joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405d94
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
call dword [edi + 0x30]
push edi
push eax
or esi, esi
jne 0x405d7c
pop eax
cmp byte [ebx + eax - 1], 0x5c
jne 0x405d8a
dec eax
jmp 0x405d8a
push esi
call dword [edi + 0x30]
xchg ecx, eax
pop eax
lea edi, [ebx + eax]
add eax, ecx
inc ecx
rep movsb byte es:[edi], byte [esi]
call 0x405d94
pop esp
sub ch, byte [esi]
sub al, byte [eax]
pop esi
lea edi, [ebx + eax]
push edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
inc esi
pop edi
push ebx
push esi
push dword [ebp - 4]
push ebx
call dword [edi + 0x38]
mov byte [esi], 0
cmp eax, 0xffffffff
je 0x405e1b
mov esi, eax
mov ebx, dword [ebp - 4]
test byte [ebx], 0x10
lea ebx, [ebx + 0x2c]
je 0x405dd2
cmp byte [ebx], 0x2e
je 0x405e02
push esi
mov edx, dword [ebp - 4]
mov esi, ebx
mov ebx, dword [ebp - 8]
call fcn.00405d63
pop esi
jmp 0x405e02
push ebx
call dword [edi + 0x30]
push eax
call 0x405de1
js 0x405e45
add byte [ebp + 0x51fc034c], cl
call dword [edi + 0x34]
or eax, eax
pop ecx
jne 0x405e02
push esi
push edi
mov esi, ebx
mov edi, dword [ebp - 0xc]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp - 8]
call fcn.00405e1d
pop esi
mov ebx, dword [ebp - 0xc]
mov byte [ebx], 0
push dword [ebp - 4]
push esi
push 1
call dword [edi]
call dword [edi + 0x3c]
or eax, eax
jne 0x405db1
push esi
call dword [edi + 0x40]
leave
ret
jae 0x405eb2
jb 0x405eb7
insb byte es:[edi], dx
js 0x405eb3
invalid

Function at 0x405e1d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
push edx
push edx
push 3
push edx
push 1
push 0xc0000000
push eax
mov esi, eax
push esi
call dword [edi + 0x30]
lea esi, [esi + eax - 0xc]
push esi
call fcn.00405e4f
outsb dx, byte [esi]
je 0x405eb4

Function at 0x405e4f
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
call dword [edi + 0x34]
or eax, eax
jne 0x405e58
leave
call dword [edi + 0x44]
mov ebx, eax
inc ebx
jne 0x405e6a
dec ebx
push 0x40
pop esi
sub esp, esi
mov edx, esp
push 0
push esp
push esi
push edx
push ebx
call dword [edi + 0x48]
cmp dword [esp - 4], esi
jne 0x405e60
cmp word [esp], 0x5a4d
jne 0x405e60
cmp byte [esp + 0x32], 0x56
je 0x405e60
push eax
add esp, esi
pop esi
mov dword [ebp - 0x1c], esi
push 0
push 0
push esi
push ebx
call dword [edi + 0x50]
inc eax
je 0x405e60
sub esp, 0x58
mov edx, esp
push 0
push esp
push 0x58
push edx
push ebx
call dword [edi + 0x48]
Function at 0x40716c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409bc0
test esi, esi
jne 0x4071a2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00409d48
jmp 0x4071c0
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004070b0
mov edi, eax
test esi, esi
je 0x4071c0
cmp dword [ebx], 0
je 0x4071c0
dec esi
jmp 0x4071a9
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x40881c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408ca8
mov byte [esp], al
cmp byte [esp], 0
jne 0x4089a5
test edi, edi
je 0x4089a5
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4088e5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4088c0
cmp edi, 0xffffffff
je 0x408881
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408881
mov byte [esp], 0
jmp 0x4089a5
cmp dword [esi], 1
jg 0x4088c0
cmp dword [esi], 0
jne 0x4088b2
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4088b2
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4089a5
lea eax, [esp + 0xc]
call fcn.004084d8
dec ebp
test ebp, ebp
jg 0x408866
cmp edi, 0xffffffff
je 0x4088e5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4088e3
mov byte [esp], 0
jmp 0x4089a5
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40882a
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4088e5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408a14
mov edx, eax
mov ebx, dword [0x76f8f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408949
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408947
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408949
xor edi, edi
cmp byte [esp], 0
je 0x40896f
mov ebx, dword [esi]
test bl, 1
jne 0x408985
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40894f
mov byte [esp + 1], 1
jmp 0x408985
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40896f
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4088fc
cmp byte [esp], 0
je 0x4089a5
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40981c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x76f058], 0
je 0x409883
cmp word [0x76f344], 0xd7b2
jne 0x409845
cmp dword [0x76f34c], 0
jbe 0x409845
mov eax, 0x76f340
call dword [0x76f35c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4098b0
call fcn.0040a540
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x767032], 0
jne 0x40989f
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x409a80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x767034], 0
je 0x409aab
mov edx, edi
mov eax, esi
call dword [0x767034]
mov ebx, eax
jmp 0x409abc
mov eax, 8
call fcn.00406e0c
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x76f059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x409a48
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x409aec
mov eax, ebx
call fcn.00406e28
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x40c854
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40c9b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409bc0
cmp si, word [0x767a00]
jb 0x40c8ec
cmp si, word [0x767c00]
ja 0x40c8ec
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40c8ec
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x767a00]
jae 0x40c8c6
mov edi, ebx
dec edi
jmp 0x40c8e7
cmp si, word [ebx*8 + 0x767a00]
jbe 0x40c8d6
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40c8e7
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x767a04]
call fcn.0040c774
jmp 0x40c8ec
cmp edi, dword [ebp - 8]
jae 0x40c8b0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40c99b
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40c99b
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a8e0
push dword [ebp - 0x160]
push 0x40c9d4
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040a8e0
push dword [ebp - 0x164]
push 0x40c9e4
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a8e0
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040ab18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c9c0
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409c20
ret
Function at 0x40cb6c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cc70
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x771c10
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x771c28]
jne 0x40cbb8
mov eax, esi
mov edx, 0x771c2a
mov ecx, 0x55
call fcn.0040a8e0
push 0x771c10
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40cc5a
push 0x771c10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00409bc0
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40cc27
cmp byte [0x771c0c], 0
je 0x40cbec
mov edx, esi
mov eax, ebx
call fcn.0040ca50
jmp 0x40cc27
mov edx, esi
mov eax, ebx
call fcn.0040c854
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40cc27
cmp dword [esi], 0
je 0x40cc10
mov eax, esi
mov edx, 0x40cc88
call fcn.0040aa38
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040c854
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040aa38
push 0x771c10
call sub.kernel32.dll_EnterCriticalSection
mov word [0x771c28], bx
mov eax, dword [esi]
call fcn.0040a83c
mov ecx, eax
mov eax, 0x771c2a
mov edx, 0xaa
call fcn.0040c6d4
push 0x771c10
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cc77
lea eax, [ebp - 4]
call fcn.00409bc0
ret
Function at 0x4204ac
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x420610
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x42044c]
call fcn.0040bf88
add esp, 4
push 0x104
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x42047c]
call fcn.0040bf88
add esp, 4
movzx ebx, byte [0x420620]
mov dl, 1
mov eax, esi
call fcn.00420814
test al, al
jne 0x420526
mov dl, 1
mov eax, esi
call fcn.0042077c
test al, al
je 0x4205b0
lea edx, [ebp - 0x1c]
mov eax, esi
call fcn.00420d20
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.00427390
push 0x104
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x104
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a83c
mov esi, eax
push esi
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x4205ab
test byte [ebp - 0x14], 1
je 0x420576
or bl, 1
test byte [ebp - 0x14], 2
je 0x42057f
or bl, 2
test byte [ebp - 0x14], 0x80
je 0x420588
or bl, 0x20
push esi
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
je 0x42059c
dec eax
je 0x4205a1
dec eax
je 0x4205a6
dec eax
jne 0x4205d1
or bl, 0x10
jmp 0x4205d1
or bl, 4
jmp 0x4205d1
or bl, 8
jmp 0x4205d1
call fcn.0042800c
lea edx, [ebp - 0x20]
mov eax, dword [0x76e3cc]
call fcn.0040ee40
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x418f00]
call fcn.00425d94
call fcn.00409280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420617
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00409c20
lea eax, [ebp - 0xc]
mov edx, dword [0x42047c]
call fcn.0040c0ac
lea eax, [ebp - 8]
mov edx, dword [0x42044c]
call fcn.0040c0ac
lea eax, [ebp - 4]
call fcn.00409bc0
ret

Function at 0x42067c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x4206a9
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x425c44
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x425d69
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00425a4c
mov esi, eax
mov eax, dword [0x76e348]
cmp byte [eax], 0
je 0x425d11
mov eax, dword [0x76e174]
call fcn.004076d4
call fcn.00406f60
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x425c14]
call fcn.0040bf88
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x425d84
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x425d4d
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x76e134]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x772624]
call fcn.0040c378
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425d70
lea eax, [ebp - 4]
mov edx, dword [0x425c14]
call fcn.0040c0ac
ret
Function at 0x6b8fc4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x6b9062
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x6b9026
cmp byte [ebx + 0x11], 0
jne 0x6b9026
cmp byte [ebx + 0x24], 0
jne 0x6b9026
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x6b9047
lea edx, [ebp - 4]
mov eax, dword [0x76e2f8]
call fcn.0040ee40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x693840]
call fcn.00425d94
call fcn.00409280
jmp 0x6b9047
lea edx, [ebp - 8]
mov eax, dword [0x76e2f8]
call fcn.0040ee40
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x693840]
call fcn.00425d94
call fcn.00409280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b9069
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409c20
ret

Function at 0x6b987c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x6b98ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.006b8e44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6b98e3
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x6b98ec
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.006b8e44
dec esi
jne 0x6b990e
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x71d924
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x71d92c
mov eax, edx
pop esi
pop ebx
ret

Function at 0x733018
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00409cb4
xor eax, eax
push ebp
push 0x733110
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x78], 0
je 0x7330f2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x78]
add eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
dec eax
test eax, eax
jl 0x7330f2
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4]
add eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov ecx, 0
call fcn.0040a258
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.0040a4c0
jne 0x7330ea
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
movzx eax, word [eax + edx*2]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov eax, dword [eax + edx*4]
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
jmp 0x7330f2
inc dword [ebp - 0x18]
dec dword [ebp - 0x24]
jne 0x73308e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x733117
lea eax, [ebp - 0x28]
call fcn.00409be4
lea eax, [ebp - 8]
call fcn.00409be4
ret
Function at 0x733120
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x733289
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x733298
call sub.kernel32.dll_GetModuleHandleW_2
push eax
lea eax, [ebp - 0x18]
mov edx, 0x7332b4
mov ecx, 0
call fcn.0040a258
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00733018
mov dword [0x76a738], eax
mov eax, dword [ebp - 4]
call fcn.0040a6ac
push eax
call dword [0x76a738]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x73324b
test byte [ebp - 0xb], 4
je 0x733241
test byte [ebp - 0xc], 0x10
je 0x7331a2
mov byte [ebp - 5], 0
jmp 0x73326e
push 0x733298
call sub.kernel32.dll_GetModuleHandleW_2
push eax
lea eax, [ebp - 0x1c]
mov edx, 0x7332c8
mov ecx, 0
call fcn.0040a258
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00733018
mov dword [0x76a734], eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040a6ac
push eax
call dword [0x76a734]
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x733237
push 0x733298
call sub.kernel32.dll_GetModuleHandleW_2
push eax
lea eax, [ebp - 0x20]
mov edx, 0x7332d4
mov ecx, 0
call fcn.0040a258
mov edx, dword [ebp - 0x20]
pop eax
call fcn.00733018
mov dword [0x76a730], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [0x76a730]
mov byte [ebp - 5], 1
jmp 0x73326e
cmp dword [ebp - 0x14], 0x20
sete byte [ebp - 5]
jmp 0x73326e
test byte [ebp - 0xc], 0x10
sete byte [ebp - 5]
jmp 0x73326e
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
je 0x733265
cmp dword [ebp - 0x14], 3
je 0x733265
cmp dword [ebp - 0x14], 0x7b
jne 0x733269
xor eax, eax
jmp 0x73326b
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x733290
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00409c50
ret

Function at 0x736780
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
xor ebx, ebx
cmp dword [esp], 0
je 0x7367e5
mov eax, dword [esp]
call fcn.00736a30
test al, al
je 0x7367e5
mov eax, dword [esp]
call fcn.00736840
mov esi, eax
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
dec esi
mov eax, dword [esp]
movzx eax, word [eax + esi*2]
mov edx, eax
mov ecx, eax
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x7367c8
mov edx, eax
and dx, 0xffdf
mov eax, edx
cmp ax, 0x41
jb 0x7367e5
cmp ax, 0x5a
ja 0x7367e5
sub al, 0x41
mov ecx, eax
shr edi, cl
and edi, 1
cmp edi, 1
sete bl
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x73f5b8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x76bef8
test edx, edx
jne 0x73f5d7
xor eax, eax
jmp 0x73f6f5
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x73f5f4
push esi
push edx
push eax
call fcn.0073f6fc
add esp, 0xc
jmp 0x73f6f5
push esi
push edx
push eax
call fcn.0073f9bc
add esp, 0xc
jmp 0x73f6f5
pop esi
pop ebx
pop ecx
pop ebp
ret