joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd13250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd27808
push 0xd17288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xd13329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xd13329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00d161d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xd13329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xd13329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xd1332c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00d13351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xd13d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd13d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xd13d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd13d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xd13d94
push eax
push esi
call fcn.00d1620b
add esp, 8
pop esi
ret 0x10

Function at 0xd13da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd13e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xd13e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xd2c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d15dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xd13dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xd13e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd13ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xd13eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xd2c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d15dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xd13eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xd13e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xd14000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xd14131
push esi
call fcn.00d17145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00d06080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xd14131
push 0
push ebp
call fcn.00d063a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00d06260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xd1408b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00d062f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xd14121
push 0xd2c918
push edi
call fcn.00d153f0
push eax
push ebx
push esi
call fcn.00d13f60
push 0xd2c8f8
push edi
call fcn.00d153f0
push eax
push ebx
push esi
call fcn.00d13f60
push 0xd2c8d8
push edi
call fcn.00d153f0
push eax
push ebx
push esi
call fcn.00d13f60
push 0xd2c8c0
push edi
call fcn.00d153f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00d13f60
push 0xd2c8a0
push edi
call fcn.00d153f0
push eax
push ebx
push esi
call fcn.00d13f60
push 0xd2c888
push edi
call fcn.00d153f0
push eax
push ebx
push esi
call fcn.00d13f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xd151b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d15140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d15140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d15140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d15140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd15bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd15c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd2787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd15c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd15c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x100010d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
nop
nop
nop
nop
nop
xor ecx, ecx
test esi, esi
jle 0x10001100
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov al, byte [edx]
add edx, 2
xor al, 0xad
mov byte [ecx + edi], al
inc ecx
cmp ecx, esi
jl 0x100010f0
pop edi
pop esi
pop ebp
ret

Function at 0x10001750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 0x40
jae 0x10001768
nop
nop
nop
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x20], edx
nop
nop
nop
mov ecx, dword [eax + 0x20]
cmp word [ecx], 0x5a4d
je 0x10001789
nop
nop
nop
nop
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
nop
nop
nop
nop
mov ecx, dword [eax + 0x20]
mov ecx, dword [ecx + 0x3c]
lea esi, [ecx + 0xf8]
cmp edi, esi
jae 0x100017a4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
add ecx, edx
mov dword [eax + 0x24], ecx
nop
nop
nop
nop
nop
mov ecx, dword [eax + 0x24]
cmp dword [ecx], 0x4550
je 0x100017c4
nop
nop
nop
nop
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
test byte [ecx + 0x17], 0x20
jne 0x100017d4
nop
nop
nop
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
nop
nop
nop
nop
nop
mov edx, dword [eax + 0x24]
test byte [edx + 0x16], 2
jne 0x100017e9
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 0x24]
cmp word [ecx + 0x14], 0xe0
je 0x10001802
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 0x24]
xor ecx, ecx
lea esi, [edx + 0xf8]
mov dword [eax + 0x28], esi
xor eax, eax
mov ax, word [edx + 6]
test eax, eax
jle 0x10001837
lea edx, [esi + 0x10]
mov esi, dword [edx + 4]
mov ebx, dword [edx]
add esi, ebx
cmp esi, edi
ja 0x100017fb
inc ecx
add edx, 0x28
cmp ecx, eax
jl 0x10001824
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x401028
Capabilities:
Hide graphical window

Disassembly:
jmp 0x404af0
sub esp, 8
mov eax, dword [0x40b640]
mov ecx, dword [str.nqV4Lunt2r3PbIdY5tpugMlmMtt877R49lae12SBrqyAL7QNfSnfH8]
push ebx
push ebp
push esi
push edi
push eax
push ecx
call fcn.00401122
mov edx, dword [0x40b640]
mov edi, eax
mov eax, dword [str.nqV4Lunt2r3PbIdY5tpugMlmMtt877R49lae12SBrqyAL7QNfSnfH8]
push edx
push eax
add edi, 0x1eef1416
call fcn.00401122
mov ecx, dword [0x40b640]
mov edx, dword [str.nqV4Lunt2r3PbIdY5tpugMlmMtt877R49lae12SBrqyAL7QNfSnfH8]
mov ebx, eax
push ecx
push edx
add ebx, 0x1eef1452
call fcn.00401122
mov ecx, dword [str.nqV4Lunt2r3PbIdY5tpugMlmMtt877R49lae12SBrqyAL7QNfSnfH8]
mov ebp, eax
mov eax, dword [0x40b640]
add ebp, 0x1eef13f2
push eax
push ecx
call fcn.00401122
mov edx, dword [0x40b640]
add eax, 0x1eef13f6
mov dword [esp + 0x30], eax
mov eax, dword [str.nqV4Lunt2r3PbIdY5tpugMlmMtt877R49lae12SBrqyAL7QNfSnfH8]
push edx
push eax
call fcn.00401122
mov ecx, dword [0x40b640]
mov edx, dword [str.nqV4Lunt2r3PbIdY5tpugMlmMtt877R49lae12SBrqyAL7QNfSnfH8]
add eax, 0x1eef13fa
push ecx
push edx
mov dword [esp + 0x44], eax
call fcn.00401122
mov esi, dword [esp + 0x4c]
mov edx, dword [esp + 0x40]
add eax, 0x1eef13fe
add esp, 0x30
mov ecx, dword [edi + esi]
mov dword [esp + 0x1c], 0
add ecx, ebx
mov ecx, dword [ecx + esi]
add ecx, esi
mov edi, dword [ecx + edx]
mov edx, dword [esp + 0x14]
mov ebx, dword [ecx + eax]
mov ebp, dword [ecx + ebp]
mov edx, dword [ecx + edx]
add edi, esi
add edx, esi
add ebx, esi
test ebp, ebp
jbe 0x404c07
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40b640]
push ecx
mov eax, dword [eax]
add eax, esi
push eax
call fcn.00401122
mov ecx, dword [esp + 0x28]
add esp, 8
cmp eax, ecx
je 0x404c07
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
inc eax
add edx, 4
cmp eax, ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
jb 0x404bcf
cmp dword [esp + 0x1c], ebp
jne 0x404c17
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov dx, word [ebx + eax*2]
mov eax, dword [edi + edx*4]
pop edi
add eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1002e429
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
daa
movzx ax, al
mov eax, edx
clc
test cl, dh
sub al, 0xa5
test ch, 4
add edi, 1
sub al, 0xdc
call fcn.1005c0e5
mov eax, dword [ebp + 8]
test esp, 0xcf3e48ff
test ecx, eax
pushal
test eax, eax
jmp 0x10047b0b
jmp 0x1005c128
mov dword [esp + 8], edi
lea esp, [esp + 0x3c]
je 0x100422a9
cmp di, 0x6c10
cmp cx, 0x4d68
bswap esi
pushfd
mov esi, dword [eax + 0x3c]
shld dx, bx, cl
add esi, eax
shr dh, cl
shld dx, bx, cl
movzx dx, cl
mov edx, dword [esi + 0x78]
pushfd
test edx, edx
call fcn.100428c7

Function at 0x10042c82
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x28]
je 0x10042132
test byte [esi - 0x1700000c], ah
ret 0xffb2
call fcn.1003df53
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x10042cfe
inc ebx
jb 0x10042d05
je 0x10042d07
arpl word [ecx + 0x6c], sp
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add ch, dh
xor al, 0x8e
pop eax
xor edx, dword [ebx - 0x55]
bound esp, qword [ecx + 0x67c5aada]
mov ebx, 0x6a47ae14
mov esi, 0x9995f219
jae 0x10042ca1
inc edi
or byte [esi - 0x739cb073], 0x9d
mov eax, edx
mov ecx, 0x53bab9c4
adc eax, 0x97862dad
pop ss
or byte [eax + 0x3a], dl
xchg byte [esi - 0x3d2e7ad1], dl
and ebp, dword [edx + 0x19a1b5ea]
jne 0x10042cfe
aad 0xa4
clc
jl 0x10042ce8
cmp eax, 0x8f4c898a
mov ebx, 0xd7041b9b
jae 0x10042c87
inc ecx
int1
push edx
out dx, al
imul byte [eax - 0x130e3fe7]
ja 0x10042cfc
mov ah, 0x15
sub dword [edx + 0x3c1c01ee], 0x94dd232f
or byte [esi - 0x1fa7ca8e], 0xb8
inc ebp
mov cl, 3
cmp dword [ecx + esi*2 + 0x5cf6e248], ebx
pop esp
test eax, 0x5543b1ad
scasb al, byte es:[edi]
cmp dl, byte [0x297d1569]
cdq
out 0x58, eax
mov edi, 0x1b04d837
fadd dword [ebx + ebx]
sub byte [0x9deab13e], al
or eax, 0xd603b167
imul edi, dword [ebx - 0x74], 0x3ebb705d
out 0x58, eax
jb 0x10042d37
and byte [edx + 0x2b], 0xc6
lodsb al, byte [esi]
adc byte [ebp - 0x39ca64e], al
xchg esi, eax
jno 0x10042d2b
xchg esi, eax
or ecx, ebp
in al, dx
pushfd
out 0x58, eax
add ah, byte [esp + 0x5281bf6]
jl 0x10042d23
int3

Function at 0x1005bf05
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ebp, [esp + 4]
clc
bts eax, 0xf
setbe al
aad 0xc5
sub esp, 0xc
sbb ah, 0xec
push esi
rcl ax, cl
aaa
bts ax, 1
push edi
pushal
push dword [esp + 4]
btr ax, dx
mov dword [esp + 0x20], ebx
daa
aas
mov dword [esp + 0x1c], edx
dec eax
xor ah, 0xbe
btc ax, bx
jmp 0x1002e445
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x470008], 0x8088405
inc edx
mov dword [ebx + 0x470008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d2ec
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d31d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d305
add dl, dl
jne 0x41d328
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d379
xor eax, eax
add dl, dl
jne 0x41d335
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d416
add dl, dl
jne 0x41d344
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d34f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d35a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d365
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d36f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d314
mov eax, 1
add dl, dl
jne 0x41d387
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d392
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d37e
sub eax, ebx
mov ebx, 1
jne 0x41d3c5
mov ecx, 1
add dl, dl
jne 0x41d3ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3b6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3a2
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d314
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d3dc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3e7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3d3
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d314
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d437
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d314
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f504
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4539f2
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f553
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f572
mov ecx, edx
add ecx, ebx
jmp 0x41f572
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f572
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f5e4
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f5cd
test esi, esi
jbe 0x41f5e4
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f5bf
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f5e4
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f59c
jmp 0x41f5e4
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f5e4
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4539f9
ret
Function at 0x420750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x454d6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x42078b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4207a4
lea eax, [ebp - 0x10]
mov edx, dword [0x47273c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x4207b7
lea eax, [ebp - 0x10]
mov edx, dword [0x47273c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4207c3
adc edx, 0
mov edx, dword [edx*4 + 0x471538]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x42093d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420930
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420930
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x4208ce
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x4208ce
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4208ce
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4208ce
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420930
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420930
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420955
inc ebx
cmp ebx, 0x19
jne 0x42077d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454d72
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x100013b9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x10001406
mov eax, esp
mov dword [eax], 0xa6b92e
mov eax, dword [sym.imp.USER32.dll_ShowCaret]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx + 4], 0x281
mov dword [ecx], 0x281
mov ecx, dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
mov dword [ebp - 8], eax
call ecx
sub esp, 8
mov dword [ebp - 0xc], eax
jmp 0x10001461
mov eax, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call eax
mov dword [ebp - 0x10], eax
jmp 0x100013c6
mov eax, dword [ebp - 4]
mov ecx, esp
mov dword [ecx + 8], 0xc6ff96
mov dword [ecx + 4], 0x8ac21
mov dword [ecx], 0xf68
mov dword [ebp - 0x14], eax
call sub.USER32.dll_PackDDElParam
sub esp, 0xc
mov ecx, esp
mov dword [ecx], 0x414
mov ecx, dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0x18], eax
call ecx
sub esp, 4
mov ecx, dword [ebp - 0x14]
sub ecx, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
je 0x100013c6
jmp 0x10001454
mov eax, dword [ebp - 0x14]
sub eax, 0x3c
mov dword [ebp - 0x24], eax
je 0x100013fa
jmp 0x10001461
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x61
mov dword [ebp - 4], eax
jne 0x10001406
add esp, 0x34
pop ebp
ret