joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401769
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4017a8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4017a8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4017a8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4017a8
cmp dword [ecx + 0x74], 0xe
jbe 0x4017a8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4078e6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4155f8
push 0x4155f0
push str.FlsAlloc
push 0x1f
call fcn.004077a5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40791a
push dword [ebp + 8]
mov ecx, esi
call dword [0x414114]
call esi
jmp 0x407920
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407964
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415608
push 0x415600
push str.FlsGetValue
push 0x21
call fcn.004077a5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40799b
push dword [ebp + 8]
mov ecx, esi
call dword [0x414114]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4079a3
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415610
push 0x415608
push str.FlsSetValue
push 0x22
call fcn.004077a5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4079dd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x414114]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40af28
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40afc5
push ebx
push esi
call fcn.0040aef1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040ae85
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40af72
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40afc4
push edi
push eax
call fcn.00408095
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40af92
call fcn.00407638
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40afc3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040ae85
add esp, 0x20
test eax, eax
jne 0x40afb1
push edi
call fcn.00407638
jmp 0x40afb9
push ebx
call fcn.00407638
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x413080
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4130ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4130ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4097ac
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409860
jmp 0x409855
cmp dword [esi + 0x10], 0x1000
jne 0x409841
test byte [esi + 0x15], 1
jne 0x409841
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409800
cmp eax, 2
je 0x409800
cmp eax, 0x10
je 0x409800
cmp eax, 0x20
jne 0x409815
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409815
mov bl, 1
xor ebp, ebp
jmp 0x409826
mov eax, dword [esi]
add eax, ebp
call fcn.004097a4
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409819
test bl, bl
je 0x409841
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409860
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4097d8
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408e84
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5a765252
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x32084daf
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x100021e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x100ad00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x1000239e
mov esi, dword [edi]
test esi, esi
je 0x1000239e
mov eax, dword [esi]
push ebx
mov dword [edi], eax
lea eax, [esi + 4]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xa8], eax
test eax, eax
je 0x10002378
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x10002350
push ebx
push dword [ebp - 0xa8]
lea eax, [esi + 4]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10002323
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xa8]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1000231c
mov ecx, dword [ebp - 0xa8]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04X_04XCompanyName
lea eax, [ebp - 0xa4]
push 0x50
push eax
call fcn.10004830
add esp, 0x14
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xa4]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100022e8
push dword [ebp - 0xb0]
push edi
call fcn.10001c30
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xa4]
push eax
push str.VerQueryValueW__ls_failed
push edi
call fcn.10001b80
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
push str.VerQueryValueW_VarFileInfoTranslation_failed
jmp 0x10002328
push str.GetFileVersionInfo_failed
push edi
call fcn.10001ae0
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
push 0x19
push str.Error:_GlobalAlloc_failed
push edi
call fcn.10001c80
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
push str.GetFileVersionInfoSizeW_failed
push edi
call fcn.10001ae0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
push 0x4c
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push 0x46
push str.Error:_Could_not_retrieve_file_name
lea ecx, [esi + 4]
push ecx
call sym.IntelFirmwareInterfaceInstallHelper.dll_nocrt_memcpy
add esp, 0xc
xor eax, eax
mov word [esi + 0x4a], ax
mov ecx, dword [edi]
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
mov dword [edi], esi
xor ecx, ebp
pop edi
pop esi
call fcn.10001210
mov esp, ebp
pop ebp
ret
Function at 0x10003680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x1000]
cmp eax, 0x2000
jb 0x1000382c
cmp dword [edi], 0x19530414
jne 0x1000382c
mov eax, dword [ebp + 0xc]
add eax, 0x1000
cmp eax, 0x2000
jb 0x10003822
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x10003817
lea eax, [edi + 4]
push esi
push eax
call fcn.1000a8a0
mov esi, eax
add esp, 4
test esi, esi
js 0x1000380e
lock inc dword [edi + 0x24]
cmp dword [edi + 0x4c], 0
jne 0x10003800
call fcn.1000a750
mov dword [edi + 0x4c], eax
cmp byte [edi + 0x29], 0
mov dword [ebp - 4], 0
jne 0x100037e2
push dword [edi + 0x64]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [edi + 4]
push eax
call fcn.1000aa40
add esp, 4
lea esi, [edi + 0x54]
lea eax, [ebp - 4]
push esi
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10003734
xor esi, esi
jmp 0x1000377d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100037d4
push 0xffffffffffffffff
push dword [edi + 0x64]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100037b8
push 1
lea eax, [ebp - 4]
push eax
push esi
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1000376c
xor esi, esi
jmp 0x1000377d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000ab30
add esp, 4
mov esi, eax
cmp dword [ebp - 4], ebx
jbe 0x10003785
mov dword [ebp - 4], ebx
lea eax, [edi + 4]
push eax
call fcn.1000a8a0
add esp, 4
test esi, esi
js 0x100037e7
mov eax, dword [ebp - 4]
add dword [ebp + 0xc], eax
sub ebx, eax
jne 0x100036f1
push edi
mov dword [edi + 0x4c], ebx
call fcn.100031c0
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
cmp eax, 0x102
jne 0x100037c6
mov esi, 0xffffffd8
jmp 0x1000377d
cmp eax, 0x80
jne 0x1000376c
mov esi, 0xfffffffc
jmp 0x1000377d
cmp eax, 0xe8
jne 0x10003772
mov esi, 0xfffffed3
jmp 0x1000377d
mov esi, 0xffffffba
push edi
mov dword [edi + 0x4c], 0
call fcn.100031c0
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push edi
mov esi, 0xffffffea
call fcn.100031c0
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
pop ebx
mov eax, 0xfffffffe
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffa
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffc
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100038d0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100ad00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20c], eax
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x10003911
test edi, edi
jne 0x10003915
mov eax, 0xfffffffe
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x100038fc
test esi, esi
jne 0x1000391d
test eax, eax
je 0x100038fc
cmp dword [ebp + 8], 0xffffffff
je 0x10003942
call fcn.1000caf0
cmp dword [ebp + 8], eax
je 0x10003942
pop edi
mov eax, 0xffffffdb
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x101
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x100039d1
cmp dword [ebp - 0x20c], 0
je 0x100039aa
push str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winprocess_win.cpp
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
lea eax, [ebp - 0x208]
push eax
call fcn.10004520
add esp, 0x18
test esi, esi
je 0x10003901
inc dword [esi]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x208]
push eax
call fcn.10004340
add esp, 4
inc eax
mov dword [esi], eax
mov eax, 0xffffffd7
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000ab30
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
call fcn.10001210
mov esp, ebp
pop ebp
ret
Function at 0x10008240
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 0x8001
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push str.SetDllDirectoryW
push dword [0x100ae0d4]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x1000829d
push 0x1007a0f4
mov ecx, ebx
call dword [section..rdata]
call ebx
test eax, eax
je 0x10008298
mov dword [0x100ad1b0], 2
jmp 0x1000829d
mov edi, 0xffffff1d
and esi, 4
cmp dword [0x100adfb0], 0x6c
jg 0x100082ad
test esi, esi
je 0x10008301
push str.SetDefaultDllDirectories
push dword [0x100ae0d4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x10008301
neg esi
mov ecx, ebx
sbb esi, esi
and esi, 0xfffffe00
add esi, 0xa00
push esi
call dword [section..rdata]
call ebx
test eax, eax
je 0x100082f8
and esi, 0x200
neg esi
sbb esi, esi
add esi, 4
mov dword [0x100ad1b0], esi
jmp 0x10008301
test edi, edi
js 0x10008301
mov edi, 0xffffff1c
push str.GetCurrentThreadStackLimits
push dword [0x100ae0d4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetUnhandledExceptionFilter
push dword [0x100ae0d4]
mov dword [0x100adfa4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.UnhandledExceptionFilter
push dword [0x100ae0d4]
mov dword [0x100ae108], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [0x100ae108]
mov dword [0x100ae10c], eax
test esi, esi
je 0x10008379
cmp dword [0x100adfa8], 0
jne 0x10008379
push 0x100088d0
mov ecx, esi
call dword [section..rdata]
call esi
mov ecx, eax
sub ecx, 0x100088d0
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [0x100adfa8], ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10009520
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x100ae1dc], 0
push esi
mov esi, 0x1c
jne 0x100095a1
push 0
push 1
push 0
push 1
push 0x100ae1dc
call fcn.100153b0
mov esi, eax
add esp, 0x14
test esi, esi
js 0x100095a1
call fcn.1000a7e0
mov esi, eax
test esi, esi
js 0x10009589
push 0x1007b2dc
push 8
push 0
push 4
call fcn.100090a0
mov esi, eax
add esp, 0x10
test esi, esi
js 0x10009589
push 4
call fcn.10007ed0
mov esi, eax
add esp, 4
test esi, esi
js 0x10009589
mov byte [0x100ae1d0], 1
xor eax, eax
pop esi
ret
push dword [0x100ae1dc]
call fcn.100154d0
add esp, 4
mov dword [0x100ae1dc], 0
mov eax, esi
pop esi
ret
Function at 0x10009b00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.1000d480
mov esi, eax
add esp, 0xc
test esi, esi
js 0x10009b47
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10009b3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000ab30
add esp, 4
mov esi, eax
push dword [ebp - 4]
call fcn.1000d470
add esp, 4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10009bc0
Capabilities:
Clear file content
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x1c
push edi
test eax, eax
je 0x10009f80
mov dword [eax], 0xffffffff
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x10009be5
mov dword [eax], 0
mov edi, dword [ebp + 8]
test edi, edi
je 0x10009f80
lea eax, [ebp + 0xc]
push eax
call fcn.10031230
add esp, 4
test eax, eax
js 0x10009ef9
mov ecx, dword [ebp + 0xc]
mov eax, ecx
and eax, 0x700
push ebx
push esi
cmp eax, 0x300
ja 0x10009c40
je 0x10009c39
cmp eax, 0x100
je 0x10009c32
cmp eax, 0x200
jne 0x10009f74
mov edx, 1
jmp 0x10009c61
mov edx, 4
jmp 0x10009c61
mov edx, 2
jmp 0x10009c61
cmp eax, 0x700
jne 0x10009f74
mov eax, ecx
mov edx, 5
and eax, 0x1000
or eax, 0
jne 0x10009c61
mov edx, 3
mov eax, ecx
mov dword [ebp - 8], edx
and eax, 3
jmp dword [eax*4 + 0x10009f8c]
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
mov eax, 0xfffffff3
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffe
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000a050
Capabilities:
Get disk size
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100ad00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x20], esi
cmp ebx, 0xffffffff
je 0x1000a074
mov eax, ebx
jmp 0x1000a077
or eax, 0xffffffff
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x28], eax
cmp eax, 0xffffffff
je 0x1000a0a4
mov ecx, dword [ebp - 0x24]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], ecx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000ab30
add esp, 4
mov esi, eax
cmp ebx, 0xffffffff
je 0x1000a0be
mov ecx, ebx
jmp 0x1000a0c1
or ecx, 0xffffffff
push 0
lea eax, [ebp - 0x34]
push eax
push 0x18
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0x70000
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1000a160
mov eax, dword [ebp - 0x14]
cmp eax, 0xc
je 0x1000a0ee
cmp eax, 0xb
jne 0x1000a160
mov eax, dword [ebp - 8]
mul dword [ebp - 0xc]
push edi
push dword [ebp - 0x18]
mov ecx, eax
mov eax, edx
mul dword [ebp - 0x10]
push dword [ebp - 0x1c]
mov edi, eax
mov eax, ecx
mul dword [ebp - 0x10]
add edi, edx
push edi
push eax
call fcn.10068110
mov esi, dword [ebp - 0x20]
pop edi
mov dword [esi], eax
mov dword [esi + 4], edx
cmp ebx, 0xffffffff
jne 0x1000a123
or ebx, 0xffffffff
push 0
lea eax, [ebp - 0x20]
push eax
push 8
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push 0x7405c
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1000a14e
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001210
mov esp, ebp
pop ebp
ret
Function at 0x1000a180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x1000a1a6
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000a30f
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp ebx, 0xffffffff
je 0x1000a1b9
mov eax, ebx
jmp 0x1000a1bc
or eax, 0xffffffff
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push 0
push ecx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000a259
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
test ecx, ecx
je 0x1000a1eb
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, eax
jbe 0x1000a30f
mov ecx, edi
mov dword [ebp - 8], 0
sub ecx, eax
lea edx, [eax + esi]
cmp ebx, 0xffffffff
je 0x1000a20a
mov eax, ebx
jmp 0x1000a20d
or eax, 0xffffffff
push 0
lea edi, [ebp - 8]
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x1000a243
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x1000a301
mov eax, dword [ebp - 4]
add eax, ecx
mov dword [ebp - 4], eax
cmp edi, eax
ja 0x1000a1f3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000ab30
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x1000a249
mov esi, edi
shr esi, 1
cmp esi, 0x4000
jbe 0x1000a277
mov esi, 0x4000
jmp 0x1000a283
add esi, 0xff
and esi, 0xffffff00
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, edi
sub ecx, eax
cmp esi, ecx
ja 0x1000a292
mov ecx, esi
mov edx, dword [ebp + 0xc]
add edx, eax
mov dword [ebp - 8], 0
cmp ebx, 0xffffffff
je 0x1000a2a7
mov eax, ebx
jmp 0x1000a2aa
or eax, 0xffffffff
push 0
lea edi, [ebp - 8]
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
test eax, eax
jne 0x1000a2de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x1000a249
cmp esi, eax
jbe 0x1000a249
mov eax, dword [ebp - 4]
shr esi, 1
jmp 0x1000a2f4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add eax, ecx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 4], eax
test edx, edx
jne 0x1000a30d
test ecx, ecx
je 0x1000a301
cmp edi, eax
ja 0x1000a288
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffff92
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret