joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b422a
Capabilities:
Link many functions at runtime

Disassembly:
call esi
push str.cef_string_ascii_to_wide
push dword [ebp - 0x14]
jmp 0x100b50d2
mov dword [ebp], edx
mov dword [esp + 8], 0x3c23bb9d
pop edx
pop eax
pop ecx
pop ecx
pop ecx
jmp esi
je 0x100883a3
cmp dword [0x10080db8], 0
not bl
mov bl, 1
jmp 0x100bbe8d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x10083ec5
mov dword [0x10080db0], eax
jmp loc.10025dc5
mov dword [ebp - 0x14], esi
call fcn.10020aa6
mov dword [ebp - 4], ebx
test edi, 0xf7a9b1b8
test esi, esi
jmp 0x10094b85
dec dl
dec cl
xor bl, cl
pop edx
add ecx, esp
mov eax, 0x8eb44a3e
xor eax, 0x3c200fa2
mov edx, dword [ecx]
sbb ebp, 4
mov dword [ebp], edx
mov eax, dword [edi]
call fcn.10090a45
movzx eax, dx
shr al, 0xa5
movzx eax, byte [edi + eax*8 - 0x4d820]
sar dx, 0xcc
xor al, bl
lea edx, [edx + edx + 0x5f3eb9ba]
xor al, 0x15
call fcn.100a3a58
lea ecx, [ecx + eax*2 + 0x212a1092]
xor ebx, ecx
sub dword [esp + eax*2], 0x683f5028
sal dx, 0xa3
adc esi, ecx
xchg dword [esp + eax], edx
add ax, word [eax + edi]
lea edi, [edi + edx - 0x5c05db1f]
dec dword [esp + edx - 0x5c05db21]
movsx ecx, byte [esp + edx - 0x5c05db21]
movzx ecx, byte [ebp + edx - 0x5c05db21]
sar edx, 0x87
je 0x1008a6cc
lea ebp, [ebp + edx*4 - 0x2e02ed7]
push edx
xor cl, bl
neg dx
sub cl, 0x35
lea edx, [edx*2 - 0x6bf68cce]
xadd word [esp + 6], dx
sal dx, 0x62
not cl
neg cl
dec edx
dec cl
call fcn.1008cb95
neg dx
push edx
mov word [ebp + edx - 0x7583b6f0], ax
sbb word [esp + edx - 0x7583b6ef], 0x7409
call fcn.1008e039
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push dword [sym.imp.KERNEL32.dll_FreeLibrary]
seta cl
mov esi, eax
bswap cx
lea ecx, [ebp - 0x28]
push esi
jmp 0x100b127c
mov dword [0x10080db8], eax
call esi
push str.cef_string_utf8_to_wide
jmp 0x100c9678
call esi
push str.cef_register_extension
push dword [ebp - 0x14]
jmp 0x100abfc6
jne 0x100883a3
push str.cef_v8context_get_current_context
push esi
jmp 0x1009e7a4
push dword [ebp - 0x14]
mov dword [0x10080dac], eax
jmp 0x100b5d49

Function at 0x100b9e83
Capabilities:
Link many functions at runtime

Disassembly:
rol ecx, 2
mov dword [esp], edx
shl eax, 0xf6
lea ecx, [ecx + edx + 0x5dc5faa]
bswap ecx
rol word [esp + eax*4], 0x25
jns 0x100b4272

Function at 0x100bd32a
Capabilities:
Link many functions at runtime

Disassembly:
shr edx, 0xcf
neg ax
bswap ecx
xor eax, 0xf611e5b8
mov dword [esp + edx*8 + 0x10], 0xb0a604b1
rol ecx, 2
mov dword [esp + edx*2], eax
and ax, word [esp + edx*8 + 0xa]
not ax
xor ebx, ecx
add esi, ecx
sal byte [esp + edx + 0x18], 0x84
lea ecx, [eax*4 + 0x60a09e03]
ror dl, 0x41
pop ecx
pop ecx
pop ecx
pop edx
pop ecx
pop edx
pop eax
pop edx
jno fcn.100c45c1
mov eax, 0x3405da36
sal eax, 0x2a
not eax
mov eax, dword [edi]
push 0xe7a1b637
movzx edx, byte [ebp]
call fcn.100af2d5
Function at 0x100bd389
Capabilities:
Link many functions at runtime

Disassembly:
mov edx, dword [ebp]
mov ecx, dword [esp + 4]
lea eax, [ecx + ecx*2 - 0x1249c876]
lea ebp, [ebp + ecx - 0x62bd12b6]
mov dword [esp + ecx - 0x62bd12ba], eax
xor edx, ebx
inc edx
rol edx, 3
sub edx, 0xf105dc35
inc ax
not dword [esp + ecx - 0x62bd12ba]
neg edx
lea edx, [ecx + edx - 0x2a842fb3]
jmp 0x100cf2ed
jo 0x100b2dce
jmp esi
xor ebx, edx
add esi, edx
add al, 0xc
xor al, byte [esp + eax*4 - 0x57b5bf0d]
mov eax, dword [edi + eax*2 - 0x2bdadf4e]
sar ecx, 0xe5
movzx cx, byte ss:[eax + ecx*2 - 0x62bd12a]
mov eax, dword [esp + 2]
lea edi, [edi + eax*2 - 0x2575d422]
js 0x100b424b
pop edx
sar dx, 0x61
mov word [edi + eax*2 - 0x2575d424], cx
pop ecx
jno 0x100bd566
Function at 0x100c307b
Capabilities:
Link many functions at runtime

Disassembly:
not cl
shl al, 0x22
sal eax, 0x96
xor bl, cl
shl eax, 0x99
jbe 0x100ce3a6
mov edx, 0xb08a6327
xor al, bl
dec edx
jno 0x1008c58f
mov edx, dword [ebp]
mov eax, 0xfda6ccaa
not eax
call fcn.10086982
jb 0x100ae1ef
push 5
setns al
mov ah, 0xa8
bswap eax
dec dl
not al
ror cx, 0x27
adc al, 0xb3
rol ecx, cl
inc dl
xor al, 0x3d
not edx
sub al, 0x92
lea edx, [edx + edx*4 - 0x18d05f00]
call fcn.100a76b6
and cl, dl
xchg word [esp + eax*2 + 5], ax
dec dword [esp + eax - 0xffe1]
not cl
mov word [eax + ebp - 0xffe3], cx
jno 0x100cba44
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
add ebp, 8
jmp 0x100bf038
push dword [ebp + 0xc]
jmp 0x100bc175
pop eax
sub ecx, 0xf7934312
neg ecx
rol ecx, 2
xor ecx, 0x9a28bbaf
or byte [esp + eax + 6], dl
sbb ecx, 0xaa308fbb
dec dx
xor ebx, ecx
add esi, ecx
movzx cx, byte [ebp + eax*4]
mov dl, byte [ebp + eax*8 + 2]
sar eax, 0xbf
je 0x1008f8a1
not cx
mov word [edi + 4], cx
mov eax, 0xcd15b12b
jmp 0x100d16bb
not dword [esp]
mov dword ss:[edx], eax
shl dword [esp], 0x7d
pop eax
xor eax, esi
jmp eax
add dword [esp + eax*8 + 4], eax
movzx cx, byte [edx + eax*2]
mov word [ebp + eax*2], cx
mov ecx, dword [eax + edi + 1]
lea edi, [edi + eax + 5]
mov dword [esp + eax*2], eax
shl eax, 0x46
mov edx, dword [esp + eax*2 + 4]
xor ecx, ebx
ror word [esp + eax + 1], 0x2c
push eax
rol ecx, 1
dec ecx
rol ecx, 1
lea ecx, [ecx + edx*4 + 0x21494aed]
neg edx
sar word [esp + eax*4 + 9], 0x6a
bswap ecx
shl byte [esp + eax + 0xb], 0x63
jnp 0x100b6042
movzx eax, word [esp]
mov cx, word [eax + edi - 0x690b]
xor word [esp + eax - 0x690d], ax
xor word [esp + eax - 0x690d], 0xca9f
shl eax, 0xbd
or dx, cx
and al, byte [esp + 3]
not dx
mov ecx, 0xb8b6cb28
xor eax, eax
mov cx, dx
or ax, word [edi + eax + 4]
or cx, ax
jmp 0x100bc383
sar word [esp + eax - 0xffe4], 0x81
lea ebp, [ebp + eax*8 - 0x7ff26]
or dword [esp + eax*2 - 0x1ffca], esi
ret 4
lea ecx, [esp + ecx + 8]
rol eax, 0x43
mov dx, word [eax + ecx]
not al
lea ecx, [eax + eax*8 - 0x1ced7d4]
mov word [edi + eax*4 - 0x3fa], dx
lea edi, [edi + eax*8 - 0x7f6]
push eax
movsx edx, ax
mov eax, dword [eax + ebp - 0xfe]
rol edx, 0x79
add ebp, 5
push edx
dec dword [esp + 0xc]
sets dl
xor eax, ebx
call fcn.100b8780
call fcn.1002bcd0
pop ecx
cmp eax, 0x400
jmp 0x100845ef
mov edx, dword [esp]
movzx ecx, byte [ebp]
xor cl, bl
rol eax, 0x4b
adc word [esp + 1], dx
ror cl, 1
or edx, 0x5aa2cc09
xadd dl, ah
xadd edx, eax
inc cl
rol edx, 0x2c
ror dl, 0x83
xor cl, 0x16
sub cl, 0xe
shr eax, 0xf0
push edx
jns 0x10083e94
lea eax, [eax + eax*2 + 0x65a4821d]
xor dl, bl
or eax, eax
neg dl
sub word [esp + eax - 0x5854d7ce], ax
mov ecx, dword [esp + 0x10]
add ecx, 0xffffbc7e
jmp ecx

Function at 0x100c7c0f
Capabilities:
Authenticate hmac

Disassembly:
not cl
mov dword [esp + eax - 0xd8006fc], edx
inc ax
lea edx, [edx*2 - 0x77de59ff]
add cl, 0x32
call fcn.1009529e
mov ecx, 0x6a14ad26
mov edx, dword [edi + ecx - 0x6a14ad26]
lea edi, [edi + ecx - 0x6a14ad22]
xor edx, ebx
sub edx, 0x690acdbe
lea eax, [ecx*2 - 0x5a4dec65]
and ax, cx
adc cl, ch
not edx
jle 0x100be291
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x43b63a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x43b3c1
pop esi
sub eax, 0x72bef454
sub edi, 0x78d3ac7e
add edi, 0x32ab1bb2
call fcn.0043b690
dec edi
sub eax, edi
inc edi
xor dword [ebx], esi
sub esp, 4
mov dword [esp], 0x2cd17630
pop eax
sub edi, 0xf8956244
inc ebx
dec edi
add eax, edi
cmp ebx, ecx
jne fcn.0043b63a
add edi, 0xc92d3c96
dec edi
mov edi, 0xca22f51
ret
Function at 0x41da2d
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor dword [esi], ebp
aaa
xor byte cs:[edi + 0x34], bl
xor eax, 0x3831622d
add byte [eax], al
add byte [eax], al
xor dword [esi], ebp
aaa
add byte [eax], al
add byte [eax], al
add byte [edi + 0x77], dh
ja 0x41dab5
pop edi
popal
jb 0x41dabc
jae 0x41dab2
and eax, 0x3d205d64
and byte [0xa73], ah
add byte [eax], al
add byte [edi + 0x69], dl
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x41dadf
and byte [edi + 0x72], ch
imul esp, dword [edi + 0x69], 0x206c616e
insd dword es:[edi], dx
popal
imul ebp, dword [esi + 0x20], 0x73677261
cmp cl, byte [edx]
add byte [eax], al
add byte [eax], al
pop edi
dec edx
inc ecx
push esi
inc ecx
pop edi
dec esp
inc ecx
push ebp
dec esi
inc ebx
dec eax
inc ebp
push edx
pop edi
inc esp
inc ebp
inc edx
push ebp
inc edi
add byte [eax], al
add byte [eax], al
push edx
push ebx
inc esp
push ebx
aad 0x52
adc eax, 0x4cf2760a
inc ebp
xchg esp, eax
sub byte [edx], 0x36
outsd dx, dword [esi]
mov byte [edi + edx*2], ah
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x3a], al
pop esp
jb 0x41db1f
inc ebx
cmp bl, byte [edx + esi*2 + 0x65]
pop esp
push 0x64
imul esi, dword [edi], 0x75
imul esi, dword fs:[edi], 0x75
xor al, 0x35
pop esp
xor dh, byte [edx]
cmp dword [edx + 0x75], ebx
imul ebp, dword [esp + 0x5c], 0x646e6977
outsd dx, dword [esi]
ja 0x41db47
sub eax, 0x36646d61
xor al, 0x5c
je 0x41db4a
jo 0x41db3b
jae 0x41db56
outsb dx, byte [esi]
pop esp
insb byte es:[edi], dx
popal
jne 0x41db55
arpl word [eax + 0x65], bp
jb 0x41db48
imul ebp, dword [ecx + ebp*2 + 0x73], 0x74
pop esp
outsd dx, dword [esi]
bound ebp, qword [edx + 0x36]
xor al, 0x5c
imul ebp, dword [ecx + ebp*2 + 0x73], 0x74
jo 0x41db64
bound eax, qword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
or al, byte [eax + eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [edx], ecx
add al, 0
or dh, byte [eax + edx]
add byte [edx], cl
rol byte [esi], cl
jo 0x41db33
add al, 1
add byte [edx], al
add dword [eax], eax
add al, 0x62
add byte [eax], al
add dword [esi], eax
add al, byte [eax]
push es
xor al, byte [edx]
push eax
or dword [edx], ecx
add al, 0
or dh, byte [esi + eax]
push es
add byte [edx], cl
xor al, byte [esi]
jo 0x41db1a
adc eax, 0x10000
add byte [eax], al
salc
adc dword [eax], eax
add byte [ebx + edx], dl
add byte [eax], al
adc byte [edi], 0
add byte [ebx + edx], dl
add byte [eax], al
add dword [ecx + eax], eax
add byte [ecx], al
add al, 1
add byte [edx + eax*2], al
add byte [eax], al
adc dword [esi], eax
add al, byte [eax]
push es
xor al, byte [edx]
xor ah, cl
adc eax, 0x10000
add byte [eax], al
retf
Function at 0x40686f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x4068ad
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406883
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x40687e
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4068da
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4068bb
not eax
pop ebp
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1001f193
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001f1ca
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1001f1d9
push 0x424
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esp, ebp
pop ebp
ret
Function at 0x10040749
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10040762
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x10040844
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x31ec
jge 0x100407ba
mov dword [ebp - 8], 1
jmp 0x100407be
and dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
jne 0x100407d1
mov dword [ebp - 0xc], 1
jmp 0x100407d5
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc]
jl 0x100407e8
mov dword [ebp - 0x10], 1
jmp 0x100407ec
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
add eax, 5
cmp eax, 0x26fbc79a
jge 0x1004080a
mov eax, dword [ebp - 0x38]
cmp dword [eax], 0
je 0x1004080a
mov dword [ebp - 0x14], 1
jmp 0x1004080e
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x14]
jle 0x10040821
mov dword [ebp - 0x18], 1
jmp 0x10040825
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jne 0x10040838
mov dword [ebp - 0x1c], 1
jmp 0x1004083c
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10046c0d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 1
lea eax, [ebp + 8]
push eax
push 0x53c8
lea eax, [ebp - 0x10]
push eax
push 0x7223
call fcn.100469b0
add esp, 0x14
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10046c47
xor eax, eax
jmp 0x10046d71
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10046c65
xor eax, eax
jmp 0x10046d71
push 0x42e6
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.10046a31
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x10046c89
xor eax, eax
jmp 0x10046d71
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x2f4b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 1
call fcn.10046a86
add esp, 0x1c
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.10046b0f
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
push 0x3620
push 0x7fad
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x282d
push 1
call fcn.10046b83
add esp, 0x18
push dword [ebp - 4]
call fcn.100466df
pop ecx
test eax, eax
jne 0x10046d00
xor eax, eax
jmp 0x10046d71
push 0x190c
push dword [ebp - 4]
push 1
push 0x13e0
call fcn.1003e793
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10046d59
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x10046d36
xor eax, eax
jmp 0x10046d71
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10046d4f
xor eax, eax
jmp 0x10046d71
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10046d6a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x10046d6e
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret