joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.004014da
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401d8d
sub eax, fcn.00401558
push eax
push fcn.00401558
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x401081
mov eax, ebx
lea edx, [ebp - 2]
call fcn.0040141a
mov eax, ebx
lea ecx, [ebx + 0x1b600]
call fcn.00401461
mov esi, ecx
mov eax, ebx
or si, 1
cdq
idiv esi
lea edx, [eax + ecx]
mov eax, ebx
mov ecx, 0x40b054
sar eax, 2
sub ecx, eax
lea ebx, [ebp - 2]
mov eax, ecx
call fcn.00401558
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x4014da
Capabilities:
Delete file
Encode data using base64 via winapi
Get common file path

Disassembly:
push ecx
push edx
enter 0x220, 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 4]
push eax

Function at 0x401521
Capabilities:
Encode data using base64 via winapi

Disassembly:
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret
Function at 0x4245e0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x4245f4
cmp dword [ecx + 0x24], eax
mov eax, 0x64d50c
je 0x4245f4
mov eax, dword [ecx + 0x1c]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x4258f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aedf5
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x663068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.CVolObject.0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 4], 0
lea eax, [ebx + 0xc]
mov dword [ebx], vtable.rg_volcano_YangWang::rg_WangLaoXiaZaiLei2_n.0
mov dword [ebp - 0x14], eax
mov dword [eax], vtable.CVolObject.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 1
mov dword [eax], vtable.rg_volcano_YangWang::rg_WangLaoXiaZaiChuLi.1.0
mov dword [eax + 0xc], vtable.rg_volcano_YangWang::rg_WangLaoXiaZaiChuLi.0
mov dword [eax + 0x10], 1
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov byte [ebp - 4], 3
lea ecx, [ebx + 0x30]
call fcn.00403990
mov byte [ebp - 4], 4
lea ecx, [ebx + 0x5c]
call fcn.00403990
mov byte [ebp - 4], 5
mov dword [ebx + 0x88], 1
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x94], 0
mov byte [ebp - 4], 6
cmp dword [0x666008], 0x40
jl 0x425a02
push 0x66600c
call fcn.0042c900
mov edi, dword [0x666004]
add esp, 4
test edi, edi
je 0x4259f4
mov eax, dword [edi]
mov dword [0x666004], eax
mov dword [0x66600c], 1
test edi, edi
jne 0x425a1d
push 0x40
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x425acf
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 7
mov dword [edi], vtable.CRefObject.0
mov dword [edi + 4], 1
mov byte [ebp - 4], 8
lea eax, [edi + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push eax
mov dword [edi], vtable.CVolEventObjectPointer.0
call esi
mov byte [ebp - 4], 9
lea eax, [edi + 0x24]
push eax
call esi
mov byte [ebp - 4], 0xa
mov dword [edi + 8], 0
mov dword [edi + 0x3c], ebx
mov byte [ebp - 4], 6
lea esi, [ebx + 0x1c]
push esi
mov dword [ebx + 0x98], edi
mov dword [ebx + 0x2c], 0
call fcn.0042c900
mov edx, dword [esi + 8]
add esp, 4
mov dword [esi + 4], 0x425860
mov dword [esi + 0xc], 0
cmp edx, edi
jne 0x425a99
mov dword [esi], 1
jmp 0x425ab4
mov ecx, edi
mov dword [esi + 8], edi
call fcn.0041e720
mov dword [esi], 1
test edx, edx
je 0x425ab4
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0x20]
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00489ffe
int3
Function at 0x429330
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af7db
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
mov eax, dword [0x663068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x400000
mov dword [0x665ff0], 0x64f0f8
mov dword [0x665ff8], 0x64f264
push 0
mov dword [ebp - 0x14], 0x665ff0
mov dword [0x66600c], 1
mov dword [0x666008], 0x100
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4295de
lea eax, [ecx + 0x400000]
mov dword [0x666004], ecx
mov dword [0x666000], eax
mov edx, 0x1555
mov eax, dword [0x666008]
mov dword [0x665ffc], ecx
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x666008]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x666008]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x666008]
add ecx, eax
sub edx, 1
jne 0x4293c4
mov dword [ecx], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0x666010
mov dword [ebp - 0x18], 0x666010
mov dword [ebp - 0x1c], 0x666010
mov dword [0x666010], 0x64ce40
mov dword [0x666014], edx
mov dword [0x666018], edx
mov byte [ebp - 4], 1
mov dword [0x666010], 0x64cddc
mov dword [0x66601c], edx
mov dword [0x666024], edx
mov dword [0x666020], edx
mov dword [0x666028], 0x40
mov byte [ebp - 4], 2
mov dword [0x666028], 0x80
mov byte [ebp - 4], 5
mov dword [0x66602c], edx
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x666040
mov dword [ebp - 0x20], 0x666040
call esi
mov byte [ebp - 4], 7
mov dword [0x666058], 0
mov byte [ebp - 4], 8
push 0x666064
mov dword [ebp - 0x24], 0x666064
call esi
mov byte [ebp - 4], 9
mov dword [0x66607c], 0x3e8
mov dword [ebp - 0x28], 0x666090
mov dword [ebp - 0x2c], 0x666090
mov dword [0x666090], 0x64ce40
mov dword [0x666094], 0
mov dword [0x666098], 0
mov byte [ebp - 4], 0xa
mov dword [0x666090], 0x64cddc
mov dword [0x66609c], 0
mov dword [0x6660a4], 0
mov dword [0x6660a0], 0
mov dword [0x6660a8], 0x40
mov byte [ebp - 4], 0xb
mov dword [0x6660a8], 0x80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x3c]
mov dword [0x666084], 0x3e80
mov dword [0x666088], 1
mov dword [0x66608c], 0
lea eax, [eax*2 + 2]
mov dword [0x666080], eax
mov byte [ebp - 4], 0xe
push 0x6660ac
call esi
mov byte [ebp - 4], 0xf
push ecx
mov ecx, 0x6660c4
call fcn.004241c0
mov byte [ebp - 4], 0x10
mov dword [0x666030], 0
mov dword [0x6660ec], 0
movsd xmm0, qword [0x654410]
movsd qword [0x666038], xmm0
xorps xmm0, xmm0
mov dword [0x6660f0], 0
mov dword [0x6660f4], 0
mov dword [0x6660f8], 0
mov dword [0x666034], 0
movq qword [0x66605c], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, 0x665ff0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00489ffe
int3
Function at 0x42a170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x14], 0
test ebx, ebx
jne 0x42a18f
pop esi
lea eax, [ebx + 1]
pop ebx
pop ebp
ret 0xc
mov eax, dword [ecx]
push edi
xor edi, edi
call dword [eax]
push dword [ebp + 0x10]
mov ecx, eax
movzx eax, bx
push eax
push ecx
mov dword [ebp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x42a265
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x42a265
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x42a25c
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [esi + 0x14], 0
cmp dword [esi + 0x10], edi
jl 0x42a240
cmp edi, 1
jne 0x42a205
mov eax, dword [esi + 0xc]
mov cl, byte [ebx]
mov byte [eax], cl
inc dword [esi + 0x14]
jmp 0x42a257
cmp edi, 2
jne 0x42a218
mov eax, dword [esi + 0xc]
movzx ecx, word [ebx]
mov word [eax], cx
add dword [esi + 0x14], edi
jmp 0x42a257
cmp edi, 4
jne 0x42a229
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov dword [eax], ecx
add dword [esi + 0x14], edi
jmp 0x42a257
cmp edi, 8
jne 0x42a240
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
add dword [esi + 0x14], edi
jmp 0x42a257
test edi, edi
jle 0x42a257
push edi
mov ecx, esi
call fcn.0042c0c0
push edi
push ebx
push eax
call fcn.00487cb0
add esp, 0xc
mov edi, 1
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x42af80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4afab5
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push esi
push edi
mov eax, dword [0x663068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x42b13e
cmp word [esi], 0
je 0x42b13e
lea ecx, [ebp - 0x38]
call fcn.00403990
mov dword [ebp - 4], 0
movzx eax, word [esi]
mov edx, eax
test ax, ax
je 0x42b117
cmp word [esi + 2], 0
je 0x42b028
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42afe4
sub ecx, edi
mov eax, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x5c
jne 0x42b028
cmp word [esi + ecx*2 - 4], 0x3a
je 0x42b028
lea eax, [ecx - 1]
push eax
push esi
lea ecx, [ebp - 0x38]
call fcn.0042d440
mov esi, dword [ebp - 0x2c]
test esi, esi
jne 0x42b025
cmp dword [ebp - 0x14], esi
je 0x42b117
mov esi, dword [ebp - 0x1c]
movzx eax, word [esi]
movzx eax, ax
test ax, ax
je 0x42b117
cmp eax, 0x5c
jne 0x42b044
cmp word [esi + 2], 0
je 0x42b117
cmp word [esi + 2], 0x3a
jne 0x42b068
movzx eax, word [esi + 4]
test ax, ax
je 0x42b117
cmp eax, 0x5c
jne 0x42b068
cmp word [esi + 6], 0
je 0x42b117
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x42b117
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42b117
cmp eax, 3
jne 0x42b113
push 0x5c
push esi
call fcn.00487709
mov edx, eax
add esp, 8
test edx, edx
je 0x42b113
cmp word [edx + 2], 0
jne 0x42b0c5
sub edx, 2
cmp edx, esi
jb 0x42b113
cmp word [edx], 0x5c
je 0x42b0c5
sub edx, 2
cmp edx, esi
jae 0x42b0b4
xor esi, esi
jmp 0x42b11c
lea ecx, [ebp - 0x64]
call fcn.00403990
mov byte [ebp - 4], 1
sub edx, esi
sar edx, 1
lea ecx, [ebp - 0x64]
push edx
push esi
call fcn.0042d440
lea ecx, [ebp - 0x64]
call fcn.0042d120
mov ecx, eax
call fcn.0042af80
test eax, eax
je 0x42b107
push 0
push esi
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00403c40
jmp 0x42b11c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00403c40
xor esi, esi
jmp 0x42b11c
mov esi, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00403c40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42b160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a987d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x663068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
test edx, edx
je 0x42b231
cmp word [edx], 0
je 0x42b231
lea ecx, [ebp - 0x38]
call fcn.00403990
mov dword [ebp - 4], 0
cmp word [edx], 0
je 0x42b200
cmp word [edx + 2], 0
je 0x42b200
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42b1c0
sub ecx, esi
sar ecx, 1
cmp word [edx + ecx*2 - 2], 0x5c
jne 0x42b200
cmp word [edx + ecx*2 - 4], 0x3a
je 0x42b200
lea eax, [ecx - 1]
push eax
push edx
lea ecx, [ebp - 0x38]
call fcn.0042d440
mov edx, dword [ebp - 0x2c]
test edx, edx
jne 0x42b200
cmp dword [ebp - 0x14], 0
mov edx, 0x64d50c
cmovne edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00403c40
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492fbd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00486900
mov eax, dword [0x663068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0049ca27
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x492fff
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x49315b
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00486850
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x665750]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004974ad
mov ecx, dword [esi*4 + 0x665750]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x493154
cmp eax, dword [edi + ecx + 0x24]
jne 0x493154
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x493154
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004974ad
add esp, 0x14
test edx, edx
jl 0x493154
jg 0x4930ca
test eax, eax
jb 0x493154
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x493154
jl 0x4930e4
cmp dword [ebp - 0x1008], eax
ja 0x493154
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x493102
test ebx, ebx
je 0x49313b
cmp ecx, edi
jae 0x49313b
mov al, byte [ecx]
cmp al, 0xd
jne 0x49311c
lea eax, [edi - 1]
cmp ecx, eax
jae 0x493128
cmp byte [ecx + 1], 0xa
jne 0x493128
inc ecx
jmp 0x493128
movzx eax, al
movsx eax, byte [eax + 0x663180]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x493102
cmp edx, ebx
jne 0x493102
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x493159
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00485f2b
leave
ret
Function at 0x4971f6
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x663068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x4c0788
push esi
call fcn.004a01f9
pop ecx
pop ecx
test eax, eax
jne 0x497224
xor al, al
jmp 0x4972a1
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.00496f2d
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x49725e
push dword [ebp - 0x210]
call fcn.0049373c
xor al, al
jmp 0x49729f
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x497264
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x497284
push edx
call fcn.0049712c
pop ecx
test al, al
je 0x49724f
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x497292
mov bl, 1
push dword [ebp - 0x210]
call fcn.0049373c
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00485f2b
leave
ret
Function at 0x4994aa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x665750]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4994ea
cmp byte [ebx], 0xa
jne 0x4994ea
or byte [eax + edi + 0x28], 4
jmp 0x4994ef
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4995ed
mov al, byte [edx]
cmp al, 0x1a
je 0x4995cf
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x49951e
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x499543
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x49954d
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x499500
jmp 0x4995ed
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4995ca
cmp dword [ebp - 0xc], 0
je 0x4995ca
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x665750]
test byte [eax + edi + 0x28], 0x48
je 0x4995a4
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x49958f
mov byte [esi], dl
jmp 0x4995a0
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x665750]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4995ed
cmp byte [ebp - 1], 0xa
jne 0x4995b3
cmp esi, ebx
jne 0x4995b3
mov byte [esi], 0xa
jmp 0x4995ec
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004974cb
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4995ed
mov byte [esi], 0xd
jmp 0x4995ec
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x665750]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4995e9
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4995ed
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4995f6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x665750]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x499639
cmp word [esi], dx
jne 0x499639
or byte [edi + eax + 0x28], 4
jmp 0x49963e
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x499791
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x499771
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x499680
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4996b6
cmp eax, edx
jae 0x4996c2
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x499658
jmp 0x499791
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49976d
cmp dword [ebp - 0x14], 0
je 0x49976d
mov eax, dword [ebx*4 + 0x665750]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x499745
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x49970e
mov word [esi], cx
jmp 0x499741
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x665750]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x665750]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x665750]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x499791
pop ebx
cmp word [ebp - 4], bx
jne 0x499756
cmp esi, dword [ebp + 0xc]
jne 0x499756
mov word [esi], bx
jmp 0x49978e
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004974cb
add esp, 0x10
cmp word [ebp - 4], bx
je 0x499791
push 0xd
jmp 0x49978a
mov ecx, dword [ebx*4 + 0x665750]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x499788
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x499791
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret