joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45dcb8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00452911
xor ebx, ebx
cmp dword [0x4aa4ac], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x45dd8d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x45dcf8
xor eax, eax
jmp 0x45de51
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x484408
push edi
call esi
cmp eax, ebx
je 0x45dcf1
push eax
call fcn.004528ae
mov dword [esp], 0x4843f8
push edi
mov dword [0x4aa4ac], eax
call esi
push eax
call fcn.004528ae
mov dword [esp], 0x4843e4
push edi
mov dword [0x4aa4b0], eax
call esi
push eax
call fcn.004528ae
mov dword [0x4aa4b4], eax
lea eax, [ebp - 8]
push eax
call fcn.004510be
test eax, eax
pop ecx
pop ecx
je 0x45dd5b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00456d2c
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x45dd8d
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004528ae
cmp eax, ebx
pop ecx
mov dword [0x4aa4bc], eax
je 0x45dd8d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004528ae
pop ecx
mov dword [0x4aa4b8], eax
mov eax, dword [0x4aa4b8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x45de06
cmp dword [0x4aa4bc], esi
je 0x45de06
push eax
call fcn.0045291a
pop ecx
call eax
cmp eax, ebx
je 0x45ddd3
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4aa4bc]
call fcn.0045291a
pop ecx
call eax
test eax, eax
je 0x45ddd3
test byte [ebp - 0x18], 1
jne 0x45de06
lea eax, [ebp - 0xc]
push eax
call fcn.004510f5
test eax, eax
pop ecx
je 0x45ddee
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00456d2c
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x45ddfd
or dword [ebp + 0x10], 0x200000
jmp 0x45de37
or dword [ebp + 0x10], 0x40000
jmp 0x45de37
mov eax, dword [0x4aa4b0]
cmp eax, esi
je 0x45de37
push eax
call fcn.0045291a
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x45de37
mov eax, dword [0x4aa4b4]
cmp eax, esi
je 0x45de37
push dword [ebp - 4]
push eax
call fcn.0045291a
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4aa4ac]
call fcn.0045291a
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4671bf
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4671f7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00465276
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046524e
jmp 0x467203
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4688b1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4688f3
call fcn.0046e369
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4688f3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4688ea
xor eax, eax
jmp 0x4688fb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00468901
pop edi
pop esi
pop ebx
ret 4

Function at 0x46e899
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46e8c7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46e8e5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046e7ff
jmp 0x46e8e5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46e8e5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046e7ff
test edi, edi
mov eax, edi
jne 0x46e8cf
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x104a0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104a01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104a007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104a006a
add dl, dl
jne 0x104a0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104a00dc
xor eax, eax
add dl, dl
jne 0x104a0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104a017d
add dl, dl
jne 0x104a00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104a00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104a00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104a00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104a00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104a0075
mov eax, 1
add dl, dl
jne 0x104a00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104a00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104a00e1
sub eax, ebx
mov ebx, 1
jne 0x104a0128
mov ecx, 1
add dl, dl
jne 0x104a010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104a0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104a0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104a0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104a013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104a014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104a0136
cmp eax, 0x7d00
jae 0x104a016d
cmp eax, 0x500
jb 0x104a0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104a0075
cmp eax, 0x7f
ja 0x104a0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104a0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104a019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104a0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x408954
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
call fcn.0040898a
sub ecx, edi
mov edi, ecx
xor dword [edx], eax
sub esp, 4
mov dword [esp], 0xb3d573b3
mov edi, dword [esp]
add esp, 4
inc edx
sub ecx, 0xca9ecc04
inc ecx
cmp edx, esi
jne fcn.00408954
sub ecx, ecx
sub edi, 0xd71bcfd1
ret
Function at 0x401ff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eec89
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x66d4f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10c], ecx
lea eax, [ebp - 0xd0]
push eax
call fcn.004040c0
mov ecx, eax
call fcn.004088e0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], 0
push 0x639d88
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0xec]
push eax
call fcn.004041b0
add esp, 0xc
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x11c], ecx
mov byte [ebp - 4], 1
push 0x639d84
mov edx, dword [ebp - 0x11c]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.004041b0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xec]
call fcn.0040b640
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xd0]
call fcn.0040b640
push str.actionserver.log
lea ecx, [ebp - 0x2c]
call fcn.004024c0
push 0x639da0
lea ecx, [ebp - 0x2c]
call fcn.0040b520
push eax
call fcn.005bd438
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4021f5
lea ecx, [ebp - 0x108]
push ecx
call fcn.00508960
add esp, 4
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x120]
mov dword [ebp - 0x124], edx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x124]
call fcn.0040b520
push eax
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push 0x639da4
push 0x80
lea eax, [ebp - 0xb4]
push eax
call fcn.005bd516
add esp, 0x14
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x108]
call fcn.0040b640
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x128]
add edx, 1
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x128]
mov cl, byte [eax]
mov byte [ebp - 0x12d], cl
add dword [ebp - 0x128], 1
cmp byte [ebp - 0x12d], 0
jne 0x40215e
mov edx, dword [ebp - 0x128]
sub edx, dword [ebp - 0x12c]
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x30]
push eax
push 1
mov ecx, dword [ebp - 0x134]
push ecx
lea edx, [ebp - 0xb4]
push edx
call fcn.005bd6b0
add esp, 0x10
mov ecx, dword [ebp + 8]
add ecx, 0x44
call fcn.0040b520
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str._d:_u:_s
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.005bd732
add esp, 0x14
mov edx, dword [ebp - 0x30]
push edx
push 1
push 2
push 0x639dc8
call fcn.005bd6b0
add esp, 0x10
mov eax, dword [ebp - 0x30]
push eax
call fcn.005bd8f3
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040b640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bd2d7
mov esp, ebp
pop ebp
ret 4
Function at 0x402b00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4ffb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673dd8], 0
jne 0x402bdd
mov ecx, 0x6740c0
call fcn.00407e60
cmp dword [0x673dd8], 0
jne 0x402bd3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xb0
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x402b85
mov ecx, dword [ebp - 0x1c]
call fcn.00457fb0
mov dword [ebp - 0x20], eax
jmp 0x402b8c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x402bb2
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x402bca
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673dd8], edx
mov ecx, 0x6740c0
call fcn.00407e20
mov eax, dword [0x673dd8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402c00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e68fb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673ddc], 0
jne 0x402cdd
mov ecx, 0x6740a4
call fcn.00407e60
cmp dword [0x673ddc], 0
jne 0x402cd3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x9c
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x402c85
mov ecx, dword [ebp - 0x1c]
call fcn.00402da0
mov dword [ebp - 0x20], eax
jmp 0x402c8c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x402cb2
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x402cca
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673ddc], edx
mov ecx, 0x6740a4
call fcn.00407e20
mov eax, dword [0x673ddc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403fd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f6e5b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x6740a0
call fcn.0048acf0
test eax, eax
jne 0x404096
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x1ac
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x404043
mov ecx, dword [ebp - 0x1c]
call fcn.004742a0
mov dword [ebp - 0x20], eax
jmp 0x40404a
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x404070
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x404088
push 0x639e10
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x6740a0
call fcn.0041bae0
mov ecx, 0x6740a0
call fcn.0048acf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4040c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eebcb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x67409c
call fcn.0048acf0
test eax, eax
jne 0x404186
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x230
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x404133
mov ecx, dword [ebp - 0x1c]
call fcn.0040b700
mov dword [ebp - 0x20], eax
jmp 0x40413a
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x404160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x404178
push 0x639e28
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x67409c
call fcn.004043f0
mov ecx, 0x67409c
call fcn.0048acf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408f70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e519b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x6740e4
call fcn.0048acf0
test eax, eax
jne 0x409033
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x34
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x408fe0
mov ecx, dword [ebp - 0x1c]
call fcn.00409050
mov dword [ebp - 0x20], eax
jmp 0x408fe7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x40900d
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x409025
push 0x639e40
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x6740e4
call fcn.00402540
mov ecx, 0x6740e4
call fcn.0048acf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c2c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e24c8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x66d4f4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 4
jb 0x40c33e
mov eax, dword [ebp - 0x4c]
add eax, 4
mov dword [ebp - 0x4c], eax
jmp 0x40c34d
cmp dword [ebp - 0x14], 2
jb 0x40c34d
mov ecx, dword [ebp - 0x4c]
add ecx, 2
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x48]
call fcn.0051d410
mov dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x48]
call fcn.0051bed0
cmp dword [ebp - 0x10], 0xfa0
jbe 0x40c37c
mov eax, dword [ebp - 0x4c]
add eax, 4
mov dword [ebp - 0x4c], eax
jmp 0x40c38e
cmp dword [ebp - 0x10], 0x7d0
jbe 0x40c38e
mov ecx, dword [ebp - 0x4c]
add ecx, 2
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x74], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0051be70
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.005bd2d7
mov esp, ebp
pop ebp
ret

Function at 0x40fc80
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x66d4f4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0xc
lea eax, [ebp - 0x18]
push eax
push 0x2d1400
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40fcce
xor eax, eax
jmp 0x40fcd1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005bd2d7
mov esp, ebp
pop ebp
ret
Function at 0x40fdf0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e7967
mov eax, dword fs:[0]
push eax
mov eax, 0x108c
call fcn.005c2160
mov eax, dword [0x66d4f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1098], ecx
mov dword [ebp - 0x1094], 0
push 0x6183a3
lea ecx, [ebp - 0x30]
call fcn.0040b540
mov dword [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x38], ax
mov byte [ebp - 0x36], al
push 2
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.005be200
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x1098]
call fcn.0040fba0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 0
cmp dword [ebp - 0x10], 0xffffffff
je 0x40ffea
mov byte [ebp - 0x103c], 0
push 0xfff
push 0
lea ecx, [ebp - 0x103b]
push ecx
call fcn.005c0cf0
add esp, 0xc
lea edx, [ebp - 0x103c]
push edx
push 0xfff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x40ffea
lea eax, [ebp - 0x103c]
mov dword [ebp - 0x1040], eax
push 1
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x1040]
push edx
call fcn.005c1e85
add esp, 0xc
test eax, eax
je 0x40ffbb
mov eax, dword [ebp - 0x1040]
push eax
mov ecx, dword [ebp - 0x1098]
call fcn.0040fba0
mov dword [ebp - 0x1044], eax
cmp dword [ebp - 0x1044], 0xffffffff
je 0x40ffbb
push 0x40
push 0
lea ecx, [ebp - 0x108c]
push ecx
call fcn.005c0cf0
add esp, 0xc
mov edx, dword [ebp - 0x1040]
movsx eax, byte [edx]
push eax
push str._c:__
lea ecx, [ebp - 0x108c]
push ecx
call fcn.005bd49b
add esp, 0xc
lea edx, [ebp - 0x108c]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x1048], eax
cmp dword [ebp - 0x1048], 3
jne 0x40ffbb
mov eax, dword [ebp - 0x1040]
mov cl, byte [eax]
push ecx
call fcn.0040fce0
add esp, 4
test eax, eax
je 0x40ffbb
mov edx, dword [ebp - 0x1040]
push edx
call fcn.005071b0
add esp, 4
mov dword [ebp - 0x1090], eax
cmp dword [ebp - 0x1090], 0
je 0x40ffbb
cmp dword [ebp - 0x1090], 0xffffffff
je 0x40ffbb
cmp dword [ebp - 0x1090], 0x1e
jbe 0x40ffbb
mov eax, dword [ebp - 0x1090]
cmp eax, dword [ebp - 0x34]
jbe 0x40ffbb
mov ecx, dword [ebp - 0x1090]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x1040]
push edx
lea ecx, [ebp - 0x30]
call fcn.0040b4d0
mov eax, dword [ebp - 0x1040]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1040]
add edx, 1
mov dword [ebp - 0x1040], edx
test ecx, ecx
je 0x40ffd9
jmp 0x40ffbb
mov eax, dword [ebp - 0x1040]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x40fec4
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040b660
mov eax, dword [ebp - 0x1094]
or eax, 1
mov dword [ebp - 0x1094], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0040b640
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005bd2d7
mov esp, ebp
pop ebp
ret 8
Function at 0x412b20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4e3b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673de0], 0
jne 0x412bfd
mov ecx, 0x674104
call fcn.00407e60
cmp dword [0x673de0], 0
jne 0x412bf3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x120
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x412ba5
mov ecx, dword [ebp - 0x1c]
call fcn.004e15b0
mov dword [ebp - 0x20], eax
jmp 0x412bac
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x412bd2
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x412bea
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673de0], edx
mov ecx, 0x674104
call fcn.00407e20
mov eax, dword [0x673de0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412c20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4feb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673de4], 0
jne 0x412cfa
mov ecx, 0x6740e8
call fcn.00407e60
cmp dword [0x673de4], 0
jne 0x412cf0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x38
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x412ca2
mov ecx, dword [ebp - 0x1c]
call fcn.004eb0f0
mov dword [ebp - 0x20], eax
jmp 0x412ca9
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x412ccf
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x412ce7
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673de4], edx
mov ecx, 0x6740e8
call fcn.00407e20
mov eax, dword [0x673de4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret