joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414721
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
push dword [esp + 0x10]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41476b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x414747
cmp eax, 2
jne 0x414767
mov eax, dword [esp + 0x10]
call fcn.00414d87
mov edi, eax
test edi, edi
je 0x414767
push edi
call esi
push edi
mov ebx, eax
call fcn.0041f805
pop ecx
cmp ebx, 0xffffffff
jne 0x41476b
xor eax, eax
jmp 0x414776
not bl
movzx eax, bl
shr eax, 4
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x414d1e
Capabilities:
Set file attributes

Disassembly:
push esi
test edi, edi
je 0x414d83
cmp word [edi], 0
je 0x414d83
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 4]
push eax
call fcn.0041f8e2
mov esi, eax
pop ecx
test esi, esi
je 0x414d83
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
call fcn.00414cf1
push dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push esi
call fcn.004148a0
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x414d77
test byte [esp + 0xc], 7
je 0x414d77
push dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call fcn.0041f805
pop ecx
mov eax, ebx
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x415ac0
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x4323d5
call fcn.0042e085
mov esi, ecx
push dword [ebp + 8]
call fcn.004147cc
mov edi, eax
xor ebx, ebx
pop ecx
cmp edi, ebx
jne 0x415ae9
xor eax, eax
call fcn.0042e124
ret 0x10
mov dword [ebp + 8], edi
mov dword [ebp - 4], ebx
cmp dword [esi + 0x5c], 0xffffffff
je 0x415afd
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x20]
cmp dword [ebp + 0x10], ebx
je 0x415b13
push 0xffffffffffffffff
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0041f9ac
add esp, 0x10
push dword [ebp + 0xc]
call fcn.00415b95
test eax, eax
jne 0x415b54
mov eax, dword [esi + 0x7c]
push dword [eax + 0x1c]
mov ecx, dword [ebp + 0xc]
push edi
call fcn.004148a0
pop ecx
pop ecx
test eax, eax
jne 0x415b3d
push edi
call fcn.0041f805
pop ecx
jmp 0x415adf
push dword [ebp + 0xc]
call fcn.00415b95
test eax, eax
jne 0x415b54
push edi
call fcn.0041f805
pop ecx
mov eax, ebx
jmp 0x415ae1
push edi
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
call fcn.004208d6
pop ecx
mov dword [esi + 0x60], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
cmp dword [esi + 0xc], ebx
jne 0x415b90
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push 0x415f0a
push ebx
push ebx
mov dword [ebp + 0xc], ebx
call fcn.00420c40
add esp, 0x18
mov dword [esi + 0xc], eax
xor ebx, ebx
inc ebx
jmp 0x415b49

Function at 0x415b95
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x441050]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x7c]
push dword [ecx + 0x1c]
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.00418627
add esp, 0xc
mov dword [esi + 0x5c], eax
cmp eax, 0xffffffff
je 0x415c09
test edi, edi
je 0x415c09
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x415c09
cmp word [edi + 2], 0x3a
jne 0x415c09
cmp word [edi + 4], 0x5c
jne 0x415c09
mov ax, word [edi]
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esi + 0x88], eax
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [esi + 0x5c], 0xffffffff
setne al
xor ecx, ebp
call fcn.0041f3bc
leave
ret 4
Function at 0x415c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x54], 1
jne 0x415c35
xor eax, eax
jmp 0x415d61
push esi
push edi
call fcn.0041850c
mov edi, dword [ebp + 0xc]
cmp edi, eax
jbe 0x415c81
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
test eax, eax
je 0x415d5d
xor esi, esi
push esi
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp + 0xc], esi
push dword [ebx + 0x5c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x415d5d
sub ebx, 0xffffff80
add dword [ebx], edi
adc dword [ebx + 4], esi
xor eax, eax
inc eax
jmp 0x415d5f
and dword [ebp - 4], 0
lea eax, [ebx + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 8]
lea esi, [ebx + 0x18]
call fcn.0040dabe
test eax, eax
jne 0x415ca7
mov dword [ebx + 0x54], 1
jmp 0x415cc7
push dword [ebx + 0x48]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [ebx + 0x2c]
call fcn.0041850c
cmp esi, eax
jbe 0x415cc3
mov dword [ebp - 4], 1
and dword [ebx + 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edi, [ebx + 0x30]
push edi
call esi
and dword [ebp - 8], 0
mov dword [ebp + 8], 0xbb8
jmp 0x415d3b
cmp dword [ebp + 8], 0
je 0x415d41
cmp dword [ebp - 4], 0
je 0x415cf7
push 0xa
push dword [ebx + 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebx + 0x54], 0
jne 0x415d41
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 4], eax
call fcn.0041850c
cmp dword [ebp - 4], eax
jbe 0x415d34
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 4], 1
cmp dword [ebp - 8], eax
jne 0x415d28
dec dword [ebp + 8]
jmp 0x415d38
mov dword [ebp - 8], eax
mov dword [ebp + 8], 0xbb8
jmp 0x415d38
and dword [ebp - 4], 0
push edi
call esi
cmp dword [ebp - 4], 0
jne 0x415ce0
xor eax, eax
inc eax
cmp dword [ebx + 0x54], eax
je 0x415d5d
cmp dword [ebp + 8], 0
jle 0x415d5d
mov ecx, dword [ebp + 0xc]
sub ebx, 0xffffff80
add dword [ebx], ecx
adc dword [ebx + 4], 0
jmp 0x415d5f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x415dcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
xor ebx, ebx
push edi
mov dword [esi + 0x58], ebx
mov dword [ebp - 0x10], 0x436018
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
cmp eax, ebx
je 0x415e03
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00415423
push dword [esi + 0x60]
call fcn.0041f805
pop ecx
cmp dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], ebx
jne 0x415e20
xor edi, edi
inc edi
lea esi, [ebp - 0x10]
call fcn.00415479
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
call fcn.00415ec0
xor eax, eax
inc eax
mov dword [ebp - 4], eax
cmp dword [esi + 0x54], eax
jne 0x415e33
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0x5c]
mov dword [esi + 0x54], ebx
cmp ecx, 0xffffffff
je 0x415e56
cmp dword [ebp - 4], ebx
je 0x415e4d
lea eax, [esi + 0x64]
push ecx
call fcn.00414f49
pop ecx
push dword [esi + 0x5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x5c], 0xffffffff
push 6
xor eax, eax
pop ecx
lea edi, [esi + 0x64]
mov dword [esi + 0x88], ebx
rep stosd dword es:[edi], eax
cmp dword [ebp + 8], ebx
je 0x415e7d
cmp dword [ebp - 0xc], ebx
je 0x415e7d
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 4]
jmp 0x415e0f

Function at 0x415f1b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 8], 0
push esi
push edi
push 0x8000
call fcn.0041f8e2
pop ecx
mov dword [ebp - 4], eax
lea esi, [ebx + 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
mov edi, dword [ebx + 0x2c]
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x415f66
test eax, eax
jne 0x415f66
mov eax, 0x8000
cmp edi, eax
sbb edi, edi
and edi, 0xffff8000
add edi, eax
jmp 0x415f73
cmp edi, 0x8000
jb 0x415f73
mov edi, 0x8000
test edi, edi
jne 0x415f84
test ecx, ecx
je 0x415f9a
mov dword [ebp - 8], 1
jmp 0x415f9a
push 1
push dword [ebp - 4]
lea esi, [ebx + 0x18]
call fcn.0040db55
push dword [ebx + 0x50]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebx + 0x2c]
lea esi, [ebx + 0x30]
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x415fdc
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 4]
push dword [ebx + 0x5c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x415fca
cmp dword [ebp - 0xc], edi
je 0x415fe7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x54], 1
jmp 0x415fe7
push 2
push dword [ebx + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edi, edi
cmp dword [ebp - 0x10], edi
je 0x416004
cmp dword [ebx + 0x54], edi
jne 0x415ff8
cmp dword [ebp - 0x14], edi
jne 0x416004
push dword [ebx + 0x4c]
mov dword [ebx + 0x14], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 8], edi
je 0x415f38
push dword [ebp - 4]
call fcn.0041f805
pop ecx
pop edi
pop esi
leave
ret
Function at 0x418627
Capabilities:
Delete file
Set file attributes

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
xor eax, eax
push eax
push eax
push 2
push eax
push 5
mov edi, 0x40000000
push edi
push ebp
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4186ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp eax, 5
je 0x418698
cmp eax, 0x7b
je 0x418698
cmp eax, 3
jne 0x4186d9
cmp dword [esp + 0x20], 0
je 0x4186e5
mov eax, ebp
call fcn.00414d87
mov ebp, eax
xor eax, eax
cmp ebp, eax
je 0x4186e5
push eax
push eax
push 2
push eax
push 1
push edi
push ebp
call esi
push ebp
mov ebx, eax
call fcn.0041f805
pop ecx
jmp 0x4186d4
push ebp
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4186d9
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push eax
push eax
push 2
push eax
push 1
push edi
push ebp
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4186ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, 0xffffffff
jne 0x4186ef
cmp dword [esp + 0x10], 0
mov eax, 0xa0000031
je 0x4186e9
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x418910
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x441050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x44]
and dword [edi], 0
cmp dword [esi + 0xc], 0xffffffff
je 0x418935
mov eax, dword [esi]
call dword [eax + 0x28]
push edi
push dword [ebp + 8]
push ebx
call fcn.004186f7
add esp, 0xc
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x41894e
xor eax, eax
jmp 0x4189a2
call fcn.00418f08
push ebx
call fcn.00418ed1
test ebx, ebx
je 0x41899f
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x41899f
cmp word [ebx + 2], 0x3a
jne 0x41899f
cmp word [ebx + 4], 0x5c
jne 0x41899f
mov ax, word [ebx]
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esi + 0x10], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041f3bc
leave
ret 4
Function at 0x418a2d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x418bc6
push edi
mov edi, dword [esi + 0x1c]
sub edi, dword [esi + 0x20]
mov dword [ebp - 4], eax
jns 0x418a57
mov dword [esi + 0x44], 0xa0000047
jmp 0x418b8c
cmp dword [esi + 0x14], 0
jne 0x418a76
mov eax, dword [esi + 0x18]
test eax, eax
je 0x418a76
push eax
call fcn.0041f8e2
pop ecx
mov dword [esi + 0x14], eax
test eax, eax
je 0x418b8c
cmp ebx, edi
ja 0x418aa7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x418aa7
mov ecx, dword [esi + 0x20]
push ebx
add ecx, eax
push ecx
push dword [ebp + 8]
call fcn.004227e0
add dword [esi + 0x20], ebx
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [esi + 0x28], ebx
adc dword [esi + 0x2c], 0
mov dword [eax], ebx
jmp 0x418bc2
mov eax, dword [ebp + 0xc]
and dword [eax], 0
test edi, edi
jle 0x418aea
mov eax, dword [esi + 0x14]
test eax, eax
je 0x418aea
mov ecx, dword [esi + 0x20]
push edi
add ecx, eax
push ecx
push dword [ebp + 8]
call fcn.004227e0
and dword [esi + 0x1c], 0
and dword [esi + 0x20], 0
mov eax, dword [ebp + 0xc]
add dword [eax], edi
mov eax, dword [ebp + 8]
add eax, edi
mov dword [ebp - 4], eax
mov eax, edi
cdq
add esp, 0xc
sub ebx, edi
add dword [esi + 0x28], eax
adc dword [esi + 0x2c], edx
mov eax, dword [esi + 0x18]
cmp ebx, eax
jb 0x418b20
and dword [ebp + 8], 0
push 0
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp - 4]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418b83
mov eax, dword [ebp + 8]
add dword [esi + 0x28], eax
mov ecx, dword [ebp + 0xc]
adc dword [esi + 0x2c], 0
add dword [ecx], eax
jmp 0x418bc2
mov edx, eax
shr edx, 1
lea ecx, [ebx + 0x1000]
cmp ecx, edx
ja 0x418b38
shr eax, 2
mov dword [ebp + 8], edx
cmp ecx, eax
ja 0x418b3b
mov dword [ebp + 8], eax
push 0
mov edi, 0x1000
push edi
push dword [esi + 0x2c]
push dword [esi + 0x28]
call fcn.004284c0
mov ecx, eax
or ecx, edx
je 0x418b64
mov ecx, dword [ebp + 8]
cmp ecx, edi
jbe 0x418b5d
sub ecx, eax
cmp ecx, ebx
jb 0x418b64
mov dword [ebp + 8], ecx
xor eax, eax
push eax
lea edi, [esi + 0x1c]
push edi
push dword [ebp + 8]
mov dword [edi], eax
push dword [esi + 0x14]
mov dword [esi + 0x20], eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x418b90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x44], eax
xor eax, eax
jmp 0x418bc5
mov edi, dword [edi]
test edi, edi
je 0x418bc2
cmp ebx, edi
jb 0x418b9c
mov ebx, edi
test ebx, ebx
je 0x418bc2
mov eax, dword [esi + 0x14]
add eax, dword [esi + 0x20]
push ebx
push eax
push dword [ebp - 4]
call fcn.004227e0
add dword [esi + 0x20], ebx
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [esi + 0x28], ebx
adc dword [esi + 0x2c], 0
add dword [eax], ebx
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 8
Function at 0x418f08
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 1
push 0
push 0
push dword [ebp - 4]
mov edi, eax
call fcn.00428580
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edx
pop edi
leave
ret

Function at 0x418f47
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x40], edi
jne 0x418f59
xor eax, eax
jmp 0x418f80
push ebx
mov ebx, dword [ebp + 0xc]
push edi
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
mov dword [esi + 0x1c], edi
push dword [esi + 0xc]
mov dword [esi + 0x20], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
je 0x418f7f
add dword [esi + 0x28], ebx
adc dword [esi + 0x2c], edi
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x419059
Capabilities:
Get disk information

Disassembly:
push 0x10
mov eax, 0x4323a8
call fcn.0042e0ee
mov eax, dword [ebp + 8]
push eax
mov esi, edx
mov dword [ebp - 0x1c], ecx
call fcn.004147cc
mov edi, eax
pop ecx
test edi, edi
jne 0x419084
xor eax, eax
call fcn.0042e138
ret 8
mov dword [ebp - 0x14], edi
and dword [ebp - 4], 0
cmp dword [esi + 0xc], 0xffffffff
je 0x41909a
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x20]
test ebx, ebx
je 0x4190ad
push 0xffffffffffffffff
push edi
push dword [ebp + 0xc]
push ebx
call fcn.0041f9ac
add esp, 0x10
push dword [ebp - 0x1c]
push edi
call fcn.00419146
test eax, eax
jne 0x4190f5
mov eax, dword [esi + 0x140]
push dword [eax + 0x1c]
mov ecx, dword [ebp - 0x1c]
push edi
call fcn.004148a0
pop ecx
pop ecx
test eax, eax
jne 0x4190db
push edi
call fcn.0041f805
pop ecx
jmp 0x41907a
push dword [ebp - 0x1c]
push edi
call fcn.00419146
test eax, eax
jne 0x4190f5
xor esi, esi
push edi
call fcn.0041f805
pop ecx
mov eax, esi
jmp 0x41907c
push edi
call fcn.004208d6
pop ecx
push edi
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x419141
cmp word [edi + 2], 0x3a
jne 0x419141
cmp word [edi + 4], 0x5c
jne 0x419141
mov ax, word [edi]
push 0x3a
mov word [ebp - 0x18], ax
pop eax
mov word [ebp - 0x16], ax
push 0x5c
pop eax
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esi + 0x38], eax
xor esi, esi
inc esi
jmp 0x4190ea

Function at 0x41916f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x13c]
test eax, eax
jne 0x419180
inc eax
leave
ret
push 0
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [esi + 0x3c]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
cmp ecx, dword [esi + 0x13c]
je 0x4191a3
xor eax, eax
leave
ret
and dword [esi + 0x13c], 0
leave
ret
Function at 0x4191ea
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call fcn.0041916f
mov ebx, dword [ebp + 0xc]
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp + 0xc], eax
cmp eax, edi
je 0x419293
cmp dword [esi + 0x38], 2
jne 0x419293
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 0x30]
push edi
mov edi, 0x400
push edi
push ecx
push eax
call fcn.00428410
push 0
push edi
push edx
push eax
call fcn.00428410
push 0
push 0xa
push edx
push eax
call fcn.00428410
mov dword [ebp - 0xc], eax
xor eax, eax
add ebx, dword [esi + 0x30]
mov dword [ebp - 8], edx
adc eax, dword [esi + 0x34]
mov dword [esi + 0x30], ebx
xor ebx, ebx
push ebx
push edi
push eax
push dword [esi + 0x30]
mov dword [esi + 0x34], eax
call fcn.00428410
push ebx
push edi
push edx
push eax
call fcn.00428410
push ebx
push 0xa
push edx
push eax
call fcn.00428410
cmp dword [ebp - 0xc], eax
jne 0x419288
cmp dword [ebp - 8], edx
je 0x419299
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x419299
add dword [esi + 0x30], ebx
adc dword [esi + 0x34], edi
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4192a3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
mov dword [ebp - 0x10], 0x436018
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
cmp eax, ebx
je 0x4192d7
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00415423
push dword [esi + 0x10]
call fcn.0041f805
pop ecx
cmp dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], ebx
jne 0x4192f4
xor edi, edi
inc edi
lea esi, [ebp - 0x10]
call fcn.00415479
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
mov dword [ebp - 4], 1
call fcn.0041916f
test eax, eax
jne 0x419307
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0xc]
cmp ecx, 0xffffffff
je 0x419326
lea eax, [esi + 0x14]
push ecx
call fcn.00414f49
pop ecx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0xc], 0xffffffff
push 6
xor eax, eax
pop ecx
lea edi, [esi + 0x14]
mov dword [esi + 0x38], ebx
rep stosd dword es:[edi], eax
cmp dword [ebp + 8], ebx
je 0x419346
cmp dword [ebp - 0xc], ebx
je 0x419346
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 4]
jmp 0x4192e3

Function at 0x419383
Capabilities:
Set file attributes

Disassembly:
push dword [esp + 4]
mov eax, dword [ecx]
call dword [eax + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4
Function at 0x41b2d3
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebx + 0x9c]
push edi
cmp eax, 0xffffffff
je 0x41b33d
cmp eax, 0x40
jbe 0x41b2fa
push esi
lea esi, [ebx + 0x40]
push ebx
call fcn.0041b62f
pop ecx
mov dword [ebx + 0x9c], 0x14
pop esi
mov eax, dword [ebx + 0x9c]
push 0x40
pop ecx
sub ecx, eax
push ecx
add eax, ebx
push 0
push eax
call fcn.00422360
add esp, 0xc
xor eax, eax
xor dword [ebx + eax*4], 0x36363636
inc eax
cmp eax, 0x10
jb 0x41b315
lea eax, [ebx + 0x40]
call fcn.0041b59e
push 0x40
mov edi, eax
mov ecx, ebx
call fcn.0041b5c9
or dword [ebx + 0x9c], 0xffffffff
pop ecx
cmp dword [esp + 0xc], 0
je 0x41b355
push dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
lea edi, [ebx + 0x40]
call fcn.0041b5c9
pop ecx
pop edi
ret

Function at 0x41b357
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x441050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp dword [ebx + 0x9c], 0xffffffff
push esi
push edi
mov dword [ebp - 0x1c], eax
je 0x41b386
push 0
push 0
call fcn.0041b2d3
pop ecx
pop ecx
lea eax, [ebp - 0x18]
lea esi, [ebx + 0x40]
push eax
call fcn.0041b62f
pop ecx
xor eax, eax
xor dword [ebx + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x41b395
mov eax, esi
call fcn.0041b59e
push 0x40
mov edi, esi
mov ecx, ebx
call fcn.0041b5c9
push 0x14
lea ecx, [ebp - 0x18]
call fcn.0041b5c9
lea eax, [ebp - 0x18]
push eax
call fcn.0041b62f
add esp, 0xc
cmp dword [ebp + 0xc], 0
pop edi
pop esi
pop ebx
jbe 0x41b3e5
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call fcn.004227e0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f3bc
leave
ret