joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d50
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, edx
mov edi, ecx
push esi
push edi
push str.MountVTLRI___s___u
call fcn.004044f0
add esp, 0xc
lea edx, [ebp - 0x208]
mov ecx, esi
call fcn.00405670
lea eax, [ebp - 0x208]
mov edx, edi
push str.ro_rem
push eax
mov ecx, str.VTLRI
call fcn.00405880
add esp, 8
push 0
push str.ventoyVTLRISRV.exe
push 0x4262f0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
movsx eax, byte [edi]
push eax
push str.ventoyVTLRISRV.exe_VTLRI_SRV__C_Z
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.0040b3ad
add esp, 0x10
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [ebp - 0x224], 1
xor eax, eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x250]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea eax, [ebp - 0x108]
push eax
push str.Process_cmdline___s_
call fcn.004044f0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor eax, eax
pop edi
pop esi
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
Function at 0x408550
Capabilities:
Create directory

Disassembly:
push ecx
push str.ventoy
call fcn.00404b10
add esp, 4
test eax, eax
je 0x408573
push str.ventoy_directory_already_exist
call fcn.004044f0
add esp, 4
xor eax, eax
pop ecx
ret
push str.ventoy_directory_not_exist__now_create_it.
call fcn.004044f0
add esp, 4
push 0
push str.ventoy
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40856f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_ventoy_directory_err:_u
call fcn.004044f0
add esp, 8
mov eax, 1
pop ecx
ret
Function at 0x408dc0
Capabilities:
Copy file
Create process on windows
Move file
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x4262f0
push str._1__Copy_New_file
call fcn.004044f0
push 0x4262f0
push str._s_NEW
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0040b3ad
add esp, 0x18
lea eax, [ebp - 0x110]
push 0
push eax
push 0x4262f0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x4262f0
push str._2__Remove_file___s_
call fcn.004044f0
add esp, 8
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [ebp - 0x234], 1
xor eax, eax
push 0x4262f0
push str.cmd.exe__c_del__F__Q__s
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0040b3ad
add esp, 0x10
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x4262f0
push str._3__Copy_back_file___s_
call fcn.004044f0
add esp, 8
lea eax, [ebp - 0x110]
push 0x4262f0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
Function at 0x408ed0
Capabilities:
Create process on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, edx
xor esi, esi
push edi
mov dword [ebp - 0x1b4], ebx
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
push str.VTLRI_ServiceMain_start__s__s__s_...
call fcn.004044f0
mov eax, dword [ebx + 8]
movsx eax, byte [eax]
push eax
push str._C:_
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.0040b3ad
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x20
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x40
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x408f4f
push 0x190
call edi
jmp 0x408f68
call ebx
cmp eax, 3
jne 0x408f68
lea eax, [ebp - 0x14]
push eax
push str._s_not_found
call fcn.004044f0
add esp, 8
inc esi
cmp esi, 3
jl 0x408f28
mov eax, dword [ebp - 0x1b4]
mov eax, dword [eax + 0xc]
movsx eax, byte [eax]
push eax
push str.ventoyimdisk.exe__d__m__C:
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0040b3ad
lea eax, [ebp - 0x158]
push eax
push str.Remove_disk_by___s_
call fcn.004044f0
add esp, 0x18
lea eax, [ebp - 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [ebp - 0x174], 1
xor eax, eax
mov word [ebp - 0x170], ax
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1a0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x158]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x1b0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
Function at 0x4093e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov dword [edx*4 + 0x426700], eax
inc edx
cmp edx, 0x100
jb 0x4093e2
ret

Function at 0x409490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov esi, ecx
not eax
test edi, edi
je 0x4094ba
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x426700]
dec edi
jne 0x4094a2
pop edi
not eax
pop esi
pop ebp
ret
Function at 0x4095e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, edx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], ebx
mov eax, dword [ebx + 4]
mov ecx, dword [edi + 0x4a8]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x14], eax
call fcn.0040ac50
mov ecx, dword [ebx + 4]
sub ecx, dword [edi + 0x10]
add dword [edi + 0x40], ecx
mov dword [ebp - 4], eax
adc dword [edi + 0x44], 0
mov ecx, dword [ebx + 0x10]
sub ecx, dword [edi + 0x14]
add dword [edi + 0x48], ecx
mov eax, dword [edi + 0x44]
adc dword [edi + 0x4c], 0
mov ecx, dword [edi + 0x28]
cmp eax, dword [edi + 0x2c]
ja 0x40971e
jb 0x40963e
cmp dword [edi + 0x40], ecx
ja 0x40971e
mov ebx, dword [edi + 0x34]
mov edx, dword [edi + 0x48]
mov esi, dword [edi + 0x30]
cmp dword [edi + 0x4c], ebx
ja 0x40971e
jb 0x40965a
cmp edx, esi
ja 0x40971e
cmp dword [edi + 0x1c], 1
jne 0x409683
mov ecx, dword [ebp - 8]
push dword [edi + 0x18]
mov edx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
sub edx, dword [edi + 0x14]
add ecx, dword [edi + 0x14]
call fcn.00409490
mov edx, dword [edi + 0x48]
add esp, 4
mov ecx, dword [edi + 0x28]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 4]
cmp eax, 1
jne 0x409723
mov eax, ecx
and eax, dword [edi + 0x2c]
cmp eax, 0xffffffff
je 0x4096aa
cmp ecx, dword [edi + 0x40]
jne 0x40971e
mov eax, dword [edi + 0x44]
cmp dword [edi + 0x2c], eax
jne 0x40971e
mov eax, esi
and eax, ebx
cmp eax, 0xffffffff
je 0x4096bc
cmp esi, edx
jne 0x40971e
cmp ebx, dword [edi + 0x4c]
jne 0x40971e
mov eax, dword [edi + 0x38]
lea esi, [edi + 0x58]
xor ecx, ecx
add eax, dword [edi + 0x40]
adc ecx, dword [edi + 0x44]
add dword [esi], eax
adc dword [esi + 4], ecx
cmp dword [edi + 0x1c], 1
jne 0x4096dc
add dword [esi], 4
adc dword [esi + 4], 0
add dword [edi + 0x60], edx
mov ebx, 0x18
mov eax, dword [edi + 0x4c]
adc dword [edi + 0x64], eax
mov eax, dword [edi + 0x68]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x426700]
dec ebx
jne 0x4096f0
add dword [edi + 0x50], 1
not eax
mov dword [edi + 0x68], eax
adc dword [edi + 0x54], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409730
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [edx + 4]
sub edi, dword [ebx + 0x10]
add dword [ebx + 0x78], edi
mov eax, dword [ebx + 0x18]
adc dword [ebx + 0x7c], 0
not eax
mov esi, dword [edx]
add esi, dword [ebx + 0x10]
test edi, edi
je 0x409768
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x426700]
dec edi
jne 0x409750
pop edi
not eax
pop esi
mov dword [ebx + 0x18], eax
pop ebx
ret
Function at 0x409780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
push esi
push edi
mov dword [ebp - 4], ebx
mov esi, ecx
lea eax, [ebx + 4]
push dword [ebx + 8]
mov edx, dword [ebx]
mov ecx, esi
push eax
call fcn.00409540
mov edi, eax
add esp, 8
cmp edi, 1
jne 0x40989a
mov eax, dword [esi + 0x70]
sub eax, 0
je 0x409831
dec eax
je 0x409816
dec eax
jne 0x409860
mov eax, dword [esi + 8]
lea edi, [esi + 0x88]
add dword [esi + 0x90], eax
mov ebx, 0x18
mov edx, dword [esi + 0x98]
mov eax, dword [esi + 0xc]
not edx
adc dword [esi + 0x94], eax
movzx eax, byte [edi]
lea edi, [edi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x426700]
dec ebx
jne 0x4097e3
add dword [esi + 0x80], 0xffffffff
not edx
mov ebx, dword [ebp - 4]
adc dword [esi + 0x84], 0xffffffff
mov dword [esi + 0x98], edx
jmp 0x409859
mov eax, dword [esi + 8]
add dword [esi + 0x88], eax
mov eax, dword [esi + 0xc]
adc dword [esi + 0x8c], eax
mov dword [esi + 0x70], 2
jmp 0x409860
mov eax, dword [esi + 8]
mov dword [esi + 0x80], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x84], eax
mov eax, dword [esi + 0x80]
cmp eax, dword [esi + 0x50]
jne 0x40988e
mov eax, dword [esi + 0x84]
cmp eax, dword [esi + 0x54]
jne 0x40988e
mov dword [esi + 0x70], 1
cmp dword [esi + 0x84], 0
lea eax, [ebx + 4]
ja 0x409791
jb 0x409882
cmp dword [esi + 0x80], 0
lea eax, [ebx + 4]
ja 0x409791
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 7
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ebx
mov ecx, esi
call fcn.00409730
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409910
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0xa8], 0x587a37fd
jne 0x4099bc
cmp word [edi + 0xac], 0x5a
jne 0x4099bc
push ebx
push esi
lea esi, [edi + 0xae]
or edx, 0xffffffff
mov ebx, 2
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x426700]
dec ebx
jne 0x409941
movzx ecx, byte [edi + 0xb3]
not edx
movzx eax, byte [edi + 0xb2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 0xb1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 0xb0]
shl ecx, 8
or ecx, eax
pop esi
pop ebx
cmp edx, ecx
je 0x409993
mov eax, 7
pop edi
ret
cmp byte [edi + 0xae], 0
je 0x4099a3
mov eax, 6
pop edi
ret
movzx ecx, byte [edi + 0xaf]
xor eax, eax
cmp ecx, 1
mov dword [edi + 0x1c], ecx
mov edx, 6
cmovg eax, edx
pop edi
ret
mov eax, 5
pop edi
ret
Function at 0x409aa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
or edx, 0xffffffff
push edi
add dword [esi + 0xa4], 0xfffffffc
lea edi, [esi + 0xa8]
mov ebx, dword [esi + 0xa4]
test ebx, ebx
je 0x409ad8
nop
movzx eax, byte [edi]
lea edi, [edi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x426700]
dec ebx
jne 0x409ac0
mov ebx, dword [esi + 0xa4]
not edx
movzx ecx, byte [ebx + esi + 0xab]
movzx eax, byte [ebx + esi + 0xaa]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + esi + 0xa9]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + esi + 0xa8]
shl ecx, 8
or ecx, eax
cmp edx, ecx
je 0x409b1c
pop edi
pop esi
mov eax, 7
pop ebx
ret
lea edi, [esi + 0xa0]
mov dword [edi], 2
mov al, byte [esi + 0xa9]
test al, 0x3f
je 0x409b3b
pop edi
pop esi
mov eax, 6
pop ebx
ret
test al, 0x40
je 0x409b66
push ebx
lea ebx, [esi + 0xa8]
mov ecx, esi
push edi
mov edx, ebx
call fcn.00409540
add esp, 8
cmp eax, 1
jne 0x409b13
mov eax, dword [esi + 8]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x2c], eax
jmp 0x409b7a
mov dword [esi + 0x28], 0xffffffff
lea ebx, [esi + 0xa8]
mov dword [esi + 0x2c], 0xffffffff
test byte [esi + 0xa9], 0x80
je 0x409bad
push dword [esi + 0xa4]
mov edx, ebx
mov ecx, esi
push edi
call fcn.00409540
add esp, 8
cmp eax, 1
jne 0x409b13
mov eax, dword [esi + 8]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x34], eax
jmp 0x409bbb
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x34], 0xffffffff
mov ecx, dword [esi + 0xa4]
mov eax, ecx
mov edx, dword [edi]
sub eax, edx
cmp eax, 2
jb 0x409b13
mov al, byte [edx + esi + 0xa8]
lea ebx, [edx + 1]
mov dword [edi], ebx
cmp al, 0x21
jne 0x409b32
mov al, byte [ebx + esi + 0xa8]
inc ebx
mov dword [edi], ebx
cmp al, 1
jne 0x409b32
sub ecx, ebx
cmp ecx, 1
jb 0x409b13
mov dl, byte [ebx + esi + 0xa8]
lea eax, [ebx + 1]
mov ecx, dword [esi + 0x4a8]
mov dword [edi], eax
call fcn.0040af50
test eax, eax
jne 0x409c62
mov edx, dword [esi + 0xa4]
cmp dword [edi], edx
jae 0x409c3e
mov eax, dword [edi]
mov cl, byte [eax + esi + 0xa8]
inc eax
mov dword [edi], eax
test cl, cl
jne 0x409b32
cmp eax, edx
jb 0x409c26
mov dword [edi], 0
xor eax, eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
pop edi
pop esi
pop ebx
ret
Function at 0x414071
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00410726
mov dword [ebp - 0x14], eax
cmp dword [0x425058], esi
jne 0x414164
push 0x800
push esi
push 0x41c59c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4140f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x414244
push esi
push esi
push 0x41c59c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x414244
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414244
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x425058], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42505c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x425060], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x425068], eax
test eax, eax
je 0x414161
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x425064], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x414189
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41417c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41419e
push 4
pop eax
jmp 0x414246
cmp dword [ebp - 0x14], esi
je 0x41419e
push dword [0x425058]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x414183
mov eax, dword [0x425064]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4141fc
cmp dword [0x425068], edi
je 0x4141fc
push eax
call ebx
push dword [0x425068]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4141fc
test eax, eax
je 0x4141fc
call ecx
test eax, eax
je 0x4141f1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4141f1
test byte [ebp - 8], 1
jne 0x4141fc
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41422c
mov eax, dword [0x42505c]
cmp eax, edi
je 0x414229
push eax
call ebx
test eax, eax
je 0x414229
call eax
mov esi, eax
test esi, esi
je 0x414229
mov eax, dword [0x425060]
cmp eax, edi
je 0x414229
push eax
call ebx
test eax, eax
je 0x414229
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x425058]
call ebx
test eax, eax
je 0x414244
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x414246
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
Function at 0x4023a0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ead2
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4fc1c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
je 0x402404
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x4b0784
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], 0x4b078c
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00402300
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
or edx, 1
mov dword [ebp - 0x14], edx
push 0
mov ecx, dword [ebp - 0x10]
call fcn.004022d0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 8
mov dword [ebp - 0x18], eax
push 0
mov ecx, dword [ebp - 0x18]
call fcn.00402370
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.QCefRendererHandler.0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], vtable.QCefRendererHandler.1.0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + edx + 4], vtable.QCefRendererHandler.2.0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 4]
sub eax, 0x48
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
mov ecx, dword [edx + 4]
mov edx, dword [ebp - 0x10]
mov dword [edx + ecx], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00402350
mov eax, dword [ebp - 0x10]
add eax, 0x18
mov dword [ebp - 0x1c], eax
push 0x4b0654
mov ecx, dword [ebp - 0x1c]
call fcn.004020c0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
mov dword [ebp - 0x20], ecx
push 0x4b0654
mov ecx, dword [ebp - 0x20]
call fcn.004020c0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5507e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x550805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x550878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x55083a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x55086d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x55086b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x550831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x5507fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x40293c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x40298e
mov dword [ebp - 0xc], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x402986
push 0x4f
push 0x4027824
push 6
call fcn.00445bf0
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x4029c7
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4029c4
push 0x7d
push 0x4027824
push 6
call fcn.00445bf0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4029db
mov eax, 0
jmp 0x402a43
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x402a0c
push 0x10b
push 0x4027824
push 6
call fcn.00445bf0
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x402a3b
push 0x12f
push 0x4027824
push 6
call fcn.00445bf0
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x402a43
mov esp, ebp
pop ebp
ret 8
Function at 0x403b5f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403ba9
push 0x19
push 0x40283f3
push 6
call fcn.00445bf0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x403c40
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x45bb33]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.00402a49
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x1bc
call fcn.004478f0
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403c01
push ebx
call fcn.00445be4
add esp, 4
pop eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00402edb
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x403c40
push 0xda
push 0x40283f3
push 6
call fcn.00445bf0
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x403c5a
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00445bea
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x403c5f
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403c70
push ebx
call fcn.00445be4
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret