joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089ed
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b248]
jne 0x4089f7
repz ret
jmp fcn.004100cc

Function at 0x413be1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040eca6
and dword [ebp - 4], 0
cmp dword [0x44ec58], 0
mov ebx, eax
jne 0x413c92
push 0x402da0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413d43
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402d94
push edi
call esi
test eax, eax
je 0x413d43
push eax
call fcn.0040ec34
mov dword [esp], 0x402d84
push edi
mov dword [0x44ec58], eax
call esi
push eax
call fcn.0040ec34
mov dword [esp], 0x402d70
push edi
mov dword [0x44ec5c], eax
call esi
push eax
call fcn.0040ec34
mov dword [esp], 0x402d54
push edi
mov dword [0x44ec60], eax
call esi
push eax
call fcn.0040ec34
pop ecx
mov dword [0x44ec68], eax
test eax, eax
je 0x413c92
push 0x402d3c
push edi
call esi
push eax
call fcn.0040ec34
pop ecx
mov dword [0x44ec64], eax
mov eax, dword [0x44ec64]
cmp eax, ebx
je 0x413cea
cmp dword [0x44ec68], ebx
je 0x413cea
push eax
call fcn.0040ecaf
push dword [0x44ec68]
mov esi, eax
call fcn.0040ecaf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413cea
test edi, edi
je 0x413cea
call esi
test eax, eax
je 0x413ce1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413ce1
test byte [ebp - 0xc], 1
jne 0x413cea
or dword [ebp + 0x10], 0x200000
jmp 0x413d23
mov eax, dword [0x44ec5c]
cmp eax, ebx
je 0x413d23
push eax
call fcn.0040ecaf
pop ecx
test eax, eax
je 0x413d23
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413d23
mov eax, dword [0x44ec60]
cmp eax, ebx
je 0x413d23
push eax
call fcn.0040ecaf
pop ecx
test eax, eax
je 0x413d23
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44ec58]
call fcn.0040ecaf
pop ecx
test eax, eax
je 0x413d43
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413d45
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401059
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4010a6
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.0040565d
lea eax, [ebp - 0x404]
push eax
call section..text
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401a85
leave
ret
Function at 0x4013d3
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
mov eax, dword [0x410004]
xor eax, esp
mov dword [esp + 0xd8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push 0x70
lea eax, [esp + 0x78]
push eax
push 9
push ebx
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x401428
cmp dword [esp + 0x10], 0x70
jne 0x401428
xor eax, eax
inc eax
jmp 0x40142a
xor eax, eax
push str.Job_information_querying_failed
push eax
call fcn.00401059
or dword [esp + 0x88], 0x3000
pop ecx
pop ecx
push 0x70
lea eax, [esp + 0x74]
push eax
push 9
push ebx
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
push str.Job_information_setting_failed
push eax
call fcn.00401059
push 0x44
pop esi
push esi
lea eax, [esp + 0x34]
push edi
push eax
call fcn.004062b0
add esp, 0x14
mov dword [esp + 0x28], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call esi
push eax
lea eax, [esp + 0x64]
call fcn.0040137b
mov dword [esp], str.stdin_duplication_failed
push eax
call fcn.00401059
pop ecx
pop ecx
push 0xfffffffffffffff5
call esi
push eax
lea eax, [esp + 0x68]
call fcn.0040137b
mov dword [esp], str.stdout_duplication_failed
push eax
call fcn.00401059
pop ecx
pop ecx
push 0xfffffffffffffff4
call esi
push eax
lea eax, [esp + 0x6c]
call fcn.0040137b
mov dword [esp], str.stderr_duplication_failed
push eax
call fcn.00401059
pop ecx
pop ecx
push 1
push 0x4013b3
mov dword [esp + 0x5c], 0x100
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push dword [esp + 0x34]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [esp + 0x14]
push str.Unable_to_create_process_using__ls
push eax
call fcn.00401059
mov eax, dword [esp + 0x2c]
add esp, 0xc
push dword [esp + 0x18]
mov dword [0x412570], eax
push ebx
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push str.Failed_to_get_exit_code_of_process
push eax
call fcn.00401059
pop ecx
pop ecx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401a85
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401a8f
repz ret
jmp fcn.00402f67

Function at 0x4083ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403fd3
and dword [ebp - 0x14], 0
cmp dword [0x411b38], 0
mov dword [ebp - 0x18], eax
jne 0x40845e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408506
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408506
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411b38], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x411b3c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x411b40], eax
call edi
push eax
call esi
mov dword [0x411b48], eax
test eax, eax
je 0x40845e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411b44], eax
mov eax, dword [0x411b44]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4084b7
cmp dword [0x411b48], ecx
je 0x4084b7
push eax
call esi
push dword [0x411b48]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4084b7
test ebx, ebx
je 0x4084b7
call edi
test eax, eax
je 0x4084ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4084ae
test byte [ebp - 8], 1
jne 0x4084b7
or dword [ebp + 0x10], 0x200000
jmp 0x4084ea
mov eax, dword [0x411b3c]
cmp eax, dword [ebp - 0x18]
je 0x4084ea
push eax
call esi
test eax, eax
je 0x4084ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4084ea
mov eax, dword [0x411b40]
cmp eax, dword [ebp - 0x18]
je 0x4084ea
push eax
call esi
test eax, eax
je 0x4084ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411b38]
call esi
test eax, eax
je 0x408506
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408508
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a85
leave
ret
Function at 0x4090f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
mov edx, ecx
push ebx
push esi
push edi
je 0x40910a
cmp dword [edx + 4], 0xffffffff
mov ebx, 1
jne 0x40910c
xor ebx, ebx
mov esi, dword [edx + 0xc]
test ebx, ebx
je 0x409179
test esi, esi
je 0x409179
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x409179
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x409179
mov eax, dword [eax + esi + 0x98]
test eax, eax
je 0x409179
lea edi, [eax + esi]
test edi, edi
je 0x409179
lea eax, [edi + 8]
test eax, eax
je 0x409179
cmp byte [eax], 0x30
lea ecx, [eax + 1]
jne 0x409179
mov al, byte [ecx]
inc ecx
mov dword [ebp - 4], ecx
cmp al, 0x82
jne 0x409179
mov eax, dword [ebp - 4]
movzx ecx, byte [ecx]
shl ecx, 8
movzx eax, byte [eax + 1]
add eax, 0x13
add eax, ecx
and eax, 0xffffff8
je 0x409179
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], edi
jmp 0x409181
mov edi, dword [edx + 0x18]
xor ebx, ebx
mov eax, dword [edx + 0x14]
add edi, eax
test ebx, ebx
je 0x409204
mov eax, dword [edx + 0x10]
add eax, esi
cmp edi, eax
jae 0x409204
xor ebx, ebx
cmp dword [edi], 0x74636159
sete bl
test ebx, ebx
je 0x4091f9
movzx ecx, byte [edi + 4]
mov eax, 0x100
imul ecx, eax
movzx eax, byte [edi + 5]
inc ax
add cx, ax
mov eax, dword [ebp + 8]
movzx ecx, cx
mov esi, ecx
mov eax, dword [eax]
test eax, eax
jne 0x4091d9
mov eax, dword [ebp + 0xc]
push esi
mov dword [eax], esi
call fcn.00410b36
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [ecx], eax
test eax, eax
je 0x4091f9
push esi
push 0
push eax
call fcn.00412cb0
push esi
lea eax, [edi + 6]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00412730
add esp, 0x18
mov ebx, 1
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403e50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x4920c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0
mov byte [ebp - 0x815], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
je 0x403f0a
push str.dism.exe
call fcn.00404620
test al, al
je 0x403f0a
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
jb 0x403eaa
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x808]
push str._sdism.exe
push eax
call fcn.00409760
add esp, 0xc
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x403f0a
push ebx
call fcn.00451565
mov edi, eax
add esp, 4
test edi, edi
je 0x403f0a
push edi
push ebx
push dword [ebp - 0x80c]
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x403f1d
push edi
call fcn.0045152d
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044fdac
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x814]
push eax
push 0x46b810
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x403f64
mov ecx, dword [ebp - 0x814]
mov byte [ebp - 0x815], 1
movzx eax, word [ecx + 0xa]
mov dword [esi + 0x50], eax
movzx eax, word [ecx + 8]
mov dword [esi + 0x54], eax
movzx eax, word [ecx + 0xe]
mov dword [esi + 0x58], eax
movzx eax, word [ecx + 0xc]
mov dword [esi + 0x5c], eax
push edi
call fcn.0045152d
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x815]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0044fdac
mov esp, ebp
pop ebp
ret
Function at 0x40a480
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462e48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4920c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
mov ecx, dword [ebx + 4]
sub ecx, dword [ebx]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
test esi, esi
je 0x40a51d
cmp word [esi], 0
jne 0x40a4eb
xor ecx, ecx
jmp 0x40a4ff
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a4f0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.004023a0
cmp byte [ebx + 0xe], 0
je 0x40a51d
movzx eax, word [ebx + 0xc]
push eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0044da60
test edi, edi
jle 0x40a559
xor esi, esi
mov eax, dword [ebx]
push 0xffffffffffffffff
push 0
add eax, esi
push eax
lea ecx, [ebp - 0x2c]
call fcn.00409650
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 0x5c
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0044da60
add esi, 0x18
dec edi
jne 0x40a523
cmp dword [ebp - 0x18], 8
jb 0x40a56a
push dword [ebp - 0x2c]
call fcn.00450920
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044fdac
mov esp, ebp
pop ebp
ret 4
Function at 0x40d690
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov edx, dword [esi]
test edx, edx
jne 0x40d6a8
mov dword [esi + 4], 6
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push ebx
lea ebx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d6b0
sub eax, ebx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebx
mov dword [esi + 4], eax
pop esi
pop ebp
ret 8

Function at 0x40d6f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp edx, 8
mov edi, ecx
lea esi, [ebp + 0xc]
cmovae esi, eax
cmp dword [edi], 0
jne 0x40d71b
mov dword [edi + 4], 6
jmp 0x40d750
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d720
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp - 4]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp + 0x20]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
pop edi
pop esi
cmp edx, 8
jb 0x40d760
push eax
call fcn.00450920
add esp, 4
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x40dcd0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4920c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 8
push esi
push edi
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x10]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
je 0x40dd0c
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
jmp 0x40dd11
or esi, 0xffffffff
or edi, esi
cmp dword [ebp + 0x1c], 8
jb 0x40dd22
push dword [ebp + 8]
call fcn.00450920
add esp, 4
mov ecx, dword [ebp - 4]
mov edx, edi
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044fdac
mov esp, ebp
pop ebp
ret
Function at 0x40de60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x4920c0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
lea eax, [esi + 0x10]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
cmp dword [eax + 0x14], 8
push edi
mov dword [ebp - 0xd8], ebx
mov dword [eax + 0x10], 0
jb 0x40dead
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x28], ecx
mov ecx, ebx
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dec0
sub ecx, edx
sar ecx, 1
je 0x40e0b9
lea eax, [ebp - 0x334]
push eax
push ebx
mov dword [ebp - 0x338], 0
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, 0xffffffff
je 0x40e0b2
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea eax, [ebp - 0xdc]
push eax
push ebx
mov dword [esi + 0x28], 2
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x40e0b9
push edi
call fcn.00451565
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40e0b9
push ebx
push edi
push dword [ebp - 0xdc]
push dword [ebp - 0xd8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x40df63
push ebx
call fcn.0045152d
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044fdac
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x344]
push eax
push 0x46b810
push ebx
call edi
test eax, eax
je 0x40dfa4
mov ecx, dword [ebp - 0x344]
movzx eax, word [ecx + 0xa]
mov dword [esi], eax
movzx eax, word [ecx + 8]
mov dword [esi + 4], eax
movzx eax, word [ecx + 0xe]
mov dword [esi + 8], eax
movzx eax, word [ecx + 0xc]
mov dword [esi + 0xc], eax
cmp byte [ebp + 8], 0
je 0x40e08f
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x338]
push eax
push str.VarFileInfoTranslation
push ebx
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x33c], 0
call edi
test eax, eax
je 0x40e08f
mov eax, dword [ebp - 0xd8]
cdq
and edx, 3
add eax, edx
sar eax, 2
xor edi, edi
test eax, eax
jle 0x40e08f
lea esp, [esp]
mov eax, dword [ebp - 0x338]
lea ecx, [eax + edi*4]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0xd4]
push str.StringFileInfo_04x_04xProductVersion
push eax
call fcn.004097a0
add esp, 0x10
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0xd4]
push eax
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40e08f
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x35c]
push dword [ebp - 0x340]
call fcn.0044d180
push eax
lea ecx, [esi + 0x10]
call fcn.00408ec0
lea ecx, [ebp - 0x35c]
call fcn.00401f20
cmp dword [esi + 0x20], 0
jne 0x40e08f
mov eax, dword [ebp - 0xd8]
cdq
and edx, 3
add eax, edx
inc edi
sar eax, 2
cmp edi, eax
jl 0x40e000
push ebx
call fcn.0045152d
add esp, 4
mov dword [esi + 0x28], 3
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044fdac
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x28], 1
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0044fdac
mov esp, ebp
pop ebp
ret
Function at 0x40e200
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x4920c0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov eax, edx
mov dword [ebp - 0x424], ecx
push edi
xor ecx, ecx
mov dword [ebp - 0x420], eax
mov word [eax], cx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call fcn.00455910
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.00455910
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstVolumeW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40e2b9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Error:_Unable_to_enumerate_volumes___d_
push 0x494648
call fcn.00409980
add esp, 0xc
mov edx, 1
mov ecx, 0x494648
call fcn.0040da30
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044fdac
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e2c2
sub ecx, edx
sar ecx, 1
cmp word [ebp - 0x214], 0x5c
lea eax, [ecx - 1]
jne 0x40e3be
mov edi, dword [sym.imp.KERNEL32.DLL_FindNextVolumeW]
jmp 0x40e2f0
cmp word [ebp - 0x212], 0x5c
jne 0x40e3be
cmp word [ebp - 0x210], 0x3f
jne 0x40e3be
cmp word [ebp - 0x20e], 0x5c
jne 0x40e3be
add eax, eax
lea esi, [ebp - 0x214]
add esi, eax
cmp word [esi], 0x5c
jne 0x40e3be
cmp eax, 0x208
jae 0x40e43e
xor eax, eax
mov word [esi], ax
push 0x104
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceW]
mov ecx, 0x5c
mov word [esi], cx
test eax, eax
je 0x40e430
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x424]
call fcn.0044fe43
add esp, 8
test eax, eax
lea eax, [ebp - 0x214]
je 0x40e417
push 0x104
push eax
push ebx
call edi
test eax, eax
je 0x40e3f2
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e3a0
sub eax, edx
sar eax, 1
dec eax
cmp word [ebp - 0x214], 0x5c
je 0x40e2f0
mov ecx, str.Error:_Bad_volume_path_returned.
mov edx, 1
call fcn.0040da30
mov esi, dword [ebp - 0x420]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindVolumeClose]
cmp word [esi], 0x5c
mov ecx, dword [ebp - 8]
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fdac
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x12
je 0x40e3cd
push eax
push str.Error:_Unable_to_finish_enumerating_volumes___d_
push 0x494648
call fcn.00409980
add esp, 0xc
mov ecx, 0x494648
jmp 0x40e3c3
mov esi, dword [ebp - 0x420]
push 0xffffffffffffffff
push eax
push 0x104
push esi
call fcn.00451bd3
add esp, 0x10
jmp 0x40e3d3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Error:_Unable_to_query_device___d_
jmp 0x40e403
call fcn.0045119a
int3
Function at 0x40e830
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x325c
call fcn.0045db90
mov eax, dword [0x4920c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, edx
push 0
push ebx
mov edi, ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push edi
lea eax, [ebp - 0x3008]
push str._s.
push eax
call fcn.00409950
add esp, 0xc
lea eax, [ebp - 0x3258]
push eax
lea eax, [ebp - 0x3008]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40e98a
jmp 0x40e890
test byte [ebp - 0x3258], 0x10
je 0x40e922
cmp word [ebp - 0x322c], 0x2e
jne 0x40e8cb
mov ax, word [ebp - 0x322a]
test ax, ax
je 0x40e96d
cmp ax, 0x2e
jne 0x40e8cb
cmp word [ebp - 0x3228], 0
je 0x40e96d
lea eax, [ebp - 0x322c]
push eax
push edi
lea eax, [ebp - 0x2008]
push 0x46c04c
push eax
call fcn.00409950
lea eax, [ebp - 0x322c]
push eax
push ebx
lea eax, [ebp - 0x1008]
push 0x46c04c
push eax
call fcn.00409950
add esp, 0x20
lea eax, [ebp - 0x1008]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
lea edx, [ebp - 0x1008]
lea ecx, [ebp - 0x2008]
call fcn.0040e830
jmp 0x40e96d
lea eax, [ebp - 0x322c]
push eax
push edi
lea eax, [ebp - 0x2008]
push 0x46c04c
push eax
call fcn.00409950
lea eax, [ebp - 0x322c]
push eax
push ebx
lea eax, [ebp - 0x1008]
push 0x46c04c
push eax
call fcn.00409950
add esp, 0x20
lea eax, [ebp - 0x1008]
push 0
push eax
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
lea eax, [ebp - 0x3258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x40e890
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fdac
mov esp, ebp
pop ebp
ret