joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40622e
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ebp - 0xc], 0
je 0x4061c6
mov eax, dword [ebp - 0x18]
xor edx, edx
jmp 0x4061d9
movsx eax, word [ebp - 0x40]
cmp eax, dword [ebp - 0x18]
jg 0x4061d2
mov eax, dword [ebp - 0x18]
movsx edx, word [ebp - 0x40]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 4]
lea ebx, [ebp - 0x3d]
cmp byte [ebp - 0x3e], 0
je 0x4061f6
cmp esi, dword [ebp + 8]
jne 0x4061f6
mov al, 0x2d
stosb byte es:[edi], al
lodsb al, byte [esi]
cmp al, 0x23
je 0x406222
cmp al, 0x30
je 0x406222
cmp al, 0x2e
je 0x4061f6
cmp al, 0x2c
je 0x4061f6
cmp al, 0x27
je 0x406229
cmp al, 0x22
je 0x406229
cmp al, 0x45
je 0x406237
cmp al, 0x65
je 0x406237
cmp al, 0x3b
je 0x40626e
or al, al
je 0x40626e
stosb byte es:[edi], al
jmp 0x4061f6
call 0x406274
jmp 0x4061f6
mov ah, al
lodsb al, byte [esi]
cmp al, ah
mov esi, 0x139db991
mov edx, 0x659a1ab8
xor edx, esi
xor edx, esi
mov ecx, 0x1561005
mov esi, 0x66880620
xor ecx, esi
xor ecx, edx
push 0x115115db
mov esi, 0x5b2a47e3
pop edx
xor esi, edx
push 0x3e3a40fd
mov ebx, 0x65d876a1
pop edx
xor ebx, edx
xor ebx, esi
xor ebx, ecx
push ebx
pop edi
mov edx, edi
mov ecx, edx
mov edx, 0x2f4cbdb5
xor edx, 0x2f4cbdb4
mov ebp, 0xf2812f4c
mov ah, 0xbd
dec esp
das
sub ecx, edx
mov eax, dword [ecx + 1]
mov edx, 0x6f
add edx, 0xffffff91
push edx
mov ecx, 0x2abb7c7
mov ebx, 0x2abb7c7
xor ebx, ecx
xor ebx, esp
push 0xe0d15c54
mov ecx, 0x1f2ea3a8
pop esi
xor ecx, esi
add esp, ecx
mov dword [esp], ebx
mov esi, 0xffffffc1
add esi, 0x7f
push esi
mov ebx, 0x5bc28391
xor ebx, 0x5bc21791
push ebx
mov ecx, 0x400000
mov ebx, 0x1000
xor ecx, ebx
push ecx
call eax
pop eax
mov ebx, 0x5a2fa01e
xor ebx, 0x5a2fa01f
mov ecx, 0
Function at 0x403ee7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi], edi
je 0x403f16
cmp dword [esi + 4], edi
jbe 0x403f0f
mov eax, dword [esi]
mov eax, dword [eax + edi*8]
test eax, eax
je 0x403f09
push eax
call fcn.004301e8
inc edi
cmp edi, dword [esi + 4]
jb 0x403efa
push dword [esi]
call fcn.004324f6
push ebx
xor ebx, ebx
mov edi, 0xe0
cmp dword [esi + 8], ebx
je 0x403f48
cmp dword [esi + 0xc], ebx
jbe 0x403f40
mov dword [ebp + 8], ebx
mov eax, dword [esi + 8]
add eax, dword [ebp + 8]
push eax
call fcn.00403e14
add dword [ebp + 8], edi
inc ebx
cmp ebx, dword [esi + 0xc]
jb 0x403f2b
push dword [esi + 8]
call fcn.004324f6
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x403f74
cmp dword [esi + 0x14], ebx
jbe 0x403f6c
and dword [ebp + 8], ebx
mov eax, dword [esi + 0x10]
add eax, dword [ebp + 8]
push eax
call fcn.00403e14
add dword [ebp + 8], edi
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x403f57
push dword [esi + 0x10]
call fcn.004324f6
xor edi, edi
pop ebx
cmp dword [esi + 0x18], edi
je 0x403f9f
cmp dword [esi + 0x1c], edi
jbe 0x403f97
mov eax, dword [esi + 0x18]
mov eax, dword [eax + edi*8]
test dword [edi + 0x65], eax
je 0x403fb9
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x73], 0x6c6c6174
push edx
imul esi, dword gs:[bp + di + 0x74], 0x654b7972
imul esi, dword [bp + di + 0x74], 0x654b7972
jns 0x403fcf
jo 0x404016
xor dword [eax], eax
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [ecx + 0x40], al
add byte [eax], al
add byte [esi + 0x2e000011], dh
adc dword [eax], eax
add byte [esi], ch
adc al, 0
add byte [0x516aede9], bl
cmp edi, dword [eax]
pop esp
add dword [edi - 0x7e818284], 0x383b8177
dec esi
dec esi
dec esi
cmp dword [ebx], 0x4e4e4e38
dec esi
adc byte [ebx - 0x6c685f5e], 0xa4
xchg ebx, eax
dec esi
mov al, byte [0xa1979593]
mov byte [0x994ea7a0], al
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
push esi
mov eax, dword [0x9d944e57]
mov al, byte [0xa1a7a14e]
mov byte [0x975b9b93], al
pushfd
mov eax, dword [0x9a9a8fa2]
xchg ebx, eax
xchg edx, eax
dec esi
invalid
invalid

Function at 0x405873
Capabilities:
Encode data using xor

Disassembly:
dec esi
push esi
pop eax
push edi
push eax
cmp edi, dword [eax]
dec esi
dec esi
dec esi
dec esi
push edx
cdq
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
pop esp
sbb dword [edi + edx*4 - 0x705d5e64], 0xffffff9a
lcall 0x959c, 0x97a0a281
cmp edi, dword [eax]
cmp edi, dword [eax]
dec esi
dec esi
dec esi
dec esi
test byte [ebx - 0x62685e60], dl
pushfd
dec esi
wait
invalid
Function at 0x427c82
Capabilities:
Check for vm using instruction vpcext

Disassembly:
add byte [ecx], al
or al, byte [esi]
push ss
add bh, byte [ebx + 0x2a]
add byte [eax], al
add byte [edx], al
add byte [edx], al
push es
sub byte [ecx], ch
add byte [eax], al
push es
sub dl, byte [ebx]
xor byte [eax + eax], al
sbb al, 0
add byte [eax], al
add dword [eax], eax
add byte [ecx], dl
jb 0x427d08
add al, byte [eax]
jo 0x427cb5
lea eax, [ecx]
add byte [eax], al
add dword [edx], ecx
push es
push ss
add bh, byte [ebx + 0x29]
add byte [eax], al
add al, 0xa2
push es
sub byte [ecx], ch
add byte [eax], al
push es
sub bl, byte [edx]
jb 0x427c79
ret 2
add al, byte [eax]
jo 0x427ce5
add dh, byte ds:[edx + 0x3e]
add eax, dword [eax]
jo 0x427d32
sub dword [eax], eax
add byte [edx], cl
push ss
inc byte [ecx]
sub al, byte [eax]
adc esi, dword [eax]
add al, 0
sbb al, 0
add byte [eax], al
add dword [eax], eax
add byte [ecx], dl
jb 0x427d2c
add eax, dword [eax]
jo 0x427cf5
lea eax, [ecx]
add byte [eax], al
add dword [edx], ecx
push es
push ss
add bh, byte [ebx + 0x2b]
add byte [eax], al
add al, 0xa2
push es
sub byte [ecx], ch
add byte [eax], al
push es
sub dl, byte [ebx]
xor byte [eax + eax], al
sbb eax, dword [eax]
add byte [eax], al
add dword [eax], eax
add byte [ecx], dl
jb 0x427cb0
add eax, dword [eax]
jo 0x427d1d
lea eax, [ecx]
add byte [eax], al
add dword [edx], ecx
push es
push ss
jb 0x427d1c
add al, byte [eax]
jo 0x427cb6
push es
sub byte [ecx], ch
add byte [eax], al
push es
sub al, byte [eax]
adc esi, dword [eax]
add al, 0
xor byte [eax + eax], al
sbb al, 0
add byte [eax], al
add dword [eax], eax
add byte [ecx], dl
jb 0x427d38
add al, 0
jo 0x427d45
lea eax, [ecx]
add byte [eax], al
add dword [edx], ecx
push es
push ss
add bh, byte [ebx + 0x2b]
add byte [eax], al
add al, 0xa2
sub eax, dword [eax]
add byte [edx], al
push es
sub byte [ecx], ch
add byte [eax], al
push es
sub dh, byte [edx]
add dh, byte [edx + 0x36]
add al, 0
jo 0x427dbb
sub dword [eax], eax
add byte [edx], cl
sub al, byte [eax]
add byte [eax], al
adc esi, dword [eax]
add al, 0
sbb al, 0
add byte [eax], al
add dword [eax], eax
add byte [ecx], dl
jb 0x427ddc
add al, 0
jo 0x427d7d
lea eax, [ecx]
add byte [eax], al
add dword [edx], ecx
push es
push ss
add bh, byte [ebx + 0x27]
add byte [eax], al
add al, 0xa2
push es
sub byte [ecx], ch
add byte [eax], al
push es
sub dh, byte [edx]
add dh, byte [edx + 0x35]
add eax, 0x296f7000
add byte [eax], al
or ch, byte [edx]
sbb dh, byte [edx + 0x4d]
add eax, 0x322a7000
add dh, byte [edx - 0x35]
add eax, 0x296f7000
add byte [eax], al
or ch, byte [edx]
sbb dh, byte [edx - 0xd]
add eax, 0x322a7000
add dh, byte [edx - 0x72]
push es
add byte [eax + 0x6f], dh
sub dword [eax], eax
add byte [edx], cl
sub bl, byte [edx]
jb 0x427d5c
push es
add byte [eax + 0x2a], dh
sub eax, dword [edi]
Function at 0x427e1e
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor al, byte [edx]
jb 0x427de7
pop es
add byte [eax + 0x6f], dh
sub dword [eax], eax
add byte [edx], cl
sub al, byte [eax]
add byte [eax], al
adc esi, dword [eax]
add al, 0
pop esp
add byte [eax], al
add byte [ecx], al
add byte [eax], al
adc dword [edx + 0x45], esi
inc ebp
pop es
add byte [eax + 0x1c], dh
lea eax, [ecx]
add byte [eax], al
add dword [edx], ecx
push es
push ss
add bh, byte [ebx + 0x26]
add byte [eax], al
add al, 0xa2
push es
pop ss
add bh, byte [ebx + 0x27]
add byte [eax], al
add al, 0xa2
push es
sbb byte [edx], al
jnp 0x427e1c
add byte [eax], al
add al, 0x8c
and eax, 0xa2010000
push es
sbb dword [edx], eax
jnp 0x427e2d
add byte [eax], al
add al, 0x8c
and eax, 0xa2010000
push es
sbb dh, byte [edx + 0xc]
add al, byte [eax]
jo 0x427db8
push es
sbb eax, dword [edx]
jnp 0x427e41
add byte [eax], al
add al, 0x28
invalid
add byte [eax + ebp], al
sub byte [ebx], ch
add byte [eax], al
or cl, byte [ebp - 0x5dff0000]
sub eax, dword [eax]
add byte [edx], cl
mov word [0xa2010000], fs
push es
sub byte [ecx], ch
add byte [eax], al
push es
add byte [esi], al
sub dh, byte [edx]
add dh, byte [edx + 0x2b]
pop es
add byte [eax + 0x6f], dh
sub dword [eax], eax
add byte [edx], cl
sub dh, byte [edx]
add dh, byte [edx - 0x67]
add byte [eax], al
jo 0x427eb4
sub dword [eax], eax
add byte [edx], cl
sub bl, byte [edx]
jb 0x427dd5
adc dword [eax], eax
jo 0x427e7b
sbb dh, byte [edx + 0x23]
adc al, byte [eax]
jo 0x427e82
adc esi, dword [eax]
add al, 0
and dword [eax], eax
add byte [eax], al
add dword [eax], eax
add byte [ecx], dl
jb 0x427ed9
adc al, byte [eax]
jo 0x427e81
add byte [eax], al
push es
Function at 0x427e30
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor al, byte [edx]
jb 0x427de7
pop es
add byte [eax + 0x6f], dh
sub dword [eax], eax
add byte [edx], cl
sub al, byte [eax]
add byte [eax], al
adc esi, dword [eax]
add al, 0
pop esp
add byte [eax], al
add byte [ecx], al
add byte [eax], al
adc dword [edx + 0x45], esi
inc ebp
pop es
add byte [eax + 0x1c], dh
lea eax, [ecx]
add byte [eax], al
add dword [edx], ecx
push es
push ss
add bh, byte [ebx + 0x26]
add byte [eax], al
add al, 0xa2
push es
pop ss
add bh, byte [ebx + 0x27]
add byte [eax], al
add al, 0xa2
push es
sbb byte [edx], al
jnp 0x427e1c
add byte [eax], al
add al, 0x8c
and eax, 0xa2010000
push es
sbb dword [edx], eax
jnp 0x427e2d
add byte [eax], al
add al, 0x8c
and eax, 0xa2010000
push es
sbb dh, byte [edx + 0xc]
add al, byte [eax]
jo 0x427db8
push es
sbb eax, dword [edx]
jnp 0x427e41
add byte [eax], al
add al, 0x28
invalid
add byte [eax + ebp], al
sub byte [ebx], ch
add byte [eax], al
or cl, byte [ebp - 0x5dff0000]
sub eax, dword [eax]
add byte [edx], cl
mov word [0xa2010000], fs
push es
sub byte [ecx], ch
add byte [eax], al
push es
add byte [esi], al
sub dh, byte [edx]
add dh, byte [edx + 0x2b]
pop es
add byte [eax + 0x6f], dh
sub dword [eax], eax
add byte [edx], cl
sub dh, byte [edx]
add dh, byte [edx - 0x67]
add byte [eax], al
jo 0x427eb4
sub dword [eax], eax
add byte [edx], cl
sub bl, byte [edx]
jb 0x427dd5
adc dword [eax], eax
jo 0x427e7b
sbb dh, byte [edx + 0x23]
adc al, byte [eax]
jo 0x427e82
adc esi, dword [eax]
add al, 0
and dword [eax], eax
add byte [eax], al
add dword [eax], eax
add byte [ecx], dl
jb 0x427ed9
adc al, byte [eax]
jo 0x427e81
add byte [eax], al
push es
Function at 0x401000
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x420044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x118
xor esi, esi
lea eax, [ebp - 0x11c]
push esi
push eax
call fcn.0040d8f0
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4010cb
mov eax, dword [ebp - 0x11c]
cmp eax, 5
jne 0x40109c
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x40107c
cmp word [ebp - 0xc], 4
jb 0x4010cb
mov esi, 1
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a476
mov esp, ebp
pop ebp
ret
cmp eax, 2
jae 0x401086
cmp eax, 1
jne 0x4010cb
mov esi, 3
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a476
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x4010cb
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x4010c1
mov esi, 4
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a476
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x4010cb
mov esi, 5
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040a476
mov esp, ebp
pop ebp
ret
Function at 0x401c60
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x420044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x206
xor edi, edi
lea ecx, [ebp - 0x20a]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x20c], ax
call fcn.0040d8f0
add esp, 0xc
mov dword [ebp - 0x210], edi
cmp esi, edi
je 0x401d1a
lea edx, [ebp - 0x20c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41c344
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a485
push 0x41c360
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0040a9af
mov eax, dword [ebp - 0x210]
add esp, 0x18
cmp eax, edi
je 0x401d1a
push eax
push 1
push 0x200
push esi
call fcn.0040ac40
mov eax, dword [ebp - 0x210]
push eax
call fcn.0040acca
add esp, 0x14
lea eax, [edi + 1]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a476
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0040a476
mov esp, ebp
pop ebp
ret

Function at 0x401d30
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x420044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x206
xor edi, edi
lea ecx, [ebp - 0x20a]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x20c], ax
call fcn.0040d8f0
add esp, 0xc
mov dword [ebp - 0x210], edi
cmp esi, edi
je 0x401e26
cmp dword [0x420f3c], 3
jne 0x401da8
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41c368
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a485
add esp, 0xc
jmp 0x401dba
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41c28c
lea edx, [ebp - 0x20c]
push 0x104
push edx
call fcn.0040a485
push 0x41c360
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040a9af
mov eax, dword [ebp - 0x210]
add esp, 0x18
cmp eax, edi
je 0x401e26
push eax
push 1
push 0x200
push esi
call fcn.0040ac40
mov edx, dword [ebp - 0x210]
push edx
call fcn.0040acca
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a476
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0040a476
mov esp, ebp
pop ebp
ret

Function at 0x401e40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x420044]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.0040d8f0
add esp, 0xc
cmp dword [0x420f3c], 3
jne 0x401ea7
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41c368
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a485
add esp, 0xc
jmp 0x401eb9
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea edx, [ebp - 0x20c]
push edx
push 0x41c36c
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x10
call fcn.0040a476
mov esp, ebp
pop ebp
ret
Function at 0x401fa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, eax
push edi
xor eax, eax
xor edi, edi
mov dword [ebp - 4], eax
cmp esi, 0xffffffff
je 0x4020c8
push 0x400
call fcn.0040aded
add esp, 4
push 0x400
mov ebx, eax
push edi
push ebx
call fcn.0040d8f0
add esp, 0xc
push esi
call fcn.004021f0
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], ecx
shld ecx, eax, 9
add esp, 4
shl eax, 9
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 8]
push ecx
push 0x400
push ebx
push esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x4020b8
cmp dword [ebx + 4], 0x5042475f
jne 0x402043
lea eax, [ebx + 0x10e]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402032
sub eax, edx
sar eax, 1
jne 0x4020a1
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x400
push ebx
push esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 0x3c00
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x4020b8
cmp dword [ebx + 4], 0x5042475f
jne 0x4020b8
lea eax, [ebx + 0x10e]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402090
sub eax, edx
sar eax, 1
je 0x4020b8
mov edi, dword [ebp + 8]
mov ecx, 0x8d
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
mov dword [ebp - 4], 1
cmp ebx, edi
je 0x4020c5
push ebx
call fcn.0040ae6d
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4020d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x420044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x24a]
push edx
mov dword [ebp - 0x254], eax
mov word [ebp - 0x24c], cx
call fcn.0040d8f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x250], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [ebp - 0x24c]
sub ecx, 0x41
push ecx
lea ebx, [ebp - 0x250]
call fcn.00402330
xor eax, eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
mov eax, dword [ebp - 0x250]
mov ecx, 9
mov esi, 0x41c380
lea edi, [ebp - 0x44]
xor edx, edx
add esp, 4
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20], 0
mov word [ebp - 0x1c], dx
test eax, eax
js 0x4021b8
push 0xa
push 0xa
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.0040b9ec
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x44]
push 0x14
push eax
call fcn.0040a485
add esp, 0x1c
push 0
push 0
push 3
push 0
push 3
push connect
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4021cb
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040a476
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x254]
push edx
call fcn.00401fa0
mov ecx, dword [ebp - 8]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a476
mov esp, ebp
pop ebp
ret
Function at 0x4021f0
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
je 0x402317
push 0xb69
call fcn.0040aded
mov ecx, dword [ebp + 8]
add esp, 4
push ebx
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0xb69
push esi
push ebx
push ebx
push 0x70050
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40230a
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
test eax, eax
jl 0x40226a
jg 0x40225b
test ecx, ecx
je 0x40226a
mov ebx, dword [esi + 0x38]
mov edi, eax
mov eax, dword [esi + 0x3c]
mov edx, ecx
mov dword [ebp - 0x14], eax
jmp 0x40226d
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0xbd]
mov ecx, dword [esi + 0xb9]
cmp eax, edi
jl 0x40229a
jg 0x402283
cmp ecx, edx
jbe 0x40229a
mov ebx, dword [esi + 0xc1]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0xc5]
mov edx, dword [ebp - 0x10]
mov edi, eax
mov dword [ebp - 0x14], ecx
mov eax, dword [esi + 0x146]
mov ecx, dword [esi + 0x142]
cmp eax, edi
jl 0x4022c6
jg 0x4022b0
cmp ecx, edx
jbe 0x4022c6
mov edx, dword [esi + 0x14e]
mov ebx, dword [esi + 0x14a]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
mov edi, eax
mov edx, ecx
mov eax, dword [esi + 0x1cf]
mov ecx, dword [esi + 0x1cb]
cmp eax, edi
jl 0x4022f2
jg 0x4022dc
cmp ecx, edx
jbe 0x4022f2
mov ebx, dword [esi + 0x1d3]
mov edi, eax
mov eax, dword [esi + 0x1d7]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov edx, ecx
mov eax, dword [ebp - 0x14]
push 0
add ebx, edx
push 0x200
adc eax, edi
push eax
push ebx
call fcn.00415770
mov dword [ebp - 4], eax
test esi, esi
je 0x402317
push esi
call fcn.0040ae6d
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4025d0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x420044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4025fa
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040a476
mov esp, ebp
pop ebp
ret
cmp dword [eax], 0x504d534d
jne 0x4025ea
push 0x200
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0040a590
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x414]
not cl
mov byte [ebp + eax - 0x414], cl
inc eax
cmp eax, 0x200
jb 0x402620
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x212]
push eax
mov word [ebp - 0x214], dx
call fcn.0040d8f0
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
push 0x104
mov dword [ebp - 0x418], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41c344
lea edx, [ebp - 0x214]
push 0x104
push edx
call fcn.0040a485
push 0x41c3d4
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.0040a9af
mov eax, dword [ebp - 0x418]
add esp, 0x18
test eax, eax
je 0x4026d0
push eax
push 1
lea edx, [ebp - 0x414]
push 0x200
push edx
call fcn.0040afcf
mov eax, dword [ebp - 0x418]
push eax
call fcn.0040acca
add esp, 0x14
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov eax, 1
call fcn.0040a476
mov esp, ebp
pop ebp
ret

Function at 0x4026f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x41c360
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], 0
call fcn.0040a9af
add esp, 0xc
test eax, eax
je 0x402719
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push ebx
push esi
push edi
push 2
push 0
push edx
call fcn.0040b0d3
mov eax, dword [ebp - 4]
push eax
call fcn.0040b2e3
mov ecx, dword [ebp - 4]
push 0
push 0
push ecx
mov esi, eax
call fcn.0040b0d3
lea eax, [esi + 0x32]
push eax
mov dword [ebp - 8], eax
call fcn.0040b348
mov edx, dword [ebp - 4]
push edx
push 1
mov ebx, eax
push esi
push ebx
call fcn.0040ac40
mov eax, dword [ebp - 4]
push eax
call fcn.0040acca
push 0x32
lea edi, [ebx + esi]
push 0
push edi
call fcn.0040d8f0
add esp, 0x40
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040a55d
add esp, 4
xor esi, esi
call fcn.0040a56f
mov dword [edi + esi*4], eax
inc esi
cmp esi, 0xc
jl 0x402786
mov ecx, dword [ebp + 8]
push 0x41c3d4
push ecx
lea edx, [ebp - 4]
push edx
call fcn.0040a9af
add esp, 0xc
test eax, eax
je 0x4027b6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push eax
push 1
push ecx
push ebx
call fcn.0040afcf
mov edx, dword [ebp - 4]
push edx
call fcn.0040acca
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret