joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cc333
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 0xc]
push edi
test al, 0x40
jne 0x4cc4b3
mov ecx, dword [esi + 8]
cmp ecx, 2
je 0x4cc4b3
cmp ecx, 4
je 0x4cc4b3
cmp ecx, 7
je 0x4cc4b3
test eax, eax
jne 0x4cc375
cmp dword [esi + 4], 2
jne 0x4cc4b3
test eax, 0x800
jne 0x4cc481
cmp byte [esi], 0
je 0x4cc481
test eax, eax
jne 0x4cc396
cmp ecx, 8
je 0x4cc481
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004cc1a5
add esp, 0xc
test al, al
jne 0x4cc4ef
mov eax, 0x7c67
mov word [ebp - 0x24], ax
add eax, 0xffffff9f
mov word [ebp - 0x22], ax
mov eax, 0x7c75
mov word [ebp - 0x20], ax
add eax, 0xffffffbf
mov word [ebp - 0x1e], ax
mov eax, 0x7c41
lea edx, [eax - 0xc]
mov word [ebp - 0x1c], ax
mov eax, edx
mov word [ebp - 0x1a], ax
add eax, 0x25
mov ecx, eax
push 7
mov word [ebp - 0x18], cx
mov word [ebp - 0x16], ax
pop ecx
mov di, word [ebp + ecx*2 - 0x26]
lea eax, [ebp + ecx*2 - 0x24]
xor word [eax], di
dec ecx
test ecx, ecx
jg 0x4cc3ef
xor word [ebp - 0x24], dx
mov eax, 0x6510
mov ecx, eax
mov word [ebp - 0xc], ax
add eax, 0x4d
mov word [ebp - 0xa], ax
mov eax, 0x653a
mov word [ebp - 8], ax
add eax, 0x1d
mov word [ebp - 6], ax
mov eax, 0x6523
mov word [ebp - 0x10], cx
add ecx, 0x50
mov word [ebp - 4], ax
xor eax, eax
push 6
mov word [ebp - 0xe], cx
mov word [ebp - 2], ax
pop ecx
mov dx, word [ebp + ecx*2 - 0x12]
lea eax, [ebp + ecx*2 - 0x10]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4cc443
mov esi, dword [esi + 8]
mov eax, 0x6551
xor word [ebp - 0x10], ax
cmp esi, 6
je 0x4cc46d
lea eax, [ebp - 0x10]
cmp esi, 5
jne 0x4cc470
lea eax, [ebp - 0x24]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.004b4d50
add esp, 0xc
jmp 0x4cc4ef
mov eax, dword [0x4ee7f8]
mov dword [ebp - 8], eax
mov eax, dword [0x4ee7fc]
push 2
mov dword [ebp - 4], eax
pop ecx
mov dx, word [ebp + ecx*2 - 0xa]
lea eax, [ebp + ecx*2 - 8]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4cc494
mov eax, 0x6da1
xor word [ebp - 8], ax
lea eax, [ebp - 8]
jmp 0x4cc4e1
mov esi, 0x4ee7e4
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 7
movsw word es:[edi], word [esi]
pop ecx
mov dx, word [ebp + ecx*2 - 0x26]
lea eax, [ebp + ecx*2 - 0x24]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4cc4c4
mov eax, 0x6b2
xor word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
push eax
push 0x104
push dword [ebp + 8]
call fcn.004c4d65
pop edi
pop esi
leave
ret
Function at 0x4cc7fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
xor ebx, ebx
push 0x1dc76ec6
mov dword [ebp - 8], ebx
call fcn.004cf30d
mov dword [ebp - 0xc], eax
mov dword [esp], 0x47d93bee
call fcn.004cf30d
pop ecx
push 9
pop ecx
mov esi, 0x4ee95c
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
push 0x11
mov dword [ebp - 4], eax
movsw word es:[edi], word [esi]
pop ecx
mov dx, word [ebp + ecx*2 - 0x3a]
lea eax, [ebp + ecx*2 - 0x38]
xor word [eax], dx
dec ecx
cmp ecx, ebx
jg 0x4cc83d
mov eax, 0x1a11
xor word [ebp - 0x38], ax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [ebp - 4]
cmp eax, ebx
jne 0x4cc977
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
shr esi, 1
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x4cc87b
sub eax, ecx
sar eax, 1
lea ebx, [eax + esi + 1]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b4117
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [ebp - 4]
test eax, eax
je 0x4cc8cb
push edi
call fcn.004b3716
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov dword [ebp - 4], edi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4cc8fa
test dx, dx
je 0x4cc8f6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4cc8fa
add eax, 4
add ecx, 4
test dx, dx
jne 0x4cc8d4
xor eax, eax
jmp 0x4cc8ff
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4cc972
mov ecx, dword [ebp - 4]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 4], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4cc90e
sub eax, dword [ebp - 4]
sar eax, 1
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4cc927
sub eax, edx
sar eax, 1
jne 0x4cc8ce
push dword [ebp + 0xc]
lea eax, [edi + esi*2 - 2]
push ebx
push eax
call fcn.004c4d65
lea eax, [ebx + ebx]
push eax
push edi
push 7
xor ecx, ecx
mov word [eax + edi - 2], cx
xor esi, esi
push esi
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [ebp - 0xc]
test eax, eax
je 0x4cc972
push edi
call fcn.004b3716
pop ecx
mov eax, esi
jmp 0x4cc8c6
xor esi, esi
inc esi
jmp 0x4cc964
cmp eax, 2
jne 0x4cc8c4
xor eax, eax
push 0x62
mov word [ebp - 0x9c], ax
lea eax, [ebp - 0x9a]
push ebx
push eax
call fcn.004b3f30
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x9c]
push 0x32
push eax
call fcn.004c4d65
lea eax, [ebp - 0x9c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4cc9b5
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 4]
push eax
lea eax, [ebp - 0x9c]
push eax
push 7
push ebx
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [ebp - 0xc]
test eax, eax
jne 0x4cc8c4
inc eax
jmp 0x4cc8c6
Function at 0x4cc9ea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push esi
push edi
push 0xf
pop ecx
mov esi, str.e____L___V_1___
lea edi, [ebp - 0xa4]
push 0x1c
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dx, word [ebp + ecx*2 - 0xa6]
lea eax, [ebp + ecx*2 - 0xa4]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4cca08
push 7
pop ecx
mov esi, str.M4_44
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x2948
xor word [ebp - 0xa4], ax
push 0xd
movsw word es:[edi], word [esi]
pop ecx
mov dx, word [ebp + ecx*2 - 0x22]
lea eax, [ebp + ecx*2 - 0x20]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4cca3d
push 8
pop ecx
mov esi, 0x4ee9a8
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x341e
xor word [ebp - 0x20], ax
push 0xf
movsw word es:[edi], word [esi]
pop ecx
mov dx, word [ebp + ecx*2 - 0x46]
lea eax, [ebp + ecx*2 - 0x44]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4cca69
push 9
pop ecx
push 0x10
mov esi, 0x4ee984
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov eax, 0x76da
xor word [ebp - 0x44], ax
pop edi
pop esi
mov dx, word [ebp + ecx*2 - 0x6a]
lea eax, [ebp + ecx*2 - 0x68]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4cca95
mov eax, 0x1edc
xor word [ebp - 0x68], ax
lea eax, [ebp - 0xa4]
push eax
push ebx
call fcn.004cc7fd
pop ecx
pop ecx
test eax, eax
je 0x4ccaf7
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.004cc7fd
pop ecx
pop ecx
test eax, eax
je 0x4ccaf7
lea eax, [ebp - 0x68]
push eax
push ebx
call fcn.004cc7fd
pop ecx
pop ecx
test eax, eax
je 0x4ccaf7
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.004cc7fd
pop ecx
pop ecx
test eax, eax
je 0x4ccaf7
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x4cd800
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx + 0x14]
push ebx
push esi
mov dword [ebp - 0x10], ecx
push edi
mov esi, dword [ecx + 0x10]
mov edx, dword [ecx]
lea eax, [ecx - 8]
mov dword [ebp - 8], edx
test esi, esi
je 0x4cd8b6
mov eax, dword [esi + 0x3c]
mov edx, dword [eax + esi + 0x78]
mov dword [ebp - 0x14], edx
test edx, edx
je 0x4cd8b6
mov ecx, dword [edx + esi + 0xc]
mov al, byte [ecx + esi]
add ecx, esi
mov dword [ebp - 4], 0
test al, al
je 0x4cd86e
mov edi, dword [ebp - 4]
ror edi, 0xf
cmp al, 0x61
movsx eax, al
jl 0x4cd861
sub eax, 0x20
add edi, eax
mov al, byte [ecx + 1]
inc ecx
mov dword [ebp - 4], edi
test al, al
jne 0x4cd851
mov ebx, dword [edx + esi + 0x20]
mov eax, dword [edx + esi + 0x18]
add ebx, esi
xor edi, edi
mov dword [ebp - 0xc], eax
test eax, eax
jbe 0x4cd8b6
mov ecx, dword [ebx + edi*4]
mov al, byte [ecx + esi]
add ecx, esi
xor edx, edx
test al, al
je 0x4cd8a6
nop
ror edx, 0xf
cmp al, 0x61
movsx eax, al
jl 0x4cd89d
sub eax, 0x20
inc ecx
add edx, eax
mov al, byte [ecx]
test al, al
jne 0x4cd890
mov ecx, dword [ebp - 4]
add edx, ecx
cmp dword [ebp + 8], edx
je 0x4cd8c6
inc edi
cmp edi, dword [ebp - 0xc]
jb 0x4cd881
mov edx, dword [ebp - 0x10]
cmp dword [ebp - 8], edx
je 0x4cd8e7
mov ecx, dword [ebp - 8]
jmp 0x4cd818
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + esi + 0x24]
lea edx, [ecx + edi*2]
movzx ecx, word [edx + esi]
mov edx, dword [eax + esi + 0x1c]
lea eax, [edx + ecx*4]
mov eax, dword [eax + esi]
pop edi
add eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cf30d
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push ebx
push esi
mov dword [ebp - 0x10], eax
push edi
lea ecx, [eax - 8]
mov edi, dword [ecx + 0x18]
mov eax, dword [eax]
mov dword [ebp - 8], eax
test edi, edi
je 0x4cf381
mov eax, dword [edi + 0x3c]
mov esi, dword [eax + edi + 0x78]
test esi, esi
je 0x4cf381
add esi, edi
mov eax, dword [esi + 0xc]
add eax, edi
push eax
call fcn.004c4764
mov ebx, dword [esi + 0x20]
and dword [ebp - 4], 0
add ebx, edi
cmp dword [esi + 0x18], 0
pop ecx
mov dword [ebp - 0xc], eax
jbe 0x4cf381
mov eax, dword [ebp - 4]
mov eax, dword [ebx + eax*4]
add eax, edi
push eax
call fcn.004c4764
add eax, dword [ebp - 0xc]
pop ecx
cmp dword [ebp + 8], eax
je 0x4cf38e
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x18]
jb 0x4cf35f
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
je 0x4cf3a8
mov eax, dword [ebp - 8]
jmp 0x4cf325
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + edi]
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + edi]
add eax, edi
jmp 0x4cf3aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cf887
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x61f968], 0
jne 0x4cf898
call fcn.004cf85d
xor ecx, ecx
or eax, 0xffffffff
cmp dword [ebp + 0xc], ecx
jbe 0x4cf8c1
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x61f568]
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x4cf8a2
pop ebp
ret

Function at 0x4cfde1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0xd9c80cfb
call fcn.004cf30d
mov dword [ebp - 0xc], eax
mov dword [esp], 0x1db96c46
call fcn.004cf30d
push 0x9c7d1073
mov dword [ebp - 0x14], eax
call fcn.004cf30d
push 0x5d5bf7c4
mov dword [ebp - 8], eax
call fcn.004cf30d
add esp, 0xc
push 9
pop ecx
mov esi, 0x4f0ba0
lea edi, [ebp - 0x38]
push 0x10
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], eax
pop ecx
xor ebx, ebx
mov dx, word [ebp + ecx*2 - 0x3a]
lea eax, [ebp + ecx*2 - 0x38]
xor word [eax], dx
dec ecx
cmp ecx, ebx
jg 0x4cfe35
push 9
pop ecx
mov esi, 0x4f0b78
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x5ef8
xor word [ebp - 0x38], ax
push 0x11
movsw word es:[edi], word [esi]
pop ecx
mov dx, word [ebp + ecx*2 - 0x62]
lea eax, [ebp + ecx*2 - 0x60]
xor word [eax], dx
dec ecx
cmp ecx, ebx
jg 0x4cfe61
mov eax, 0x8cd
xor word [ebp - 0x60], ax
xor edi, edi
inc edi
lea eax, [ebp - 0x38]
push edi
push eax
call fcn.004c7bed
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.004c7bed
add esp, 0x10
lea eax, [ebp - 4]
push eax
mov esi, 0x2000000
push esi
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [ebp - 0xc]
test eax, eax
je 0x4cfed1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0xc], edi
push dword [ebp + 8]
call dword [ebp - 0x10]
test eax, eax
je 0x4cfed1
xor eax, eax
jmp 0x4cff04
push 8
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [ebp - 0x14]
push dword [ebp - 4]
test eax, eax
je 0x4cfee8
call dword [ebp - 8]
jmp 0x4cfecd
call dword [ebp - 8]
lea eax, [ebp - 0x38]
push ebx
push eax
call fcn.004c7bed
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.004c7bed
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cff09
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 9
pop ecx
mov esi, 0x4f0bc4
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
push 0x10
pop ecx
xor esi, esi
mov dx, word [ebp + ecx*2 - 0x32]
lea eax, [ebp + ecx*2 - 0x30]
xor word [eax], dx
dec ecx
cmp ecx, esi
jg 0x4cff24
mov eax, 0x4d81
xor word [ebp - 0x30], ax
push 0xd9c80cfb
call fcn.004cf30d
push 0xea47fbbc
mov edi, eax
call fcn.004cf30d
push 0x9c7d1073
mov dword [ebp - 0xc], eax
call fcn.004cf30d
push 0xdedcf066
mov dword [ebp - 8], eax
call fcn.004cf30d
add esp, 0x10
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push dword [ebp + 0x10]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call edi
test eax, eax
je 0x4cff90
xor eax, eax
jmp 0x4cffdf
push dword [ebp + 0xc]
call ebx
lea eax, [ebp - 0x30]
push 1
push eax
call fcn.004c7bed
pop ecx
pop ecx
test eax, eax
je 0x4cff8c
push 1
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [ebp - 0xc]
test eax, eax
je 0x4cffca
lea eax, [ebp - 0x30]
push esi
push eax
call fcn.004c7bed
pop ecx
pop ecx
push dword [ebp - 4]
call dword [ebp - 8]
jmp 0x4cff8c
push dword [ebp - 4]
call dword [ebp - 8]
lea eax, [ebp - 0x30]
push esi
push eax
call fcn.004c7bed
pop ecx
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cffe4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0xdcc68363
call fcn.004cf30d
mov dword [ebp - 4], eax
mov dword [esp], 0x175c2821
call fcn.004cf30d
push 0xaec1bc34
mov dword [ebp - 0xc], eax
call fcn.004cf30d
push 0x9c7d1073
mov dword [ebp - 0x10], eax
call fcn.004cf30d
mov dword [ebp - 0x14], eax
xor eax, eax
xor esi, esi
push 0x208
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
call fcn.004b4117
mov ebx, 0x104
push ebx
mov edi, eax
push esi
push edi
call fcn.004b3f30
add esp, 0x1c
push dword [ebp + 8]
push ebx
push edi
call fcn.004c4d65
push edi
lea eax, [ebp - 0x20]
push eax
call dword [ebp - 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x18]
push eax
push 3
push esi
push esi
lea eax, [ebp - 0x40]
push eax
push 0x22
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x40], 0x18
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], 0x40
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
call dword [ebp - 0xc]
test eax, eax
je 0x4d009d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x4d00a3
push 9
sub eax, edx
pop ecx
sar eax, 1
mov esi, 0x4f0be8
lea edi, [ebp - 0x64]
add eax, eax
push 0x10
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
pop ecx
mov dx, word [ebp + ecx*2 - 0x66]
lea eax, [ebp + ecx*2 - 0x64]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4d00c6
mov eax, 0x29c1
xor word [ebp - 0x64], ax
xor eax, eax
xor edi, edi
push 0x208
mov dword [ebp - 0x24], edi
mov word [ebp - 0x28], ax
mov word [ebp - 0x26], ax
call fcn.004b4117
push ebx
mov esi, eax
push edi
push esi
call fcn.004b3f30
add esp, 0x10
lea eax, [ebp - 0x64]
push eax
push ebx
push esi
call fcn.004c4d65
push esi
lea eax, [ebp - 0x28]
push eax
call dword [ebp - 4]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push dword [ebp + 0xc]
push 6
push edi
push eax
push dword [ebp - 8]
call dword [ebp - 0x10]
test eax, eax
je 0x4d013d
push dword [ebp - 8]
call dword [ebp - 0x14]
mov eax, edi
jmp 0x4d0098
xor edi, edi
inc edi
jmp 0x4d0130
Function at 0x1000bec0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x100ed294]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3e8
push 0
lea eax, [ebp - 0x4bc]
push eax
call fcn.1006cfe0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov word [ebp - 8], cx
push 0xc8
push 0
lea edx, [ebp - 0xd4]
push edx
call fcn.1006cfe0
add esp, 0xc
mov dword [ebp - 0x4c4], 0
cmp dword [ebp + 8], 0
je 0x1000bf1e
cmp dword [ebp + 0xc], 0
jne 0x1000bf25
xor eax, eax
jmp 0x1000c056
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1000c054
mov dword [ebp - 0x4c0], 0
jmp 0x1000bf5a
mov ecx, dword [ebp - 0x4c0]
add ecx, 4
mov dword [ebp - 0x4c0], ecx
mov edx, dword [ebp - 0x4c0]
movzx eax, word [ebp + edx*2 - 0x4bc]
test eax, eax
je 0x1000c054
mov ecx, 2
imul edx, ecx, 0
mov eax, dword [ebp - 0x4c0]
mov cx, word [ebp + eax*2 - 0x4bc]
mov word [ebp + edx - 0xc], cx
mov edx, 2
shl edx, 0
mov eax, dword [ebp - 0x4c0]
mov cx, word [ebp + eax*2 - 0x4ba]
mov word [ebp + edx - 0xc], cx
mov edx, 2
shl edx, 1
mov dword [ebp - 0x4c8], edx
cmp dword [ebp - 0x4c8], 6
jae 0x1000bfbe
jmp 0x1000bfc3
call fcn.10063318
xor eax, eax
mov ecx, dword [ebp - 0x4c8]
mov word [ebp + ecx - 0xc], ax
push 0x64
lea edx, [ebp - 0xd4]
push edx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x1000bfec
jmp 0x1000bf4b
lea ecx, [ebp - 0xd4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x4c4], eax
mov edx, dword [ebp - 0x4c4]
push edx
lea eax, [ebp - 0xd4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1006f61c
add esp, 0xc
test eax, eax
jne 0x1000c04f
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1000eac0
mov edx, dword [ebp - 0x4c4]
mov eax, dword [ebp + 8]
lea ecx, [eax + edx*2]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.1000ea60
mov eax, 1
jmp 0x1000c056
jmp 0x1000bf4b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100633f2
mov esp, ebp
pop ebp
ret
Function at 0x1000c520
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x100ed294]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x9c], 0
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jne 0x1000c567
mov eax, dword [ebp - 0x9c]
jmp 0x1000c725
mov edx, dword [ebp - 0x94]
push edx
call fcn.1006f836
add esp, 4
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, dword [ebp - 0x94]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1000c710
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x90]
push ecx
push 0x100ac84c
mov edx, dword [ebp - 0x8c]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1000c710
cmp dword [ebp + 0xc], 0
je 0x1000c665
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + ecx]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx + eax]
and edx, 0xffff
movzx eax, dx
push eax
push str.StringFileInfo_04x_04xFileDescription
push 0x80
lea ecx, [ebp - 0x84]
push ecx
call fcn.1000ea00
add esp, 0x14
lea edx, [ebp - 0x98]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1000c665
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.1000eac0
cmp dword [ebp + 0x10], 0
je 0x1000c706
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + ecx]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx + eax]
and edx, 0xffff
movzx eax, dx
push eax
push str.StringFileInfo_04x_04xCompanyName
push 0x80
lea ecx, [ebp - 0x84]
push ecx
call fcn.1000ea00
add esp, 0x14
lea edx, [ebp - 0x98]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1000c706
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
push eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.1000eac0
mov dword [ebp - 0x9c], 1
mov eax, dword [ebp - 0x8c]
push eax
call fcn.1006f831
add esp, 4
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100633f2
mov esp, ebp
pop ebp
ret
Function at 0x1000cc20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x100ed294]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], 0xffffffff
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
je 0x1000ccdc
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.1006cfe0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x1000cccf
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp + 8]
jne 0x1000ccb4
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x23c], ecx
jmp 0x1000cccf
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x238], eax
jmp 0x1000cc92
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100633f2
mov esp, ebp
pop ebp
ret
Function at 0x1000d1a0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.10063450
mov eax, dword [0x100ed294]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x1000d1c3
cmp dword [ebp + 0x10], 0x64
jae 0x1000d1ca
xor eax, eax
jmp 0x1000d346
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0
jne 0x1000d211
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x1010
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0
jne 0x1000d211
xor eax, eax
jmp 0x1000d346
mov dword [ebp - 0x1010], 0x400
push 0x800
push 0
lea edx, [ebp - 0x804]
push edx
call fcn.1006cfe0
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.1006cfe0
add esp, 0xc
mov dword [ebp - 0x100c], 0
push 0x400
lea ecx, [ebp - 0x804]
push ecx
push 0
mov edx, dword [ebp - 0x1008]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x1000d2fa
push 0x800
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.1006cfe0
add esp, 0xc
push 0x800
push 0
lea ecx, [ebp - 0x1004]
push ecx
call fcn.1006cfe0
add esp, 0xc
push 0x400
lea edx, [ebp - 0x1004]
push edx
lea eax, [ebp - 0x804]
push eax
call fcn.1000bb90
add esp, 0xc
test eax, eax
je 0x1000d2d7
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x1004]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.1006f464
add esp, 0xc
jmp 0x1000d2ee
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x804]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.1006f464
add esp, 0xc
mov dword [ebp - 0x100c], 1
jmp 0x1000d333
push 0x400
lea ecx, [ebp - 0x804]
push ecx
mov edx, dword [ebp - 0x1008]
push edx
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x1000d333
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x804]
push edx
call fcn.1000bec0
add esp, 0xc
mov dword [ebp - 0x100c], eax
mov eax, dword [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x100c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100633f2
mov esp, ebp
pop ebp
ret