joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1017b9f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, 0x100
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
mov ebp, ecx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
shr eax, 8
add ecx, esi
add eax, ecx
movzx ecx, word [ebp + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [esp + 0x18]
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x1017ba03
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x1017ba50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, ecx
push esi
push edi
xor edi, edi
or edx, 0x100
mov ecx, edx
mov eax, edx
shr ecx, 7
add edx, edx
and ecx, 1
shr eax, 8
neg ecx
sar ecx, 4
and ecx, 0x7f
movzx esi, word [ebx + eax*2]
shr esi, 4
xor esi, ecx
add edi, dword [ebp + esi*4]
cmp edx, 0x10000
jb 0x1017ba62
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1018be50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x10320eb4], ebx
jne 0x1018be86
push 0x10320fc0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x100
push ebx
push 0x10320ec0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [0x10320eb4], 1
push 0x10320fc0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x14]
xor ecx, ecx
nop word [eax + eax]
mov esi, dword [ecx + 0x10320ec0]
test esi, esi
je 0x1018beb1
lea eax, [esi + 0x2c]
cmp eax, dword [edi]
je 0x1018bece
add ecx, 4
cmp ecx, 0x100
jb 0x1018bea0
push 0x10320fc0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
test esi, esi
je 0x1018bf78
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push ebp
call fcn.1018c760
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebp, eax
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
push eax
push 0x40
push dword [esi + 4]
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1018bf72
mov eax, dword [esi + 4]
xor ecx, ecx
mov edx, dword [esi]
test eax, eax
je 0x1018bf21
nop
mov al, byte [esi + ecx + 0x4c]
mov byte [ecx + edx], al
inc ecx
mov eax, dword [esi + 4]
cmp ecx, eax
jb 0x1018bf10
mov edx, dword [esi]
push eax
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push dword [esi + 4]
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [esi]
mov ebx, 1
mov dword [edi], eax
xor eax, eax
nop word [eax + eax]
cmp dword [eax*4 + 0x10320ec0], esi
je 0x1018bf61
inc eax
cmp eax, 0x40
jb 0x1018bf50
jmp 0x1018bf72
dec dword [0x10320eb8]
mov dword [eax*4 + 0x10320ec0], 0
call fcn.1018c990
pop ebp
push 0x10320fc0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x1018c990
Capabilities:
Resume thread

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [esp + 0xc], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x10320ebc], esi
jbe 0x1018c9ef
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax]
mov eax, dword [0x10320fd8]
push dword [eax + esi*4]
call ebx
mov eax, dword [0x10320fd8]
push dword [eax + esi*4]
call ebp
inc esi
cmp esi, dword [0x10320ebc]
jb 0x1018c9d0
pop ebp
pop ebx
push dword [0x10320fd8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [0x10320fd8], 0
mov dword [0x10320ebc], 0
push dword [esp + 8]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ecx
ret

Function at 0x1018e2c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x1018e2eb
nop word [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x1018e2d0
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret

Function at 0x10191f10
Capabilities:
Write file on windows

Disassembly:
push dword [ecx + 4]
push 1
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
ret 8
Function at 0x10191f60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], edx
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x10191f84
mov dword [edi], 1
jmp 0x10192064
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
push 2
push 0
push 0
push ebx
call esi
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
push 0
push 0
push 0
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
call esi
mov eax, dword [esp + 0x34]
add esp, 0x24
test eax, eax
jg 0x10191fca
jl 0x10191fc0
mov esi, dword [esp + 0xc]
test esi, esi
jae 0x10191fce
mov esi, 2
jmp 0x10192058
mov esi, dword [esp + 0xc]
xor ecx, ecx
cmp ecx, eax
jne 0x10192053
mov ecx, dword [0x1031bcc0]
test esi, esi
mov eax, 1
cmovne eax, esi
push eax
call ecx
add esp, 4
mov dword [esp + 0x10], eax
push ebx
test eax, eax
jne 0x10192001
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov dword [edi], 3
jmp 0x10192061
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push ebx
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [esp + 0x20]
add esp, 0x14
cmp esi, eax
je 0x10192031
push dword [esp + 0x10]
call dword [0x102f74e8]
mov dword [edi], 2
jmp 0x10192061
mov ecx, dword [esp + 0x14]
push 1
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [esp + 0x24]
push edi
call sym.WMCommon.dll_private:_struct_pugi::xml_parse_result___thiscall_pugi::xml_document::load_buffer_impl_void___unsigned_int__unsigned_int__enum_pugi::xml_encoding__bool__bool_
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 3
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov dword [edi], esi
add esp, 4
mov dword [edi + 4], 0
mov eax, edi
mov dword [edi + 8], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101e8c10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebp
mov eax, ecx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x18]
xor ebp, ebp
push esi
xor esi, esi
mov dword [esp + 0x10], eax
cmp dword [eax + 0x14], esi
jle 0x101e8ccc
push ebx
push edi
mov eax, dword [eax + 0x10]
mov ebx, esi
xor ebx, 1
cmp esi, 2
cmovge ebx, esi
mov ecx, ebx
add ecx, ecx
mov edi, dword [eax + ecx*8 + 0xc]
mov dword [esp + 0x10], edi
test edx, edx
je 0x101e8c94
mov eax, dword [eax + ecx*8]
mov edi, edx
sub edi, eax
movzx edx, byte [eax]
movzx ecx, byte [edi + eax]
cmp edx, ecx
jne 0x101e8c69
test edx, edx
je 0x101e8c94
inc eax
jmp 0x101e8c57
movzx ecx, byte [ecx + 0x1025d320]
movzx edx, byte [edx + 0x1025d320]
sub edx, ecx
jne 0x101e8c7e
inc eax
jmp 0x101e8c57
test ebx, ebx
jne 0x101e8cb0
mov edx, dword [esp + 0x24]
mov ecx, str.main
call fcn.10233820
test eax, eax
jne 0x101e8cb0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
lea ecx, [ecx + 0x18]
call fcn.10231e00
add esp, 4
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x101e8cc2
mov eax, dword [esp + 0x18]
inc esi
mov edx, dword [esp + 0x24]
cmp esi, dword [eax + 0x14]
jl 0x101e8c32
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
add esp, 0x10
ret
pop esi
mov eax, ebp
pop ebp
add esp, 0x10
ret
Function at 0x101efc50
Capabilities:
Reference sql statements

Disassembly:
push ebx
push edi
push dword [esp + 0x14]
mov edi, edx
mov ebx, ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
mov byte [ebx + 0x10], 1
push edi
push edi
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push ebx
call fcn.101e9290
add esp, 0x1c
cmp dword [esp + 0xc], 0
jne 0x101efc94
push dword [esp + 0x14]
push dword [esp + 0x14]
push edi
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push ebx
call fcn.101e9290
add esp, 0x14
pop edi
pop ebx
ret
Function at 0x101ff250
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov ebp, edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.102373b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x101ff278
lea eax, [esi + 7]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp byte [0x1031bda4], 0
mov edi, dword [esp + 0x14]
je 0x101ff2c1
mov eax, dword [0x1031bea0]
test eax, eax
je 0x101ff29c
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x101ff2c1
lea eax, [esi + 4]
mov dword [esi + 8], ebp
push eax
push 0
push esi
push 0x102344e0
push 0
push 0
mov dword [esi + 0xc], edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x101ff2ce
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x101ff2e6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call ebp
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebp
pop ebx
ret
Function at 0x1023c2f0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x1023c32c
cmp byte [edi + 0x2c], bl
jne 0x1023c3f3
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 2
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1023c320
jmp 0x1023c3d9
call fcn.1023cf00
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push 2
push 0
push ebx
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0xffffffff
call esi
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push 0
push 0
push ebx
mov ebp, eax
call esi
add esp, 0x1c
test ebp, ebp
jg 0x1023c38c
cmp byte [edi + 0x2c], 0
jne 0x1023c3f3
mov edx, dword [str.Error_document_empty.]
mov ecx, edx
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 0xc
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1023c383
jmp 0x1023c3d9
lea eax, [ebp + 1]
push eax
call fcn.1006e70d
push ebx
mov esi, eax
push 1
push ebp
push esi
mov byte [esi], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x1023c3fc
push esi
call fcn.1006e708
add esp, 4
cmp byte [edi + 0x2c], 0
jne 0x1023c3f3
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 2
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1023c3d2
sub ecx, esi
push ecx
push edx
lea ecx, [edi + 0x34]
call fcn.1023b7e0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 0x40], 0xffffffff
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
mov byte [esi + ebp], 0
mov eax, esi
mov cl, byte [esi]
mov edx, esi
test cl, cl
je 0x1023c431
nop word [eax + eax]
mov ebp, eax
lea ebx, [edx + 1]
inc eax
cmp cl, 0xd
jne 0x1023c427
mov byte [edx], 0xa
cmp byte [eax], 0xa
cmovne eax, ebp
inc eax
jmp 0x1023c429
mov byte [edx], cl
mov cl, byte [eax]
mov edx, ebx
test cl, cl
jne 0x1023c410
push 0
mov byte [edx], 0
mov ecx, edi
mov eax, dword [edi]
push 0
push esi
call dword [eax + 8]
push esi
call fcn.1006e708
add esp, 4
cmp byte [edi + 0x2c], 0
sete al
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x1023d990
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025455c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
push 0x50
mov edi, ecx
call fcn.1006e6a7
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x1032091c
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x1032091c
mov byte [ebp - 4], 2
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x10265063
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1023b7e0
push esi
mov ecx, edi
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 0xffffffff
call fcn.1023c200
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x102406d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
jne 0x102406d7
xor eax, eax
ret
jmp fcn.10240430

Function at 0x10241150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
mov ebp, dword [edi + 0x74]
nop dword [eax]
mov eax, dword [edi + 0x2c]
mov ebx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub ebx, dword [edi + 0x6c]
add eax, esi
sub ebx, ebp
cmp dword [edi + 0x6c], eax
jb 0x102411f7
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ebp, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea edx, [eax + ebp*2]
nop
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [esp + 0x10], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [esp + 0x10]
mov word [edx], ax
sub ebp, 1
jne 0x102411a0
mov eax, dword [edi + 0x40]
mov ebp, esi
lea edx, [eax + esi*2]
nop dword [eax]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [esp + 0x10], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [esp + 0x10]
mov word [edx], ax
sub ebp, 1
jne 0x102411d0
add ebx, esi
mov ebp, dword [edi]
mov eax, dword [ebp + 4]
test eax, eax
je 0x102412ae
mov edx, dword [edi + 0x6c]
mov ecx, dword [edi + 0x74]
add edx, ecx
add edx, dword [edi + 0x38]
cmp eax, ebx
mov dword [esp + 0x10], edx
cmovbe ebx, eax
test ebx, ebx
je 0x10241272
sub eax, ebx
mov dword [ebp + 4], eax
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x1024123a
mov edx, dword [ebp]
mov ecx, dword [ebp + 0x30]
push ebx
call fcn.1023fee0
jmp 0x10241253
cmp eax, 2
jne 0x10241259
mov edx, dword [ebp]
test edx, edx
jne 0x1024124a
xor eax, eax
jmp 0x10241256
mov ecx, dword [ebp + 0x30]
push ebx
call fcn.10240430
add esp, 4
mov dword [ebp + 0x30], eax
push ebx
push dword [ebp]
push dword [esp + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add dword [ebp], ebx
add esp, 0xc
add dword [ebp + 8], ebx
mov ecx, dword [edi + 0x74]
lea ebp, [ecx + ebx]
mov dword [edi + 0x74], ebp
cmp ebp, 3
jb 0x1024129a
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebp, 0x106
jae 0x102412ae
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x10241160
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10241690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
mov esi, 1
cmp byte [eax], 0x31
jne 0x10241889
push ebx
test edi, edi
je 0x10241880
cmp dword [edi + 0x20], 0
mov dword [edi + 0x18], 0
jne 0x102416ca
mov dword [edi + 0x20], 0x10246220
mov dword [edi + 0x28], 0
cmp dword [edi + 0x24], 0
jne 0x102416d7
mov dword [edi + 0x24], 0x10246210
mov ebx, dword [esp + 0x14]
cmp edx, 0xffffffff
mov ecx, 6
cmovne ecx, edx
mov dword [esp + 0x20], ecx
test ebx, ebx
jns 0x102416f4
xor esi, esi
neg ebx
jmp 0x10241701
cmp ebx, 0xf
jle 0x10241701
mov esi, 2
sub ebx, 0x10
mov eax, dword [esp + 0x18]
dec eax
cmp eax, 8
ja 0x10241880
cmp dword [esp + 0x10], 8
jne 0x10241880
lea eax, [ebx - 8]
cmp eax, 7
ja 0x10241880
cmp ecx, 9
ja 0x10241880
cmp dword [esp + 0x1c], 4
ja 0x10241880
push ebp
push 0x16c0
mov eax, 9
cmp ebx, 8
push 1
push dword [edi + 0x28]
cmove ebx, eax
mov eax, dword [edi + 0x20]
call eax
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x10241876
mov dword [edi + 0x1c], ebp
mov ecx, ebx
mov dword [ebp + 0x18], esi
mov esi, 1
shl esi, cl
mov dword [ebp + 0x30], ebx
mov ebx, dword [esp + 0x1c]
push 2
lea eax, [esi - 1]
mov dword [ebp], edi
mov dword [ebp + 0x34], eax
mov eax, 1
lea ecx, [ebx + 7]
mov dword [ebp + 0x1c], 0
shl eax, cl
mov dword [ebp + 0x4c], eax
dec eax
mov dword [ebp + 0x54], eax
mov eax, 0xaaaaaaab
mov dword [ebp + 0x50], ecx
add ecx, 2
mul ecx
mov dword [ebp + 0x2c], esi
shr edx, 1
mov dword [ebp + 0x58], edx
mov eax, dword [edi + 0x20]
push esi
push dword [edi + 0x28]
call eax
push 2
push dword [ebp + 0x2c]
mov dword [ebp + 0x38], eax
push dword [edi + 0x28]
mov eax, dword [edi + 0x20]
call eax
push 2
push dword [ebp + 0x4c]
mov dword [ebp + 0x40], eax
push dword [edi + 0x28]
mov eax, dword [edi + 0x20]
call eax
mov dword [ebp + 0x44], eax
lea ecx, [ebx + 6]
mov eax, 1
shl eax, cl
push 4
push eax
mov dword [ebp + 0x169c], eax
push dword [edi + 0x28]
mov eax, dword [edi + 0x20]
call eax
mov esi, dword [ebp + 0x169c]
add esp, 0x30
cmp dword [ebp + 0x38], 0
mov edx, eax
mov dword [ebp + 8], edx
lea ecx, [esi*4]
mov dword [ebp + 0xc], ecx
je 0x10241860
cmp dword [ebp + 0x40], 0
je 0x10241860
cmp dword [ebp + 0x44], 0
je 0x10241860
test edx, edx
je 0x10241860
mov eax, esi
mov byte [ebp + 0x24], 8
shr eax, 1
mov ecx, edi
lea eax, [edx + eax*2]
mov dword [ebp + 0x16a4], eax
lea eax, [edx + esi*2]
add eax, esi
mov dword [ebp + 0x1698], eax
mov eax, dword [esp + 0x24]
mov dword [ebp + 0x84], eax
mov eax, dword [esp + 0x20]
mov dword [ebp + 0x88], eax
pop ebp
pop ebx
pop edi
pop esi
jmp fcn.102418c0
mov eax, dword [str.insufficient_memory]
mov ecx, edi
mov dword [ebp + 4], 0x29a
mov dword [edi + 0x18], eax
call fcn.10241a50
pop ebp
pop ebx
pop edi
mov eax, 0xfffffffc
pop esi
ret
pop ebx
pop edi
mov eax, 0xfffffffe
pop esi
ret
pop edi
mov eax, 0xfffffffa
pop esi
ret
Function at 0x102418c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
test ecx, ecx
je 0x10241a44
mov esi, dword [ecx + 0x1c]
test esi, esi
je 0x10241a44
cmp dword [ecx + 0x20], 0
je 0x10241a44
cmp dword [ecx + 0x24], 0
je 0x10241a44
mov dword [ecx + 0x14], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x2c], 2
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
test edx, edx
jns 0x1024191d
neg edx
mov dword [esi + 0x18], edx
test edx, edx
mov eax, 0x71
push edi
mov edi, 0x2a
cmovne eax, edi
mov dword [esi + 4], eax
xor eax, eax
cmp edx, 2
setne al
mov dword [ecx + 0x30], eax
lea eax, [esi + 0x94]
mov dword [esi + 0xb18], eax
mov ecx, esi
lea eax, [esi + 0x988]
mov dword [esi + 0x28], 0
mov dword [esi + 0xb24], eax
lea eax, [esi + 0xa7c]
mov dword [esi + 0xb30], eax
xor eax, eax
mov dword [esi + 0xb20], 0x1031da90
mov dword [esi + 0xb2c], 0x1031da68
mov dword [esi + 0xb38], 0x1031da7c
mov word [esi + 0x16b8], ax
mov dword [esi + 0x16bc], eax
mov dword [esi + 0x16b4], 8
call fcn.10245b20
mov eax, dword [esi + 0x2c]
xor edx, edx
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x10263332]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x10263330]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x10263334]
mov dword [esi + 0x90], eax
movzx eax, word [ecx*4 + 0x10263336]
mov dword [esi + 0x7c], eax
xor eax, eax
pop edi
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x10246530
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0
je 0x10246597
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10246545
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x10246593
cmp eax, 2
jne 0x10246597
mov eax, dword [esi + 0x14]
mov ecx, esi
cmp eax, 8
jb 0x10246562
mov ecx, dword [esi]
cmp word [ecx], 0x41
je 0x10246597
mov ecx, esi
cmp eax, 8
jb 0x10246571
mov ecx, dword [esi]
cmp word [ecx], 0x42
je 0x10246597
mov ecx, esi
cmp eax, 8
jb 0x10246580
mov ecx, dword [esi]
cmp word [ecx], 0x61
je 0x10246597
cmp eax, 8
jb 0x1024658d
mov esi, dword [esi]
cmp word [esi], 0x62
je 0x10246597
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x10246a70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10254718
push eax
mov dword fs:[0], esp
lea eax, [ebp - 0x834]
sub esp, 0x828
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push eax
push 0x3fe
call edi
mov ebx, eax
test ebx, ebx
jne 0x10246abc
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
lea edx, [ebp - 0x834]
xor esi, esi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
cmp ebx, 0x3fe
jbe 0x10246b1f
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006e70d
mov esi, eax
mov dword [ebp - 0x10], eax
push 0
mov dword [ebp - 0x18], esi
call fcn.1006e708
add esp, 8
push esi
push ebx
call edi
test eax, eax
je 0x10246b18
cmp eax, ebx
ja 0x10246b18
mov edx, esi
xor ecx, ecx
mov ebx, eax
mov dword [edx + eax*2], ecx
jmp 0x10246b28
xor bl, bl
jmp 0x10246bbc
xor eax, eax
mov dword [ebp + ebx*2 - 0x834], eax
xor ecx, ecx
xor edi, edi
test ebx, ebx
je 0x10246bba
mov edx, dword [ebp - 0x10]
mov eax, 2
mov dword [ebp - 0x14], eax
nop
cmp word [edx + eax - 2], 0
jne 0x10246baf
cmp ecx, edi
je 0x10246baf
xor eax, eax
mov dword [ebp - 0x24], 0
lea edx, [edx + ecx*2]
mov word [ebp - 0x34], ax
mov eax, edx
mov dword [ebp - 0x20], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x1c], ecx
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10246b70
sub eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x34]
sar eax, 1
push eax
push edx
call fcn.1001a600
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.100313d0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.1001a5a0
mov eax, dword [ebp - 0x14]
lea ecx, [edi + 1]
mov edx, dword [ebp - 0x10]
inc edi
add eax, 2
mov dword [ebp - 0x14], eax
cmp edi, ebx
jb 0x10246b40
mov bl, 1
push esi
call fcn.1006e708
mov ecx, dword [ebp - 0xc]
add esp, 4
mov al, bl
mov dword fs:[0], ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret