joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bba0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x38
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x3c]
push ebx
mov dword [esp + 8], eax
xor eax, eax
cmp dword [esi + 0x18], 0x10
push edi
mov byte [esp + 0x1c], 0
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov word [esp + 0x39], ax
mov byte [esp + 0x3b], al
mov dword [esp + 0x14], 0x34
lea edi, [esi + 4]
jb 0x1000bbf9
mov eax, dword [edi]
jmp 0x1000bbfb
mov eax, edi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
ja 0x1000bc1c
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10032551
add esp, 0x38
ret
push ebp
push ebx
call fcn.10024af0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x1000bc40
pop ebp
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10032551
add esp, 0x38
ret
cmp dword [esi + 0x18], 0x10
jb 0x1000bc48
mov edi, dword [edi]
push ebp
push ebx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1000bcca
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x10055abc
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1000bcca
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x10055ad8
push ebp
mov dword [esp + 0x24], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1000bcca
mov eax, dword [esp + 0xc]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
push 0x10055adc
lea ecx, [esp + 0x34]
push 0x20
push ecx
call fcn.10032b06
mov ecx, dword [esp + 0x2c]
add esp, 0x1c
lea edx, [esp + 0x20]
push edx
call fcn.10001f90
push ebp
call fcn.10024afb
mov ecx, dword [esp + 0x44]
add esp, 4
pop ebp
pop edi
pop ebx
xor ecx, esp
mov al, 1
call fcn.10032551
add esp, 0x38
ret
Function at 0x1000c600
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x1004d073
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10062da0]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x248], ebp
mov eax, dword [esp + 0x254]
mov edi, 8
cmp dword [esp + 0x268], edi
jae 0x1000c660
lea eax, [esp + 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x206
lea ecx, [esp + 0x3a]
xor eax, eax
push ebp
push ecx
mov dword [esp + 0x20], ebp
mov word [esp + 0x40], ax
call fcn.10037cf0
add esp, 0xc
xor edx, edx
push ebp
mov eax, 0x10059940
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebp
mov word [esp + 0x20], dx
call fcn.1000c210
mov eax, 0x10057dc4
mov byte [esp + 0x248], 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x1000c6b7
sub eax, edx
sar eax, 1
cmp dword [esp + 0x264], eax
jbe 0x1000c7c6
mov eax, 0x10057dc4
lea edx, [eax + 2]
jmp 0x1000c6e0
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x1000c6e0
sub eax, edx
sar eax, 1
mov ebx, eax
lea eax, [esp + 0x250]
call fcn.1000cc80
cmp eax, 0xffffffff
je 0x1000c7c6
mov eax, dword [esp + 0x254]
cmp dword [esp + 0x268], edi
jae 0x1000c71d
lea eax, [esp + 0x254]
push eax
lea eax, [esp + 0x38]
push 0x104
push eax
call fcn.10033ec2
mov eax, 0x10057dc4
add esp, 0xc
lea edx, [eax + 2]
jmp 0x1000c740
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x1000c740
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, dword [esp + 0x264]
cmp edi, eax
jae 0x1000c7a8
lea esp, [esp]
cmp word [esp + edi*2 + 0x34], 0x5c
jne 0x1000c7a3
xor ecx, ecx
lea eax, [esp + 0x34]
mov word [esp + edi*2 + 0x34], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x1000c776
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x38]
lea esi, [esp + 0x1c]
call fcn.1000c210
push 1
mov eax, esi
call fcn.1000cbb0
mov eax, dword [esp + 0x264]
inc edi
cmp edi, eax
jb 0x1000c760
cmp eax, dword [esp + 0x2c]
jbe 0x1000c7c1
push str._IsUDiskInUse__find
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esp + 0x14], 1
mov edi, 8
cmp dword [esp + 0x30], edi
jb 0x1000c7d9
mov edx, dword [esp + 0x1c]
push edx
call fcn.10024afb
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], ax
cmp dword [esp + 0x268], edi
jb 0x1000c805
mov ecx, dword [esp + 0x254]
push ecx
call fcn.10024afb
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.10032551
add esp, 0x238
ret
Function at 0x1000ce30
Capabilities:
Print debug messages

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1000ce6f
push str.GetDriveGeometry_CreateFile_Fail___r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, str.GetDriveGeometry_CreateFile_Fail___r_n
call fcn.10011e30
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x18
push 0x10067698
push 0
push 0
push 0x70000
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x1000cef5
push 0x208
call fcn.10024af0
add esp, 4
push esi
lea edx, [esp + 0x14]
push edx
push 0x208
mov ebp, eax
push ebp
push esi
push esi
push 0x2d0c04
push ebx
call edi
mov esi, eax
test esi, esi
je 0x1000ced7
push 0x18
lea eax, [ebp + 8]
push eax
push 0x19
push 0x10067698
call fcn.10032c83
add esp, 0x10
jmp 0x1000ceec
push str.GetDriveGeometry_DeviceIoControl_Fail___r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, str.GetDriveGeometry_DeviceIoControl_Fail___r_n
call fcn.10011e30
push ebp
call fcn.10024afb
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1000cf70
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x1004e230
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10062da0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
xor ebx, ebx
mov eax, 0xf
mov esi, ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
mov dword [esp + 0x58], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov ebp, 0x10
mov byte [esp + 0x58], 1
lea edi, [esi + 4]
cmp dword [esi + 0x18], ebp
jb 0x1000cfdd
mov eax, dword [edi]
jmp 0x1000cfdf
mov eax, edi
push eax
push 0x104
push 0x10068ce0
call fcn.100329ad
add esp, 0xc
cmp dword [esi + 0x18], ebp
jb 0x1000cff9
mov edi, dword [edi]
push edi
push 0x104
push 0x10068de8
call fcn.100329ad
add esp, 0xc
push 0x104
push 0x10068ce0
call fcn.100340e8
push 0x104
push 0x10068de8
call fcn.100340e8
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x10
push str.UpdateUniqueID_unique_identifier
call esi
push 0x10068ce0
call esi
push str.UpdateUniqueID_unique_identifier_short
call esi
push 0x10068de8
call esi
mov edi, str.UpdateUniqueID_unique_identifier
call fcn.10011e30
mov edi, 0x10068ce0
call fcn.10011e30
cmp dword [esp + 0x2c], ebp
jb 0x1000d076
mov eax, dword [esp + 0x18]
push eax
call fcn.10024afb
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
cmp dword [esp + 0x48], ebp
jb 0x1000d099
mov ecx, dword [esp + 0x34]
push ecx
call fcn.10024afb
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10032551
add esp, 0x48
ret
Function at 0x1000d4a0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2014
call fcn.1003a830
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x2010], eax
push ebp
mov ebp, dword [esp + 0x201c]
push esi
push edi
mov esi, ecx
jmp 0x1000d4d6
push 0xfff
lea eax, [esp + 0x1d]
push 0
push eax
mov byte [esp + 0x24], 0
call fcn.10037cf0
add esp, 0xc
push 0xfff
lea ecx, [esp + 0x101d]
push 0
push ecx
mov byte [esp + 0x1024], 0
call fcn.10037cf0
add esp, 0xc
test ebp, ebp
je 0x1000d6fb
push 0x80
push 0
push ebp
call fcn.10037cf0
add esp, 0xc
push 0x10057f88
lea edx, [ebp + 8]
push 0x10
push edx
mov dword [ebp + 4], 1
call fcn.100329ad
add esp, 0xc
push 0x10057f90
lea eax, [ebp + 0x18]
push 0x10
push eax
call fcn.100329ad
mov eax, dword [0x100676ac]
add esp, 0xc
push 0
lea ecx, [eax + eax*4]
push 0
add ecx, ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [0x100676ac]
push 0
lea edx, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x1024]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000d59e
mov edi, str.ReadTempUseInfo_ReadFile_Fail__r_n
call fcn.10011e30
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1000d6d7
push 0x1000
lea edx, [esp + 0x101c]
push edx
lea eax, [esp + 0x20]
push 0x1001
push eax
call fcn.10032c83
add esp, 0x10
call fcn.1001f600
mov eax, 0x10068ce0
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000d5d0
sub eax, edx
mov edx, eax
mov esi, 0x10068ce0
call fcn.1001f690
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push 0x80
push edx
mov ecx, edx
mov edx, 4
mov dword [esp + 0x20], eax
call fcn.1001f2b0
mov edi, 0x49534545
add esp, 0xc
cmp dword [esp + 0x18], edi
je 0x1000d6ad
push 0x1000
lea eax, [esp + 0x101c]
push eax
lea ecx, [esp + 0x20]
push 0x1001
push ecx
call fcn.10032c83
mov eax, 0x10068de8
add esp, 0x10
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000d640
sub eax, edx
mov edx, eax
mov esi, 0x10068de8
call fcn.1001f690
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push 0x80
push eax
mov ecx, eax
mov edx, 4
call fcn.1001f2b0
add esp, 0xc
cmp dword [esp + 0x18], edi
jne 0x1000d6f1
mov edi, str.Find_EDP_EDISK_SET_INFO_FLAG__r_n
call fcn.10011e30
push esi
push 0x104
push 0x10068ce0
call fcn.100329ad
add esp, 0xc
push esi
push 0x104
push 0x10069f30
call fcn.100329ad
add esp, 0xc
push 0x80
lea ecx, [esp + 0x1c]
push ecx
push 0x81
push ebp
call fcn.10032c83
add esp, 0x10
jmp 0x1000d6d5
xor eax, eax
mov ecx, dword [esp + 0x201c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10032551
add esp, 0x2014
ret 4
mov edi, str.ReadEdpEdiskSetInfo_Not_EDP_EDISK_SET_INFO_FLAG_Flag___r_n
call fcn.10011e30
mov eax, 1
jmp 0x1000d6d7
Function at 0x1000d710
Capabilities:
Print debug messages
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebp
push esi
mov esi, ecx
jmp 0x1000d73a
push 0x1ff
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.10037cf0
add esp, 0xc
push 0x1ff
lea ecx, [esp + 0x215]
push 0
push ecx
mov byte [esp + 0x21c], 0
call fcn.10037cf0
add esp, 0xc
test esi, esi
je 0x1000d84d
push 0x80
push esi
lea edx, [esp + 0x18]
push 0x81
push edx
mov dword [esi], 0x49534545
call fcn.10032c83
add esp, 0x10
call fcn.1001f600
mov eax, 0x10068ce0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000d7a5
mov ecx, 0
sub eax, edx
mov edx, ecx
je 0x1000d7db
jmp 0x1000d7c0
movzx esi, byte [edx + 0x10068ce0]
movzx ebp, cl
xor esi, ebp
shr ecx, 8
xor ecx, dword [esi*4 + 0x100676c0]
inc edx
cmp edx, eax
jb 0x1000d7c0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x14]
push 0x80
push ecx
mov edx, 4
call fcn.1001f410
add esp, 0xc
jmp 0x1000d80b
mov eax, dword [0x100676ac]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
lea edx, [eax + eax*8]
push edx
push edi
call esi
mov ecx, dword [0x100676ac]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x21c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000d869
push str.EDPEDISK_WriteEdpEdiskSetInfo_ReadFile_fail
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
pop esi
pop ebp
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10032551
add esp, 0x414
ret
push 0x80
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x218]
push 0x80
push ecx
call fcn.10032c83
mov eax, dword [0x100676ac]
add esp, 0x10
push 0
lea edx, [eax + eax*4]
push 0
add edx, edx
push edx
push edi
call esi
mov ecx, dword [0x100676ac]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x21c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000d8df
push str.EDPEDISK_WriteEdpEdiskSetInfo_WriteFile_success
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
pop ebp
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10032551
add esp, 0x414
ret
push str.EDPEDISK_WriteEdpEdiskSetInfo_WriteFile_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x414]
pop esi
pop ebp
xor ecx, esp
call fcn.10032551
add esp, 0x414
ret
Function at 0x1000d725
Capabilities:
Encode data using xor
Print debug messages
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebp
push esi
mov esi, ecx
jmp 0x1000d73a
push 0x1ff
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.10037cf0
add esp, 0xc
push 0x1ff
lea ecx, [esp + 0x215]
push 0
push ecx
mov byte [esp + 0x21c], 0
call fcn.10037cf0
add esp, 0xc
test esi, esi
je 0x1000d84d
push 0x80
push esi
lea edx, [esp + 0x18]
push 0x81
push edx
mov dword [esi], 0x49534545
call fcn.10032c83
add esp, 0x10
call fcn.1001f600
mov eax, 0x10068ce0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000d7a5
mov ecx, 0
sub eax, edx
mov edx, ecx
je 0x1000d7db
jmp 0x1000d7c0
movzx esi, byte [edx + 0x10068ce0]
movzx ebp, cl
xor esi, ebp
shr ecx, 8
xor ecx, dword [esi*4 + 0x100676c0]
inc edx
cmp edx, eax
jb 0x1000d7c0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x14]
push 0x80
push ecx
mov edx, 4
call fcn.1001f410
add esp, 0xc
jmp 0x1000d80b
mov eax, dword [0x100676ac]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
lea edx, [eax + eax*8]
push edx
push edi
call esi
mov ecx, dword [0x100676ac]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x21c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000d869
push str.EDPEDISK_WriteEdpEdiskSetInfo_ReadFile_fail
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
pop esi
pop ebp
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10032551
add esp, 0x414
ret
push 0x80
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x218]
push 0x80
push ecx
call fcn.10032c83
mov eax, dword [0x100676ac]
add esp, 0x10
push 0
lea edx, [eax + eax*4]
push 0
add edx, edx
push edx
push edi
call esi
mov ecx, dword [0x100676ac]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x21c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000d8df
push str.EDPEDISK_WriteEdpEdiskSetInfo_WriteFile_success
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
pop ebp
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10032551
add esp, 0x414
ret
push str.EDPEDISK_WriteEdpEdiskSetInfo_WriteFile_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x414]
pop esi
pop ebp
xor ecx, esp
call fcn.10032551
add esp, 0x414
ret
Function at 0x1000d910
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov eax, 0x2014
call fcn.1003a830
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x2010], eax
push ebp
mov ebp, dword [esp + 0x201c]
push esi
push edi
mov esi, ecx
jmp 0x1000d946
push 0xfff
lea eax, [esp + 0x1d]
push 0
push eax
mov byte [esp + 0x24], 0
call fcn.10037cf0
add esp, 0xc
push 0xfff
lea ecx, [esp + 0x101d]
push 0
push ecx
mov byte [esp + 0x1024], 0
call fcn.10037cf0
mov eax, dword [0x100676ac]
add esp, 0xc
push 0
push 0
lea edx, [eax + eax*8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x100676ac]
push 0
lea eax, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x1024]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000d9c8
mov edi, str.ReadTempUseInfo_ReadFile_Fail__r_n
call fcn.10011e30
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1000db18
push 0x1000
lea eax, [esp + 0x101c]
push eax
lea ecx, [esp + 0x20]
push 0x1001
push ecx
call fcn.10032c83
add esp, 0x10
call fcn.1001f600
mov eax, 0x10068ce0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000d9f4
mov ecx, 0
sub eax, edx
mov edx, ecx
je 0x1000da2b
jmp 0x1000da10
movzx esi, byte [edx + 0x10068ce0]
movzx edi, cl
xor esi, edi
shr ecx, 8
xor ecx, dword [esi*4 + 0x100676c0]
inc edx
cmp edx, eax
jb 0x1000da10
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], ecx
push 0x80
push eax
mov ecx, eax
mov edx, 4
call fcn.1001f2b0
mov edi, 0x55544545
add esp, 0xc
cmp dword [esp + 0x18], edi
je 0x1000daee
push 0x1000
lea ecx, [esp + 0x101c]
push ecx
lea edx, [esp + 0x20]
push 0x1001
push edx
call fcn.10032c83
mov eax, 0x10068de8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000da83
sub eax, edx
mov edx, eax
mov esi, 0x10068de8
call fcn.1001f690
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push 0x80
push ecx
mov edx, 4
call fcn.1001f2b0
add esp, 0xc
cmp dword [esp + 0x18], edi
jne 0x1000db32
mov edi, str.Find_EDP_EDISK_TEMP_USE_FLAG__r_n
call fcn.10011e30
push esi
push 0x104
push 0x10068ce0
call fcn.100329ad
add esp, 0xc
push esi
push 0x104
push 0x10069f30
call fcn.100329ad
add esp, 0xc
push 0x80
lea edx, [esp + 0x1c]
push edx
push 0x81
push ebp
call fcn.10032c83
add esp, 0x10
jmp 0x1000db16
xor eax, eax
mov ecx, dword [esp + 0x201c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10032551
add esp, 0x2014
ret 4
mov edi, str.ReadPartionInfoEx_Not_EDP_EDISK_TEMP_USE_FLAG_Flag___r_n
call fcn.10011e30
mov eax, 1
jmp 0x1000db18
Function at 0x1000db50
Capabilities:
Encode data using xor
Print debug messages
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x418
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x410], eax
push ebp
push esi
push edi
mov esi, ecx
mov edi, edx
jmp 0x1000db7d
push 0x1ff
lea eax, [esp + 0x1d]
push 0
push eax
mov byte [esp + 0x24], 0
call fcn.10037cf0
add esp, 0xc
push 0x1ff
lea ecx, [esp + 0x21d]
push 0
push ecx
mov byte [esp + 0x224], 0
call fcn.10037cf0
add esp, 0xc
push 0x80
push edi
lea edx, [esp + 0x20]
push 0x81
push edx
call fcn.10032c83
add esp, 0x10
call fcn.1001f600
mov eax, 0x10068ce0
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000dbe0
sub eax, ecx
mov ecx, 0
mov edx, ecx
je 0x1000dc0d
movzx edi, byte [edx + 0x10068ce0]
movzx ebp, cl
xor edi, ebp
shr ecx, 8
xor ecx, dword [edi*4 + 0x100676c0]
inc edx
cmp edx, eax
jb 0x1000dbf2
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x1c]
push 0x80
push ecx
mov edx, 4
call fcn.1001f410
add esp, 0xc
jmp 0x1000dc3d
mov eax, dword [0x100676ac]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
lea edx, [eax + eax*8]
push edx
push esi
call edi
mov ecx, dword [0x100676ac]
push 0
lea eax, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x224]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000dc9c
push str.EDPEDISK_WriteTempUseInfo_ReadFile_fail
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.10032551
add esp, 0x418
ret
push 0x80
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x220]
push 0x80
push ecx
call fcn.10032c83
mov eax, dword [0x100676ac]
add esp, 0x10
push 0
push 0
lea edx, [eax + eax*8]
push edx
push esi
call edi
mov ecx, dword [0x100676ac]
push 0
lea eax, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x224]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000dd14
push str.EDPEDISK_WriteTempUseInfo_WriteFile_fail
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.10032551
add esp, 0x418
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10032551
add esp, 0x418
ret
Function at 0x1000e010
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov eax, 0x1008
call fcn.1003a830
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x1004], eax
push esi
push edi
mov edi, ecx
mov esi, edx
jmp 0x1000e040
push 0xfff
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.10037cf0
push 0xc0
mov eax, 0x88
xor byte [esi + 3], al
xor byte [esi + 6], al
push edi
lea edx, [esp + 0x20]
mov ecx, eax
xor word [esi], cx
push 0xc1
push edx
call fcn.10032c83
push 0xe
push esi
lea eax, [esp + 0xf0]
push 0xf
push eax
call fcn.10032c83
add esp, 0x2c
call fcn.1001f600
mov eax, 0x10068ce0
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000e0a0
sub eax, ecx
mov ecx, 0
mov edx, ecx
je 0x1000e0cd
movzx esi, byte [edx + 0x10068ce0]
movzx edi, cl
xor esi, edi
shr ecx, 8
xor ecx, dword [esi*4 + 0x100676c0]
inc edx
cmp edx, eax
jb 0x1000e0b2
mov edx, ecx
shr edx, 0x10
xor edx, ecx
movzx ecx, dx
xor eax, eax
lea esp, [esp]
xor word [esp + eax*2 + 0xc], cx
mov edx, 0xff
sub edx, eax
inc eax
add ecx, edx
cmp eax, 0x100
jl 0x1000e0e0
jmp 0x1000e106
mov eax, dword [0x100676ac]
push 0
lea ecx, [eax*8]
push 0
sub ecx, eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [0x100676ac]
push 0
lea edx, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000e156
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.10032551
add esp, 0x1008
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
xor ecx, esp
call fcn.10032551
add esp, 0x1008
ret

Function at 0x1000e180
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1008
call fcn.1003a830
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x1004], eax
push 0xfff
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.10037cf0
mov ecx, dword [0x100676ac]
add esp, 0xc
push 0
push 0
lea edx, [ecx*8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x100676ac]
push 0
lea eax, [esp + 4]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000e220
lea eax, [esp + 4]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000e1f0
sub eax, edx
lea ecx, [esp + 4]
push ecx
inc eax
push eax
push edi
call fcn.100329ad
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.10032551
add esp, 0x1008
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.10032551
add esp, 0x1008
ret