joyce8/EMBER2024-capa huggingface dataset:
Function at 0x393880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x40e]
push eax
movzx eax, word [ebp - 0x410]
push eax
movzx eax, word [ebp - 0x412]
push eax
movzx eax, word [ebp - 0x414]
push eax
movzx eax, word [ebp - 0x416]
push eax
movzx eax, word [ebp - 0x41a]
push eax
movzx eax, word [ebp - 0x41c]
push eax
push str.__4d__02d__02d__02d:_02d:_02d._03d_
lea eax, [ebp - 0x40c]
push 0x400
push eax
call fcn.00395c7a
mov esi, eax
mov ecx, 0x400
lea eax, [ebp + 0xc]
sub ecx, esi
push eax
push dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0x40c]
add ecx, esi
push ecx
call fcn.003979f0
push 0x3a7ee0
add esi, eax
lea eax, [ebp - 0x420]
push str.ventoy.log
push eax
call fcn.00396087
mov eax, dword [ebp - 0x420]
add esp, 0x48
test eax, eax
je 0x393970
push eax
push esi
lea eax, [ebp - 0x40c]
push 1
push eax
call fcn.00396225
push dword [ebp - 0x420]
push 1
push 1
push 0x3a7ef0
call fcn.00396225
push dword [ebp - 0x420]
call fcn.00396376
add esp, 0x24
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.003959f4
mov esp, ebp
pop ebp
ret
Function at 0x393980
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xff
lea eax, [ebp - 0x107]
mov dword [ebp - 0x10c], 0
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x108], 0
call fcn.0039aca0
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3939c4
sub ecx, edx
lea eax, [ecx - 1]
test eax, eax
js 0x393a03
mov cl, byte [esi + eax]
cmp cl, 0x5c
je 0x3939e6
cmp cl, 0x2f
je 0x3939e6
dec eax
jns 0x3939d4
jmp 0x393a03
inc eax
add eax, esi
push eax
push 0x3a7ef4
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.00395c7a
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
push esi
push str.Load_NT_driver:__s__s
call fcn.00393880
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x393a55
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_Error:_u
call fcn.00393880
lea eax, [edi + 1]
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.003959f4
mov esp, ebp
pop ebp
ret
push str.OpenSCManager_OK
call fcn.00393880
add esp, 4
lea eax, [ebp - 0x108]
push 0
push 0
push 0
push 0
push 0
push esi
push 1
push 3
push 1
push 0xf01ff
push eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x393b1e
call esi
mov esi, eax
cmp esi, 0x3e5
je 0x393ad6
cmp esi, 0x431
je 0x393ad6
push esi
push str.CreateService_failed_v__u
call fcn.00393880
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.003959f4
mov esp, ebp
pop ebp
ret
push 0xf01ff
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
jne 0x393b18
push esi
push str.OpenService_failed__u
call fcn.00393880
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebx + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.003959f4
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CreateService_imdisk_OK
call fcn.00393880
add esp, 4
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x393b49
push str.StartService_OK
call fcn.00393880
add esp, 4
jmp 0x393b76
call esi
cmp eax, 0x420
jne 0x393b5e
mov dword [ebp - 0x10c], 0
jmp 0x393b76
push eax
push str.StartService_error___u
call fcn.00393880
add esp, 8
mov dword [ebp - 0x10c], 1
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push edi
call esi
mov esi, dword [ebp - 0x10c]
mov eax, str.success
test esi, esi
mov ecx, str.failed
cmove ecx, eax
push ecx
push str.Load_NT_driver__s
call fcn.00393880
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.003959f4
mov esp, ebp
pop ebp
ret
Function at 0x393bc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], edx
push esi
push str.ReadWholeFile2Buf___s_
mov dword [ebp - 0x14], eax
mov ebx, 1
call fcn.00393880
add esp, 8
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x393c36
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Could_not_open_the_file__s___error:_u
call fcn.00393880
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.003959f4
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
push esi
call fcn.00395cce
add esp, 4
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x393c65
push esi
push str.Failed_to_alloc_memory_size:_u
call fcn.00393880
add esp, 8
jmp 0x393cbd
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x393ca0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 8]
push str.ReadFile_failed__dwSize:_u__error:_u
call fcn.00393880
add esp, 0xc
jmp 0x393cbd
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
push esi
push str.Success_read_file_size:_u
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
call fcn.00393880
add esp, 8
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.003959f4
mov esp, ebp
pop ebp
ret

Function at 0x393d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push dword [ebp + 8]
mov esi, ecx
mov ebx, edx
push esi
push str.SaveBuffer2File___s__len:_u
call fcn.00393880
add esp, 0xc
push 0
push 0
push 1
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x393dcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_create_new_file__error:_u
call fcn.00393880
add esp, 8
mov eax, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.003959f4
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.003959f4
mov esp, ebp
pop ebp
ret
Function at 0x393e00
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push 0x104
push 0x104
push eax
call fcn.003979f0
add esp, 0x14
lea eax, [ebp - 0x108]
push 0
push 0
push 3
push 0
push 1
push 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x393e6f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp dword [ebp + 8], 0
je 0x393e7f
test al, 0x10
jne 0x393e83
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.003959f4
mov esp, ebp
pop ebp
ret
test al, 0x10
jne 0x393e6f
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.003959f4
mov esp, ebp
pop ebp
ret
Function at 0x393ea0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
movsx ebx, cl
push ebx
push str.GetPhyDiskUUID__C
mov dword [ebp - 0x2b8], edx
mov dword [ebp - 0x2bc], eax
call fcn.00393880
push ebx
push str.._C:
lea eax, [ebp - 0x8c]
push 0x80
push eax
call fcn.00395c7a
add esp, 0x18
lea eax, [ebp - 0x8c]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x393f30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x8c]
push eax
push str.Could_not_open_the_disk__s___error:_u
call fcn.00393880
add esp, 0xc
jmp 0x394055
push 0
lea eax, [ebp - 0x290]
push eax
push 0x20
lea eax, [ebp - 0x2b4]
push eax
push 0
push 0
push 0x560000
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x39403a
cmp dword [ebp - 0x2b4], 0
je 0x39403a
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov eax, dword [ebp - 0x2ac]
mov ecx, dword [ebp - 0x2bc]
push eax
push ebx
push str._C:_is_in_PhysicalDrive_d
mov dword [ecx], eax
call fcn.00393880
add esp, 0xc
lea eax, [ebp - 0x8c]
push dword [ebp - 0x2ac]
push str..PhysicalDrive_d
push 0x80
push eax
call fcn.00395c7a
add esp, 0x10
lea eax, [ebp - 0x8c]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x393f10
push 0
lea eax, [ebp - 0x290]
push eax
push 0x200
lea eax, [ebp - 0x28c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x394012
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x290]
push str.ReadFile_failed__dwSize:_u__error:_u
call fcn.00393880
add esp, 0xc
push esi
call edi
jmp 0x394055
mov eax, dword [ebp - 0x2b8]
movdqu xmm0, xmmword [ebp - 0x10c]
push esi
movdqu xmmword [eax], xmm0
call edi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.003959f4
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeviceIoControl_IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS_failed__error:_u
call fcn.00393880
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.003959f4
mov esp, ebp
pop ebp
ret
Function at 0x394410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0
mov edi, ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
push eax
push 0x200
lea eax, [ebp - 0x208]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
push eax
push dword [ebp - 8]
push esi
push str.Read_MBR_Ret:_u_Size:_u_code:_u
call fcn.00393880
add esp, 0x10
cmp byte [ebp - 0x46], 0xee
jne 0x394503
push str.GPT_partition_style
call fcn.00393880
add esp, 4
push 0x4400
call fcn.00395cce
mov esi, eax
add esp, 4
test esi, esi
je 0x3944ee
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
push eax
push 0x4400
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test edi, edi
je 0x3944da
cmp dword [ebp - 8], 0x4400
jne 0x3944da
mov edi, dword [esi + 0x4a0]
mov ebx, dword [esi + 0x4a4]
push esi
call fcn.00395c96
add esp, 4
jmp 0x394515
call ebx
push eax
push dword [ebp - 8]
push edi
push str.Failed_to_read_gpt_info__d__u__d
call fcn.00393880
add esp, 0x10
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.003959f4
mov esp, ebp
pop ebp
ret
push str.MBR_partition_style
call fcn.00393880
mov edi, dword [ebp - 0x32]
add esp, 4
xor ebx, ebx
push ebx
push edi
push str.GetVentoyEfiPart_StartSector:__llu
call fcn.00393880
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, edi
mov edx, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.003959f4
mov esp, ebp
pop ebp
ret
Function at 0x394980
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
push str.DeleteVentoyPart2MountPoint_Phy_u_...
mov dword [ebp - 0xbc], ecx
mov byte [ebp - 0xb5], 0x41
mov dword [ebp - 0x8c], 0x5c3a3f
call fcn.00393880
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
test ebx, ebx
je 0x394b1f
mov al, byte [ebp - 0xb5]
test bl, 1
je 0x394b0f
movsx edi, al
push edi
push str._C:_ventoy_ventoy.cpio
push 0
call fcn.00393e00
add esp, 0xc
test eax, eax
je 0x394b09
push edi
push str.File__C:_ventoy_ventoy.cpio_exist
call fcn.00393880
push edi
push str.._C:
lea eax, [ebp - 0x88]
push 0x80
push eax
call fcn.00395c7a
add esp, 0x18
lea eax, [ebp - 0x88]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x394a5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x88]
push eax
push str.Could_not_open_the_disk__s___error:_u
call fcn.00393880
add esp, 0xc
jmp 0x394aef
push 0
lea eax, [ebp - 0xb4]
push eax
push 0x20
lea eax, [ebp - 0xb0]
push eax
push 0
push 0
push 0x560000
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x394acd
cmp dword [ebp - 0xb0], 0
je 0x394acd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x94]
lea eax, [ebp - 0x88]
push dword [ebp - 0x98]
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push dword [ebp - 0xa8]
push eax
push str.LogicalDrive:_s_PhyDrive:_d_Offset:_llu_ExtentLength:_llu
call fcn.00393880
mov esi, dword [ebp - 0xa8]
add esp, 0x1c
jmp 0x394af2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x88]
push eax
push str.DeviceIoControl_IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS_failed__s__error:_u
call fcn.00393880
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
push edi
push esi
push str.PhyDisk_u_for__C
call fcn.00393880
add esp, 0xc
cmp esi, dword [ebp - 0xbc]
je 0x394b35
mov al, byte [ebp - 0xb5]
inc al
shr ebx, 1
mov byte [ebp - 0xb5], al
jne 0x3949d1
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.003959f4
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0xb5]
mov byte [ebp - 0x8c], al
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.003959f4
mov esp, ebp
pop ebp
ret
Function at 0x394f90
Capabilities:
Copy file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str.Copy_unattended_XML_...
mov esi, ecx
call fcn.00393880
add esp, 4
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov bl, byte [ebp - 0x110]
cmp bl, 0x41
jl 0x394fd6
cmp bl, 0x5a
jle 0x394fdd
lea eax, [ebx - 0x61]
cmp al, 0x19
ja 0x394ff0
movsx eax, bl
push eax
push str.Current_Drive_Letter:__C
call fcn.00393880
add esp, 8
jmp 0x394ff2
mov bl, 0x58
movsx eax, bl
push eax
push str._C:Autounattend.xml
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00395c7a
lea eax, [ebp - 0x110]
push eax
push esi
push str.Copy_file___s________s_
call fcn.00393880
add esp, 0x1c
lea eax, [ebp - 0x110]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SystemSetup
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x395099
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x395070
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x110]
push eax
push 1
push 0
push str.UnattendFile
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.003959f4
mov esp, ebp
pop ebp
ret
Function at 0x3957b0
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x270
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x26c], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [edi]
test eax, eax
je 0x395874
cmp byte [eax], 0
je 0x395874
cmp byte [eax + 1], 0x3a
jne 0x395874
lea eax, [esp + 0x168]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [edi]
lea eax, [esp + 0x64]
push 0x104
push eax
call fcn.00395a88
add esp, 0xc
lea ecx, [esp + 0x60]
call fcn.003953a0
push 0x3a8b10
mov esi, eax
lea eax, [esp + 0x16c]
push 0x104
push eax
call fcn.003962a7
add esp, 0xc
lea eax, [esp + 0x168]
push esi
push 0x104
push eax
call fcn.003962a7
add esp, 0xc
lea eax, [esp + 0x168]
push eax
push dword [edi]
call fcn.00395b9e
add esp, 8
test eax, eax
je 0x395874
lea eax, [esp + 0x60]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str._VentoyJump_
call fcn.00393880
add esp, 4
push dword [edi]
push dword [ebp + 8]
push str.argc___d_argv_0_____s_
call fcn.00393880
add esp, 0xc
test esi, esi
je 0x3958c2
cmp byte [esi], 0
jne 0x3958c2
lea eax, [esp + 0x168]
push eax
push str.Old_current_directory____s_
call fcn.00393880
lea eax, [esp + 0x68]
push eax
push str.New_current_directory____s_
call fcn.00393880
add esp, 0x10
jmp 0x3958ea
lea eax, [esp + 0x168]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x168]
push eax
push str.Current_directory____s_
call fcn.00393880
add esp, 8
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x104
lea eax, [esp + 0x64]
push 0
push eax
call fcn.0039aca0
add esp, 0xc
lea eax, [esp + 0x60]
mov edx, edi
push eax
call fcn.003953f0
add esp, 4
mov esi, eax
cmp byte [0x3ad088], 3
jne 0x39594e
push str.Open_log_for_debug_...
call fcn.00393880
add esp, 4
lea eax, [esp + 0x60]
push str.notepad.exe_ventoy.log
push 0x3a7ef4
push 0x104
push eax
call fcn.00395c7a
add esp, 0x10
jmp 0x395977
or dword [esp + 0x44], 1
xor eax, eax
mov word [esp + 0x48], ax
mov ecx, str.failed
test esi, esi
mov eax, str.success
cmovne eax, ecx
push eax
push str.Ventoy_jump__s_...
call fcn.00393880
add esp, 8
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x80]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test esi, esi
je 0x3959d2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x3959b0
push str.Ventoy_hook_failed__now_wait_and_retry_...
call fcn.00393880
add esp, 4
push 0x3e8
call esi
mov ecx, 0x3ad0b0
call fcn.003950b0
test eax, eax
jne 0x3959b0
push 0xffffffffffffffff
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x274]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.003959f4
mov esp, ebp
pop ebp
ret
Function at 0x39d20e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0039a98c
mov dword [ebp - 0x14], eax
cmp dword [0x3abf44], esi
jne 0x39d301
push 0x800
push esi
push 0x3a7dac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x39d28e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x39d3e1
push esi
push esi
push 0x3a7dac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x39d3e1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x39d3e1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x3abf44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x3abf48], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x3abf4c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x3abf54], eax
test eax, eax
je 0x39d2fe
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x3abf50], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x39d326
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x39d319
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x39d33b
push 4
pop eax
jmp 0x39d3e3
cmp dword [ebp - 0x14], esi
je 0x39d33b
push dword [0x3abf44]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x39d320
mov eax, dword [0x3abf50]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x39d399
cmp dword [0x3abf54], edi
je 0x39d399
push eax
call ebx
push dword [0x3abf54]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x39d399
test eax, eax
je 0x39d399
call ecx
test eax, eax
je 0x39d38e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x39d38e
test byte [ebp - 8], 1
jne 0x39d399
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x39d3c9
mov eax, dword [0x3abf48]
cmp eax, edi
je 0x39d3c6
push eax
call ebx
test eax, eax
je 0x39d3c6
call eax
mov esi, eax
test esi, esi
je 0x39d3c6
mov eax, dword [0x3abf4c]
cmp eax, edi
je 0x39d3c6
push eax
call ebx
test eax, eax
je 0x39d3c6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x3abf44]
call ebx
test eax, eax
je 0x39d3e1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x39d3e3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.003959f4
mov esp, ebp
pop ebp
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3aed5f21
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x309c70b2
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219