joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5be320
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ecx, dword [edx + 4]
mov ebp, edx
push edi
cmp ecx, dword [ebx + 4]
mov edi, dword [esp + 0x10]
cmovge ebp, ebx
cmovge ebx, edx
mov eax, dword [ebx + 4]
cmp eax, dword [edi + 8]
jg 0x5be349
mov eax, edi
jmp 0x5be353
push eax
push edi
call fcn.0053b6c0
add esp, 8
test eax, eax
jne 0x5be35b
pop edi
pop ebp
pop ebx
ret
xor eax, eax
cmp dword [ebp + 4], eax
jle 0x5be37a
push esi
mov ecx, dword [ebx]
mov edx, dword [ebp]
mov esi, dword [ecx + eax*4]
mov ecx, dword [edi]
xor esi, dword [edx + eax*4]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, dword [ebp + 4]
jl 0x5be363
pop esi
cmp eax, dword [ebx + 4]
jge 0x5be390
nop
mov ecx, dword [ebx]
mov edx, dword [edi]
mov ecx, dword [ecx + eax*4]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, dword [ebx + 4]
jl 0x5be380
mov ecx, dword [ebx + 4]
mov dword [edi + 4], ecx
test ecx, ecx
jle 0x5be3b3
mov edx, dword [edi]
add edx, 0xfffffffc
lea edx, [edx + ecx*4]
mov eax, dword [edx]
lea edx, [edx - 4]
test eax, eax
jne 0x5be3b0
dec ecx
test ecx, ecx
jg 0x5be3a2
mov dword [edi + 4], ecx
cmp dword [edi + 4], 0
jne 0x5be3c0
mov dword [edi + 0xc], 0
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x4010d4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, str._ccav_
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00401224
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401108
push ebx
call fcn.0040fae3
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [0x41bef1]
test ebx, ebx
je 0x40111f
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [0x41bef1], eax
push 0x41b216
push dword [0x41bef1]
call fcn.00401037
add esp, 8
cmp eax, 0
jne 0x401165
mov dword [ebp - 8], esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401448
call fcn.00403124
call main
call fcn.004033f7
call fcn.0040d441
mov eax, str._56cbebc7ebeb3f18_
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401194
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x40119d
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4011ad
push ebx
call fcn.0040fae3
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4056c4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4056e0
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x4056e3
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405712
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405756
test edi, edi
jne 0x40571d
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405750
Function at 0x408fda
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409019
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409019
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409019
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409019
cmp dword [ecx + 0x74], 0xe
jbe 0x409019
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40eed6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4ba6a8
push 0x4ba6a0
push str.FlsAlloc
push 0x1f
call fcn.0040ed95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ef0a
push dword [ebp + 8]
mov ecx, esi
call dword [0x427130]
call esi
jmp 0x40ef10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40ef54
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4ba6b8
push 0x4ba6b0
push str.FlsGetValue
push 0x21
call fcn.0040ed95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ef8b
push dword [ebp + 8]
mov ecx, esi
call dword [0x427130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40ef93
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4ba6c0
push 0x4ba6b8
push str.FlsSetValue
push 0x22
call fcn.0040ed95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40efcd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x427130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41251b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4125b8
push ebx
push esi
call fcn.004124e4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00412478
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x412565
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4125b7
push edi
push eax
call fcn.0040f685
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x412585
call fcn.0040ec28
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4125b6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00412478
add esp, 0x20
test eax, eax
jne 0x4125a4
push edi
call fcn.0040ec28
jmp 0x4125ac
push ebx
call fcn.0040ec28
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41a670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41a69d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41a69d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x73dfdb2a
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xffffff8d
invalid
adc al, 0x83
shl al, 0xe0
loopne 0x73dfd9a7
sal al, 0xe0
invalid
test eax, edx
mov esi, 0xf08b46e0
mov edx, eax
mov al, dl
mov al, byte [0xa8f0acd0]
shl al, 0x95
rol byte [edx - 0x2f2f7a20], 1
add al, 0xd0
add eax, 0xf0c085d0
scasd eax, dword es:[edi]
loopne 0x73dfda1e
pop eax
xchg al, ah
mov eax, esi
test al, ah
rol byte [esi - 0x7b0f7620], 0xe0
and eax, 0xffffff84
ror byte [esi - 0x7d2f7b10], 0xf0
and eax, 0x42
mov al, al
wait
rol byte [ebx - 0x772f6e40], 0xe0
rcl byte [ecx - 0x7d1f7730], 0xc0
rol byte [ecx - 0x7e2f2f30], 1
rcl al, 0xd0
rcl byte [eax - 0x632f7d40]
invalid
adc eax, 0xfffffff0
test eax, esi
test eax, esi
and al, 0x86
loopne 0x73dfda8e
invalid
rol byte [esi - 0x633f7540], 1
ror byte [eax + 0x41f0f0d0], 0x83
sal al, 1
xchg al, dh
test eax, esi
add al, 0x86
invalid
xchg al, ah
invalid
loopne 0x73dfda6c
rol byte [ebp - 0x7a1f7d20], 0xc0
test eax, eax
xchg eax, esp
xchg al, al
mov al, ah
xor al, 0x93
loopne 0x73dfda83
rol byte [ebx - 0x7b1f7340], 1
invalid
and eax, 0xf084e08d
add al, 0x85
rol byte [eax + esi*8 - 0x780f3f75], 0xc0
xchg al, al
add al, 0x85
loopne 0x73dfdac4
loopne 0x73dfdac6
rol byte [ebp - 0x7a1f7d30], 0xc0
test eax, eax
xchg eax, esp
mov al, dh
mov al, dh
adc eax, 0xffffff96
rol byte [eax - 0x1f721f7f], 0x84
invalid
Function at 0x10001030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1dc
push ebx
push esi
push edi
lea edi, [ebp - 0x1dc]
mov ecx, 0x77
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10075ae0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.10008ff0
add esp, 8
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp esi, esp
call fcn.100095d0
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffff
je 0x100010a4
mov eax, dword [ebp - 0x114]
and eax, 0x10
jne 0x100010a4
mov dword [ebp - 0x1dc], 1
jmp 0x100010ae
mov dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x1dc]
push edx
mov ecx, ebp
push eax
lea edx, [0x100010e4]
call fcn.10009570
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009600
add esp, 0x1dc
cmp ebp, esp
call fcn.100095d0
mov esp, ebp
pop ebp
ret
Function at 0x401ff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dce29
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x65d4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10c], ecx
lea eax, [ebp - 0xd0]
push eax
call fcn.00404970
mov ecx, eax
call fcn.004091d0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], 0
push 0x62aa0c
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0xec]
push eax
call fcn.00404a60
add esp, 0xc
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x11c], ecx
mov byte [ebp - 4], 1
push 0x62aa08
mov edx, dword [ebp - 0x11c]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00404a60
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xec]
call fcn.0040bf30
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xd0]
call fcn.0040bf30
push str.actionserver.log
lea ecx, [ebp - 0x2c]
call fcn.004024c0
push 0x62aa24
lea ecx, [ebp - 0x2c]
call fcn.0040be10
push eax
call fcn.005b1ae9
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4021f5
lea ecx, [ebp - 0x108]
push ecx
call fcn.00500fe0
add esp, 4
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x120]
mov dword [ebp - 0x124], edx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x124]
call fcn.0040be10
push eax
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push 0x62aa28
push 0x80
lea eax, [ebp - 0xb4]
push eax
call fcn.005b1bc7
add esp, 0x14
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x108]
call fcn.0040bf30
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x128]
add edx, 1
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x128]
mov cl, byte [eax]
mov byte [ebp - 0x12d], cl
add dword [ebp - 0x128], 1
cmp byte [ebp - 0x12d], 0
jne 0x40215e
mov edx, dword [ebp - 0x128]
sub edx, dword [ebp - 0x12c]
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x30]
push eax
push 1
mov ecx, dword [ebp - 0x134]
push ecx
lea edx, [ebp - 0xb4]
push edx
call fcn.005b1d61
add esp, 0x10
mov ecx, dword [ebp + 8]
add ecx, 0x44
call fcn.0040be10
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str._d:_u:_s
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.005b1de3
add esp, 0x14
mov edx, dword [ebp - 0x30]
push edx
push 1
push 2
push 0x62aa4c
call fcn.005b1d61
add esp, 0x10
mov eax, dword [ebp - 0x30]
push eax
call fcn.005b1fa4
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040bf30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b1988
mov esp, ebp
pop ebp
ret 4
Function at 0x402c10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e590b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663c1c], 0
jne 0x402ced
mov ecx, 0x663f08
call fcn.004087a0
cmp dword [0x663c1c], 0
jne 0x402ce3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xb0
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x402c95
mov ecx, dword [ebp - 0x1c]
call fcn.00457340
mov dword [ebp - 0x20], eax
jmp 0x402c9c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x402cc2
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x402cda
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663c1c], edx
mov ecx, 0x663f08
call fcn.00408760
mov eax, dword [0x663c1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402d10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da6cb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663c20], 0
jne 0x402dea
mov ecx, 0x663eec
call fcn.004087a0
cmp dword [0x663c20], 0
jne 0x402de0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x60
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x402d92
mov ecx, dword [ebp - 0x1c]
call fcn.00402eb0
mov dword [ebp - 0x20], eax
jmp 0x402d99
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x402dbf
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x402dd7
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663c20], edx
mov ecx, 0x663eec
call fcn.00408760
mov eax, dword [0x663c20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404880
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ea75b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x663ee8
call fcn.0043ead0
test eax, eax
jne 0x404946
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x170
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4048f3
mov ecx, dword [ebp - 0x1c]
call fcn.00472600
mov dword [ebp - 0x20], eax
jmp 0x4048fa
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x404920
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x404938
push 0x62aa94
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x663ee8
call fcn.0041bd20
mov ecx, 0x663ee8
call fcn.0043ead0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404970
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dcd3b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x663ee4
call fcn.0043ead0
test eax, eax
jne 0x404a36
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x214
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4049e3
mov ecx, dword [ebp - 0x1c]
call fcn.0040bff0
mov dword [ebp - 0x20], eax
jmp 0x4049ea
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x404a10
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x404a28
push 0x62aaac
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x663ee4
call fcn.00404bc0
mov ecx, 0x663ee4
call fcn.0043ead0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409860
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d929b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x663f2c
call fcn.0043ead0
test eax, eax
jne 0x409923
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x34
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4098d0
mov ecx, dword [ebp - 0x1c]
call fcn.00409940
mov dword [ebp - 0x20], eax
jmp 0x4098d7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x4098fd
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x409915
push 0x62aac4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x663f2c
call fcn.004026b0
mov ecx, 0x663f2c
call fcn.0043ead0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ca00
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6728
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x65d4e4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 4
jb 0x40ca7e
mov eax, dword [ebp - 0x4c]
add eax, 4
mov dword [ebp - 0x4c], eax
jmp 0x40ca8d
cmp dword [ebp - 0x14], 2
jb 0x40ca8d
mov ecx, dword [ebp - 0x4c]
add ecx, 2
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x48]
call fcn.005231a0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x48]
call fcn.00521c60
cmp dword [ebp - 0x10], 0xfa0
jbe 0x40cabc
mov eax, dword [ebp - 0x4c]
add eax, 4
mov dword [ebp - 0x4c], eax
jmp 0x40cace
cmp dword [ebp - 0x10], 0x7d0
jbe 0x40cace
mov ecx, dword [ebp - 0x4c]
add ecx, 2
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x74], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00521c00
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.005b1988
mov esp, ebp
pop ebp
ret

Function at 0x410390
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x65d4e4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0xc
lea eax, [ebp - 0x18]
push eax
push 0x2d1400
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4103de
xor eax, eax
jmp 0x4103e1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005b1988
mov esp, ebp
pop ebp
ret
Function at 0x410500
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db717
mov eax, dword fs:[0]
push eax
mov eax, 0x108c
call fcn.005b6f10
mov eax, dword [0x65d4e4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1098], ecx
mov dword [ebp - 0x1094], 0
push 0x60b11f
lea ecx, [ebp - 0x30]
call fcn.0040be30
mov dword [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x38], ax
mov byte [ebp - 0x36], al
push 2
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.005b2ba0
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x1098]
call fcn.004102b0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 0
cmp dword [ebp - 0x10], 0xffffffff
je 0x4106fa
mov byte [ebp - 0x103c], 0
push 0xfff
push 0
lea ecx, [ebp - 0x103b]
push ecx
call fcn.005b5540
add esp, 0xc
lea edx, [ebp - 0x103c]
push edx
push 0xfff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x4106fa
lea eax, [ebp - 0x103c]
mov dword [ebp - 0x1040], eax
push 1
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x1040]
push edx
call fcn.005b6c36
add esp, 0xc
test eax, eax
je 0x4106cb
mov eax, dword [ebp - 0x1040]
push eax
mov ecx, dword [ebp - 0x1098]
call fcn.004102b0
mov dword [ebp - 0x1044], eax
cmp dword [ebp - 0x1044], 0xffffffff
je 0x4106cb
push 0x40
push 0
lea ecx, [ebp - 0x108c]
push ecx
call fcn.005b5540
add esp, 0xc
mov edx, dword [ebp - 0x1040]
movsx eax, byte [edx]
push eax
push str._c:__
lea ecx, [ebp - 0x108c]
push ecx
call fcn.005b1b4c
add esp, 0xc
lea edx, [ebp - 0x108c]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x1048], eax
cmp dword [ebp - 0x1048], 3
jne 0x4106cb
mov eax, dword [ebp - 0x1040]
mov cl, byte [eax]
push ecx
call fcn.004103f0
add esp, 4
test eax, eax
je 0x4106cb
mov edx, dword [ebp - 0x1040]
push edx
call fcn.004ffd00
add esp, 4
mov dword [ebp - 0x1090], eax
cmp dword [ebp - 0x1090], 0
je 0x4106cb
cmp dword [ebp - 0x1090], 0xffffffff
je 0x4106cb
cmp dword [ebp - 0x1090], 0x1e
jbe 0x4106cb
mov eax, dword [ebp - 0x1090]
cmp eax, dword [ebp - 0x34]
jbe 0x4106cb
mov ecx, dword [ebp - 0x1090]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x1040]
push edx
lea ecx, [ebp - 0x30]
call fcn.0040bdc0
mov eax, dword [ebp - 0x1040]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1040]
add edx, 1
mov dword [ebp - 0x1040], edx
test ecx, ecx
je 0x4106e9
jmp 0x4106cb
mov eax, dword [ebp - 0x1040]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x4105d4
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040bf50
mov eax, dword [ebp - 0x1094]
or eax, 1
mov dword [ebp - 0x1094], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0040bf30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b1988
mov esp, ebp
pop ebp
ret 8