joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e7c
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x406ec1
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
je 0x406eb0
cmp eax, dword [ebp + 0x10]
jle 0x406f4a
mov dword [0x50103c], 8
xor eax, eax
jmp 0x406fb5
cmp dword [0x525838], 1
jne 0x406f06
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0x406f4a
xor eax, eax
jmp 0x406fb5
call sub.KERNEL32.dll_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x406f46
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.KERNEL32.dll_GetFullPathNameA
jmp 0x406f4a
xor eax, eax
jmp 0x406fb5
lea edx, [ebp - 0x10c]
push edx
call fcn.00401318
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0x406f6a
mov dword [0x50103c], 0x22
xor eax, eax
jmp 0x406fb5
test edi, edi
jne 0x406f8c
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040c55c
pop ecx
mov edi, eax
test eax, eax
jne 0x406f8c
mov dword [0x50103c], 8
xor eax, eax
jmp 0x406fb5
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406fbc
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test al, al
jne 0x406fd1
xor eax, eax
jmp 0x406fe5
add al, 0x40
mov byte [ebp - 4], al
lea eax, [ebp - 4]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push edx
lea edx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push edx
push ecx
push eax
call sub.KERNEL32.dll_GetDiskFreeSpaceA
dec eax
je 0x407007
mov dword [ebx + 0xc], 0xffffffff
jmp 0x40701e
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov edx, dword [ebp - 8]
mov dword [ebx + 0xc], edx
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 8], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407798
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4077b7
mov eax, dword [0x5000c0]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4077c4
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4077f1
je 0x407803
sub ecx, 0x100
je 0x407811
sub ecx, 0x100
je 0x407818
sub ecx, 0x100
je 0x40780a
jmp 0x40781f
sub ecx, 0x600
je 0x407818
sub ecx, 0x100
je 0x407803
jmp 0x40781f
mov edi, 1
jmp 0x407824
mov edi, 2
jmp 0x407824
mov edi, 4
jmp 0x407824
mov edi, 5
jmp 0x407824
mov edi, 3
test byte [ebp + 0xd], 1
je 0x40784b
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5005cc]
test al, 0x80
je 0x407844
mov ebx, 0x80
jmp 0x40785d
mov ebx, 1
jmp 0x40785d
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40785d
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x40786f
je 0x407878
dec eax
je 0x407881
jmp 0x40788a
mov dword [ebp - 4], 0x80000000
jmp 0x407899
mov dword [ebp - 4], 0x40000000
jmp 0x407899
mov dword [ebp - 4], 0xc0000000
jmp 0x407899
push 1
call fcn.004072f4
pop ecx
mov ebx, eax
jmp 0x407985
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4078b5
sub eax, 0x10
je 0x4078bc
sub eax, 0x10
je 0x4078c5
sub eax, 0x10
je 0x4078ce
jmp 0x4078ce
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4078d5
mov dword [ebp - 8], 1
jmp 0x4078d5
mov dword [ebp - 8], 2
jmp 0x4078d5
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x40793e
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x407933
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x407933
add ebx, 0xffffffb2
push ebx
call fcn.004072f4
pop ecx
mov ebx, eax
jmp 0x407985
mov edi, esi
push edi
call fcn.00407708
pop ecx
test eax, eax
je 0x407952
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x40795e
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00407050
add esp, 8
mov ebx, eax
inc eax
jne 0x407985
push 4
call fcn.004072f4
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c838
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x40cca8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x501060], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40cd60
cmp byte [0x4f1062], 0
je 0x40cd1a
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.0040bc3c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40cd03
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.0040bc3c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40cd03
lea ebx, [ebp - 0x54]
jmp 0x40cd04
inc ebx
call fcn.0040cc60
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x40cd81
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x501064
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00401318
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x501067
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x40cd81
cmp dword [0x501060], 0xffffffff
je 0x40cd81
mov eax, dword [0x501060]
test eax, eax
je 0x40cd81
cmp byte [eax], 0
je 0x40cd81
push esi
push eax
call fcn.0040ce10
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d404
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push esi
call fcn.00401318
pop ecx
inc eax
push eax
call fcn.0040c55c
pop ecx
mov ebx, eax
test eax, eax
jne 0x40d431
mov dword [0x50103c], 8
or eax, 0xffffffff
jmp 0x40d4a9
xor eax, eax
push esi
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0x3d
push ebx
call fcn.0040ba70
add esp, 8
mov esi, eax
test eax, eax
jne 0x40d47b
mov dword [0x50103c], 0x13
push ebx
call fcn.0040c454
pop ecx
or eax, 0xffffffff
jmp 0x40d4a9
mov byte [esi], 0
cmp byte [esi + 1], 0
jne 0x40d488
xor edx, edx
jmp 0x40d48b
lea edx, [esi + 1]
push edx
push ebx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x40d49e
call fcn.00407358
mov esi, eax
jmp 0x40d4a0
xor esi, esi
push ebx
call fcn.0040c454
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40d4e4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x5258c8], 0
jne 0x40d565
cmp dword [0x5258e4], 0
jne 0x40d514
call sub.KERNEL32.dll_GetEnvironmentStrings
mov dword [0x5258e4], eax
test eax, eax
jne 0x40d514
push 0x501188
call fcn.0040cd98
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x5258e4]
jmp 0x40d528
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00401318
pop ecx
mov edi, eax
test eax, eax
jne 0x40d520
lea edi, [ebp + 1]
push edi
call fcn.0040c55c
pop ecx
mov ebx, eax
mov dword [0x5258cc], ebx
test ebx, ebx
jne 0x40d552
xor eax, eax
jmp 0x40d628
push edi
mov edx, dword [0x5258e4]
push edx
push ebx
call fcn.00401128
add esp, 0xc
jmp 0x40d585
xor esi, esi
mov ebx, dword [0x5258c8]
jmp 0x40d57f
push eax
call fcn.00401318
pop ecx
test eax, eax
jne 0x40d57b
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40d56f
lea ebx, [esi + 4]
push 4
mov dword [0x5258d0], ebx
inc ebx
push ebx
call fcn.0040bcb0
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40d5a8
xor eax, eax
jmp 0x40d628
cmp dword [0x5258c8], 0
jne 0x40d5d9
xor esi, esi
mov ebx, dword [0x5258cc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40d5ca
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00401318
pop ecx
mov edi, eax
test eax, eax
jne 0x40d5c0
jmp 0x40d60a
xor esi, esi
mov ebx, dword [0x5258c8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40d604
push eax
call fcn.00401318
pop ecx
test eax, eax
je 0x40d5f9
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40d5fd
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40d5e8
mov eax, dword [0x5258c8]
test eax, eax
je 0x40d61a
push eax
call fcn.0040c454
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x5258c8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40fd04
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
push 0x180
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryA
test eax, eax
jne 0x40fd2a
xor eax, eax
jmp 0x40fe45
push 0x4f11d0
mov edx, dword [ebp + 8]
push edx
call fcn.0040123c
add esp, 8
push 2
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041f620
test eax, eax
jne 0x40fd51
xor eax, eax
jmp 0x40fe45
xor edi, edi
xor eax, eax
mov dword [ebp - 4], eax
mov byte [ebx], 0
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push 0x3e7
push 0
push 0
push 0
lea edx, [edi + 1]
push edx
push ebx
push 0x4f11e1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00464a08
cmp byte [ebx], 0
je 0x40fe2a
test eax, eax
jle 0x40fe2a
inc edi
push 0x50d1f7
push 0x50d0f7
push 0x50cff7
push 0x50cff4
push ebx
call fcn.00405b58
add esp, 0x14
push esi
push edi
mov esi, ebx
mov edi, 0x50d0f7
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x50d1f7
push ebx
call fcn.0040123c
add esp, 8
push ebx
call fcn.00408b88
pop ecx
test esi, esi
jle 0x40fd65
cmp dword [ebp + 0x10], 0
je 0x40fe21
cmp esi, 0x270f
jne 0x40fe21
mov eax, dword [ebp + 0x10]
push eax
push ebx
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x40fe22
mov dword [ebp - 4], 1
xor esi, esi
jmp 0x40fe22
dec esi
test esi, esi
jg 0x40fd65
push 0
call sub.KERNEL32.dll_SetErrorMode
cmp esi, 0x270f
jne 0x40fe43
cmp dword [ebp - 4], 0
jne 0x40fe43
xor eax, eax
jmp 0x40fe45
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x10

Function at 0x413ae8
Capabilities:
Read .ini file

Disassembly:
push 0x4f7dec
push 0x3e7
push 0x504a33
push 0x4f1735
push 0x4f172f
push 0x4f1728
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4f173f
push 0x504a33
call fcn.004014a8
add esp, 8
test eax, eax
je 0x413b43
mov dword [0x4f171c], 1
push 0
push 0x85
push 0x111
mov eax, dword [0x4fd9ec]
push eax
call sub.USER32.dll_PostMessageA
ret
call fcn.004a34d0
ret
Function at 0x419fc4
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x504a33
mov esi, 0x504190
mov edi, 0x4f1b14
mov ebp, 0x5041a4
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [0x504194], eax
push 0x4f7dec
push 0x3e7
push ebx
lea eax, [edi + 0x36]
push eax
lea edx, [edi + 0x2d]
push edx
lea ecx, [edi + 0x26]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [ebx], 0
je 0x41a03b
push 0x4f7dec
push ebx
lea eax, [edi + 0x42]
push eax
lea edx, [edi + 0x3a]
push edx
call fcn.0048326c
push 0x4f7dec
push 0
lea ecx, [edi + 0x4d]
push ecx
lea eax, [edi + 0x46]
push eax
call fcn.0048326c
call fcn.00419b34
xor edx, edx
mov dword [ebp], edx
mov ecx, dword [ebp]
inc dword [ebp]
push ecx
lea eax, [edi + 0x56]
push eax
push 0x504198
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x4f7dec
push 0x3e7
push ebx
lea edx, [edi + 0x63]
push edx
push 0x504198
lea ecx, [edi + 0x5b]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [ebx], 0
je 0x41a099
push ebx
call fcn.0041fbd4
push 1
push ebx
call fcn.0041f620
test eax, eax
je 0x41a045
push ebx
call fcn.00419df8
jmp 0x41a045
cmp dword [0x4f1b08], 0
jne 0x41a0c1
push 0x4f7cec
lea eax, [edi + 0x67]
push eax
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push ebx
call fcn.00419df8
push 0
call fcn.0041a184
xor edx, edx
mov dword [ebp], edx
mov ecx, dword [0x4f1b08]
mov dword [esi], ecx
jmp 0x41a0fe
mov edx, dword [ebp]
cmp edx, dword [0x4f1b0c]
jne 0x41a0e7
mov dword [eax + 0x130], 1
jmp 0x41a0f1
mov eax, dword [esi]
xor ecx, ecx
mov dword [eax + 0x130], ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x14c]
mov dword [esi], edx
inc dword [ebp]
mov eax, dword [esi]
test eax, eax
jne 0x41a0d0
mov edx, dword [0x504194]
push edx
call sub.USER32.dll_SetCursor
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41ae20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push 0x4f7dec
push 0x3e7
push 0x504a33
push 0x4f1c08
mov eax, dword [ebp + 0xc]
push eax
push 0x4f1c01
call sub.KERNEL32.dll_GetPrivateProfileStringA
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], 1
push 0x2c
push 0x504a33
call fcn.00401278
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x41aedd
mov byte [ebx], 0
inc ebx
cmp byte [ebx], 0
je 0x41aeba
push 0x2c
push ebx
call fcn.00401278
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41aeb0
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
inc dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
cmp byte [edx], 0
je 0x41aeb0
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00409a14
pop ecx
mov dword [ebp - 0xc], eax
push ebx
call fcn.00409a14
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x41aec7
mov dword [ebp - 4], 8
cmp dword [ebp - 4], 0x64
jle 0x41af04
sub dword [ebp - 4], 0x64
add dword [ebp - 8], 0x64
cmp dword [ebp - 4], 0x64
jg 0x41aecd
jmp 0x41af04
push esi
push edi
mov esi, 0x4f1c19
mov edi, 0x504a33
mov eax, edi
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
mov dword [ebp - 4], 8
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x14], 0
je 0x41af2e
push 0xffffffffffffffff
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
push 0x504a33
push esi
call fcn.00469584
test eax, eax
jne 0x41af2e
mov eax, edi
jmp 0x41aff8
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
push 0x504a33
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
neg eax
push eax
call sub.GDI32.dll_CreateFontA
mov ebx, eax
test ebx, ebx
je 0x41af8e
test edi, edi
je 0x41af7c
push edi
call sub.GDI32.dll_DeleteObject
push 0
push ebx
push 0x30
push 0x12c
push esi
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x41af90
mov ebx, edi
cmp dword [ebp + 0x14], 0
je 0x41afd0
mov eax, dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
push edx
push 0x504a33
push 0x4f1c28
push 0x50464c
call sub.USER32.dll_wsprintfA
add esp, 0x14
push 0x4f7dec
push 0x50464c
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4f1c32
call fcn.0048326c
push 1
push 0
push 0x12c
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_InvalidateRect
push 0x12c
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_UpdateWindow
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41bb8c
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x4f1c80
push 0
call fcn.004e85bc
mov esi, eax
mov dword [ebx], esi
test esi, esi
je 0x41bce4
mov esi, 0x4f1c8e
mov edi, 0x4f1c84
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edx, dword [ebx]
add edx, 4
mov esi, edx
mov edi, 0x4f1c84
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
mov edx, dword [0x4fd9f0]
mov dword [eax], edx
mov byte [eax + 0x4cc], 9
mov dword [eax + 0x5f4], 2
mov byte [eax + 0x4e9], 1
xor ecx, ecx
mov dword [eax + 0x5fc], ecx
xor edx, edx
mov dword [eax + 0x5e0], edx
xor ecx, ecx
mov dword [eax + 0x5dc], ecx
xor edx, edx
mov dword [eax + 0x5f8], edx
push 0x4f7dec
push 0x3e7
push 0x5120fc
push 0x4f1ca0
add eax, 4
push eax
push 0x4f1c94
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x5120fc], 0
je 0x41bcc2
push 0x2c
push 0x5120fc
call fcn.004015cc
add esp, 8
mov esi, eax
test esi, esi
je 0x41bc91
mov byte [esi], 0
inc esi
cmp byte [esi], 0
je 0x41bc91
push esi
call fcn.00409a14
pop ecx
mov edx, dword [ebx]
mov dword [edx + 0x5f4], eax
mov edx, dword [ebx]
mov eax, dword [edx + 0x5f4]
test eax, eax
jl 0x41bc89
cmp eax, 4
jle 0x41bc91
xor ecx, ecx
mov dword [edx + 0x5f4], ecx
push 0x5120fc
call fcn.0041fbd4
push 0x5120fc
mov eax, dword [ebx]
mov edx, dword [eax]
push edx
call fcn.0041cc7c
test eax, eax
je 0x41bcc2
mov ecx, dword [ebx]
push ecx
call fcn.004562a8
mov eax, dword [ebx]
mov edx, dword [eax]
push edx
call sub.USER32.dll_UpdateWindow
jmp 0x41bce4
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x5fc], edx
xor ecx, ecx
mov dword [eax + 0x5e0], ecx
xor edx, edx
mov dword [eax + 0x5dc], edx
xor ecx, ecx
mov dword [eax + 0x5f8], ecx
pop edi
pop esi
pop ebx
ret
Function at 0x41bce8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x505228
mov eax, dword [0x4f1c80]
test eax, eax
je 0x41bd07
cmp eax, ebx
je 0x41bf24
push ebx
call fcn.004e8a54
test eax, eax
je 0x41bf24
cmp byte [ebx + 0x4cc], 1
jne 0x41bd46
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4f1cba
push 0x4f1cb0
push 0x4f1ca4
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x41bddf
cmp byte [ebx + 0x4cc], 2
jne 0x41bf24
cmp byte [ebx + 0x4cd], 3
jne 0x41bd81
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4f1cd1
push 0x4f1cca
push 0x4f1cbe
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x41bddf
cmp byte [ebx + 0x4cd], 4
jne 0x41bdaf
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4f1ce8
push 0x4f1ce1
push 0x4f1cd5
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x41bddf
cmp byte [ebx + 0x4cd], 1
jne 0x41bf24
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4f1d00
push 0x4f1cf8
push 0x4f1cec
call sub.KERNEL32.dll_GetPrivateProfileStringA
xor edx, edx
mov dword [0x50522c], edx
push 0x2c
push 0x515718
call fcn.004015cc
add esp, 8
mov ebx, eax
mov dword [0x505224], ebx
test ebx, ebx
je 0x41be38
mov byte [ebx], 0
inc dword [0x505224]
mov ebx, dword [0x505224]
cmp byte [ebx], 0
je 0x41be38
push ebx
call fcn.00409a14
pop ecx
mov dword [0x50522c], eax
mov eax, dword [0x50522c]
test eax, eax
jl 0x41be30
cmp eax, 5
jle 0x41be38
xor edx, edx
mov dword [0x50522c], edx
mov ebx, dword [0x4fd9e4]
test ebx, ebx
je 0x41bf24
push 0
mov eax, dword [ebx]
push eax
call sub.USER32.dll_GetSystemMenu
mov esi, eax
mov dword [edi], esi
test esi, esi
je 0x41bf16
push 0
push 0x64
push 0x515aff
push 0xaf
push esi
call sub.USER32.dll_GetMenuStringA
test eax, eax
jle 0x41bf16
cmp byte [0x515718], 0
je 0x41beed
cmp dword [ebx + 0x5f8], 0
jne 0x41be9b
push 0
push 0xaf
mov eax, dword [edi]
push eax
call sub.USER32.dll_CheckMenuItem
jmp 0x41bf16
push 0x515718
call fcn.0041fbd4
mov edx, dword [ebx + 0x5f8]
push edx
push 0x515718
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x41bedc
mov ecx, dword [ebx + 0x5f4]
cmp ecx, dword [0x50522c]
jne 0x41bedc
push 8
push 0xaf
mov eax, dword [edi]
push eax
call sub.USER32.dll_CheckMenuItem
jmp 0x41bf16
push 0
push 0xaf
mov edx, dword [edi]
push edx
call sub.USER32.dll_CheckMenuItem
jmp 0x41bf16
cmp dword [ebx + 0x5f8], 0
jne 0x41bf07
push 8
push 0xaf
mov ecx, dword [edi]
push ecx
call sub.USER32.dll_CheckMenuItem
jmp 0x41bf16
push 0
push 0xaf
mov eax, dword [edi]
push eax
call sub.USER32.dll_CheckMenuItem
mov ebx, dword [ebx + 0x828]
test ebx, ebx
jne 0x41be46
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x41f478
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x505474
test ebx, ebx
je 0x41f48f
cmp byte [ebx], 0
jne 0x41f499
mov eax, 1
jmp 0x41f618
push 0x2e
push ebx
call fcn.00401278
add esp, 8
mov esi, eax
mov dword [edi], esi
test esi, esi
je 0x41f4af
mov byte [esi], 0
push 0x4f1f1c
push ebx
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x41f4d4
mov eax, dword [edi]
test eax, eax
je 0x41f4ca
mov byte [eax], 0x2e
mov eax, 1
jmp 0x41f618
push 0x505450
push ebx
call fcn.004073dc
add esp, 8
test eax, eax
jne 0x41f522
movsx edx, word [0x505454]
sub edx, 0x1000
je 0x41f50f
sub edx, 0x1000
je 0x41f50f
sub edx, 0x1000
je 0x41f50f
sub edx, 0xc000
je 0x41f50f
jmp 0x41f522
mov eax, dword [edi]
test eax, eax
je 0x41f518
mov byte [eax], 0x2e
mov eax, 1
jmp 0x41f618
push 0xa
push 0x50547c
push ebx
call sub.KERNEL32.dll_QueryDosDeviceA
test eax, eax
je 0x41f546
mov eax, dword [edi]
test eax, eax
je 0x41f53c
mov byte [eax], 0x2e
mov eax, 1
jmp 0x41f618
push pe_nt_image_headers32
push 0
push 0
push ebx
call fcn.00406b7c
add esp, 0x10
mov esi, eax
mov dword [0x505478], esi
test esi, esi
jge 0x41f574
mov eax, dword [edi]
test eax, eax
je 0x41f56d
mov byte [eax], 0x2e
xor eax, eax
jmp 0x41f618
mov edx, dword [0x505478]
push edx
call fcn.00405260
pop ecx
test eax, eax
je 0x41f5a2
mov eax, dword [edi]
test eax, eax
je 0x41f58e
mov byte [eax], 0x2e
mov edx, dword [0x505478]
push edx
call fcn.0040471c
pop ecx
mov eax, 1
jmp 0x41f618
push 0x505450
mov edx, dword [0x505478]
push edx
call fcn.00406d00
add esp, 8
test eax, eax
jne 0x41f600
movsx ecx, word [0x505454]
sub ecx, 0x1000
je 0x41f5e3
sub ecx, 0x1000
je 0x41f5e3
sub ecx, 0x1000
je 0x41f5e3
sub ecx, 0xc000
je 0x41f5e3
jmp 0x41f600
mov eax, dword [edi]
test eax, eax
je 0x41f5ec
mov byte [eax], 0x2e
mov edx, dword [0x505478]
push edx
call fcn.0040471c
pop ecx
mov eax, 1
jmp 0x41f618
mov eax, dword [edi]
test eax, eax
je 0x41f609
mov byte [eax], 0x2e
mov edx, dword [0x505478]
push edx
call fcn.0040471c
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4