joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56053c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c8]
mov edx, 0x80000005
call fcn.00451f7c
mov dl, 1
mov eax, dword [0x41a5e8]
call fcn.00421ed8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56069c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00402c18
push 0x4101
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x90
mov eax, dword [0x58a120]
call fcn.0040404c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 4]
call fcn.0042227c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c8]
mov edx, dword [ebp - 4]
call fcn.00451bac
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00402c18
push 0x4103
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x90
mov eax, dword [0x58a120]
call fcn.0040404c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 4]
call fcn.0042227c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c8]
mov edx, dword [ebp - 4]
call fcn.00451bac
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00402c18
push 0xc101
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x90
mov eax, dword [0x58a120]
call fcn.0040404c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 4]
call fcn.0042227c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c8]
mov edx, dword [ebp - 4]
call fcn.00451bac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5606a3
mov eax, dword [ebp - 4]
call fcn.00402fa8
ret
Function at 0x56ad48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x208]
call fcn.00482918
mov esi, eax
dec esi
test esi, esi
jle 0x56ad9d
mov ebx, 1
mov eax, dword [edi + 0x208]
mov edx, ebx
call fcn.00482950
mov edx, 3
call fcn.004823d8
xor al, 1
push eax
mov eax, dword [edi + 0x208]
mov edx, ebx
call fcn.00482950
mov edx, 3
pop ecx
call fcn.00482444
inc ebx
dec esi
jne 0x56ad67
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x57782c
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x57789b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0xffffffff
je 0x577885
cmp dword [ebx + 0x1c4], 0xffffffff
je 0x577885
push 4
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
mov eax, dword [ebx + 0x1c4]
push eax
call sub.wsock32.dll_setsockopt
lea eax, [ebp - 8]
push eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.0057c288
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5778a2
lea eax, [ebp - 8]
call fcn.00403c0c
ret
Function at 0x57aa60
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x57ab3b
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [edi + 0x1c4], esi
inc esi
jne 0x57aaa1
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dx, 0x2733
mov eax, edi
call fcn.0057c288
mov edx, dword [edi + 0xf4]
mov eax, edi
call fcn.0057922c
mov dl, 1
mov eax, edi
call fcn.005778a8
mov byte [edi + 0x1dc], 1
mov byte [edi + 0x201], 1
mov byte [edi + 0x128], 0
test bl, bl
je 0x57aaec
push 0x28
push 0x466
mov eax, dword [edi + 0x1e0]
push eax
mov eax, dword [edi + 0x1c4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x57ab06
push 0x28
push 0x465
mov eax, dword [edi + 0x1e0]
push eax
mov eax, dword [edi + 0x1c4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 5
mov eax, dword [edi + 0x1c4]
push eax
call sub.wsock32.dll_listen
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dx, 0x2733
mov eax, edi
call fcn.0057c288
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57ab42
lea eax, [ebp - 4]
call fcn.00403c0c
ret
Function at 0x57b248
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
cmp eax, 0xffffffff
jne 0x57b270
or ebx, 0xffffffff
jmp 0x57b392
mov edx, dword [ebp - 4]
cmp byte [edx + 0x148], 0
je 0x57b380
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c4], 0xffffffff
je 0x57b29d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x178], 0
jne 0x57b2a5
or ebx, 0xffffffff
jmp 0x57b3a4
xor eax, eax
push ebp
push 0x57b2dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x178]
push eax
mov eax, dword [0x585de0]
mov eax, dword [eax]
call eax
add esp, 0xc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57b2ea
test ebx, ebx
jg 0x57b377
cmp dword [ebp - 0x10], 0xc8
jg 0x57b377
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x178]
push eax
mov eax, dword [0x586074]
mov eax, dword [eax]
call eax
add esp, 8
sub eax, 1
jb 0x57b377
je 0x57b343
sub eax, 4
je 0x57b323
dec eax
je 0x57b335
jmp 0x57b351
test ebx, ebx
je 0x57b377
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0057c0e8
jmp 0x57b377
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0057c0e8
jmp 0x57b377
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0057c0e8
jmp 0x57b377
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc4], 0
je 0x57b377
inc dword [ebp - 0x10]
cmp byte [ebp + 8], 0
jne 0x57b377
mov dx, 2
mov eax, dword [ebp - 4]
call fcn.0057c848
jmp 0x57b285
test ebx, ebx
jne 0x57b392
or ebx, 0xffffffff
jmp 0x57b392
push 0
mov edx, dword [ebp - 0xc]
push edx
mov edx, dword [ebp - 8]
push edx
push eax
call sub.wsock32.dll_recv
mov ebx, eax
test ebx, ebx
jle 0x57b3a4
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x160], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x57b3b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebx + 0x1c4]
cmp eax, 0xffffffff
jne 0x57b3d4
or esi, 0xffffffff
jmp 0x57b473
cmp byte [ebx + 0x148], 0
je 0x57b461
xor edi, edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
mov eax, dword [0x585a40]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
test esi, esi
jg 0x57b473
cmp edi, 0x14
jg 0x57b473
push esi
mov eax, dword [ebx + 0x178]
push eax
mov eax, dword [0x586074]
mov eax, dword [eax]
call eax
add esp, 8
sub eax, 1
jb 0x57b473
je 0x57b448
sub eax, 4
je 0x57b42e
dec eax
je 0x57b43b
jmp 0x57b455
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0057c0e8
jmp 0x57b473
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0057c0e8
jmp 0x57b473
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0057c0e8
jmp 0x57b473
cmp byte [ebx + 0xc4], 2
je 0x57b473
inc edi
jmp 0x57b3e3
push 0
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push eax
call sub.wsock32.dll_send
mov esi, eax
test esi, esi
jle 0x57b482
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x164], eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x57d730
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x57d9a9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x22
push 0x465
mov eax, dword [ebx + 0x1e0]
push eax
mov eax, dword [ebx + 0x1c4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx + 0xec]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov eax, dword [ebx + 0xf4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x57d9c0
call fcn.00409ffc
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x57d9e0
call fcn.00403ed4
cmp dword [ebx + 0xd0], 0
je 0x57d800
push dword [ebp - 8]
push 0x57d9ec
push dword [ebx + 0xd0]
push 0x57da10
push dword [ebx + 0xd4]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403f48
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xc]
call fcn.00456ca0
push dword [ebp - 0xc]
push 0x57d9e0
lea eax, [ebp - 8]
mov edx, 4
call fcn.00403f48
push dword [ebp - 8]
push 0x57da1c
push 0x57d9e0
push 0x57d9e0
lea eax, [ebp - 8]
mov edx, 4
call fcn.00403f48
mov eax, dword [ebp - 8]
call fcn.00403e88
push eax
mov eax, dword [ebp - 8]
call fcn.0040404c
mov edx, eax
mov eax, ebx
pop ecx
call fcn.00579a14
xor edx, edx
mov eax, ebx
call fcn.0057ad24
lea eax, [ebp - 4]
mov edx, 0x2000
call fcn.004041b8
mov eax, dword [ebp - 4]
call fcn.0040404c
xor ecx, ecx
mov edx, 0x2000
call fcn.004078bc
push 2
push 0x2000
mov eax, dword [ebp - 4]
call fcn.0040404c
push eax
mov eax, dword [ebx + 0x1c4]
push eax
call sub.wsock32.dll_recv
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040408c
mov eax, dword [ebp - 0xc]
mov edx, 0x57da3c
call fcn.00403f98
jne 0x57d8fc
mov edx, dword [ebp - 4]
mov eax, 0x57da4c
call fcn.00404170
mov esi, eax
test esi, esi
jle 0x57d907
lea edi, [esi + 4]
mov edx, edi
lea eax, [ebp - 4]
call fcn.004041b8
mov eax, dword [ebp - 4]
call fcn.0040404c
mov edx, edi
xor ecx, ecx
call fcn.004078bc
push 0
push edi
mov eax, dword [ebp - 4]
call fcn.0040404c
push eax
mov eax, dword [ebx + 0x1c4]
push eax
call sub.wsock32.dll_recv
mov esi, eax
lea eax, [ebp - 4]
mov edx, esi
call fcn.004041b8
jmp 0x57d926
mov dx, 3
mov eax, ebx
call fcn.0057c848
cmp byte [ebx + 0x200], 0
je 0x57d926
cmp byte [ebx + 0x1ae], 0
jne 0x57d926
cmp byte [ebx + 0x1ad], 0
je 0x57d864
mov eax, ebx
call fcn.0057ad7c
cmp byte [ebx + 0x150], 0
jne 0x57d964
push 0x23
push 0x465
mov eax, dword [ebx + 0x1e0]
push eax
mov eax, dword [ebx + 0x1c4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push ebx
push 0
push 0x468
mov eax, dword [ebx + 0x1e0]
push eax
call sub.user32.dll_SendMessageA
mov byte [ebx + 0x199], 5
mov dword [ebx + 0x1f0], 0xffffffff
mov dword [ebx + 0x1f4], 0xffffffff
mov byte [ebx + 0xfc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57d9b0
lea eax, [ebp - 0x20]
call fcn.00403c0c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403c30
ret
Function at 0x57da84
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x57db0a
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
push edi
call sub.wsock32.dll_htons
mov word [ebx + 0x1ca], ax
push 0x10
lea eax, [ebx + 0x1c8]
push eax
push esi
call sub.wsock32.dll_bind
push 1
push esi
call sub.wsock32.dll_listen
test eax, eax
sete al
xor al, 1
mov byte [ebp - 1], al
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebp - 8]
push eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.0057c288
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57db11
lea eax, [ebp - 8]
call fcn.00403c0c
ret
Function at 0x57e5d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, 0x57e0e0
call fcn.00406b44
xor eax, eax
push ebp
push 0x57f265
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x57f274
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [0x58a874], eax
call fcn.0040299c
push 0x57f284
call sub.user32.dll_RegisterWindowMessageA
mov edx, dword [0x585904]
mov dword [edx], eax
mov eax, dword [0x585d88]
mov eax, dword [eax]
call fcn.0043b3f4
mov eax, dword [0x585d88]
mov eax, dword [eax]
mov edx, 0x57f29c
call fcn.0043b014
call sub.kernel32.dll_GetTickCount
mov edx, dword [0x5857dc]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x45e070]
call fcn.0045e1b8
mov dword [0x58a754], eax
xor eax, eax
push ebp
push 0x57e7e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x80000001
call fcn.0057dfa8
test al, al
jne 0x57e68f
mov eax, 0x80000002
call fcn.0057dfa8
test al, al
je 0x57e789
push 0x58a758
push 0x1a
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00467ba4
test al, al
je 0x57e789
mov eax, 0x58a768
mov edx, 0x104
call fcn.004041b8
mov eax, dword [0x58a768]
call fcn.0040404c
push eax
mov eax, dword [0x58a758]
push eax
call sub.shell32.dll_SHGetPathFromIDList
test eax, eax
je 0x57e6ee
mov eax, dword [0x58a768]
call fcn.0040404c
call fcn.00409878
mov edx, eax
mov eax, 0x58a768
call fcn.004041b8
mov eax, 0x58a768
call fcn.00456440
mov eax, dword [0x58a768]
call fcn.0045647c
test al, al
je 0x57e740
mov eax, dword [0x585c3c]
mov edx, dword [0x58a768]
call fcn.00403c60
mov eax, dword [0x585c3c]
mov edx, 0x57f2b0
call fcn.00403e90
mov eax, dword [0x585c3c]
mov eax, dword [0x585c3c]
call fcn.00456440
mov eax, dword [0x585c3c]
mov eax, dword [eax]
call fcn.0045743c
cmp dword [0x58a758], 0
je 0x57e789
push 0x58a75c
call sub.shell32.dll_SHGetMalloc
call fcn.00467ba4
test al, al
je 0x57e789
mov eax, dword [0x58a758]
push eax
mov eax, dword [0x58a75c]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
test eax, eax
jle 0x57e789
mov eax, dword [0x58a758]
push eax
mov eax, dword [0x58a75c]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
mov dword [0x58a758], eax
mov eax, dword [0x585c3c]
mov eax, dword [eax]
mov edx, dword [0x585ebc]
mov edx, dword [edx]
call fcn.00403f98
jne 0x57e7a9
mov eax, 0x80000001
call fcn.0057dec0
mov eax, dword [0x585c3c]
mov eax, dword [eax]
mov edx, dword [0x585ebc]
mov edx, dword [edx]
call fcn.00403f98
jne 0x57e7c9
mov eax, 0x80000002
call fcn.0057dec0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57e7e8
mov eax, dword [0x58a754]
call fcn.00402fa8
ret
Function at 0x10043ea0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Packed with generic packer

Disassembly:
xor edi, edi
je 0x10043eaa
popal
jmp 0x40548bf4
mov edx, 0x4c
cmp byte [esp + 8], 1
jne 0x10044098
pushal
mov esi, section..rdata
xor edi, edi
je 0x10043eca
popal
jmp 0x40548c14
lea edi, [esi - 0xf000]
xor ecx, ecx
je 0x10043eda
popal
jmp 0x40548c24
mov eax, 0x7d
cmp edx, eax
mov eax, 0x4c
not eax
jne 0x10043f29
mov eax, dword fs:[0x30]
test eax, eax
js 0x10043f17
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x1000
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x10043f28
jmp 0x10043f29
xor eax, eax
mov al, byte fs:[0x20]
test eax, eax
jne 0x10043f28
jmp 0x10043f29
popal
push edi
or ebp, 0xffffffff
jmp 0x10043f3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10043f41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10043f30
mov eax, 1
add ebx, ebx
jne 0x10043f53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10043f48
jne 0x10043f64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10043f48
xor ecx, ecx
sub eax, 3
jb 0x10043f78
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10043fea
mov ebp, eax
add ebx, ebx
jne 0x10043f83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10043f90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10043fb4
inc ecx
add ebx, ebx
jne 0x10043fa0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10043f95
jne 0x10043fb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10043f95
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10043fd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10043fc5
jmp 0x10043f36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10043fd4
add edi, ecx
jmp 0x10043f36
pop esi
mov edi, esi
mov ecx, 0x21
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10043ff2
cmp byte [edi], 4
jne 0x10043ff2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x10043ff7
lea edi, [esi + 0x41000]
mov eax, dword [edi]
or eax, eax
je 0x10044066
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x44440]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x44490]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10044024
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x44494]
or eax, eax
je 0x10044060
mov dword [ebx], eax
add ebx, 4
jmp 0x10044041
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10044097
cmp al, 0xef
ja 0x1004408a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1004406c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10044079
popal
jmp loc.1000a7aa
Function at 0x4075ea
Capabilities:
Get disk information

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push eax
xor ebp, ebp
call fcn.004077ca
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x407612
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x20]
mov edx, dword [ebx]
lea eax, [edx*4 + 4]
push eax
call fcn.004083c6
mov esi, dword [esp + 0x20]
mov edi, eax
add esp, 4
test edi, edi
mov dword [esi], edi
jne 0x40763c
pop edi
pop esi
mov dword [ebx], eax
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [ebx]
xor eax, eax
push 0x8000
lea ecx, [ecx*4 + 4]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.004083c6
add esp, 4
mov ebx, eax
mov ecx, 0x2000
xor eax, eax
mov edi, ebx
push 0x8000
push ebx
push eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x40769f
mov eax, dword [esp + 0x20]
push ebx
mov dword [eax], 0
call fcn.00408738
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x18]
lea ecx, [eax + 0x8000]
cmp eax, ecx
jae 0x4077a5
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4077a1
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push edx
call fcn.0040e251
add esp, 0xc
test eax, eax
jne 0x407780
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, 8
push ecx
call fcn.004083c6
mov ecx, dword [esi]
mov edi, ebx
add esp, 4
mov dword [ecx + ebp*4], eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esi]
repne scasb al, byte es:[edi]
mov edi, dword [edx + ebp*4]
not ecx
add ecx, 3
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi]
mov edi, ebx
not ecx
mov edx, dword [eax + ebp*4]
add ecx, 3
mov dword [edx], ecx
mov eax, dword [esi]
mov edx, dword [str.._]
mov ecx, dword [eax + ebp*4]
add ecx, 4
mov dword [ecx], edx
mov al, byte [0x41d298]
mov byte [ecx + 4], al
mov ecx, dword [esi]
xor eax, eax
mov edx, dword [ecx + ebp*4]
or ecx, 0xffffffff
add edx, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
add eax, 0x8000
lea ebx, [ebx + ecx + 1]
cmp ebx, eax
jb 0x4076b1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push eax
mov dword [ecx], ebp
call fcn.00408738
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4098ab
Capabilities:
Check os version
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x122c
call fcn.00408a1b
lea eax, [ebp - 0x98]
push ebx
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
je 0x4098ee
cmp dword [ebp - 0x88], 2
jne 0x4098ee
cmp dword [ebp - 0x94], 5
jb 0x4098ee
push 1
pop eax
jmp 0x4099f0
lea eax, [ebp - 0x122c]
push 0x1090
push eax
push 0x40e84f
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4099dd
xor ebx, ebx
lea ecx, [ebp - 0x122c]
cmp byte [ebp - 0x122c], bl
je 0x409930
mov al, byte [ecx]
cmp al, 0x61
jl 0x40992b
cmp al, 0x7a
jg 0x40992b
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x40991d
lea eax, [ebp - 0x122c]
push 0x16
push eax
push 0x40e837
call fcn.0040882b
add esp, 0xc
test eax, eax
jne 0x409952
lea eax, [ebp - 0x122c]
jmp 0x40999b
lea eax, [ebp - 0x19c]
push 0x104
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x19c], bl
lea ecx, [ebp - 0x19c]
je 0x409986
mov al, byte [ecx]
cmp al, 0x61
jl 0x409981
cmp al, 0x7a
jg 0x409981
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x409973
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x122c]
push eax
call fcn.0040ca92
pop ecx
pop ecx
cmp eax, ebx
je 0x4099dd
push 0x2c
push eax
call fcn.0040851f
pop ecx
cmp eax, ebx
pop ecx
je 0x4099dd
inc eax
mov ecx, eax
cmp byte [eax], bl
je 0x4099c2
cmp byte [ecx], 0x3b
jne 0x4099bd
mov byte [ecx], bl
jmp 0x4099be
inc ecx
cmp byte [ecx], bl
jne 0x4099b4
push 0xa
push ebx
push eax
call fcn.0040c86c
add esp, 0xc
cmp eax, 2
je 0x4099f0
cmp eax, 3
je 0x4099f0
cmp eax, 1
je 0x4099f0
lea eax, [ebp - 4]
push eax
call fcn.0040987e
cmp byte [ebp - 4], 6
pop ecx
sbb eax, eax
add eax, 3
pop ebx
leave
ret
Function at 0x40b5dc
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x42027c]
push ebx
push ebp
mov ebp, dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x40b62a
call ebp
mov esi, eax
cmp esi, ebx
je 0x40b60b
mov dword [0x42027c], 1
jmp 0x40b633
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsA]
mov edi, eax
cmp edi, ebx
je 0x40b705
mov dword [0x42027c], 2
jmp 0x40b6b9
cmp eax, 1
jne 0x40b6b4
cmp esi, ebx
jne 0x40b643
call ebp
mov esi, eax
cmp esi, ebx
je 0x40b705
cmp word [esi], bx
mov eax, esi
je 0x40b658
inc eax
inc eax
cmp word [eax], bx
jne 0x40b64a
inc eax
inc eax
cmp word [eax], bx
jne 0x40b64a
sub eax, esi
mov edi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sar eax, 1
push ebx
push ebx
inc eax
push ebx
push ebx
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x40b6a9
push ebp
call fcn.004083c6
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x40b6a9
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
jne 0x40b6a5
push dword [esp + 0x10]
call fcn.00408738
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x40b707
cmp eax, 2
jne 0x40b705
cmp edi, ebx
jne 0x40b6c9
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsA]
mov edi, eax
cmp edi, ebx
je 0x40b705
cmp byte [edi], bl
mov eax, edi
je 0x40b6d9
inc eax
cmp byte [eax], bl
jne 0x40b6cf
inc eax
cmp byte [eax], bl
jne 0x40b6cf
sub eax, edi
inc eax
mov ebp, eax
push ebp
call fcn.004083c6
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x40b6ef
xor esi, esi
jmp 0x40b6fa
push ebp
push edi
push esi
call fcn.0040cf63
add esp, 0xc
push edi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
mov eax, esi
jmp 0x40b707
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret