb8
jne 0x1002dfd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002dfb8
xor ecx, ecx
sub eax, 3
jb 0x1002dfe8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1002e05a
mov ebp, eax
add ebx, ebx
jne 0x1002dff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1002e000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1002e024
inc ecx
add ebx, ebx
jne 0x1002e010
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1002e005
jne 0x1002e021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002e005
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1002e044
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1002e035
jmp 0x1002dfa6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1002e044
add edi, ecx
jmp 0x1002dfa6
pop esi
mov edi, esi
mov ecx, 0xc42
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1002e062
cmp byte [edi], 0x11
jne 0x1002e062
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1002e067
lea edi, [esi + 0x2a000]
mov eax, dword [edi]
or eax, eax
je 0x1002e0d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e44c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e49c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1002e094
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2e4a0]
or eax, eax
je 0x1002e0d0
mov dword [ebx], eax
add ebx, 4
jmp 0x1002e0b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1002e107
cmp al, 0xef
ja 0x1002e0fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1002e0dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1002e0e9
mov ebp, dword [esi + 0x2e4a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1002e13b
sub esp, 0xffffff80
jmp 0x10013194
Function at 0x4af630
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x73000]
push edi
jmp 0x4af64a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4af651
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4af640
mov eax, 1
add ebx, ebx
jne 0x4af663
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4af674
jne 0x4af693
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4af693
dec eax
add ebx, ebx
jne 0x4af680
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4af658
add ebx, ebx
jne 0x4af68f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4af6e5
xor ecx, ecx
sub eax, 3
jb 0x4af6ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4af71a
sar eax, 1
mov ebp, eax
jmp 0x4af6b6
add ebx, ebx
jne 0x4af6b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4af684
inc ecx
add ebx, ebx
jne 0x4af6c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4af684
add ebx, ebx
jne 0x4af6d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4af6c6
jne 0x4af6e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4af6c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4af704
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4af6f6
jmp 0x4af646
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4af704
add edi, ecx
jmp 0x4af646
pop esi
mov edi, esi
mov ecx, 0xa5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4af722
cmp byte [edi], 3
jne 0x4af722
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4af727
lea edi, [esi + 0xad000]
mov eax, dword [edi]
or eax, eax
je 0x4af79f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc66cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc67e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4af754
mov ecx, edi
jns 0x4af783
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc67f0]
or eax, eax
je 0x4af799
mov dword [ebx], eax
add ebx, 4
jmp 0x4af771
call dword [esi + 0xc67ec]
mov ebp, dword [esi + 0xc67f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4af7d3
sub esp, 0xffffff80
jmp 0x405000
Function at 0x40deeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00409a53
and dword [ebp - 0x14], 0
cmp dword [0x416cac], 0
mov dword [ebp - 0x18], eax
jne 0x40df9e
push 0x412300
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40e046
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4122f4
push ebx
call edi
test eax, eax
je 0x40e046
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4122e4
push ebx
mov dword [0x416cac], eax
call edi
push eax
call esi
push 0x4122d0
push ebx
mov dword [0x416cb0], eax
call edi
push eax
call esi
push 0x4122b4
push ebx
mov dword [0x416cb4], eax
call edi
push eax
call esi
mov dword [0x416cbc], eax
test eax, eax
je 0x40df9e
push 0x41229c
push ebx
call edi
push eax
call esi
mov dword [0x416cb8], eax
mov eax, dword [0x416cb8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40dff7
cmp dword [0x416cbc], ecx
je 0x40dff7
push eax
call esi
push dword [0x416cbc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40dff7
test ebx, ebx
je 0x40dff7
call edi
test eax, eax
je 0x40dfee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40dfee
test byte [ebp - 8], 1
jne 0x40dff7
or dword [ebp + 0x10], 0x200000
jmp 0x40e02a
mov eax, dword [0x416cb0]
cmp eax, dword [ebp - 0x18]
je 0x40e02a
push eax
call esi
test eax, eax
je 0x40e02a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40e02a
mov eax, dword [0x416cb4]
cmp eax, dword [ebp - 0x18]
je 0x40e02a
push eax
call esi
test eax, eax
je 0x40e02a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x416cac]
call esi
test eax, eax
je 0x40e046
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40e048
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404588
leave
ret
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x41c230
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x41c252
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41c259
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41c248
mov eax, 1
add ebx, ebx
jne 0x41c26b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41c260
jne 0x41c27c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c260
xor ecx, ecx
sub eax, 3
jb 0x41c290
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41c302
mov ebp, eax
add ebx, ebx
jne 0x41c29b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41c2a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41c2cc
inc ecx
add ebx, ebx
jne 0x41c2b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41c2ad
jne 0x41c2c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c2ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41c2ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41c2dd
jmp 0x41c24e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41c2ec
add edi, ecx
jmp 0x41c24e
pop esi
mov edi, esi
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41c30a
cmp byte [edi], 5
jne 0x41c30a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41c30f
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41c387
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x21bac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x21be8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41c33c
mov ecx, edi
jns 0x41c36b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21bec]
or eax, eax
je 0x41c381
mov dword [ebx], eax
add ebx, 4
jmp 0x41c359
call dword [esi + 0x21bf0]
popal
jmp 0x401150
Function at 0xdbd92c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdbd936
pushal
call 0xdbd93c
pop ebp
sub ebp, 0x10
sub ebp, 0x9bd92c
jmp 0xdbd952
mov eax, 0x9bd92c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cf
mov edx, 0x7d65e40a
xor byte [eax], dl
inc eax
dec ecx
jne 0xdbd969
jmp 0xdbd97c
add edi, 0xa368381
or cl, byte [edx]
mov ecx, ebx
or cl, byte [edx]
or cl, byte [ecx]
invalid
Function at 0x100015a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x100015b4
pop dword [ebp - 0x30]
mov eax, 0x36bf5603
add eax, 0xd940bfb1
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xd3880f82
add dword [ebp - 0x40], 0x7aca35c9
mov dword [ebp - 0x3c], 0x5bc5cf71
add dword [ebp - 0x3c], 0xd66d7cd4
mov dword [ebp - 0x38], 0xafad6f39
add dword [ebp - 0x38], 0x9c9ed4f5
mov dword [ebp - 0x34], 0xee943455
sub dword [ebp - 0x34], 0xee943455
lea eax, [ebp - 0x40]
push eax
mov eax, 0x9c82d0d3
sub eax, 0x8c82a0cf
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x984b9f86
sub dword [ebp - 0x40], 0x23d93630
mov dword [ebp - 0x3c], 0x875197c9
add dword [ebp - 0x3c], 0xba1ac9ac
mov dword [ebp - 0x38], 0x855c030
add dword [ebp - 0x38], 0x5b19ac3c
mov dword [ebp - 0x34], 0x6345ae02
sub dword [ebp - 0x34], 0x6345ae02
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x680bb4cf
add eax, 0xa7f47b3d
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x37973
push 0
call eax
mov ecx, 0x4c6d
xor esi, esi
add esi, eax
mov edx, 0x1ef1d07f
sub edx, 0xef16c7f
add edx, dword [ebp - 0x30]
mov ebx, 0x26d2894f
sub ebx, 0x5c9d48db
mov dword [ebp - 0x1c], 0xe48b594b
mov edi, dword [edx]
sub dword [ebp - 0x28], ebx
xor edi, ebx
sub dword [ebp - 0x18], ebx
mov dword [esi], edi
xor dword [ebp - 4], ecx
add esi, 0xe2b32452
add esi, 0x1d4cdbb2
add edx, 0xa34f79a3
sub edx, 0xa34f799f
loop 0x100016d2
add eax, 0x12487
mov ebx, eax
add eax, 5
mov ecx, 0x53ab61a1
sub ecx, 0x43ab61a1
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x40bf53
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x451040]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0x24]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.0040ac17
push 0x446cdc
lea ecx, [esp + 0x1c]
call fcn.0040ab8b
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x40bfd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40bff9
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xcd
call fcn.0040bc92
mov edi, eax
jmp 0x40bff8
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.0040be28
mov ebx, eax
test ebx, ebx
jns 0x40bfff
push ebx
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xd3
call fcn.0040bc4d
pop ecx
mov edi, ebx
pop ecx
test esi, esi
je 0x40c013
jmp 0x40c00d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
push esi
call fcn.0040bd43
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00417ad4
mov esp, ebp
pop ebp
ret
Function at 0x40cd61
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040ce9f
Function at 0x40dd55
Capabilities:
Read file on windows

Disassembly:
push 0x5c
mov eax, 0x43bfe2
call fcn.00418271
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x2c]
xor eax, eax
xor ecx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], cl
mov dword [ebp - 4], ecx
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x68]
call fcn.0040d835
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.0040da50
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.00401da8
cmp dword [ebp - 0x30], 7
lea eax, [ebp - 0x44]
push 0x446eb8
cmova eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.004254c5
add esp, 0xc
cmp dword [ebp - 0x4c], 0
jne 0x40de24
xor eax, eax
lea ecx, [ebp - 0x44]
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
mov byte [esi], al
call fcn.00401da8
mov eax, dword [ebp - 0x18]
cmp eax, 0xf
jbe 0x40deaa
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x40dea1
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00401ec9
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
jmp 0x40dea1
mov ecx, ebx
call fcn.0040dcff
mov edi, eax
test edi, edi
je 0x40de57
xor eax, eax
lea ecx, [ebp - 0x2c]
push eax
push edi
call fcn.0040e742
push dword [ebp - 0x4c]
cmp dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x2c]
push 1
cmova ecx, dword [ebp - 0x2c]
push edi
push ecx
call fcn.004256e5
add esp, 0x10
push dword [ebp - 0x4c]
call fcn.004258c4
pop ecx
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00401d13
lea ecx, [ebp - 0x44]
call fcn.00401da8
mov eax, dword [ebp - 0x18]
cmp eax, 0xf
jbe 0x40deaa
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x40dea1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00401ec9
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.00417b35
pop ecx
pop ecx
mov eax, esi
call fcn.00418220
ret
Function at 0x410854
Capabilities:
Read file via mapping

Disassembly:
push 0x64
mov eax, 0x43c5b8
call fcn.00418271
mov eax, dword [ebp + 0xc]
lea edi, [ecx + 0x84]
mov ebx, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
push ebx
push eax
mov dword [ebp - 0x2c], edi
call fcn.00407a28
mov esi, dword [ebp - 0x38]
cmp byte [esi + 0xd], 0
jne 0x4108a1
lea eax, [esi + 0x10]
push eax
push ebx
call fcn.00403545
test al, al
jne 0x4108a1
cmp esi, dword [edi]
je 0x4108a1
mov eax, dword [esi + 0x30]
jmp 0x410955
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0x4c]
call fcn.0040d835
xor esi, esi
lea ecx, [ebp - 0x28]
mov edx, eax
mov dword [ebp - 4], esi
call fcn.0040da50
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00401da8
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
push esi
cmova eax, dword [ebp - 0x28]
push 0x80
push 3
push esi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
je 0x41094b
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
je 0x41094b
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x410949
push ebx
lea ecx, [ebp - 0x70]
call fcn.00401e92
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], esi
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 3
push eax
call fcn.0041544e
lea ecx, [ebp - 0x70]
call fcn.00401f37
jmp 0x41094b
xor esi, esi
lea ecx, [ebp - 0x28]
call fcn.00401da8
mov eax, esi
call fcn.00418220
ret 8

Function at 0x418970
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4189af
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4189af
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4189af
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4189af
cmp dword [ecx + 0x74], 0xe
jbe 0x4189af
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42534c
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x451040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x43fbe0
push esi
call fcn.0042bd92
pop ecx
pop ecx
test eax, eax
jne 0x42537a
xor al, al
jmp 0x4253f7
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.0042508d
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x4253b4
push dword [ebp - 0x210]
call fcn.00425cce
xor al, al
jmp 0x4253f5
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4253ba
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x4253da
push edx
call fcn.00425283
pop ecx
test al, al
je 0x4253a5
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4253e8
mov bl, 1
push dword [ebp - 0x210]
call fcn.00425cce
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00417ad4
leave
ret
Function at 0x42b627
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4412bc
push 0x4412b4
push str.FlsAlloc
push 0x1f
call fcn.0042b452
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b65b
push dword [ebp + 8]
mov ecx, esi
call dword [0x43d29c]
call esi
jmp 0x42b661
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42b6a5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4412cc
push 0x4412c4
push str.FlsGetValue
push 0x21
call fcn.0042b452
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b6dc
push dword [ebp + 8]
mov ecx, esi
call dword [0x43d29c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42b6e4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4412d4
push 0x4412cc
push str.FlsSetValue
push 0x22
call fcn.0042b452
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b71e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43d29c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]