joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426248
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x426292
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x426239
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x426248
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x82beeb
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x426299
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.0040d10f
cmp eax, dword [ebp + 0xc]
pop eax
je 0x426338
add edi, 4
add eax, 2
dec ecx
jne 0x42627e
call 0x4262e5
loope 0x4262db
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x426335
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x426346
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4262f9
cmp eax, ecx
ja 0x4262f9
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x426383
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x426379
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.0040d5ee
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x16044bad
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4e3506b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10001000
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [0x100555dc]
mov cx, word [0x100555e0]
mov dword [esp], eax
mov word [esp + 4], cx
mov dword [esp + 6], 0
test esi, esi
je 0x10001078
mov eax, dword [esp + 0x14]
push 0x104
push esi
lea ecx, [esp + 8]
xor edx, edx
add eax, 0x41
push ecx
mov word [esi], dx
mov word [esp + 0xc], ax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10001078
push 0x104
push esi
call fcn.100327cc
add esp, 8
mov eax, 1
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10032551
add esp, 0x10
ret 4
mov ecx, dword [esp + 0xc]
xor ecx, esp
xor eax, eax
call fcn.10032551
add esp, 0x10
ret 4
Function at 0x10001190
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x1004e6db
mov eax, dword fs:[0]
push eax
sub esp, 0x480
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x478], eax
push esi
push edi
mov eax, dword [0x10062da0]
xor eax, esp
push eax
lea eax, [esp + 0x48c]
mov dword fs:[0], eax
mov al, byte [esp + 0x49c]
lea ecx, [esp + 0x10]
push 4
mov dword [esp + 0x14], 0x5c3a41
push ecx
mov byte [esp + 0x18], al
call fcn.10032996
xor edi, edi
add esp, 8
cmp dword [0x1006a0e8], edi
je 0x10001350
push 0x3fe
lea eax, [esp + 0x6a]
xor edx, edx
push edi
push eax
mov word [esp + 0x70], dx
call fcn.10037cf0
movsx ecx, byte [esp + 0x1c]
xor eax, eax
add esp, 0xc
sub ecx, 0x41
push ecx
lea esi, [esp + 0x68]
mov dword [esp + 0x468], eax
mov dword [esp + 0x46c], eax
mov dword [esp + 0x470], eax
mov dword [esp + 0x474], eax
mov dword [esp + 0x478], eax
mov dword [esp + 0x47c], eax
mov dword [esp + 0x480], eax
mov word [esp + 0x484], ax
call fcn.10001000
test eax, eax
jne 0x1000127e
push 0x10055670
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, 0x10055670
call fcn.10011e30
jmp 0x10001350
mov dword [esp + 0x14], vtable.CVistaCreateProcess.0
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
lea edx, [esp + 0x464]
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x49c], edi
call fcn.10012d90
test eax, eax
je 0x10001332
sub esp, 0x420
mov edi, esp
mov ecx, 0x107
lea esi, [esp + 0x484]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call dword [0x1006a0e8]
test eax, eax
jne 0x10001322
push 0x10055690
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, 0x10055690
call fcn.10011e30
lea ecx, [esp + 0x14]
call fcn.10012630
mov eax, 1
jmp 0x10001352
push 0x100556b0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, 0x100556b0
call fcn.10011e30
lea ecx, [esp + 0x14]
call fcn.10012630
xor eax, eax
mov ecx, dword [esp + 0x48c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x478]
xor ecx, esp
call fcn.10032551
add esp, 0x48c
ret 4
Function at 0x10001380
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x430
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x42c], eax
mov al, byte [esp + 0x434]
push esi
push edi
lea ecx, [esp + 0xc]
push 4
mov dword [esp + 0x10], 0x5c3a41
push ecx
mov byte [esp + 0x14], al
call fcn.10032996
add esp, 8
cmp dword [0x1006a0e4], 0
je 0x10001445
xor edx, edx
push 0x3fe
push edx
lea eax, [esp + 0x1a]
push eax
mov word [esp + 0x1c], dx
call fcn.10037cf0
movsx ecx, byte [esp + 0x18]
xor eax, eax
add esp, 0xc
sub ecx, 0x41
push ecx
lea esi, [esp + 0x14]
mov dword [esp + 0x414], eax
mov dword [esp + 0x418], eax
mov dword [esp + 0x41c], eax
mov dword [esp + 0x420], eax
mov dword [esp + 0x424], eax
mov dword [esp + 0x428], eax
mov dword [esp + 0x42c], eax
mov word [esp + 0x430], ax
call fcn.10001000
test eax, eax
jne 0x10001460
push 0x10055670
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, 0x10055670
call fcn.10011e30
xor eax, eax
mov ecx, dword [esp + 0x434]
pop edi
pop esi
xor ecx, esp
call fcn.10032551
add esp, 0x430
ret 4
sub esp, 0x420
mov edi, esp
mov ecx, 0x107
lea esi, [esp + 0x430]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call dword [0x1006a0e4]
test eax, eax
jne 0x10001494
push str.CDiskCtrlApp:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, str.CDiskCtrlApp:
jmp 0x10001440
mov eax, 1
jmp 0x10001447

Function at 0x100014b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push 0x103
lea eax, [esp + 0x10d]
push 0
push eax
mov bl, cl
mov byte [esp + 0x114], 0
call fcn.10037cf0
push 0x103
lea ecx, [esp + 0x15]
push 0
push ecx
mov byte [esp + 0x1c], 0
call fcn.10037cf0
add esp, 0x18
test esi, esi
je 0x100015ac
cmp bl, 0x41
jge 0x10001512
cmp bl, 0x5a
jg 0x100015ac
movsx edx, bl
sub edx, 0x41
push edx
push str.EdpInfo
push 0x10055704
lea eax, [esp + 0x114]
push 0x104
push eax
call fcn.10032b06
add esp, 0x14
push edi
lea ecx, [esp + 8]
push ecx
push 0x1005570c
lea edx, [esp + 0x114]
mov byte [esp + 0x10], bl
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push edx
call ebx
cmp byte [esi], 0
mov byte [esp + 4], 0
je 0x10001584
push edi
push 0x104
lea eax, [esp + 0xc]
push eax
push 0x1005571a
push str.LOGON
lea ecx, [esp + 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
lea edx, [esp + 8]
push 0x104
push edx
call fcn.10032a15
add esp, 0xc
push edi
lea eax, [esp + 8]
push eax
push str.LOGON
lea ecx, [esp + 0x114]
push ecx
call ebx
mov ecx, dword [esp + 0x20c]
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10032551
add esp, 0x20c
ret
Function at 0x100020e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
xor bl, bl
cmp dword [esp + 0x1c], 0
ja 0x10002102
cmp dword [esp + 0x20], 0x10
jb 0x100020fe
mov eax, dword [esp + 0xc]
push eax
call fcn.10024afb
add esp, 4
xor al, al
pop ebx
ret
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x10002111
lea eax, [esp + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jbe 0x10002192
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10055afc
push esi
call edi
push 0x10055b0c
push esi
mov dword [0x1006a088], eax
call edi
push 0x10055b1c
push esi
mov dword [0x1006a08c], eax
call edi
push 0x10055b28
push esi
mov dword [0x1006a090], eax
call edi
push 0x10055b34
push esi
mov dword [0x1006a094], eax
call edi
cmp dword [0x1006a088], 0
mov dword [0x1006a098], eax
pop edi
je 0x10002192
cmp dword [0x1006a08c], 0
je 0x10002192
cmp dword [0x1006a090], 0
je 0x10002192
cmp dword [0x1006a094], 0
je 0x10002192
test eax, eax
je 0x10002192
mov bl, 1
cmp dword [esp + 0x24], 0x10
pop esi
jb 0x100021a7
mov ecx, dword [esp + 0xc]
push ecx
call fcn.10024afb
add esp, 4
mov al, bl
pop ebx
ret

Function at 0x100027d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100027e9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10002824
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10002820
lea ebx, [ebx]
cmp esi, eax
jae 0x10002824
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10002810
cmp esi, eax
jb 0x1000282a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x10002e30
Capabilities:
Get disk size
Print debug messages

Disassembly:
sub esp, 0x138
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x134], eax
push ebx
push ebp
movsx ebp, byte [esp + 0x144]
xor eax, eax
push ebp
xor ebx, ebx
push 0x10055b74
lea edx, [esp + 0x2c]
mov byte [esp + 0x2c], bl
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov byte [esp + 0x35], al
call fcn.1000a6e0
push 0x103
lea eax, [esp + 0x3d]
push ebx
push eax
mov byte [esp + 0x44], bl
call fcn.10037cf0
lea ecx, [esp + 0x38]
push ecx
push str.GetDiskFreeSpaceExA_szDiskDir___s_n
lea edx, [esp + 0x4c]
call fcn.1000a700
add esp, 0x1c
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x10002f5e
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x10]
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0xc], eax
fild qword [esp + 8]
mov eax, dword [esp + 0x14]
and ecx, 0x80000000
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
fild qword [esp + 8]
mov ecx, eax
and eax, 0x7fffffff
fchs
mov dword [esp + 0x10], edx
faddp st(1)
mov dword [esp + 0x14], eax
fld qword [0x1005aff0]
and ecx, 0x80000000
fmul st(1), st(0)
fmul st(1), st(0)
fmul st(1), st(0)
fxch st(1)
fstp dword [esi]
fild qword [esp + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
fild qword [esp + 0x10]
fchs
mov eax, 1
faddp st(1)
fmul st(1)
fmul st(1)
fmulp st(1)
fstp dword [edi]
pop ebp
pop ebx
mov ecx, dword [esp + 0x134]
xor ecx, esp
call fcn.10032551
add esp, 0x138
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x10003010
push ebp
push 0x10055b9c
lea edx, [esp + 0x2c]
call fcn.1000a6e0
add esp, 8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x10003010
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x10]
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0xc], eax
fild qword [esp + 8]
mov eax, dword [esp + 0x14]
and ecx, 0x80000000
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
fild qword [esp + 8]
mov ecx, eax
and eax, 0x7fffffff
fchs
mov dword [esp + 0x10], edx
faddp st(1)
mov dword [esp + 0x14], eax
fld qword [0x1005aff0]
and ecx, 0x80000000
fmul st(1), st(0)
fmul st(1), st(0)
fmul st(1), st(0)
fxch st(1)
fstp dword [esi]
fild qword [esp + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
fild qword [esp + 0x10]
jmp 0x10002f36
mov ecx, dword [esp + 0x13c]
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10032551
add esp, 0x138
ret
Function at 0x100031f0
Capabilities:
Delete file
Move file

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x44]
mov dword [edi], vtable.CEdpEDiskCtrlInterface.0
cmp dword [esi + 0x20], 0
je 0x10003225
mov eax, dword [esi + 0x30]
test eax, eax
je 0x10003218
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi + 0x20]
push eax
call ebx
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10003236
push eax
call ebx
mov dword [esi + 0x1c], 0
mov eax, dword [edi + 0x180]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10003258
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 4
push 0
lea ecx, [edi + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
call fcn.100118f0
mov eax, dword [edi + 4]
test eax, eax
je 0x10003280
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [edi + 4], 0
mov dword [edi], vtable.CEdpEDiskCtrlIntBase.0
pop edi
pop esi
pop ebx
ret
Function at 0x10003c20
Capabilities:
Print debug messages

Disassembly:
mov dl, byte [0x1006b33a]
mov cl, byte [0x1006b33c]
xor eax, eax
push ebx
mov bl, byte [0x1006b33b]
test dl, dl
je 0x10003c74
test bl, bl
je 0x10003cac
test cl, cl
je 0x10003ce0
push 0x10055f7c
push eax
push 0x167
push str.CEdpEDiskCtrlInterface::GetPartitionsType
mov ecx, str..EdpEDiskCtrlInterface.cpp
call fcn.10010760
add esp, 0x10
push 0x10055fc0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
pop ebx
ret
test bl, bl
je 0x10003cac
test cl, cl
je 0x10003ce0
push 0x10055ff0
push 0
push 0x16d
push str.CEdpEDiskCtrlInterface::GetPartitionsType
mov ecx, str..EdpEDiskCtrlInterface.cpp
call fcn.10010760
add esp, 0x10
push 0x1005600c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 2
pop ebx
ret
test cl, cl
je 0x10003ce0
push 0x10056040
push 0
push 0x173
push str.CEdpEDiskCtrlInterface::GetPartitionsType
mov ecx, str..EdpEDiskCtrlInterface.cpp
call fcn.10010760
add esp, 0x10
push 0x10056060
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 3
pop ebx
ret
test dl, dl
je 0x10003d1a
test bl, bl
je 0x10003d1a
test cl, cl
jne 0x10003d1a
push 0x10056094
push 0
push 0x179
push str.CEdpEDiskCtrlInterface::GetPartitionsType
mov ecx, str..EdpEDiskCtrlInterface.cpp
call fcn.10010760
add esp, 0x10
push str.EdpEDiskCtrl_GetPartitionsType
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 4
pop ebx
ret
Function at 0x10007ce0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x1004dae8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push esi
mov eax, dword [0x10062da0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
push 0x40
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x18], 0
call fcn.10037cf0
add esp, 0xc
xor ecx, ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x20]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push esi
push ecx
mov dword [esp + 0x44], 0x44
mov word [esp + 0x74], cx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10007e13
call fcn.10025867
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x10007d75
push 0x80004005
call fcn.10002d80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
mov dword [esp + 0x70], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea ecx, [esp + 0x10]
push str.CreateProcess__s_Fail_Value_d
push ecx
call fcn.100027b0
mov esi, dword [esp + 0x18]
add esp, 0x10
cmp dword [esi - 4], 1
jle 0x10007dc2
mov edx, dword [esi - 0xc]
push edx
lea ecx, [esp + 0xc]
call fcn.10002a10
mov esi, dword [esp + 8]
push esi
push 0
push 0xa06
push str.CEdpEDiskCtrlInterface::RunProgram
mov ecx, str..EdpEDiskCtrlInterface.cpp
call fcn.10010760
lea eax, [esi - 0x10]
add esp, 0x10
mov dword [esp + 0x70], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10007e00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x6c
ret
test ebx, ebx
je 0x10007e1d
mov ecx, dword [esp + 0x14]
mov dword [ebx], ecx
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
mov eax, 1
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x6c
ret
Function at 0x10008210
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1004de76
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [0x10062da0]
xor eax, esp
push eax
lea eax, [esp + 0x114]
mov dword fs:[0], eax
cmp byte [0x1006b339], 0
jne 0x10008296
push 0x103
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.10037cf0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x10055dd0
lea edx, [esp + 0x10]
push edx
push str._sSystem32_s
push esi
call fcn.100027b0
add esp, 0x10
jmp 0x10008334
cmp dword [0x1006c56c], 0x10
mov eax, dword [0x1006c558]
jae 0x100082a9
mov eax, 0x1006c558
push eax
lea ecx, [esp + 8]
call fcn.10002ca0
push 0x10055dd0
push eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x128], 0
call fcn.10009a40
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0x120], 1
call fcn.1000bb20
mov byte [esp + 0x11c], 0
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10008309
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x11c], 0xffffffff
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10008334
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x114]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.10032551
add esp, 0x11c
ret
Function at 0x10009460
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x1004e818
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x10062da0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push str.EdpEdisk__StartReadonlyCheckAndRepair_Enter
push 0
push 0xc41
push str.CEdpEDiskCtrlInterface::StartReadonlyCheckAndRepair
mov ecx, str..EdpEDiskCtrlInterface.cpp
mov dword [esp + 0x2c], 0
call fcn.10010760
xor bl, bl
add esp, 0x10
mov eax, 1
mov byte [esp + 0x13], al
cmp byte [0x1006b339], bl
je 0x100094de
cmp edi, 2
jne 0x100094cd
cmp dword [0x1006b344], eax
je 0x100094da
jmp 0x100094e0
cmp edi, 4
jne 0x100094e0
cmp dword [0x1006b348], eax
jne 0x100094e0
mov bl, al
jmp 0x100094e0
xor bl, bl
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Edpedisk__StartReadonlyCheckAndRepair_11
call esi
test bl, bl
je 0x10009578
push str.Edpedisk__StartReadonlyCheckAndRepair_22
call esi
mov eax, dword [esp + 0x28]
push eax
call fcn.100095e0
test al, al
je 0x1000955a
push str.Edpedisk__StartReadonlyCheckAndRepair_33
call esi
push str.EdpEdisk__StartReadonlyCheckAndRepair_nead_repair
push 0
push 0xc5b
push str.CEdpEDiskCtrlInterface::StartReadonlyCheckAndRepair
mov ecx, str..EdpEDiskCtrlInterface.cpp
call fcn.10010760
mov eax, dword [esp + 0x3c]
add esp, 0xc
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
push eax
call fcn.1000bab0
mov ecx, dword [esp + 0x2c]
add esp, 4
add eax, 0x10
push ecx
mov ecx, edi
mov dword [esi], eax
call fcn.10009690
mov bl, al
jmp 0x1000957c
push str.EdpEdisk__StartReadonlyCheckAndRepair_not_nead_repair
push 0
push 0xc60
push str.CEdpEDiskCtrlInterface::StartReadonlyCheckAndRepair
mov ecx, str..EdpEDiskCtrlInterface.cpp
call fcn.10010760
add esp, 0x10
mov bl, byte [esp + 0x13]
push str.EdpEdisk__StartReadonlyCheckAndRepair_Leave
push 0
push 0xc64
push str.CEdpEDiskCtrlInterface::StartReadonlyCheckAndRepair
mov ecx, str..EdpEDiskCtrlInterface.cpp
call fcn.10010760
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100095c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 0xc
Function at 0x1000a530
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1004cefb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10062da0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1004bac9
push 4
mov dword [esp + 0x20], 0
call fcn.10024ac1
mov edi, eax
add esp, 4
test edi, edi
je 0x1000a5ae
call fcn.1004bd7b
mov dword [edi], eax
call fcn.1004bba9
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.1004ba8a
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x1000a5a3
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.1004bab2
jmp 0x1000a5b0
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4