joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eaa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x46d038
mov edi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x46d0ec]
test esi, esi
je 0x40eacc
mov eax, dword [esi]
mov dword [0x46d0ec], eax
mov dword [esi], 0
jmp 0x40ead3
call fcn.0040e9b0
mov esi, eax
push 0x46d038
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
jne 0x40eaeb
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0xc8]
push ebx
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40eb4b
mov edi, 0xfffffffe
push 0x46d038
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x46d0ec]
test eax, eax
jne 0x40ebca
mov dword [0x46d0ec], esi
push 0x46d038
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xb4]
mov ecx, dword [esi + 0xc]
push 0
lea edx, [ebp - 4]
push edx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40eb6c
lea edi, [eax - 4]
jmp 0x40eb17
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0xb4]
cmp dword [ebp - 4], eax
je 0x40eb85
mov edi, 0xfffffffd
jmp 0x40eb17
mov edx, dword [esi + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], edi
mov dword [edi + 0xac], edx
mov eax, dword [esi + 8]
mov dword [edi + 0xb0], eax
mov dword [edi + 0x20], 1
push 1
lea edi, [ebx + 0x28]
call fcn.0040ea20
mov ecx, dword [ebx + 8]
inc dword [ebx + 0x1c]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi], eax
push 0x46d038
mov dword [0x46d0ec], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ee40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebx]
mov dword [ebp - 4], 0
mov ecx, dword [eax + 0xba8]
mov edx, dword [eax + 0xba4]
push esi
push 0x2c
mov dword [0x46d0e0], ecx
mov dword [0x46d0e8], edx
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x40ef22
push edi
push 0x2c
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x46d038
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
mov dword [esi + 0x24], ebx
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 8], eax
call edi
push 0
push 0
push 1
push 0
mov dword [esi], eax
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0xc], eax
call edi
cmp dword [esi + 8], 0
mov dword [esi + 4], eax
pop edi
je 0x40ef1b
cmp dword [esi], 0
je 0x40ef1b
cmp dword [esi + 0xc], 0
je 0x40ef1b
test eax, eax
je 0x40ef1b
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x40ecc0
push 0
push 0
mov dword [ebx + 0x1030], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi + 0xc]
push 0x7530
push ecx
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
call fcn.0040ef30
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411db0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x46af24]
xor eax, esp
mov dword [esp + 0x34], eax
xor eax, eax
push ebx
push edi
mov edi, ecx
mov word [esp + 0x24], ax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], ax
test edi, edi
je 0x411e40
mov ebx, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, dword [edi + 0x28]
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.00441b83
add esp, 8
test eax, eax
jne 0x411e39
lea eax, [esp + 0x10]
push eax
mov eax, dword [edi + 0x28]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
push eax
call ebx
test eax, eax
je 0x411e2f
mov ecx, dword [esp + 8]
add dword [esi], ecx
mov edx, dword [esp + 0xc]
adc dword [esi + 4], edx
jmp 0x411e39
add dword [esi], 0xffffffff
adc dword [esi + 4], 0xff
mov edi, dword [edi + 4]
test edi, edi
jne 0x411df2
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.004534b8
mov esp, ebp
pop ebp
ret

Function at 0x411e60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [edi]
mov dword [ebp - 4], 0
cmp dword [eax + 0x978], 0
je 0x411f57
cmp dword [eax + 0xb24], 0
jne 0x411f57
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call ebx
push 0
push 0
push 1
push 0
mov dword [esi + 0x14], eax
call ebx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
test ecx, ecx
je 0x411f4a
test eax, eax
je 0x411f4a
mov ebx, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ecx
call ebx
mov eax, dword [esi + 0x18]
push eax
call ebx
mov ecx, dword [edi]
mov edx, dword [ecx + 0x978]
mov dword [esi + 0x1c], edx
mov eax, dword [edi]
mov ecx, dword [eax + 0xd44]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0x1024]
mov dword [esi], edx
mov eax, dword [edi]
mov ecx, dword [eax + 0x9c4]
lea edx, [ebp - 4]
push edx
push 0
push esi
push 0x411d10
push 0
push 0
mov dword [esi + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x411f23
mov eax, dword [edi]
mov ecx, dword [eax + 0xae8]
inc ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 0x18]
mov edx, dword [ebp - 4]
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x20], edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00411f60
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411f60
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
test esi, esi
jne 0x411f6f
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
mov dword [ebp - 4], eax
test eax, eax
jne 0x411f82
mov eax, 0xfffffffe
mov esp, ebp
pop ebp
ret
cmp dword [esi + 4], 0
push ebx
push edi
mov ebx, 0x1e
je 0x411fbd
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, ebx
dec ebx
test eax, eax
je 0x411fa6
push 0x64
call edi
cmp dword [esi + 4], 0
jne 0x411f95
test ebx, ebx
jg 0x411fbd
mov ecx, dword [ebp - 4]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x3e8
call edi
mov edx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x411fd8
push eax
call edi
mov dword [esi + 0x14], ebx
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x411fe5
push eax
call edi
mov dword [esi + 0x18], ebx
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x465550
push 0x453acc
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x46af24]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x30], 0x20000
or edi, 0xffffffff
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x28], esi
push 0x46136c
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.MSVCR100.dll__wfopen]
add esp, 8
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x4120fc
mov dword [ebp - 0x28], 0x8ca4
jmp 0x4122b1
mov eax, dword [ebp + 0xc]
add eax, 6
mov dword [ebp - 4], esi
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00432940
add esp, 8
mov edi, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0xfffffffe
jmp 0x412161
cmp edi, 0xffffffff
je 0x4122a4
mov dword [ebp - 0x20], 0
mov esi, 1
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], esi
push edi
call fcn.004329d0
add esp, 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x4121d0
test esi, esi
je 0x4122b1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1024]
cmp dword [ecx], 0
je 0x4122b1
cmp dword [ebp + 0x14], 0
je 0x4122b1
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 2
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
push edi
call fcn.00432990
add esp, 0x10
mov esi, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x412269
test esi, esi
je 0x4122b1
test ebx, ebx
je 0x412275
mov eax, ebx
jmp 0x41227e
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x20
push eax
mov eax, dword [ebp - 0x20]
push eax
push 1
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp - 0x20]
jae 0x4121d0
mov dword [ebp - 0x28], 0x8ca6
jmp 0x4122ab
mov dword [ebp - 0x28], 0x8ca5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xffffffff
je 0x41231a
cmp dword [ebp + 0x14], 0
je 0x41231a
mov dword [ebp - 4], 3
push edi
call fcn.00432970
add esp, 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x412313
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x412328
push ebx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412b50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
xor edi, edi
push edi
push edi
push 1
push edi
call esi
mov dword [0x46d0f8], eax
test eax, eax
je 0x412bdd
push edi
push edi
push 1
push edi
call esi
mov dword [0x46d0fc], eax
test eax, eax
je 0x412bdd
push edi
push edi
push 1
push edi
call esi
mov dword [0x46d100], eax
test eax, eax
je 0x412bdd
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
call esi
push 0x46d080
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x412790
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x46d100]
push 0x1d4c0
push ecx
mov dword [0x46d104], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x46d100]
push edx
call esi
cmp dword [0x46d12c], edi
jne 0x412bef
mov esi, 0x8ca3
call fcn.00412c00
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4141c0
Capabilities:
Suspend thread

Disassembly:
test esi, esi
je 0x4141ff
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SuspendThread]
push edi
mov edi, dword [esi + 0x24]
test eax, eax
je 0x4141d9
push eax
call ebx
mov eax, dword [esi + 0x20]
cmp dword [eax + 0xb9c], 0
je 0x4141fd
test edi, edi
je 0x4141fd
mov eax, dword [edi + 0x1030]
test eax, eax
je 0x4141fd
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4141fd
push eax
call ebx
pop edi
pop ebx
xor eax, eax
ret

Function at 0x414210
Capabilities:
Resume thread

Disassembly:
test esi, esi
je 0x41424f
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
mov edi, dword [esi + 0x24]
test eax, eax
je 0x414229
push eax
call ebx
mov eax, dword [esi + 0x20]
cmp dword [eax + 0xb9c], 0
je 0x41424d
test edi, edi
je 0x41424d
mov eax, dword [edi + 0x1030]
test eax, eax
je 0x41424d
mov eax, dword [eax + 0x20]
test eax, eax
je 0x41424d
push eax
call ebx
pop edi
pop ebx
xor eax, eax
ret
Function at 0x414620
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0xf8]
push eax
mov esi, ecx
mov edi, edx
mov dword [ebp - 0xe8], 0
call dword [sym.imp.MSVCR100.dll__time64]
add esp, 4
cmp dword [edi + 0x24], 0
mov eax, 4
jne 0x414668
cmp dword [edi + 0x54], 0
je 0x41466d
cmp dword [edi + 0xc], eax
jne 0x4146df
lea ecx, [esi + 0x44]
lea edx, [esi + 0x34]
push ecx
push edx
cmp dword [edi + 0xc], eax
jne 0x414689
mov eax, dword [edi + 0xc8]
push eax
push ebx
call fcn.0043e47f
jmp 0x414691
push 8
push ebx
call fcn.0043d8ae
lea eax, [ebp - 0xf0]
add esp, 0x10
push eax
call dword [sym.imp.MSVCR100.dll__time64]
mov ecx, dword [ebp - 0xf0]
push 0x3d
lea edi, [esi + 0x84]
push 0
push edi
mov dword [esi + 0x24], ecx
call sub.MSVCR100.dll_memset
push 0x3c
push 0x45f664
push edi
call fcn.004508a0
push 0x3c
lea edx, [esi + 0x1a0]
push 0x45f664
push edx
call fcn.004508a0
add esp, 0x28
jmp 0x4146f2
mov ecx, edi
mov eax, esi
call fcn.00414350
mov dword [ebp - 0xe8], 1
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x414728
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004534b8
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [ebp - 0xe4]
push eax
push 0xdc
lea ecx, [ebp - 0xe0]
push ecx
push ebx
mov dword [ebp - 0xe4], 0xdc
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x414712
mov edx, dword [esi + 0x34]
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
mov dword [ebp - 0x94], edx
mov edx, dword [esi + 0x40]
mov dword [ebp - 0x90], eax
mov eax, dword [esi + 0x44]
mov dword [ebp - 0x8c], ecx
mov ecx, dword [esi + 0x48]
mov dword [ebp - 0x88], edx
mov edx, dword [esi + 0x4c]
mov dword [ebp - 0x84], eax
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x80], ecx
add esi, 0x84
cmp dword [ebp - 0xe8], 0
mov ecx, 0xf
lea edi, [ebp - 0x44]
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], eax
rep movsd dword es:[edi], dword [esi]
je 0x4147b3
and dword [ebp - 0xc4], 0xfffffff7
jmp 0x4147ca
push 0x3d
lea ecx, [ebp - 0x44]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
or dword [ebp - 0xc4], 8
mov edx, dword [ebp - 0xf8]
push 0
push 0
push 0
push ebx
mov dword [ebp - 0xa4], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0xe4]
push eax
push 0xdc
lea ecx, [ebp - 0xe0]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004534b8
mov esp, ebp
pop ebp
ret 4
Function at 0x417d80
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push str.VDMDBG.DLL
call fcn.0044e639
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov dword [0x46d13c], eax
test eax, eax
je 0x417daa
push str.VDMEnumTaskWOWEx
push eax
call esi
mov dword [0x46d0b4], eax
push str.KERNEL32.DLL
call fcn.0044e639
add esp, 4
mov dword [0x46d138], eax
test eax, eax
jne 0x417dc7
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x46182c
push eax
call esi
mov dword [0x46d0b8], eax
mov eax, dword [0x46d138]
push str.Process32FirstW
push eax
call esi
mov ecx, dword [0x46d138]
push str.Process32NextW
push ecx
mov dword [0x46d0bc], eax
call esi
mov edx, dword [0x46d138]
push str.Module32FirstW
push edx
mov dword [0x46d0c0], eax
call esi
mov dword [0x46d0b0], eax
mov eax, dword [0x46d138]
push str.Module32NextW
push eax
call esi
cmp dword [0x46d0c0], 0
mov dword [0x46d0c4], eax
je 0x417e4a
cmp dword [0x46d0bc], 0
je 0x417e4a
test eax, eax
je 0x417e4a
cmp dword [0x46d0b0], 0
je 0x417e4a
cmp dword [0x46d0b8], 0
je 0x417e4a
xor eax, eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x46d138]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop esi
ret

Function at 0x418010
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
test esi, esi
jne 0x418049
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004534b8
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x41808e
mov eax, dword [ebp - 0x18]
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push eax
mov dword [ebp - 8], 2
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004534b8
mov esp, ebp
pop ebp
ret
Function at 0x4182e0
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push edi
xor esi, esi
push esi
push 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41832d
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004534b8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push edi
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x418397
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenThread]
lea ebx, [ebx]
mov ecx, dword [ebp + 8]
cmp dword [ebp - 0x14], ecx
jne 0x418384
mov edx, dword [ebp - 0x18]
push edx
push 0
push 2
call ebx
mov esi, eax
test esi, esi
je 0x418384
cmp byte [ebp + 0xc], 0
push esi
je 0x418377
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x41837d
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x418350
lea esi, [eax + 1]
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004534b8
mov esp, ebp
pop ebp
ret
Function at 0x418b30
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x28], eax
test esi, esi
je 0x418bd1
cmp dword [ebx + 0x14], 0
je 0x418bcb
mov eax, dword [ebx + 0x24]
mov esi, dword [eax + 0x10]
mov dword [ebp - 0x24], esi
cmp esi, dword [ebp - 0x28]
je 0x418bcb
cmp dword [ebx + 0x1c], 0
jne 0x418bcb
xor eax, eax
push eax
push 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x418b9f
xor edi, edi
jmp 0x418bcb
lea ecx, [ebp - 0x20]
push ecx
push edi
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x418be7
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, esi
test esi, esi
je 0x418bcb
mov dword [ebx + 0x18], 1
mov ebx, dword [ebx]
test ebx, ebx
jne 0x418b56
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004534b8
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x24]
cmp dword [ebp - 0x14], esi
jne 0x418c0e
mov edx, dword [ebp - 0x18]
push edx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x418c0e
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x418be4
lea esi, [eax + 1]
jmp 0x418bb7
Function at 0x41a4a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
push edi
mov edi, ecx
mov word [ebp - 0x24], ax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
mov eax, dword [edi + 0xfc]
cmp eax, 0x80
jb 0x41a4f5
add eax, 0xffffff80
push eax
push str.c:mbr_disc_d.sav
lea ecx, [ebp - 0xa4]
push ecx
jmp 0x41a512
lea edx, [eax + 0x41]
lea ecx, [ebp - 0x24]
push ecx
mov word [ebp - 0x24], dx
xor eax, eax
push str.c:_bootsector__s.sav
lea edx, [ebp - 0xa4]
mov word [ebp - 0x22], ax
push edx
call dword [sym.imp.MSVCR100.dll__swprintf]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41a55d
pop edi
or eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004534b8
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 0xa8]
push ecx
push 0x200
add edi, 0x1a4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004534b8
mov esp, ebp
pop ebp
ret
Function at 0x41e590
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
lea eax, [ebp - 4]
push eax
push edi
call fcn.004134e0
add esp, 8
test eax, eax
je 0x41e5d1
mov eax, 4
pop edi
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x41e68c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x462328
push edi
call ebx
push str.VDiscLib_Done
push edi
mov dword [esi + 8], eax
call ebx
push str.VDiscLib_Open2
push edi
mov dword [esi + 0xc], eax
call ebx
push str.VDiscLib_Close
push edi
mov dword [esi + 0x10], eax
call ebx
push 0x462368
push edi
mov dword [esi + 0x14], eax
call ebx
push 0x462378
push edi
mov dword [esi + 0x18], eax
call ebx
push str.VDiscLib_GetSupportedExtList
push edi
mov dword [esi + 0x1c], eax
call ebx
push str.VDiscLib_FreeSupportedExtList
push edi
mov dword [esi + 0x20], eax
call ebx
mov ecx, dword [esi + 8]
mov dword [esi + 0x24], eax
pop ebx
test ecx, ecx
je 0x41e685
cmp dword [esi + 0xc], 0
je 0x41e685
cmp dword [esi + 0x10], 0
je 0x41e685
cmp dword [esi + 0x14], 0
je 0x41e685
cmp dword [esi + 0x18], 0
je 0x41e685
cmp dword [esi + 0x1c], 0
je 0x41e685
cmp dword [esi + 0x20], 0
je 0x41e685
test eax, eax
je 0x41e685
lea edx, [esi + 4]
push edx
call ecx
add esp, 4
test eax, eax
jne 0x41e685
mov dword [esi], edi
pop edi
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret