joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ce40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x290
push ebx
mov ebx, dword [esp + 0x2a0]
test ebx, ebx
je 0x42d061
mov eax, dword [esp + 0x2c0]
test al, 1
je 0x42d061
mov cl, byte [esp + 0x2b0]
mov dl, bh
shr cl, 5
and cl, 1
and dl, 1
xor cl, dl
je 0x42d061
cmp byte [0x737928], 0x59
je 0x42d061
mov ecx, dword [0x78ca5c]
test ecx, ecx
jne 0x42d061
and eax, 0x7f
cmp al, 0x39
jne 0x42d061
push edi
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x59c94aba
mov dword [esp + 0xc], 0x1cde4c9b
mov dword [esp + 0x10], 0xddf4b89
mov dword [esp + 0x14], 0x1dc9508b
mov dword [esp + 0x18], 0xbc954ce
mov dword [esp + 0x1c], 0x17c34b9d
mov dword [esp + 0x20], 0x17cd41ce
mov dword [esp + 0x24], 0x15c24dce
mov dword [esp + 0x28], 0xbcf0297
mov dword [esp + 0x2c], 0x1cd8438b
mov dword [esp + 0x30], 0x59de4dce
mov dword [esp + 0x34], 0xdc5468b
mov dword [esp + 0x38], 0x1cc456ce
mov dword [esp + 0x3c], 0x15c544ce
mov dword [esp + 0x40], 0x11db028b
mov dword [esp + 0x44], 0x59c44187
mov dword [esp + 0x48], 0xac94d8a
mov dword [esp + 0x4c], 0xdc34cce
mov dword [esp + 0x50], 0x1ad447ce
mov dword [esp + 0x54], 0x59c8478b
mov dword [esp + 0x58], 0x59c94a9a
mov dword [esp + 0x5c], 0x1cd64b9d
mov dword [esp + 0x60], 0x59ca4dce
mov dword [esp + 0x64], 0x349c12dd
mov dword [esp + 0x68], 0x16f802c0
mov dword [esp + 0x6c], 0x14c950ce
mov dword [esp + 0x70], 0x59c95481
mov dword [esp + 0x74], 0xac54a9a
mov dword [esp + 0x78], 0x14c54ece
mov dword [esp + 0x7c], 0xdcd5687
mov dword [esp + 0x80], 0x55c24d87
mov dword [esp + 0x84], 0x1cc052ce
mov dword [esp + 0x88], 0x59c9518f
mov dword [esp + 0x8c], 0x10cb479c
mov dword [esp + 0x90], 0xbc9569d
mov dword [esp + 0x94], 0x79ac22c0
pop edi
mov ecx, dword [esp + eax + 4]
add eax, 4
xor ecx, 0x79ac22ee
cmp eax, 0x90
mov dword [esp + eax + 0x90], ecx
jl 0x42cfe9
mov edx, dword [0x748004]
push 0x40000
push 0
push edx
lea eax, [esp + 0xa0]
push 0xffffffffffffffff
push eax
call fcn.0042b5a0
mov eax, dword [0x78ca5c]
add esp, 0x14
test eax, eax
jne 0x42d03e
mov ecx, dword [0x748004]
push 0x10
push ecx
call fcn.004f3450
add esp, 8
push 0
push 0
push 0x671120
call fcn.004f6430
or eax, 0x80000000
push 0
push eax
push 0x671120
call fcn.004f6640
add esp, 0x18
mov edx, dword [esp + 0x2c0]
mov eax, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2b8]
push edx
mov edx, dword [esp + 0x2b8]
push eax
mov eax, dword [esp + 0x2b8]
push ecx
mov ecx, dword [esp + 0x2b8]
push edx
mov edx, dword [esp + 0x2b8]
push eax
mov eax, dword [esp + 0x2b8]
push ecx
push edx
mov edx, dword [0x750018]
push eax
mov eax, dword [esp + 0x2b8]
push ebx
push 1
lea ecx, [eax + 0x2d8]
push ecx
push 0
push edx
push eax
call fcn.0041c4c0
add esp, 0x38
cmp eax, 1
pop ebx
je 0x42d0d4
or eax, 0xffffffff
add esp, 0x290
ret
mov edx, dword [0x750018]
mov eax, dword [esp + 0x298]
inc edx
test eax, eax
mov dword [0x750018], edx
je 0x42d108
mov eax, dword [eax + 4]
test eax, eax
je 0x42d108
push 0
push 0x800
call eax
add esp, 8
xor eax, eax
add esp, 0x290
ret
push 0
push 0x800
call fcn.004a88c0
add esp, 8
xor eax, eax
add esp, 0x290
ret
Function at 0x43bd60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x40]
xor edx, edx
mov ecx, esi
push edi
mov edi, dword [eax + 0x3900]
add ecx, ebp
adc edx, ebx
push 0
push 0x200
push edx
push ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], 0
call fcn.0053f700
cmp edx, dword [edi + 0x14]
ja 0x43bf39
jb 0x43bdb3
cmp eax, dword [edi + 0x10]
ja 0x43bf39
test esi, esi
jbe 0x43bf39
jmp 0x43bdc5
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x34]
push eax
mov eax, dword [esp + 0x3c]
push ecx
push edx
push eax
push edi
call fcn.0043bf60
add esp, 0x14
cmp eax, 0xffffffff
je 0x43bf39
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x43bf39
mov edi, dword [ebx + 0x50]
mov ecx, dword [ebx + 0x48]
mov eax, dword [ebx + 0x4c]
mov edx, dword [esp + 0x1c]
xor ebp, ebp
add edi, ecx
mov ecx, dword [ebx + 0x54]
adc ecx, eax
mov eax, dword [esp + 0x18]
sub edi, eax
sbb ecx, edx
cmp ebp, ecx
jb 0x43be26
ja 0x43be22
cmp esi, edi
jbe 0x43be26
mov esi, edi
mov ebp, ecx
mov ecx, dword [ebx + 0x74]
dec ecx
cmp ecx, 3
ja case.default.0x43be33
jmp dword [ecx*4 + 0x43bf48]
lea ecx, [esp + 0x20]
push ecx
push edx
mov edx, dword [esp + 0x1c]
push eax
push ebx
mov eax, dword [edx + 0x18]
push eax
call fcn.0043bfe0
add esp, 0x14
cmp eax, 0xffffffff
je 0x43bf39
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [eax + 0x1c]
mov edi, dword [eax + 0x18]
push ebx
push edi
push ecx
push edx
call fcn.0053fae0
sub edi, eax
sbb ebx, edx
cmp ebp, ebx
jb 0x43be8a
ja 0x43be84
cmp esi, edi
jbe 0x43be8a
mov esi, edi
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, eax
or ecx, edx
mov ecx, esi
je 0x43bee2
shl ecx, 9
push ecx
mov ecx, 9
call fcn.0053f8e0
push edx
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x40]
push edx
mov ecx, dword [eax]
push ecx
call fcn.004f59c0
add esp, 0x14
test eax, eax
je 0x43bf39
jmp case.default.0x43be33
mov ecx, esi
shl ecx, 9
push ecx
mov ecx, 9
call fcn.0053f8e0
push edx
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [ebx]
push edx
push eax
jmp 0x43beb6
mov ecx, esi
mov edi, dword [esp + 0x40]
xor eax, eax
shl ecx, 9
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov edx, dword [esp + 0x10]
sub eax, esi
add ecx, esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x38], ecx
mov ecx, esi
adc ebp, 0
add edx, esi
shl ecx, 9
add edi, ecx
mov dword [esp + 0x3c], ebp
test eax, eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x10], edx
ja 0x43bdbd
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x43fbf0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
ret
Function at 0x4411e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x575a91
push eax
mov eax, 0x2274
mov dword fs:[0], esp
call fcn.0053f480
push esi
push edi
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2288], 1
call fcn.004e3e50
mov eax, dword [esp + 0x22a0]
mov esi, dword [0x7378fc]
lea ecx, [esp + 0x2290]
or edi, 0xffffffff
push ecx
mov byte [esp + 0x2288], 2
mov dword [0x750ed0], eax
mov dword [0x750ed4], edi
call fcn.004f7d50
lea edx, [esp + 0x2298]
mov dword [0x750ee4], eax
push edx
call fcn.004f7d50
mov ecx, dword [0x750ee4]
add esp, 8
test ecx, ecx
mov dword [0x750ee0], eax
je 0x441395
test eax, eax
je 0x441395
push eax
push 0
call fcn.004ecfb0
add esp, 8
call fcn.004f35c0
mov eax, dword [0x78ca5c]
test eax, eax
jne 0x4412ba
test esi, esi
je 0x4412ba
mov esi, dword [esi]
test esi, esi
je 0x4412ba
mov eax, dword [0x750ee4]
push esi
push eax
call fcn.0053f51d
add esp, 8
test eax, eax
jne 0x4412ba
call fcn.004f2940
cmp eax, edi
je 0x441395
mov eax, dword [0x78ca5c]
mov ecx, dword [esp + 0x2298]
mov edx, dword [esp + 0x229c]
cmp eax, 1
mov dword [0x750edc], ecx
mov dword [0x750ed8], edx
jne 0x4412ea
push 0
call fcn.004414b0
jmp 0x441395
push ecx
lea eax, [esp + 0x2298]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
call fcn.0055ab58
push ecx
lea edx, [esp + 0x2298]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x2290], 3
call fcn.0055ab58
lea eax, [esp + 0x10]
mov byte [esp + 0x228c], 2
push eax
call fcn.004f7fe0
add esp, 0xc
push eax
lea ecx, [esp + 0x2200]
mov byte [esp + 0x2288], 4
call fcn.0055af32
lea ecx, [esp + 8]
mov byte [esp + 0x2284], 2
call fcn.0055adeb
mov ecx, dword [esp + 0x228c]
lea edx, [esp + 0x11fc]
push ecx
push edx
mov dword [esp + 0x11fc], 0
mov dword [esp + 0x2280], 0x4414b0
call fcn.0053f406
lea eax, [esp + 0x1c]
add esp, 8
lea ecx, [esp + 0x14]
mov dword [0x750ef4], eax
call fcn.0055b97c
cmp dword [0x750ed4], edi
je 0x4413b7
cmp dword [0x750ed8], 1
jne 0x4413b7
mov ecx, dword [0x750ee0]
push 0
push ecx
call fcn.00444630
add esp, 8
mov edx, dword [0x750ee4]
push edx
call fcn.004f5720
mov eax, dword [0x750ee0]
push eax
call fcn.004f5720
mov eax, dword [0x750ed4]
add esp, 8
cmp eax, edi
jne 0x44142b
lea ecx, [esp + 0x14]
mov byte [esp + 0x2284], 1
call fcn.004e3f70
lea ecx, [esp + 0x2290]
mov byte [esp + 0x2284], 0
call fcn.0055adeb
lea ecx, [esp + 0x2294]
mov dword [esp + 0x2284], edi
call fcn.0055adeb
mov eax, edi
mov ecx, dword [esp + 0x227c]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x2280
ret
push 0x40
push str.Converting_image_file_completed_successfully.
push 0x4d3
call fcn.0051faa0
add esp, 8
push eax
call fcn.004f3450
add esp, 8
mov ecx, 0x78caa8
call fcn.004f5e40
test eax, eax
je 0x44145e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x14]
mov byte [esp + 0x2284], 1
call fcn.004e3f70
lea ecx, [esp + 0x2290]
mov byte [esp + 0x2284], 0
call fcn.0055adeb
lea ecx, [esp + 0x2294]
mov dword [esp + 0x2284], edi
call fcn.0055adeb
mov ecx, dword [esp + 0x227c]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
add esp, 0x2280
ret
Function at 0x4480e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5761db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebp
push esi
push edi
xor ebp, ebp
mov esi, 1
mov edi, ecx
mov word [esp + 0x20], 0xf
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x30], esi
mov dword [esp + 0xc], ebp
call fcn.0041abc0
test eax, eax
jne 0x4482a8
push 0x99
call fcn.00434520
add esp, 4
test eax, eax
je 0x4482a8
push ebx
push 0x10
call fcn.0055f8c0
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebp
mov dword [esp + 0x40], ebp
je 0x448167
mov ecx, eax
call fcn.00573c9c
mov ebx, eax
jmp 0x448169
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x40], 0xffffffff
call fcn.0055f5e7
call fcn.004f35c0
mov ecx, edi
call fcn.00471a20
cmp eax, esi
jne 0x4481aa
mov eax, dword [0x78c448]
mov eax, dword [eax + 0x350]
mov ecx, dword [eax + 0xc8]
cmp ecx, ebp
je 0x4481aa
push ecx
lea ecx, [eax + 0x7c]
call fcn.00558c43
mov esi, eax
jmp 0x4481c0
mov ecx, edi
call fcn.00471a20
cmp eax, 2
jne 0x4481c4
mov esi, dword [0x750f98]
cmp esi, ebp
je 0x4481c4
cmp esi, ebp
jne 0x4481ca
mov esi, dword [0x78c44c]
mov ecx, ebx
call fcn.00573d6e
test eax, eax
je 0x448259
push ebp
push 0xf
mov ecx, ebx
call fcn.00573d30
test eax, eax
je 0x448259
lea ecx, [esp + 0x24]
lea edx, [esp + 0x18]
push ecx
push edx
push 0xf
mov ecx, ebx
mov dword [0x78c4e8], 1
call fcn.00573cf0
test eax, eax
je 0x448237
mov eax, dword [esp + 0x1c]
mov ecx, edi
push eax
mov dword [0x750f3c], esi
call fcn.00447b80
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x44822a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x448253
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x448253
cmp dword [0x78c4e8], 0xa
jne 0x448253
push 0xffffffffffffffff
push esi
push ebp
mov ecx, edi
mov dword [esp + 0x1c], 1
call fcn.00448660
mov dword [0x78c4e8], ebp
cmp ebx, ebp
je 0x44826d
mov ecx, ebx
call fcn.00573cc9
push ebx
call fcn.0055f8e9
add esp, 4
mov eax, dword [esp + 0x10]
pop ebx
cmp eax, ebp
je 0x448290
mov eax, dword [0x78c4e0]
cmp eax, ebp
je 0x448290
lea ecx, [eax + 0x48]
call fcn.004f5e40
test eax, eax
jne 0x448290
call fcn.0047a490
mov eax, dword [0x78c448]
mov ecx, dword [eax + 0x350]
mov dword [ecx + 0xc8], ebp
mov ecx, edi
call fcn.0055f5fc
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x44c730
Capabilities:
Terminate process

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x44]
push eax
lea edx, [esp + 0x4c]
push ecx
push edx
push 0
mov dword [esp + 0x5c], 0xffffffff
call fcn.00469440
call fcn.004f35c0
mov edi, dword [esp + 0x64]
mov esi, dword [0x7378fc]
push 0x200
push edi
push 0x85a5a0
call fcn.00540068
mov eax, dword [esi + 0x14]
mov dword [esi + 0x18], 0
push eax
call fcn.004f5730
push edi
call fcn.004f5890
add esp, 0x3c
mov dword [esi + 0x14], eax
test eax, eax
push edi
jne 0x44c7d3
call fcn.004f2e00
push edi
call fcn.004f5860
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
jne 0x44c8f1
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004f3d20
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
jne 0x44c7fa
push edi
mov dword [0x85ac64], 2
call fcn.004f2e00
add esp, 4
jmp 0x44c8f1
mov al, byte [esi + 0x2bc]
mov ecx, dword [esi + 0x29c]
test al, al
mov dword [esi + 0x28c], ecx
je 0x44c81a
mov dword [esi + 0x28c], 1
mov edx, dword [esi + 0xc]
push edx
call fcn.004f5720
push edi
call fcn.0053f4af
mov ebx, dword [esi + 0x12e0]
add esp, 8
cmp ebx, 0xffffffff
mov dword [esi + 0xc], eax
je 0x44c88c
lea ebp, [esi + 0x2d8]
push 1
push ebp
push esi
call fcn.00416c70
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
mov eax, ebx
push edx
push 1
cdq
push ebp
push edx
push eax
push esi
call fcn.0041c4c0
add esp, 0x44
cmp eax, 1
jne 0x44c8f1
mov ebx, dword [esi + 0x12e4]
cmp ebx, 0xffffffff
je 0x44c8e9
lea ebp, [esi + 0xad8]
push 1
push ebp
push esi
call fcn.00416f30
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
mov eax, ebx
push edx
push 1
cdq
push ebp
push edx
push eax
push esi
call fcn.0041c4c0
add esp, 0x44
cmp eax, 1
jne 0x44c8f1
mov dword [esp + 0x34], 0
mov eax, dword [esi + 0x14]
push eax
call fcn.004f5730
mov ecx, dword [esi + 0x18]
push ecx
call fcn.004f5730
push edi
mov dword [esi + 0x18], 0
call fcn.004f5860
add esp, 0xc
mov dword [esi + 0x14], eax
test eax, eax
jne 0x44c92b
push edi
call fcn.004f2e00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x451040
Capabilities:
Enumerate pe sections
Terminate process

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
cdq
and edx, 0x1ff
push ebp
push esi
add eax, edx
push edi
mov edi, eax
mov eax, dword [esp + 0x24]
sar edi, 9
cmp eax, edi
jge 0x451066
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x18]
mov ebp, eax
cmp dword [eax], 0x3eb202fe
je 0x451082
mov ecx, dword [ebp + 4]
add ebp, 4
cmp ecx, 0x3eb202fe
jne 0x451074
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
xor ebx, ebx
mov bx, word [ebp + 0x16]
mov ecx, dword [esi]
add ebx, eax
xor eax, eax
mov ax, word [ebx + 0xe]
mov dword [eax + edx], ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov ecx, 0x20
call fcn.0053f900
mov edx, dword [esp + 0x14]
xor ecx, ecx
mov cx, word [ebx + 0x10]
add esi, 8
mov dword [ecx + edx], eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffc00
lea ecx, [edi - 2]
sar eax, 2
mov dword [esp + 0x14], eax
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
mov word [ebp + 8], cx
test eax, eax
mov word [ebp + 0xa], 2
je 0x4510ea
mov word [ebp + 0x14], 1
lea eax, [edi - 3]
xor edx, edx
mov dx, word [ebx + 0xc]
push eax
push esi
xor eax, eax
mov ax, word [ebx + 0xa]
push edx
add eax, dword [esp + 0x24]
push eax
call fcn.00451210
mov ecx, dword [esp + 0x28]
xor eax, eax
mov ax, word [ebx]
mov edx, dword [esi + edi*8 - 0x18]
add eax, ecx
lea ecx, [edi - 3]
add esp, 0x10
mov dword [eax], edx
mov ecx, dword [esi + ecx*8 + 4]
mov dword [eax + 4], ecx
mov edx, dword [esi + edi*8 - 0x10]
mov dword [eax + 8], edx
mov ecx, dword [esi + edi*8 - 0xc]
mov esi, dword [esp + 0x30]
mov dword [eax + 0xc], ecx
test esi, esi
je 0x451182
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
mov dx, word [ebx + 4]
not ecx
cmp edx, ecx
jge 0x451168
push str.Subdirectory_path_too_long..._aborting_install__n
push 0x734eb0
call fcn.00541c6a
add esp, 8
push 1
call fcn.00541b77
mov eax, dword [esp + 0x18]
xor edi, edi
mov di, word [ebx + 2]
add edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x34]
test esi, esi
je 0x4511d2
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
mov dx, word [ebx + 8]
not ecx
cmp edx, ecx
jge 0x4511b8
push str.Subvol_name_too_long..._aborting_install__n
push 0x734eb0
call fcn.00541c6a
add esp, 8
push 1
call fcn.00541b77
xor edi, edi
mov eax, ecx
mov di, word [ebx + 6]
mov ebx, dword [esp + 0x18]
add edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add ebp, 0x10
mov eax, 0x3eb202fe
test esi, esi
mov dword [ebp], 0
jle 0x4511f9
mov edx, esi
mov edi, dword [ecx]
add ecx, 4
sub eax, edi
dec edx
jne 0x4511ef
mov dword [ebp], eax
lea eax, [esi*4]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x457420
Capabilities:
Get disk information via ioctl

Disassembly:
sub esp, 0x264
push ebx
push esi
lea eax, [esp + 0x68]
push edi
push eax
push 0x102
xor esi, esi
call dword [0x7363d4]
mov ecx, dword [str..A:]
mov ebx, dword [esp + 0x278]
mov edx, dword [0x69d4f0]
mov edi, eax
mov eax, dword [0x69d4f4]
mov dword [esp + 0x30], ecx
mov cx, word [0x69d4f8]
cmp ebx, esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov word [esp + 0x3c], cx
je 0x45765f
cmp dword [ebx + 0xc], esi
je 0x45765f
xor edx, edx
lea eax, [esp + 0x2c]
mov dword [esp + 0x40], edx
push esi
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x4c], edx
push 0xc
push ecx
mov dword [esp + 0x58], edx
mov edx, dword [esp + 0x284]
push esi
push esi
push 0x2d1080
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x45765f
mov eax, dword [esp + 0x44]
cmp edi, esi
mov dword [esp + 0x28], eax
jle 0x45765a
push ebp
lea ebp, [esp + 0x70]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebp
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
cmp ax, 0x41
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
je 0x45763b
cmp ax, 0x42
je 0x45763b
lea edx, [esp + 0x1c]
push edx
call dword [0x7363bc]
cmp eax, 2
jb 0x45763b
cmp eax, 3
ja 0x45763b
mov ax, word [esp + 0x1c]
push 0
push 0x80
push 3
push 0
push 3
lea ecx, [esp + 0x48]
push 0x80000000
push ecx
mov word [esp + 0x58], ax
call dword [0x736388]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x18], esi
je 0x45763b
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x50]
lea edx, [esp + 0x30]
rep stosd dword es:[edi], eax
push eax
push edx
lea eax, [esp + 0x58]
push 0x20
push eax
push 0
push 0
push 0x560000
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x45763b
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x58]
cmp eax, ecx
jne 0x45762e
mov eax, dword [ebx + 0xc]
xor edi, edi
test eax, eax
mov dword [esp + 0x24], eax
jle 0x45762e
mov esi, dword [ebx + 0xa34]
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x60]
add esi, 0x88
mov edx, dword [esi - 4]
mov eax, dword [esi - 8]
push 0
push 0x200
push edx
push eax
call fcn.0053f700
cmp eax, ebp
jne 0x4575ee
cmp edx, dword [esp + 0x64]
jne 0x4575ee
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push 0
push 0x200
push ecx
push edx
call fcn.0053f700
cmp eax, ebx
jne 0x4575ee
cmp edx, dword [esp + 0x6c]
je 0x4575ff
mov eax, dword [esp + 0x24]
inc edi
add esi, 0x440
cmp edi, eax
jl 0x4575b3
jmp 0x457623
mov eax, dword [esp + 0x27c]
mov dx, word [esp + 0x1c]
mov ecx, edi
mov eax, dword [eax + 0xa34]
shl ecx, 4
add ecx, edi
shl ecx, 6
mov word [ecx + eax + 0x98], dx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x27c]
push esi
call fcn.004f5730
mov ebp, dword [esp + 0x14]
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
add eax, 4
add ebp, 8
cmp eax, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
jl 0x4574d7
pop ebp
mov esi, 1
mov edi, dword [esp + 0x274]
push edi
call fcn.004d93f0
push edi
mov dword [ebx + 0xa28], eax
call fcn.004d93a0
add esp, 8
mov dword [ebx + 0x20], eax
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x264
ret
Function at 0x457c40
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x817700]
push esi
cmp eax, 2
jl 0x457c9a
mov eax, dword [esp + 0x14]
push 0
cdq
push 0x200
push edx
push eax
call fcn.0053f700
mov esi, dword [esp + 8]
push edx
push eax
push esi
call fcn.004f57a0
add esp, 0xc
test eax, eax
jne 0x457c76
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0
shl ecx, 9
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
pop esi
neg eax
dec eax
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
push 1
call fcn.00457b90
add esp, 0x18
pop esi
ret

Function at 0x458b60
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [0x751394]
push 0x32
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x75138c]
push eax
call fcn.004f5860
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x458cc4
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x458ca7
cmp esi, 0xc800000
ja 0x458ca7
push edi
call fcn.00418ea0
mov edi, eax
add esp, 4
test edi, edi
je 0x458cc4
lea edx, [esi + 0x7ff]
shr edx, 0xb
shl edx, 0xb
push edx
call fcn.004f56f0
add esp, 4
mov dword [edi + 8], eax
test eax, eax
je 0x458cc4
mov dword [edi + 0x88], esi
mov eax, dword [edi + 8]
push esi
push eax
push 0
push edi
call fcn.00418f50
mov eax, dword [esp + 0x34]
add esp, 0x10
test eax, eax
mov dword [edi + 0x30c], 1
je 0x458c1c
push 0
push esi
call dword [eax]
add esp, 8
xor ebx, ebx
mov ebp, esi
test esi, esi
jle 0x458c80
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00423f80
add esp, 4
test eax, eax
je 0x458cc4
cmp ebp, 0x4000
mov esi, 0x4000
jg 0x458c48
mov esi, ebp
mov eax, dword [edi + 8]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push 0
push edx
add eax, ebx
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x458c96
mov ecx, dword [esp + 0x24]
add ebx, esi
sub ebp, esi
test ecx, ecx
je 0x458c7c
mov eax, esi
cdq
push edx
push eax
call dword [ecx + 4]
add esp, 8
test ebp, ebp
jg 0x458c24
mov eax, dword [esp + 0x18]
push 2
mov dword [eax + 0x141c], edi
call fcn.00442960
add esp, 4
jmp 0x458cc4
mov edx, dword [0x75138c]
push edx
call fcn.004f2e00
add esp, 4
jmp 0x458cc4
push 0x10
push str.Invalid_boot_image_file.
push 0x18d
call fcn.0051faa0
add esp, 8
push eax
call fcn.004f3450
add esp, 8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004f5730
mov eax, dword [esp + 0x28]
add esp, 4
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x458ce0
call dword [eax + 0xc]
xor eax, eax
add esp, 0x10
ret 4