joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032cae
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10032cd2
xor eax, eax
jmp 0x10032e16
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10032cf0
xor eax, eax
jmp 0x10032e16
push 1
lea eax, [ebp - 0xc]
push eax
push 0x5745
push 0x26cd
lea eax, [ebp - 8]
push eax
call fcn.10032ad1
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x10032d19
xor eax, eax
jmp 0x10032e16
push dword [ebp - 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x4d39
push 0xf26
push 0x6ae8
push 1
push 0x264e
push 0x2653
push dword [ebp - 0x10]
call fcn.1003284f
add esp, 0x2c
push 0x5d81
push 0x2e22
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.10032b5f
add esp, 0x18
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x10032d98
lea eax, [ebp - 0x14]
push eax
push 1
push 0x3456
lea eax, [ebp - 4]
push eax
push 0xb3c
call fcn.10032c02
add esp, 0x14
push dword [ebp - 4]
call fcn.100325e3
pop ecx
test eax, eax
jne 0x10032da9
xor eax, eax
jmp 0x10032e16
push 0x3c7e
lea eax, [ebp - 4]
push eax
push 1
call fcn.10032c69
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10032dfe
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10032ddb
xor eax, eax
jmp 0x10032e16
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10032df4
xor eax, eax
jmp 0x10032e16
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10032e0f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10032e13
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10084bb5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008f330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100759c4
mov dword [ebp - 0x14], eax
cmp dword [0x1067bfac], esi
jne 0x10084ca8
push 0x800
push esi
push 0x10007a7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10084c35
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10084d88
push esi
push esi
push 0x10007a7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10084d88
push 0x10007a94
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10084d88
push eax
call ebx
push 0x10007aa0
push edi
mov dword [0x1067bfac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007ab0
push edi
mov dword [0x1067bfb0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007ac4
push edi
mov dword [0x1067bfb4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067bfbc], eax
test eax, eax
je 0x10084ca5
push 0x10007ae0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067bfb8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10084ccd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10084cc0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10084ce2
push 4
pop eax
jmp 0x10084d8a
cmp dword [ebp - 0x14], esi
je 0x10084ce2
push dword [0x1067bfac]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10084cc7
mov eax, dword [0x1067bfb8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10084d40
cmp dword [0x1067bfbc], edi
je 0x10084d40
push eax
call ebx
push dword [0x1067bfbc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10084d40
test eax, eax
je 0x10084d40
call ecx
test eax, eax
je 0x10084d35
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10084d35
test byte [ebp - 8], 1
jne 0x10084d40
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10084d70
mov eax, dword [0x1067bfb0]
cmp eax, edi
je 0x10084d6d
push eax
call ebx
test eax, eax
je 0x10084d6d
call eax
mov esi, eax
test esi, esi
je 0x10084d6d
mov eax, dword [0x1067bfb4]
cmp eax, edi
je 0x10084d6d
push eax
call ebx
test eax, eax
je 0x10084d6d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067bfac]
call ebx
test eax, eax
je 0x10084d88
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10084d8a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x6c6ca570
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6c6dab80
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6c6dab80
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6c6ca5d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6c7ee054]
test esi, esi
jle 0x6c6ca6f0
mov eax, dword [0x6c7ee058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x6c6ca604
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6c6ca687
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6c6ca5f0
mov dword [esp], ebx
call fcn.6c6cad30
mov edi, eax
test eax, eax
je 0x6c6ca717
mov eax, dword [0x6c7ee058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6c6cae70
mov edx, dword [0x6c7ee058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6c6ca6f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6c6ca680
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6c6ca690
add dword [0x6c7ee054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6c7ee058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6c6ca680
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6c6ca570
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6c6ca60e
mov eax, dword [0x6c7ee058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6c6ca570
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6c6ca570
lea esi, [esi]
nop
Function at 0x6c6ca9b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6c7ee064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6c7ee05c]
sub esp, 4
test ebx, ebx
je 0x6c6caa05
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6c6ca9fe
test esi, esi
je 0x6c6ca9fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6c6ca9e0
mov dword [esp], 0x6c7ee064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6c6cad30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6c6c0000], 0x5a4d
jne 0x6c6cad55
mov ecx, dword [0x6c6c003c]
cmp dword [ecx + 0x6c6c0000], 0x4550
lea edx, [ecx + 0x6c6c0000]
je 0x6c6cad60
ret
cmp word [ecx + 0x6c6c0018], 0x10b
jne 0x6c6cad55
push esi
movzx eax, word [ecx + 0x6c6c0014]
push ebx
movzx esi, word [ecx + 0x6c6c0006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x6c6c0000
test esi, esi
je 0x6c6cada8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6c6cad9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6c6cadaa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6c6cad90
xor eax, eax
pop ebx
pop esi
ret

Function at 0x6c6cb320
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x6c7ee060]
test eax, eax
jne 0x6c6caa30
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x6c6caa90
mov eax, dword [esp + 0x20]
mov dword [esp], 0x6c7ee064
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x6c7ee05c]
mov dword [0x6c7ee05c], ebx
sub esp, 4
mov dword [ebx + 8], eax
mov dword [esp], 0x6c7ee064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
or eax, 0xffffffff
jmp 0x6c6caa8b
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x6c6cb350
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x6c6dad80
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
test eax, eax
jne 0x6c6dad90
xor eax, eax
ret
jmp 0x6c6caa20

Function at 0x6c6cb390
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x6c6cb3d0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x6c6cb3f8
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x6c6dadd8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1c], eax
mov eax, dword [0x6c7ee02c]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6c6dae40
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.6c729900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x6c7a8432
mov ecx, eax
call fcn.6c766b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.6c729930
jmp 0x6c6dafb0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_OpenClipboard]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6c6dae92
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.6c729900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x6c7a8432
mov ecx, eax
call fcn.6c766b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.6c729930
jmp 0x6c6dafb0
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetClipboardData]
call eax
sub esp, 4
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
jne 0x6c6daeed
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.6c729900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x6c7a8432
mov ecx, eax
call fcn.6c766b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.6c729930
jmp 0x6c6dafb0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalLock]
call eax
sub esp, 4
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
jne 0x6c6daf45
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.6c729900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x6c7a8432
mov ecx, eax
call fcn.6c766b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.6c729930
jmp 0x6c6dafb0
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.6c729900
lea eax, [esp + 0x34]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
mov dword [esp], edx
mov ecx, eax
call fcn.6c766b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.6c729930
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call eax
sub esp, 4
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.6c766a50
sub esp, 4
lea eax, [esp + 0x34]
mov ecx, eax
call fcn.6c767640
mov eax, dword [esp + 0x4c]
sub eax, dword [0x6c7ee02c]
je 0x6c6dafc1
call fcn.6c6c15c0
mov eax, dword [esp + 0x1c]
add esp, 0x5c
ret
Function at 0x6c6df590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x6c7a9e11
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x6c7a9e75]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6c6cb010
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.6c79eae0
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x6c7a726c], 0
jne 0x6c6df6b6
mov byte [0x6c7a726c], 1
call fcn.6c79cbd0
test eax, eax
je 0x6c6df684
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.6c6ca220
mov dword [esp], 2
mov esi, dword [fcn.6c6dab80]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x6c6df674
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6c7aa555
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6c79f360
jmp 0x6c79f358
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x6c6df63a
mov dword [esp], 2
call dword [0x6c7a6178]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x6c79f353
mov dword [esp], 2
call dword [0x6c7a6178]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6c7aa504
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.6c6da428
call fcn.6c79cfa0
call fcn.6c79cab0
call fcn.6c79cc20
jmp 0x6c79f353
Function at 0x6c6f0bd4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x68
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, edx
mov byte [esp + 0x10], al
mov eax, dword [0x6c7ee02c]
mov dword [esp + 0x5c], eax
xor eax, eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.6c7984f0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.6c766ee0
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x14]
je 0x6c6f0c78
mov eax, dword [esp + 0x18]
movzx eax, byte [eax]
movsx edx, al
mov eax, dword [esp + 0x28]
mov dword [esp], edx
mov ecx, eax
call fcn.6c6ea10c
sub esp, 4
movsx edx, al
mov eax, dword [esp + 0x28]
mov dword [esp + 4], 0
mov dword [esp], edx
mov ecx, eax
call fcn.6c6e9ff0
sub esp, 8
movsx edx, al
lea eax, [esp + 0x44]
mov dword [esp], edx
mov ecx, eax
call fcn.6c767a60
sub esp, 4
add dword [esp + 0x18], 1
jmp 0x6c6f0c1c
mov dword [esp + 0x2c], str.dwsmaklthrtter
mov dword [esp + 0x24], 0x6c7b2ec0
mov dword [esp + 0x30], 0x6c7b2f38
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x30]
je 0x6c6f0d80
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.6c799074
test al, al
je 0x6c6f0d76
cmp byte [esp + 0x10], 0
je 0x6c6f0d41
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, eax
call fcn.6c76b530
sub esp, 8
lea eax, [esp + 0x38]
mov dword [esp + 4], 0
mov dword [esp], 3
mov ecx, eax
call fcn.6c76b530
sub esp, 8
mov eax, dword [esp + 0x34]
add eax, 4
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov ecx, eax
call fcn.6c6f0a40
sub esp, 4
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov dword [esp], edx
mov ecx, eax
call fcn.6c6f0b18
sub esp, 4
test al, al
je 0x6c6f0d41
mov eax, 1
jmp 0x6c6f0d46
mov eax, 0
test al, al
je 0x6c6f0d6d
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 4
mov ecx, eax
call fcn.6c76b530
sub esp, 8
mov ebx, dword [esp + 0x40]
jmp 0x6c6f0da1
mov eax, dword [esp + 0x34]
mov ebx, dword [eax + 4]
jmp 0x6c6f0da1
add dword [esp + 0x24], 8
jmp 0x6c6f0c90
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, eax
call fcn.6c76b530
sub esp, 8
mov ebx, dword [esp + 0x40]
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.6c767640
mov eax, ebx
mov ebx, dword [esp + 0x5c]
sub ebx, dword [0x6c7ee02c]
je 0x6c6f0dbf
call fcn.6c6c15c0
add esp, 0x68
pop ebx
ret 0xc
Function at 0x6c6f0f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [0x6c7ee02c]
mov dword [esp + 0x5c], eax
xor eax, eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.6c7984f0
mov dword [esp + 0x34], eax
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.6c766ee0
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10]
je 0x6c6f0fcd
mov eax, dword [esp + 0x14]
movzx eax, byte [eax]
movsx edx, al
mov eax, dword [esp + 0x34]
mov dword [esp + 4], 0
mov dword [esp], edx
mov ecx, eax
call fcn.6c6e9ff0
sub esp, 8
movsx edx, al
lea eax, [esp + 0x44]
mov dword [esp], edx
mov ecx, eax
call fcn.6c767a60
sub esp, 4
add dword [esp + 0x14], 1
jmp 0x6c6f0f85
mov dword [esp + 0x38], 0x6c7a7280
mov dword [esp + 0x30], 0x6c7a7280
mov dword [esp + 0x3c], 0x6c7a7480
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x3c]
je 0x6c6f107b
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.6c799074
test al, al
je 0x6c6f1071
lea eax, [esp + 0x2f]
mov ecx, eax
call fcn.6c729900
mov eax, dword [esp + 0x40]
sub eax, 0x6c7a7280
sar eax, 2
movsx edx, al
mov eax, dword [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.6c6e9f20
sub esp, 4
movsx edx, al
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x2f]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], 1
mov ecx, eax
call fcn.6c766e40
sub esp, 0xc
lea eax, [esp + 0x2f]
mov ecx, eax
call fcn.6c729930
jmp 0x6c6f1086
add dword [esp + 0x30], 4
jmp 0x6c6f0fe5
mov eax, dword [esp + 0x1c]
mov ecx, eax
call fcn.6c766ee0
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.6c767640
mov eax, dword [esp + 0x5c]
sub eax, dword [0x6c7ee02c]
je 0x6c6f10a2
call fcn.6c6c15c0
mov eax, dword [esp + 0x1c]
add esp, 0x6c
ret 0xc
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219