joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409af0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
mov esi, ecx
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edx + 0x2ff0]
call fcn.0041f250
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esi]
mov ebp, dword [esp + 0x18]
mov esi, dword [esi + 4]
mov ecx, dword [eax + 0x2ff8]
mov eax, dword [ecx + 0x490]
sub ebp, eax
mov eax, dword [esp + 0x14]
cdq
and edx, 0xf
mov dword [esp + 0x18], ebp
mov ebx, dword [esi + 0x1021a4]
add eax, edx
sar eax, 4
cmp eax, ebx
jge 0x409b5c
xor ax, ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov edx, dword [esi + 0x1021ac]
add edx, ebx
cmp eax, edx
jl 0x409b75
xor ax, ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov eax, ebp
mov edi, dword [esi + 0x1021a8]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
cmp eax, edi
jge 0x409b97
xor ax, ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov ecx, dword [esi + 0x1021b0]
add ecx, edi
cmp eax, ecx
jl 0x409bb0
xor ax, ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov eax, dword [esp + 0x20]
mov edx, dword [esi + 0x102194]
xor ecx, ecx
mov cx, word [eax + 4]
sub ecx, edx
xor edx, edx
mov dx, word [eax + 6]
add ecx, ebx
mov ebx, dword [esi + 0x102198]
shl ecx, 4
sub edx, ebx
mov dword [esp + 0x10], ecx
add edx, edi
lea edi, [ecx - 0x20]
shl edx, 4
test edi, edi
mov esi, edx
jge 0x409be9
xor ecx, ecx
lea edi, [edx - 0x20]
test edi, edi
jge 0x409bf2
xor edx, edx
mov edi, dword [esp + 0x14]
xor ebx, ebx
cmp edi, ecx
mov dword [esp + 0x20], ebx
jl 0x409c36
mov ebx, dword [esp + 0x10]
xor ecx, ecx
mov cl, byte [eax + 2]
and ebx, 0xffff
shl ecx, 4
add ecx, ebx
cmp edi, ecx
jg 0x409c32
cmp ebp, edx
jl 0x409c32
xor edx, edx
mov ecx, esi
mov dl, byte [eax + 3]
and ecx, 0xffff
shl edx, 4
add edx, ecx
cmp ebp, edx
jle 0x409c87
mov ebx, dword [esp + 0x20]
mov ecx, esi
and ecx, 0xffff
cmp ebp, ecx
jge 0x409c47
mov ebx, 1
xor edx, edx
mov dl, byte [eax + 3]
shl edx, 4
add edx, ecx
cmp ebp, edx
jle 0x409c58
or ebx, 8
mov ecx, dword [esp + 0x10]
and ecx, 0xffff
cmp edi, ecx
jge 0x409c69
or ebx, 2
xor edx, edx
mov dl, byte [eax + 2]
shl edx, 4
add edx, ecx
cmp edi, edx
jle 0x409c8b
or ebx, 4
mov ax, bx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov ebx, dword [esp + 0x20]
pop edi
pop esi
mov ax, bx
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x40ae40
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov edi, ecx
push 0x21
mov dword [esp + 0x14], edi
call esi
test ax, ax
je 0x40aeb1
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
push 0
push 0
push 0
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
je 0x40aea4
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
call ebx
test eax, eax
je 0x40aead
lea edx, [esp + 0x14]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0x21
call esi
test ax, ax
jne 0x40ae6e
mov edi, dword [esp + 0x10]
mov ax, word [edi + 4]
test ax, ax
je 0x40aebf
dec eax
mov word [edi + 4], ax
mov ecx, dword [esp + 0x38]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8

Function at 0x40aee0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, ecx
push 0x22
call edi
test ax, ax
je 0x40af47
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebp, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call ebx
test eax, eax
je 0x40af3e
push 0
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
call ebp
test eax, eax
je 0x40af47
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0x22
call edi
test ax, ax
jne 0x40af04
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40af73
cmp eax, 3
jne 0x40af9a
mov cx, word [esi + 4]
mov eax, ecx
and eax, 0xffff
add eax, 2
lea eax, [eax + eax*4]
shl eax, 4
cmp eax, 0x190
jl 0x40af95
jg 0x40af9a
jmp 0x40af95
mov cx, word [esi + 4]
mov eax, ecx
and eax, 0xffff
add eax, 2
lea eax, [eax + eax*4]
shl eax, 4
cmp eax, 0x1000
jl 0x40af95
cmp eax, 0x1040
jg 0x40af9a
inc ecx
mov word [esi + 4], cx
mov ecx, dword [esp + 0x34]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x40c900
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x40c92a
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x40c91c
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 4], 1
pop esi
add esp, 0x1c
ret 4
mov eax, dword [esp + 0x24]
push 0
push 0x40bcd0
push eax
push 0x6d
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [esi], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push ecx
push edx
mov dword [esi + 4], 1
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40c9a3
mov eax, dword [esi]
push 0
push 0
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40c9a3
lea edx, [esp + 4]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
add esp, 0x1c
ret 4
Function at 0x40e2b0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x1c], ecx
call fcn.0040e190
test eax, eax
jne 0x40e30a
push edi
lea ecx, [esp + 0x24]
push str.___s__
push ecx
call fcn.00420440
add esp, 0xc
lea edx, [esp + 0x20]
push 0
push str.data
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 8
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40e33e
push edi
push 0x43a374
call fcn.00412360
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 8
mov ebx, dword [esp + 0x128]
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea edx, [esp + 0x18]
push 0
push edx
push esi
push ebx
push eax
mov edi, eax
call ebp
test eax, eax
jne 0x40e3ad
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x40e370
xor eax, eax
jmp 0x40e385
call fcn.004105f0
test eax, eax
je 0x40e385
lea eax, [esp + 0x18]
push 0
push eax
push esi
push ebx
push edi
call ebp
test eax, eax
jne 0x40e3ad
mov ecx, dword [esp + 0x124]
push ecx
push 0x43a350
call fcn.00412360
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 8
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
test eax, eax
jne 0x40e3dd
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x40e3cd
xor eax, eax
jmp 0x40e3e5
call fcn.004105f0
test eax, eax
je 0x40e3e5
mov eax, dword [esp + 0x10]
push eax
call esi
mov dword [esp + 0x10], 0
test eax, eax
jne 0x40e40d
mov ecx, dword [esp + 0x124]
push ecx
push 0x43a32c
call fcn.00412360
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 8
Function at 0x40e420
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x110
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x120]
push edi
push eax
mov ebp, ecx
push esi
call fcn.0040e190
test eax, eax
jne 0x40e478
push esi
lea ecx, [esp + 0x24]
push str.___s__
push ecx
call fcn.00420440
add esp, 0xc
lea edx, [esp + 0x20]
push 0
push str.data
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 8
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
cmp edx, 0xffffffff
mov dword [esp + 0x14], edx
jne 0x40e4b0
push esi
push 0x43a374
call fcn.00412360
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 8
mov eax, dword [ebp + 0x28]
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
mov esi, dword [eax + 0x1158]
mov edi, ecx
lea esi, [esi + eax + 0x2000]
lea eax, [esp + 0x1c]
push eax
push edx
push esi
push ecx
call ebx
test eax, eax
jne 0x40e52a
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40e4e7
xor eax, eax
jmp 0x40e502
mov ecx, ebp
call fcn.004105f0
test eax, eax
je 0x40e502
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push edx
push esi
push edi
call ebx
test eax, eax
jne 0x40e52a
mov eax, dword [esp + 0x124]
push eax
push 0x43a350
call fcn.00412360
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 8
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
test eax, eax
jne 0x40e558
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40e546
xor eax, eax
jmp 0x40e560
mov ecx, ebp
call fcn.004105f0
test eax, eax
je 0x40e560
mov edx, dword [esp + 0x10]
push edx
call esi
mov dword [esp + 0x10], 0
test eax, eax
jne 0x40e588
mov eax, dword [esp + 0x124]
push eax
push 0x43a32c
call fcn.00412360
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 8
mov eax, dword [ebp + 0x28]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x128]
push ecx
mov ecx, dword [eax + 0x1158]
push edx
lea edx, [ecx + eax + 0x2000]
mov ecx, dword [ebp + 4]
push edx
call fcn.0040bae0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 8
Function at 0x40e5c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x14], 0x11
test eax, eax
mov byte [ebp - 0x13], 2
mov byte [ebp - 0x12], 8
mov byte [ebp - 0x11], 0x13
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 5
mov byte [ebp - 0xe], 0xa
mov byte [ebp - 0xd], 0xd
mov byte [ebp - 0xc], 1
mov byte [ebp - 0xb], 0xf
mov byte [ebp - 0xa], 6
mov byte [ebp - 9], 4
mov byte [ebp - 8], 0xb
mov byte [ebp - 7], 0x10
mov byte [ebp - 6], 3
mov byte [ebp - 5], 9
mov byte [ebp - 4], 0x12
mov byte [ebp - 3], 0xc
mov byte [ebp - 2], 7
mov byte [ebp - 1], 0xe
mov byte [ebp + 0xf], al
jbe 0x40e677
mov edx, dword [ebp + 8]
push edi
push esi
push ebx
mov dword [ebp + 8], eax
mov edi, edx
lea eax, [ebp - 0x14]
xor ecx, ecx
sub edi, eax
mov bl, byte [ebp + 0xf]
lea esi, [ebp + ecx - 0x14]
mov al, byte [edi + esi]
xor al, bl
xor ebx, ebx
mov bl, byte [esi]
mov byte [ebp + ebx - 0x28], al
xor ah, ah
mov al, byte [ebp + 0xf]
shl ax, 1
add al, byte [ebp + 0xf]
inc ax
mov byte [ebp + 0xf], al
inc ecx
cmp ecx, 0x14
jl 0x40e632
mov eax, dword [ebp + 8]
mov edi, edx
add edx, 0x14
mov ecx, 5
lea esi, [ebp - 0x28]
dec eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp + 8], eax
jne 0x40e629
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x40e680
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x98
xor eax, eax
push ebx
mov ebx, dword [esp + 0xa0]
mov dword [esp + 0xc], eax
push ebp
mov dword [esp + 0x14], eax
push esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
push ebx
mov byte [esp + 0x28], al
call fcn.004204e0
mov eax, dword [esp + 0xbc]
add esp, 4
xor edi, edi
test eax, eax
jbe 0x40e71c
mov ebp, dword [esp + 0xb0]
mov ecx, ebp
lea esi, [esp + 0x18]
mov edx, dword [ecx]
mov dword [esp + 0x18], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x1c], eax
mov eax, ebx
mov ecx, dword [ecx + 8]
mov dword [esp + 0x20], ecx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40e704
test cl, cl
je 0x40e700
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40e704
add eax, 2
add esi, 2
test cl, cl
jne 0x40e6e0
xor eax, eax
jmp 0x40e709
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40e71c
mov eax, dword [esp + 0xb8]
inc edi
add ebp, 0x14
cmp edi, eax
jb 0x40e6c4
cmp edi, dword [esp + 0xb8]
jne 0x40e75b
push ebx
lea eax, [esp + 0x2c]
push 0x43a3f8
push eax
call fcn.00420440
add esp, 0xc
lea ecx, [esp + 0x28]
push 0
push 0x43a3ec
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret 0x14
mov eax, dword [esp + 0xb0]
mov esi, dword [esp + 0xbc]
lea edx, [edi + edi*4]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [eax + edx*4 + 0x10]
lea ecx, [esp + 0x10]
lea ebx, [eax + edx*4]
push 0
push ecx
push edi
push esi
mov dword [esp + 0x20], 0
call ebp
cmp eax, 0xffffffff
jne 0x40e7cc
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 8]
test eax, eax
je 0x40e842
call fcn.004105f0
test eax, eax
je 0x40e842
lea edx, [esp + 0x10]
push 0
push edx
push edi
push esi
call ebp
cmp eax, 0xffffffff
jne 0x40e7cc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret 0x14
mov ebx, dword [ebx + 0xc]
mov edi, dword [esp + 0xb4]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x10]
push 0
push eax
push ebx
push edi
push esi
call ebp
test eax, eax
jne 0x40e851
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x40e7fb
xor eax, eax
jmp 0x40e810
call fcn.004105f0
test eax, eax
je 0x40e810
lea ecx, [esp + 0x10]
push 0
push ecx
push ebx
push edi
push esi
call ebp
test eax, eax
jne 0x40e851
mov edx, dword [esp + 0xac]
lea eax, [esp + 0x28]
push edx
push 0x43a3f8
push eax
call fcn.00420440
add esp, 0xc
lea ecx, [esp + 0x28]
push 0
push 0x43a3ec
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret 0x14
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x98
ret 0x14
Function at 0x40eb50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 8], eax
push ebp
mov dword [esp + 0x10], eax
push esi
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
push ebx
mov byte [esp + 0x24], al
call fcn.004204e0
mov eax, dword [esp + 0x38]
add esp, 4
xor edi, edi
test eax, eax
jbe 0x40ebdd
mov ebp, dword [esp + 0x2c]
mov ecx, ebp
lea esi, [esp + 0x14]
mov edx, dword [ecx]
mov dword [esp + 0x14], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x18], eax
mov eax, ebx
mov ecx, dword [ecx + 8]
mov dword [esp + 0x1c], ecx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40ebc8
test cl, cl
je 0x40ebc4
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40ebc8
add eax, 2
add esi, 2
test cl, cl
jne 0x40eba4
xor eax, eax
jmp 0x40ebcd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40ebdd
mov eax, dword [esp + 0x34]
inc edi
add ebp, 0x14
cmp edi, eax
jb 0x40eb88
cmp edi, dword [esp + 0x34]
jne 0x40ebfd
push ebx
push 0x43a418
call fcn.00412360
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x14
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x38]
lea eax, [edi + edi*4]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [ecx + eax*4 + 0x10]
lea edx, [esp + 0x34]
lea ebp, [ecx + eax*4]
push 0
push edx
push edi
push esi
mov dword [esp + 0x44], 0
call ebx
cmp eax, 0xffffffff
jne 0x40ec65
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
je 0x40ecd2
call fcn.004105f0
test eax, eax
je 0x40ecd2
lea eax, [esp + 0x34]
push 0
push eax
push edi
push esi
call ebx
cmp eax, 0xffffffff
jne 0x40ec65
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x14
mov ecx, dword [esp + 0x10]
mov edi, dword [ebp + 0xc]
push 0
mov eax, dword [ecx + 0x28]
mov edx, dword [eax + 0x1158]
lea ebx, [edx + eax + 0x2000]
lea eax, [esp + 0x38]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40ecb8
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x40ec9f
xor eax, eax
jmp 0x40ecbc
call fcn.004105f0
test eax, eax
je 0x40ecb8
lea ecx, [esp + 0x34]
push 0
push ecx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x40ecde
mov edx, dword [esp + 0x28]
push edx
push 0x43a350
call fcn.00412360
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x28]
push edx
mov edx, dword [esp + 0x34]
mov ecx, dword [ecx + 4]
push edx
mov edx, dword [eax + 0x1158]
lea eax, [edx + eax + 0x2000]
push eax
call fcn.0040bae0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret 0x14
Function at 0x40ed10
Capabilities:
Get disk information
Inspect section memory permissions

Disassembly:
sub esp, 0x80
mov dword [esp], 1
mov dword [esp + 4], 2
mov dword [esp + 8], 4
mov dword [esp + 0xc], 8
mov dword [esp + 0x10], 0x10
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x1c], 0x80
mov dword [esp + 0x20], 0x100
mov dword [esp + 0x24], 0x200
mov dword [esp + 0x28], 0x400
mov dword [esp + 0x2c], 0x800
mov dword [esp + 0x30], 0x1000
mov dword [esp + 0x34], 0x2000
mov dword [esp + 0x38], 0x4000
mov dword [esp + 0x3c], 0x8000
mov dword [esp + 0x40], 0x10000
mov dword [esp + 0x44], 0x20000
mov dword [esp + 0x48], 0x40000
mov dword [esp + 0x4c], 0x80000
mov dword [esp + 0x50], 0x100000
mov dword [esp + 0x54], 0x200000
mov dword [esp + 0x58], 0x400000
mov dword [esp + 0x5c], 0x800000
mov dword [esp + 0x60], 0x1000000
mov dword [esp + 0x64], 0x2000000
mov dword [esp + 0x68], 0x4000000
mov dword [esp + 0x6c], 0x8000000
mov dword [esp + 0x70], 0x10000000
mov dword [esp + 0x74], 0x20000000
mov dword [esp + 0x78], 0x40000000
mov dword [esp + 0x7c], 0x80000000
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, dword [esp + 0x84]
and ecx, 0xff
and eax, dword [esp + ecx*4]
neg eax
sbb eax, eax
neg eax
add esp, 0x80
ret 4

Function at 0x40ef70
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ebx, ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40efa7
push edi
push 0x43a3d4
call fcn.00412360
add esp, 8
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push 0
push eax
push 0x2000
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40efd5
push 0x43a350
push 0x43a3c4
call fcn.00412360
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
test eax, eax
jne 0x40f011
mov eax, dword [ebx + 8]
test eax, eax
jne 0x40efed
xor eax, eax
jmp 0x40effb
mov ecx, ebx
call fcn.004105f0
test eax, eax
je 0x40effb
push esi
call edi
test eax, eax
jne 0x40f011
push 0x43a32c
push 0x43a3c4
call fcn.00412360
add esp, 8
pop edi
pop esi
pop ebx
ret 8
Function at 0x40f8f0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x100c
call fcn.004204b0
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x40f913
mov eax, 1
pop esi
add esp, 0x100c
ret 4
mov ecx, dword [esi]
push ebx
lea eax, [esp + 0x14]
push 0x80
push eax
push 0x43a42c
push str.TITLE
push str.Config
call fcn.004126a0
mov ecx, dword [esp + 0x1018]
lea edx, [esp + 0x14]
inc ecx
lea eax, [esp + 0x414]
push ecx
push edx
push str._s_d
push eax
call fcn.00420440
add esp, 0x10
lea ecx, [esp + 0xc14]
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push 0x400
push ecx
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0x828]
push 0x400
add esi, 0x1855
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea esi, [esp + 0x814]
lea eax, [esp + 0x414]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40f9d5
test cl, cl
je 0x40f9bf
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40f9d5
add eax, 2
add esi, 2
test cl, cl
jne 0x40f99b
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
pop ebx
pop esi
add esp, 0x100c
ret 4
sbb eax, eax
pop ebx
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
pop esi
add esp, 0x100c
ret 4
Function at 0x4105f0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x140c
call fcn.004204b0
push ebx
push ebp
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x1c8c], 1
jne 0x41061d
mov ecx, dword [edi]
call fcn.00412b90
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140c
ret
xor eax, eax
lea ebp, [edi + 0x1855]
mov al, byte [edi + 0x54]
push ebp
inc eax
lea ecx, [esp + 0x20]
push eax
push 0x43a524
push ecx
call fcn.00420440
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add esp, 0x10
mov dl, byte [ebp]
mov ecx, edi
sub dl, 0x41
push edx
call fcn.0040ed10
test eax, eax
jne 0x410679
mov ecx, dword [edi]
lea eax, [esp + 0x1c]
push eax
push 0x43a510
call fcn.00412b30
cmp eax, 2
je 0x410757
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x410643
mov eax, dword [edi + 8]
xor ecx, ecx
mov cl, byte [edi + 0x54]
test eax, eax
mov esi, ecx
je 0x410775
mov ecx, dword [edi]
lea edx, [esp + 0xc1c]
push 0x80
push edx
push 0x43a42c
push str.TITLE
push str.Config
call fcn.004126a0
inc esi
lea eax, [esp + 0xc1c]
push esi
push eax
lea ecx, [esp + 0x824]
push str._s_d
push ecx
call fcn.00420440
add esp, 0x10
lea edx, [esp + 0x101c]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push 0x400
push edx
push eax
lea edx, [esp + 0x24]
push ecx
push edx
lea eax, [esp + 0x430]
push 0x400
push eax
push ebp
call ebx
lea esi, [esp + 0x41c]
lea eax, [esp + 0x81c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41072b
test cl, cl
je 0x410727
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41072b
add eax, 2
add esi, 2
test cl, cl
jne 0x410707
xor eax, eax
jmp 0x410730
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jmp 0x410775
mov ecx, dword [edi]
mov dword [edi + 0x1c8c], 1
call fcn.00412b90
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x140c
ret