joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f573
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f5b2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f5b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f5b2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f5b2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f5b2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x431790
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4317bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4317bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
mov ecx, 0x44630d7c
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..text
mov ebx, 0x4304d8
nop
mov ecx, 0x3d26244b
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001060
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov edx, ecx
push edi
xor eax, eax
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
xor ebp, ebp
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x20]
mov dword [edi], ebp
call fcn.10001310
test al, al
jne 0x10001098
pop edi
pop ebp
mov ax, 0xfff6
pop ebx
ret 0x18
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push ebp
push 1
push ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x2c], eax
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x100010e5
push esi
call fcn.10001340
add esp, 4
cmp ax, 1
je 0x100010e5
mov esi, 0xfffffffa
call fcn.10001300
mov ax, si
pop esi
pop edi
pop ebp
pop ebx
ret 0x18
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi]
lea ebp, [esi + 0x1c]
push ebp
push edi
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000115c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1000112b
push esi
mov dword [edi], 0
call fcn.10001560
add esp, 4
or esi, 0xffffffff
call fcn.10001300
mov ax, si
pop esi
pop edi
pop ebp
pop ebx
ret 0x18
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0x2c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000114d
mov edx, dword [esi]
push 1
push edi
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x1000115c
push esi
mov dword [edi], 0
call fcn.10001560
add esp, 4
cmp dword [edi], 2
jb 0x10001197
mov ecx, dword [esp + 0x20]
mov al, byte [ebx]
lea esi, [ebx + 1]
mov byte [ecx], al
mov ebp, dword [edi]
dec ebp
mov ecx, ebp
mov dword [edi], ebp
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
call fcn.10001300
mov ax, si
pop esi
pop edi
pop ebp
pop ebx
ret 0x18
push esi
call fcn.10001560
add esp, 4
mov esi, 0xfffffffb
call fcn.10001300
mov ax, si
pop esi
pop edi
pop ebp
pop ebx
ret 0x18
Function at 0x100011c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x64
mov al, byte [esp + 0x74]
push ebx
mov ebx, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x74]
mov ecx, ebx
mov edx, ecx
push edi
lea edi, [esp + 0xd]
mov byte [esp + 0xc], al
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
call fcn.10001310
test al, al
jne 0x10001201
pop edi
pop esi
mov ax, 0xfff6
pop ebx
add esp, 0x64
ret 0x14
mov esi, dword [esp + 0x74]
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push eax
push eax
push 1
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x10001252
push esi
call fcn.10001340
add esp, 4
cmp ax, 1
je 0x10001252
mov edi, 0xfffffffa
call fcn.10001300
mov ax, di
pop edi
pop esi
pop ebx
add esp, 0x64
ret 0x14
mov eax, dword [esi + 4]
lea edi, [esi + 8]
lea ecx, [esp + 0x80]
push edi
push ecx
lea edx, [esp + 0x14]
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100012c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1000129c
push esi
or edi, 0xffffffff
call fcn.10001560
add esp, 4
call fcn.10001300
mov ax, di
pop edi
pop esi
pop ebx
add esp, 0x64
ret 0x14
mov ecx, dword [esp + 0x84]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100012dd
mov ecx, dword [esi + 4]
lea eax, [esp + 0x80]
push 1
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edi, 1
call fcn.10001300
mov ax, di
pop edi
pop esi
pop ebx
add esp, 0x64
ret 0x14
push esi
call fcn.10001560
add esp, 4
mov edi, 0xfffffffb
call fcn.10001300
mov ax, di
pop edi
pop esi
pop ebx
add esp, 0x64
ret 0x14

Function at 0x10001310
Capabilities:
Check mutex on windows

Disassembly:
push str.HID_MUTEX
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xbb8
push eax
mov dword [0x10006370], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
setne al
ret
Function at 0x10002b13
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10006138
cmp edx, dword [eax]
je 0x10002b35
add eax, 8
inc ecx
cmp eax, 0x100061c8
jl 0x10002b26
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10006138]
jne 0x10002c63
mov eax, dword [0x10006380]
cmp eax, 1
je 0x10002c3d
test eax, eax
jne 0x10002b66
cmp dword [0x10006384], 1
je 0x10002c3d
cmp edx, 0xfc
je 0x10002c63
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10002b9d
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.10003040
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10003130
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10002be0
lea eax, [ebp - 0x1a4]
push eax
call fcn.10003130
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x100053cc
push edi
call fcn.10003960
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.10003040
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10003050
lea eax, [ebp - 0xa0]
push 0x100053ac
push eax
call fcn.10003050
push dword [esi + 0x1000613c]
lea eax, [ebp - 0xa0]
push eax
call fcn.10003050
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.100038d5
add esp, 0x2c
pop edi
jmp 0x10002c63
lea eax, [ebp + 8]
lea esi, [esi + 0x1000613c]
push 0
push eax
push dword [esi]
call fcn.10003130
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
sub esp, 0x64
push esi
mov esi, dword [esp + 0x70]
push 0x40b098
push esi
call fcn.00401e9e
add esp, 8
test eax, eax
jne 0x40104b
push eax
call fcn.00401df0
push esi
lea eax, [esp + 0xc]
push 0x40b07c
push eax
call fcn.00401d9e
mov ecx, dword [0x40c328]
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.00401d50
add esp, 0x18
push 1
call fcn.00401c5d
pop esi
add esp, 0x64
ret

Function at 0x401050
Capabilities:
Terminate process

Disassembly:
sub esp, 0x64
push esi
mov esi, dword [esp + 0x70]
push 0x40b09c
push esi
call fcn.00401e9e
add esp, 8
test eax, eax
jne 0x40109b
push eax
call fcn.00401df0
push esi
lea eax, [esp + 0xc]
push 0x40b07c
push eax
call fcn.00401d9e
mov ecx, dword [0x40c328]
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.00401d50
add esp, 0x18
push 1
call fcn.00401c5d
pop esi
add esp, 0x64
ret

Function at 0x401170
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x40c544]
sub esp, 0x194
push esi
push edi
push 0x40b068
push eax
xor esi, esi
call fcn.00401000
add esp, 8
mov dword [0x40c544], eax
test eax, eax
jne 0x40119d
push 1
call fcn.00401c5d
mov ecx, dword [0x40c4c4]
lea edx, [esp + 8]
push ecx
push 0x64
push edx
mov edi, 1
mov dword [0x40bf88], 0
call fcn.00401eb1
add esp, 0xc
test eax, eax
je 0x40129c
lea eax, [esp + 8]
lea ecx, [esp + 0xd4]
push eax
push 0x40b0d0
push ecx
call fcn.00401d9e
push 0x40b0c8
push edi
push 0x40b0c0
lea edx, [esp + 0x88]
push 0x40b0b8
push edx
call fcn.00401d9e
lea eax, [esp + 0x90]
lea ecx, [esp + 0x28]
push eax
push 0x40b0a0
push ecx
call fcn.00401d9e
mov edx, dword [0x40c544]
lea eax, [esp + 0x34]
push edx
push eax
call fcn.00401d50
mov ecx, dword [0x40bf88]
inc ecx
mov dword [0x40bf88], ecx
lea ecx, [esp + 0xa4]
push ecx
push esi
call fcn.00401000
mov esi, eax
add esp, 0x3c
test esi, esi
je 0x4012b7
lea edx, [esp + 0xd4]
lea eax, [esp + 0x138]
push edx
push 0x40b0ac
push 0x40b0a4
push eax
call fcn.00401d9e
lea ecx, [esp + 0x148]
push esi
push ecx
call fcn.00401d50
push esi
call fcn.00401df0
mov edx, dword [0x40c4c4]
lea eax, [esp + 0x24]
push edx
push 0x64
push eax
inc edi
call fcn.00401eb1
add esp, 0x28
test eax, eax
jne 0x4011ca
mov ecx, dword [0x40c544]
push ecx
call fcn.00401df0
add esp, 4
lea eax, [edi - 1]
pop edi
pop esi
add esp, 0x194
ret
push 1
call fcn.00401c5d
nop
nop
Function at 0x4014a0
Capabilities:
Delete file
Terminate process

Disassembly:
mov eax, dword [0x40c544]
sub esp, 0xc8
push esi
push 0x40b068
push eax
or esi, 0xffffffff
call fcn.00401050
add esp, 8
mov dword [0x40c544], eax
test eax, eax
jne 0x4014cd
push 1
call fcn.00401c5d
mov ecx, dword [0x40bf88]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
xor edi, edi
test ecx, ecx
jle 0x401515
lea ecx, [esp + 0x70]
push ecx
push 0x40b0d0
push eax
call fcn.00402a7a
add esp, 0xc
test eax, eax
je 0x401506
lea edx, [esp + 0x70]
push edx
call ebx
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, dword [0x40bf88]
inc edi
cmp edi, eax
mov eax, dword [0x40c544]
jl 0x4014e1
push eax
call fcn.00401df0
add esp, 4
test esi, esi
jne 0x40158b
push 0x40b068
call ebx
test eax, eax
jne 0x401566
push 0x40b068
lea eax, [esp + 0x10]
push 0x40b18c
push eax
mov esi, 1
call fcn.00401d9e
mov ecx, dword [0x40c328]
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.00401d50
add esp, 0x14
mov eax, esi
pop edi
pop ebx
pop esi
add esp, 0xc8
ret
lea eax, [esp + 0xc]
push 0x40b164
push eax
xor esi, esi
call fcn.00401d9e
mov ecx, dword [0x40c328]
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.00401d50
add esp, 0x10
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 0xc8
ret

Function at 0x4015a0
Capabilities:
Delete file
Terminate process

Disassembly:
mov eax, dword [0x40c4c4]
sub esp, 0xc8
push esi
push 0x40b048
push eax
or esi, 0xffffffff
call fcn.00401050
add esp, 8
mov dword [0x40c4c4], eax
test eax, eax
jne 0x4015cd
push 1
call fcn.00401c5d
mov ecx, dword [0x40bf88]
push edi
xor edi, edi
test ecx, ecx
jle 0x401616
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0xc]
push ecx
push 0x40b0d0
push eax
call fcn.00402a7a
add esp, 0xc
test eax, eax
je 0x401606
lea edx, [esp + 0xc]
push edx
call ebx
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, dword [0x40bf88]
inc edi
cmp edi, eax
mov eax, dword [0x40c4c4]
jl 0x4015e1
pop ebx
push eax
call fcn.00401df0
add esp, 4
test esi, esi
pop edi
jne 0x401647
lea eax, [esp + 0x68]
push 0x40b1a8
push eax
call fcn.00401d9e
mov ecx, dword [0x40c328]
lea edx, [esp + 0x70]
push ecx
push edx
call fcn.00401d50
add esp, 0x10
mov eax, esi
pop esi
add esp, 0xc8
ret
Function at 0x401820
Capabilities:
Delete file
Terminate process

Disassembly:
mov eax, dword [0x40c328]
sub esp, 0x64
mov dword [0x40bf88], 0
push 0x40b058
push eax
call fcn.00401000
add esp, 8
mov dword [0x40c328], eax
test eax, eax
jne 0x401850
push 1
call fcn.00401c5d
push esi
push 0x40b2a4
push 0x40b058
lea ecx, [esp + 0xc]
push 0x40b298
push ecx
call fcn.00401d9e
mov edx, dword [0x40c328]
lea eax, [esp + 0x14]
push edx
push eax
call fcn.00401d50
mov esi, dword [esp + 0x84]
add esp, 0x18
cmp esi, 1
jle 0x401919
push edi
mov edi, dword [esp + 0x74]
mov ecx, dword [edi + 4]
push ecx
push 0x40b0d0
push 0x40c480
call fcn.00401d9e
push 0x40c480
lea edx, [esp + 0x18]
push 0x40b288
push edx
call fcn.00401d9e
mov eax, dword [0x40c328]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.00401d50
add esp, 0x20
cmp esi, 2
jle 0x40190d
mov edx, dword [edi + 8]
push edx
push 0x40b0d0
push 0x40c4a0
call fcn.00401d9e
push 0x40c4a0
lea eax, [esp + 0x18]
push 0x40b278
push eax
call fcn.00401d9e
mov ecx, dword [0x40c328]
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.00401d50
add esp, 0x20
push esi
call fcn.00401660
add esp, 4
pop edi
jmp 0x401941
push 0x40b250
lea eax, [esp + 8]
push 0x40b0a0
push eax
call fcn.00401d9e
mov ecx, dword [0x40c328]
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.00401d50
add esp, 0x14
mov eax, dword [0x40c4c4]
push 0x40b048
push eax
call fcn.00401000
add esp, 8
mov dword [0x40c4c4], eax
test eax, eax
pop esi
jne 0x401965
push 1
call fcn.00401c5d
call fcn.004010a0
test eax, eax
jne 0x4019b2
mov ecx, dword [0x40c4c4]
push ecx
call fcn.00401df0
push 0x40b074
push 0x40b228
lea edx, [esp + 0xc]
push 0x40b220
push edx
call fcn.00401d9e
mov eax, dword [0x40c328]
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00401d50
add esp, 0x1c
call fcn.00401340
push 1
call fcn.00401c5d
call fcn.00401100
mov edx, dword [0x40c4c4]
push edx
call fcn.00401df0
mov eax, dword [0x40c4c4]
push 0x40b048
push eax
call fcn.00401050
add esp, 0xc
mov dword [0x40c4c4], eax
test eax, eax
jne 0x4019e6
push 1
call fcn.00401c5d
call fcn.00401170
cmp eax, 1
jge 0x4019f7
push 1
call fcn.00401c5d
mov ecx, dword [0x40c4c4]
push ecx
call fcn.00401df0
add esp, 4
call fcn.00401340
test eax, eax
je 0x401a16
push 1
call fcn.00401c5d
call fcn.004013c0
test eax, eax
je 0x401a26
push 1
call fcn.00401c5d
call fcn.004014a0
test eax, eax
je 0x401a36
push 1
call fcn.00401c5d
cmp dword [0x40bf80], 1
jne 0x401a4f
call fcn.004015a0
test eax, eax
je 0x401a4f
push 1
call fcn.00401c5d
push 0x40b048
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x401a8c
push 0x40b048
lea edx, [esp + 4]
push 0x40b208
push edx
call fcn.00401d9e
mov eax, dword [0x40c328]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.00401d50
add esp, 0x14
push 1
call fcn.00401c5d
push 0x40b1e0
lea edx, [esp + 4]
push 0x40b0a0
push edx
call fcn.00401d9e
mov eax, dword [0x40c328]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.00401d50
mov edx, dword [0x40c328]
push edx
call fcn.00401df0
add esp, 0x18
add esp, 0x64
ret
Function at 0x401ad0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xbc
xor eax, eax
push esi
mov dword [esp + 8], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], eax
push edi
mov dword [esp + 0x14], eax
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
mov dx, word [esp + 0xd0]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0
push 0x200
mov word [esp + 0x60], dx
mov edx, dword [esp + 0xdc]
push 0
push 0
push 0
push edx
push 0
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x70], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
test esi, esi
jne 0x401b89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [esp + 0x60]
push esi
push 0x40b2dc
push eax
call fcn.00401d9e
lea ecx, [esp + 0x6c]
push ecx
call fcn.00402d1b
add esp, 0x10
test esi, esi
je 0x401c23
or esi, 0xffffffff
pop edi
mov eax, esi
pop esi
add esp, 0xbc
ret
mov eax, dword [esp + 0xcc]
test eax, eax
jne 0x401bbd
push 0
lea edx, [esp + 0x64]
push 0x40b2d0
push edx
call fcn.00401d9e
lea eax, [esp + 0x6c]
push eax
call fcn.00402d1b
add esp, 0x10
mov eax, esi
pop edi
pop esi
add esp, 0xbc
ret
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401bf5
mov esi, dword [esp + 8]
cmp esi, 0x103
jne 0x401c23
mov eax, esi
pop edi
pop esi
add esp, 0xbc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [esp + 0x60]
push esi
push 0x40b2b8
push ecx
call fcn.00401d9e
lea edx, [esp + 0x6c]
push edx
call fcn.00402d1b
add esp, 0x10
test esi, esi
je 0x401c23
mov esi, 0xfffffffd
mov eax, esi
pop edi
pop esi
add esp, 0xbc
ret
Function at 0x406545
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40bbb0
cmp edx, dword [eax]
je 0x406567
add eax, 8
inc ecx
cmp eax, 0x40bc40
jl 0x406558
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40bbb0]
jne 0x406695
mov eax, dword [0x40bff0]
cmp eax, 1
je 0x40666f
test eax, eax
jne 0x406598
cmp dword [0x40b3a8], 1
je 0x40666f
cmp edx, 0xfc
je 0x406695
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4065cf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404060
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403120
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x406612
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403120
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40a5fc
push edi
call fcn.00408180
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404060
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404070
lea eax, [ebp - 0xa0]
push 0x40a5dc
push eax
call fcn.00404070
push dword [esi + 0x40bbb4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404070
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00408cfc
add esp, 0x2c
pop edi
jmp 0x406695
lea eax, [ebp + 8]
lea esi, [esi + 0x40bbb4]
push 0
push eax
push dword [esi]
call fcn.00403120
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10007660
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37c8
call fcn.10074f70
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push dword [ecx]
lea eax, [ebp - 0x108]
xor esi, esi
push str..PhysicalDrive_d
push eax
call fcn.10007f30
add esp, 0xc
lea eax, [ebp - 0x108]
push esi
push esi
push 3
push esi
push 3
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10007883
push 0x2710
lea eax, [ebp - 0x37b8]
mov dword [ebp - 0x37bc], esi
push esi
push eax
mov dword [ebp - 0x37c0], esi
mov dword [ebp - 0x37c8], esi
mov dword [ebp - 0x37c4], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x37bc]
push esi
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0xc
lea eax, [ebp - 0x37c8]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10007876
mov edx, dword [ebp - 0x37ac]
lea eax, [ebp - 0x8d8]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.100074d0
mov edx, dword [ebp - 0x37a8]
lea eax, [ebp - 0xcc0]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.100074d0
mov edx, dword [ebp - 0x37a4]
lea eax, [ebp - 0x10a8]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.100074d0
mov edx, dword [ebp - 0x37a0]
lea eax, [ebp - 0x4f0]
push eax
push 1
lea ecx, [ebp - 0x37b8]
call fcn.100074d0
add esp, 0x20
cmp byte [0x100a9460], 0
jne 0x10007839
movsx eax, byte [ebp - 0x4f0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
jne 0x100077b2
movsx eax, byte [ebp - 0x4dd]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
je 0x10007839
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x8d8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100a905f], al
test al, al
jne 0x100077c0
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0xcc0]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100a885f], al
test al, al
jne 0x100077e0
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x4f0]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100a945f], al
test al, al
jne 0x10007800
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x10a8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100a8c5f], al
test al, al
jne 0x10007820
mov esi, 1
push 0x2710
lea eax, [ebp - 0x37b8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x37bc]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0
push 0
push 0x700a0
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x1000787c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10073bc9
mov esp, ebp
pop ebp
ret