joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10045e20
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [esp + 0x18], eax
mov al, byte [0x1007a230]
test al, 1
je 0x10045fe4
xor esi, esi
mov ecx, 0xfffffff7
lea ebx, [esp + 0x10]
dec esi
mov edi, esi
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
push ebx
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
push 0x1007b690
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edx, dword [0x1007b6d8]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov esi, dword [0x1007b6dc]
mov dword [esp], edx
cmp eax, edx
mov edx, ecx
sbb edx, esi
jl 0x10045e9b
mov esi, ecx
mov dword [0x1007b6d8], eax
mov dword [0x1007b6dc], ecx
mov dword [esp], eax
mov dword [esp + 0xc], esi
mov esi, 0x1007b690
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push ebx
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x14]
mov esi, dword [0x1007b6d8]
mov eax, dword [esp + 0x10]
mov ebx, dword [0x1007b6dc]
cmp eax, esi
mov edx, ecx
sbb edx, ebx
jl 0x10045ee4
mov esi, eax
mov ebx, ecx
mov dword [0x1007b6d8], eax
mov dword [0x1007b6dc], ecx
push 0x1007b690
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esi, dword [esp]
mov ecx, 0x3e8
sbb ebx, dword [esp + 0xc]
mov eax, esi
mov esi, dword [esp + 4]
mul ecx
imul ecx, ebx, 0x3e8
lea ebx, [esp + 0x10]
add ecx, edx
cmp eax, esi
mov edx, ecx
sbb edx, edi
cmovb edi, ecx
mov ecx, dword [esp + 8]
cmovb esi, eax
test ecx, ecx
je 0x10045f2e
mov eax, esi
inc ecx
or eax, edi
jne 0x10045e52
xor eax, eax
mov edx, esi
xor ecx, ecx
inc eax
or edx, edi
mov edx, dword [0x1007a228]
cmovne eax, esi
mov esi, dword [0x1007a22c]
cmovne ecx, edi
mov dword [esp], edx
mov edx, 0xf4240
imul ebx, ecx, 0xf4240
mov dword [esp + 8], esi
mul edx
mov dword [esp + 4], eax
add ebx, edx
push esi
mov edi, dword [esp + 4]
push edi
push ebx
push eax
call fcn.1006a070
mov esi, edx
mov ecx, eax
xor edx, edx
xor eax, eax
inc eax
cmp dword [esp + 4], edi
sbb ebx, dword [esp + 8]
cmovb esi, edx
cmovb ecx, eax
mov dword [esp + 4], esi
mov dword [0x1007b6bc], esi
mov dword [esp], ecx
mov dword [0x1007b6b8], ecx
mov edi, eax
mov ebx, edx
mov esi, edx
mov edx, 0xa
mov ecx, eax
xor edi, dword [esp]
xor ebx, dword [esp + 4]
mul edx
or ebx, edi
je 0x10045fc5
cmp dword [esp], eax
mov ebx, dword [esp + 4]
lea edi, [esi + esi*4]
lea edx, [edx + edi*2]
sbb ebx, edx
jae 0x10045f9a
mov dword [0x1007b6c0], ecx
mov dword [0x1007b6c4], esi
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.10069260
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x1007a22c]
mov eax, dword [0x1007a228]
mov ecx, esi
mov dword [esp], eax
shld ecx, eax, 4
shl eax, 4
jmp 0x10045f4c
Function at 0x10049e24
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov dword [0], 0x321
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push 3
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
sub edi, dword [ecx - 4]
mov eax, dword [edi - 0x50]
lea ebx, [edi - 0x4c]
lea esi, [edi - 0x50]
mov eax, dword [eax + 4]
mov dword [edi + eax - 0x50], 0x1006c730
mov eax, dword [edi - 0x50]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x50]
mov dword [edi + eax - 0x54], ecx
mov ecx, ebx
mov dword [edi - 0x4c], 0x1006c740
call fcn.10049eb0
mov ecx, ebx
call dword [sym.imp.msvcp140.dll_public_virtual:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, edi
call dword [sym.imp.msvcp140.dll_public_virtual:_void___thiscall_std::ios_base::destructor_void_]
cmp dword [ebp + 8], 0
je 0x10049e99
push esi
call sym.mozglue.dll__aligned_free
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1005f1f0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xf
jmp dword [eax*4 + 0x1006c928]

Function at 0x1005f930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
mov esi, ecx
and esi, 0xfffffffc
je 0x1005f977
xor edi, edi
nop word [eax + eax]
rol eax, 5
xor eax, dword [edx + edi]
add edi, 4
imul ebx, eax, 0x9e3779b9
imul eax, eax, 0xc6ef3720
shr ebx, 0x1b
or ebx, eax
xor ebx, 4
imul eax, ebx, 0x9e3779b9
cmp edi, esi
jb 0x1005f950
cmp esi, ecx
jae 0x1005f991
sub ecx, esi
add edx, esi
movsx esi, byte [edx]
rol eax, 5
inc edx
xor eax, esi
imul eax, eax, 0x9e3779b9
dec ecx
jne 0x1005f97f
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1005f9a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x1007a00c]
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, ebp
mov dword [esp + 0xc], eax
mov eax, esp
mov dword [eax + 4], ebx
mov dword [eax], ebx
push 8
push eax
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x1005f9f0
movsd xmm0, qword [esp]
mov bl, 1
movsd qword [esi], xmm0
mov byte [esi + 8], bl
mov ecx, dword [esp + 0xc]
xor ecx, ebp
call fcn.10069260
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
jmp 0x1005f9d9

Function at 0x1005fa00
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x1007a00c]
mov ecx, esp
xor eax, ebp
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
push 8
push ecx
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x1005fa48
mov esi, dword [esp]
mov edi, dword [esp + 4]
mov ecx, dword [esp + 0xc]
xor ecx, ebp
call fcn.10069260
mov eax, esi
mov edx, edi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
int3
Function at 0x10069bc2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10069bd1
pop dword [ebp - 0x20]
mov eax, 0x8610a033
sub eax, 0x760a0462
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3a0f0
push 0
mov eax, 0x3d16ba92
add eax, 0xd2f0c496
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x986ee109
sub ecx, 0x986e8da5
xor edi, edi
add edi, eax
mov edx, 0x10082e00
add edx, dword [ebp - 0x20]
mov esi, 0xd220cbd7
add esi, 0xd8e8c343
sub dword [ebp - 0x18], 0xec306380
mov ebx, dword [edx]
add dword [ebp - 8], ecx
sub ebx, esi
xor dword [ebp - 0x14], 0x3b2054b1
mov dword [edi], ebx
add edi, 4
add edx, 0x44034474
sub edx, 0x44034470
loop 0x10069c2c
add eax, 0xcf41fa0d
sub eax, 0xcf40b9aa
xor ebx, ebx
add ebx, eax
add eax, 0x31f836de
add eax, 0xce07c927
mov ecx, 0xa7329670
add ecx, 0x68cd6990
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4010e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c004]
jne 0x4010f2
repz ret
jmp fcn.004017b3

Function at 0x40623b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404398
and dword [ebp - 0x14], 0
cmp dword [0x42ec88], 0
mov dword [ebp - 0x18], eax
jne 0x4062ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406396
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406396
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42ec88], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42ec8c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42ec90], eax
call edi
push eax
call esi
mov dword [0x42ec98], eax
test eax, eax
je 0x4062ee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42ec94], eax
mov eax, dword [0x42ec94]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406347
cmp dword [0x42ec98], ecx
je 0x406347
push eax
call esi
push dword [0x42ec98]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406347
test ebx, ebx
je 0x406347
call edi
test eax, eax
je 0x40633e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40633e
test byte [ebp - 8], 1
jne 0x406347
or dword [ebp + 0x10], 0x200000
jmp 0x40637a
mov eax, dword [0x42ec8c]
cmp eax, dword [ebp - 0x18]
je 0x40637a
push eax
call esi
test eax, eax
je 0x40637a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40637a
mov eax, dword [0x42ec90]
cmp eax, dword [ebp - 0x18]
je 0x40637a
push eax
call esi
test eax, eax
je 0x40637a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42ec88]
call esi
test eax, eax
je 0x406396
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406398
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010e8
leave
ret
Function at 0x427980
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x427994
call fcn.00427900
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x427987
pop esi
cmp ebx, 0x2d
jne 0x4279ae
mov dword [0x2bd46e8], 0xa62e7790
mov dword [0x2bd46ec], 0xffffffff
ret

Function at 0x4279b0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x42c004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x42d200]
push ebx
mov ebx, dword [0x2bd46dc]
push edi
mov edi, dword [0x2bd225c]
call fcn.00427950
cmp dword [0x2bd46dc], 0x2f
jne 0x427a1d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00427980
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010e8
add esp, 0x24
ret
Function at 0x10007cac
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.10009fdb
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x10007e1f
jg 0x10007cdb
test esi, esi
jb 0x10007e1f
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.10017328
add esp, 0xc
test eax, eax
js 0x10007e1f
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x10007d3d
push edi
call fcn.1000822e
pop ecx
test eax, eax
je 0x10007d34
push ebx
push esi
push edi
push ebp
call fcn.10009fdb
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x10007e24
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.10009fdb
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x10007e1f
jg 0x10007d66
cmp ebp, ebx
jb 0x10007e1f
mov ecx, 0x10015
cmp eax, ebx
jg 0x10007d7b
jl 0x10007d75
cmp ebp, ecx
jae 0x10007d7b
mov esi, ebp
mov ecx, eax
jmp 0x10007d7f
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.10009fdb
add esp, 0x10
cmp edx, ebx
jl 0x10007e1f
jg 0x10007da5
cmp eax, ebx
jb 0x10007e1f
push 0x10015
call fcn.10009fdb
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10007e1f
push esi
push ebx
push dword [esp + 0x24]
call fcn.10017328
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x10007e18
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x10007e14
cmp byte [esi], 0x50
jne 0x10007e13
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x10007e13
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x10007e2b
dec esi
cmp esi, ebx
jae 0x10007dd4
push ebx
call fcn.10009fdb
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.1000a190
push ebx
call fcn.10009fdb
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.1000822e
add esp, 0x14
test eax, eax
je 0x10007e6b
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.10009fdb
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x10007e24
Function at 0x4042c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c44
call fcn.004059f0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ebx, ebx
xor eax, eax
mov edx, eax
mov ecx, eax
shr edx, 9
add eax, 5
shr ecx, 6
xor dl, cl
add dl, bl
mov byte [ebp + ebx - 0x50c08], dl
inc ebx
cmp eax, 0x193bf6
jb 0x404346
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00404d48
mov esp, ebp
pop ebp
ret
Function at 0x405578
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4055b7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4055b7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4055b7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4055b7
cmp dword [ecx + 0x74], 0xe
jbe 0x4055b7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4013f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40140b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401444
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401440
jmp 0x401430
cmp esi, eax
jae 0x401444
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401430
cmp esi, eax
jb 0x40144b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402f90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469d40
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x48794c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0040e5e6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402fd4
push 0x80004005
call fcn.004014a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
movzx ecx, byte [esi + 4]
push ecx
lea edx, [ebp - 0x10]
push str._d_1
push edx
call fcn.00403600
add esp, 0xc
cmp byte [esi + 5], 0xff
je 0x40307e
lea edi, [esi + 5]
lea esp, [esp]
call fcn.0040e5e6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x402fca
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
movzx ecx, byte [edi]
push ecx
lea edx, [ebp - 0x14]
push 0x47825c
push edx
call fcn.00403600
mov esi, dword [ebp - 0x14]
mov eax, dword [esi - 0xc]
add esp, 0xc
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.004034b0
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403078
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc edi
cmp byte [edi], 0xff
jne 0x403010
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040af50
mov eax, dword [eax]
mov edi, dword [ebp - 0x10]
add esp, 4
push eax
push 0xffffffffffffffff
push edi
push str.PortMap
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [ebp - 0x14]
cmp esi, 0xffffffff
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4030c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x403101
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4030ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub esi, 1
js 0x40310e
cmp esi, 0xff
jl 0x403111
or esi, 0xffffffff
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403134
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ab10
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469f76
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x48794c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0040ac50
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
mov dword [ebp - 4], 0
push edx
mov word [ebp - 0x218], cx
call fcn.00440cf0
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax - 0xc]
dec ecx
push ecx
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.0043fd38
add esp, 0xc
test eax, eax
je 0x40ac01
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
push eax
call fcn.00402500
add eax, 0x10
add esp, 4
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 1
mov eax, dword [eax - 0xc]
lea edx, [ebp - 0x220]
lea ecx, [eax - 1]
push edx
mov eax, 1
call fcn.004088e0
mov esi, dword [ebp - 0x220]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ac01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ac2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ea11
mov esp, ebp
pop ebp
ret
Function at 0x40af50
Capabilities:
Get common file path
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x48794c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x104
lea ecx, [ebp - 0x24c]
push ecx
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, dword [str..Z:]
mov eax, dword [0x479640]
mov ecx, dword [0x479644]
push 0x32
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], edx
mov dx, word [0x479648]
lea eax, [ebp - 0x36]
push 0
or ebx, 0xffffffff
push eax
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x3c], ecx
mov word [ebp - 0x38], dx
call fcn.00440cf0
mov cx, word [ebp - 0x24c]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0xc
push 0
push 0
push 3
push 0
push 2
push 0
lea edx, [ebp - 0x44]
push edx
mov word [ebp - 0x3c], cx
call edi
mov esi, eax
cmp esi, ebx
je 0x40b025
push 0
lea eax, [ebp - 0x258]
push eax
push 0xc
lea ecx, [ebp - 0x264]
push ecx
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40b01e
mov ebx, dword [ebp - 0x260]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 3
push 0
push 2
push 0
lea eax, [ebp - 0x44]
mov edx, 0x44
push eax
mov word [ebp - 0x3c], dx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x40b080
push 0
lea ecx, [ebp - 0x258]
push ecx
push 0xc
lea edx, [ebp - 0x264]
push edx
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40b079
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x250], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
je 0x40b0c7
cmp ebx, dword [ebp - 0x250]
jne 0x40b0c7
push str.D:Port.pfg
lea ecx, [ebp - 0x44]
push 0x20
push ecx
call fcn.0043f7e4
add esp, 0xc
push 0
push 0
push 4
push 0
push 3
push SysReAllocString
lea edx, [ebp - 0x44]
push edx
call edi
cmp eax, 0xffffffff
je 0x40b0c7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x44]
push eax
jmp 0x40b0e7
push str.Port.pfg
lea ecx, [ebp - 0x24c]
push 0x104
push ecx
call fcn.0043ff1a
add esp, 0xc
lea edx, [ebp - 0x24c]
push edx
mov esi, dword [ebp - 0x254]
mov ecx, esi
call fcn.00401b10
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ea11
mov esp, ebp
pop ebp
ret