joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42332a
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ecx
mov esi, 0x104
mov dword [ebx], 0
mov edx, esi
mov dword [ebx + 4], 0
lea ecx, [ebp - 0x20c]
call fcn.00410820
mov edx, esi
lea eax, [ebp - 0x20c]
cmp word [eax], 0
je 0x42337b
add eax, 2
sub edx, 1
jne 0x42336d
mov eax, edx
neg eax
sbb eax, eax
and eax, 0x7ff8ffa9
add eax, 0x80070057
test edx, edx
je 0x423395
mov ecx, esi
sub ecx, edx
jmp 0x423397
xor ecx, ecx
test eax, eax
js 0x4233e1
lea eax, [ebp - 0x20c]
lea eax, [eax + ecx*2]
sub esi, ecx
je 0x4233d9
add ecx, 0x7ffffefa
mov edx, 0x403584
add ecx, esi
sub edx, eax
lea ecx, [ecx]
test ecx, ecx
je 0x4233d5
movzx edi, word [edx + eax]
test di, di
je 0x4233d5
mov word [eax], di
dec ecx
add eax, 2
sub esi, 1
jne 0x4233ba
jmp 0x4233d9
test esi, esi
jne 0x4233dc
sub eax, 2
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_OpenSemaphoreW]
mov esi, eax
mov dword [ebp - 0x210], esi
test esi, esi
jne 0x423428
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 2
je 0x42346c
mov ecx, dword [ebp + 4]
mov edx, 0xc8
push 0x403580
call fcn.0042301f
mov esi, dword [ebp - 0x210]
mov edi, eax
jmp 0x42346e
lea edx, [ebp - 0x214]
mov dword [ebp - 0x214], 0
mov ecx, esi
call fcn.00422805
mov edi, eax
test edi, edi
jns 0x423460
mov ecx, dword [ebp + 4]
mov edx, 0xce
push edi
push 0x403580
call fcn.0042306c
mov esi, dword [ebp - 0x210]
jmp 0x42346e
mov eax, dword [ebp - 0x214]
cdq
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor edi, edi
test esi, esi
je 0x42348b
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
jne 0x42348b
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0x875
call fcn.004234a6
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ce0
mov esp, ebp
pop ebp
ret 8
Function at 0x423db0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 1
push 0
mov esi, ecx
mov dword [ebp - 0x10], edx
push 0
push esi
mov dword [ebp - 8], esi
mov ebx, 0x42d630
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
mov dword [ebp - 0xc], eax
mov eax, 0x1fff
cmp dword [ebp + 8], eax
jb 0x423de5
mov dword [ebp + 8], eax
push 0x447f30
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_AcquireSRWLockShared]
mov edi, dword [ebp + 0xc]
push 0
push edi
push dword [ebp + 8]
push 0x42d630
push esi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
push 0x447f30
mov esi, eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockShared]
test esi, esi
jne 0x423e1a
xor eax, eax
jmp 0x423e8f
mov edi, dword [edi]
test edi, edi
je 0x423e16
mov ecx, edi
jmp 0x423e60
cmp ecx, 3
jl 0x423e3f
mov al, byte [ebx]
cmp al, 0xa
jne 0x423e35
cmp byte [ebx + 1], 0xd
je 0x423e98
cmp al, 0xd
jne 0x423e3f
cmp byte [ebx + 1], 0xa
je 0x423e98
movzx eax, byte [ebx]
cmp byte [eax + 0x447f40], 0
je 0x423e58
cmp ecx, 1
je 0x423ebb
push 2
sub ecx, 2
pop eax
jmp 0x423e5c
xor eax, eax
dec ecx
inc eax
add ebx, eax
test ecx, ecx
mov dword [ebp - 4], ecx
jg 0x423e24
mov ecx, dword [0x433864]
call fcn.0040f9a9
push dword [ebp + 8]
neg eax
push dword [ebp - 0x10]
sbb eax, eax
push edi
push 0x42d630
neg eax
push eax
push ecx
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov edi, ebx
push eax
push eax
mov byte [ebx + 2], al
sub edi, 0x42d630
mov eax, dword [ebp - 0xc]
add edi, 2
add eax, edi
push eax
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
jmp 0x423e65
push 0x447f30
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_AcquireSRWLockShared]
push 0
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebx + 1]
push eax
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
push 0x447f30
mov esi, eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockShared]
test esi, esi
je 0x423ef8
cmp dword [ebp - 4], 0
je 0x423ef8
inc edi
jmp 0x423e65
mov ecx, dword [ebp + 0xc]
and dword [ecx], 0
jmp 0x423e16

Function at 0x424866
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebx
mov ebx, 0x4023ac
push esi
mov ecx, ebx
call fcn.00412570
mov esi, eax
test esi, esi
jne 0x42488a
pop esi
mov ecx, ebx
mov edx, 0x4026b4
pop ebx
jmp fcn.00412faa
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42488f
sub ecx, edx
sar ecx, 1
push edi
lea ebx, [ecx + 4]
lea ecx, [ebx + ebx]
call fcn.0040f4e0
mov edi, eax
test edi, edi
jne 0x4248b3
inc eax
jmp 0x4248f0
push esi
mov edx, ebx
mov ecx, edi
call fcn.00410820
push 0x402318
mov edx, ebx
mov ecx, edi
call fcn.00410770
push 0x4026b4
mov edx, ebx
mov ecx, edi
call fcn.00410770
mov edx, edi
mov ecx, 0x4023ac
call fcn.00412faa
mov ecx, edi
mov esi, eax
call fcn.0040f480
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x424a93
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov esi, edx
mov ecx, dword [edi + 0x3c]
test ecx, ecx
je 0x424aaf
call fcn.0040ce09
movzx eax, word [eax]
jmp 0x424ab1
mov eax, ebx
test ax, ax
je 0x424abc
cmp ax, 0xa
jne 0x424ae6
mov ecx, dword [edi + 0x3c]
push 0x3b
pop edx
call fcn.004115ed
test eax, eax
je 0x424ae6
mov ecx, 0x402120
test esi, esi
jne 0x424ad9
mov ecx, 0x403374
mov edx, 0x40263c
pop edi
pop esi
pop ebx
jmp fcn.00412faa
mov ecx, dword [edi + 0x3c]
mov edx, 0x402348
push 5
call fcn.0040de50
cmp word [eax], bx
je 0x424b0c
mov ecx, 0x402120
test esi, esi
jne 0x424b08
mov ecx, 0x403374
mov edx, eax
jmp 0x424ade
mov edi, 0x402120
mov eax, 0x403374
mov ecx, edi
test esi, esi
jne 0x424b20
mov ecx, eax
mov edi, eax
call fcn.0040c222
push eax
push edi
push 0x4037dc
call fcn.0040c37c
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x424f3e
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x210], esi
push edi
test edx, edx
jne 0x425045
xor edi, edi
mov ebx, edi
mov dword [ebp - 0x214], edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x425032
cmp word [ebp - 0x20c], 0x2e
jne 0x424ff9
mov ecx, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
call fcn.00425a7a
mov ebx, eax
test ebx, ebx
je 0x42501b
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x424fc4
sub ecx, edx
sar ecx, 1
je 0x424fec
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x4037dc
call fcn.0040c37c
add esp, 0xc
mov esi, eax
mov ecx, ebx
call fcn.0040f480
mov ebx, dword [ebp - 0x214]
cmp dword [0x42d54c], edi
jne 0x42502a
inc ebx
mov dword [ebp - 0x214], ebx
test esi, esi
jne 0x4250cd
mov esi, dword [ebp - 0x210]
jmp 0x424f70
push edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
push eax
call fcn.00414802
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x4250cf
cmp esi, 0x103
jne 0x4250cd
mov esi, edi
jmp 0x4250cd
mov ecx, edx
call fcn.0040ce09
mov ecx, eax
call fcn.0040ce50
mov ebx, eax
test ebx, ebx
je 0x42502a
push 0x20
pop edx
mov ecx, ebx
call fcn.004111d9
test eax, eax
je 0x42506c
xor ecx, ecx
mov word [eax], cx
mov edx, ebx
mov ecx, esi
call fcn.00425a7a
mov edx, eax
mov dword [ebp - 0x210], edx
test edx, edx
je 0x4250a9
mov ecx, edx
xor edi, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x425088
sub ecx, esi
sar ecx, 1
je 0x4250a9
push edx
push ebx
push 0x4037dc
call fcn.0040c37c
mov esi, eax
jmp 0x4250b8
xor esi, esi
push ebx
inc esi
push esi
push 0x400023a3
call fcn.00414802
mov ecx, dword [ebp - 0x210]
add esp, 0xc
call fcn.0040f480
mov ecx, ebx
call fcn.0040f480
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ce0
mov esp, ebp
pop ebp
ret
Function at 0x425967
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov ebx, edi
test ecx, ecx
jne 0x42598b
xor eax, eax
jmp 0x425a69
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push ecx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x425a66
push 0x40
lea edx, [ebp - 0x48]
mov ecx, esi
call fcn.00425b80
test eax, eax
je 0x425a5f
mov eax, 0x5a4d
cmp ax, word [ebp - 0x48]
jne 0x425a5f
push edi
push edi
push dword [ebp - 0xc]
push esi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x425a5f
push 4
lea edx, [ebp - 0x60]
mov ecx, esi
call fcn.00425b80
test eax, eax
je 0x425a5f
cmp dword [ebp - 0x60], 0x4550
jne 0x425a5f
push 0x14
lea edx, [ebp - 0x5c]
mov ecx, esi
call fcn.00425b80
test eax, eax
je 0x425a5f
mov ax, word [ebp - 0x4c]
test ax, ax
je 0x425a5f
movzx eax, ax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x425a5f
movzx eax, word [ebp - 0x4c]
mov edx, edi
push eax
mov ecx, esi
call fcn.00425b80
test eax, eax
je 0x425a4f
mov ecx, dword [ebp - 0x5c]
mov edx, edi
call fcn.00425b53
test eax, eax
je 0x425a4f
movzx ebx, word [eax]
push edi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ax, bx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ce0
mov esp, ebp
pop ebp
ret
Function at 0x425a7a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
push 0x42bec0
call fcn.00417398
mov edi, ecx
mov dword [ebp - 0x2c], edi
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], ebx
test edx, edx
je 0x425aba
cmp word [edx], bx
je 0x425aba
lea eax, [ebp - 0x1c]
push eax
push 1
push ebx
push edx
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x425aba
push eax
jmp 0x425b24
lea eax, [ebp - 0x24]
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 2
jne 0x425ae4
mov ecx, 0x40263c
call fcn.0040ce50
mov esi, eax
mov dword [ebp - 0x20], esi
jmp 0x425b2a
test eax, eax
jne 0x425ab7
mov ecx, dword [ebp - 0x24]
call fcn.0040f4e0
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x425b22
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x425b2a
mov ecx, esi
call fcn.0040f480
xor esi, esi
mov dword [ebp - 0x20], esi
push ebx
jmp 0x425b24
push 8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
call fcn.00425b44
mov eax, esi
call fcn.004173dd
ret
Function at 0x425ca2
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push 0x18
push 0x42bea0
call fcn.00417398
mov ebx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
xor edi, edi
test eax, eax
je 0x425d53
cmp word [eax], di
je 0x425d53
push edi
lea eax, [ebp - 0x20]
push eax
push edi
push 2
push edi
push edi
push edi
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x425d3a
mov edx, dword [ebp + 8]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x425ced
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push edi
push edi
push dword [ebp - 0x20]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
push dword [ebp - 0x20]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
jne 0x425d3a
push dword [ebp + 8]
push ebx
push 0x4037dc
call fcn.0040c37c
add esp, 0xc
jmp 0x425dbc
push edi
push esi
call fcn.00414802
push ebx
push 1
push 0x235d
call fcn.00414802
add esp, 0x14
jmp 0x425dbc
push edi
push edi
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x425dc0
lea eax, [ebp - 0x24]
push eax
push 0x2000000
push edi
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x425d93
cmp esi, 2
je 0x425dbc
push edi
push esi
call fcn.00414802
pop ecx
pop ecx
jmp 0x425dbc
push 0x40263c
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x425db3
push edi
push esi
call fcn.00414802
pop ecx
pop ecx
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
jne 0x425e03
mov dword [ebp - 4], edi
call fcn.004174b8
test al, al
je 0x425dda
push edi
push edi
push edi
push 0x8000000
call dword [sym.imp.ext_ms_win_cmd_util_l1_1_0.dll_DoSHChangeNotify]
mov dword [ebp - 4], 0xfffffffe
jmp 0x425e03
mov eax, esi
call fcn.004173dd
ret 4
Function at 0x4282ce
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
push dword [esi]
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FlushFileBuffers]
mov ecx, dword [esi]
call fcn.0040caaa
push ecx
push ecx
xor edx, edx
mov ecx, edi
call fcn.004061ee
mov ecx, eax
mov dword [esi], ecx
cmp ecx, 0xffffffff
jne 0x42831e
push edi
push 1
push 0x4000271f
call fcn.00414802
xor eax, eax
add esp, 0xc
inc eax
jmp 0x4283b0
mov ebx, dword [ebp + 8]
mov eax, ebx
push 2
push 0
neg eax
push eax
push ecx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
test eax, eax
jne 0x428363
mov ecx, dword [esi]
call fcn.0040caaa
or dword [esi], 0xffffffff
jmp 0x428306
cmp dword [ebp - 4], ebx
jne 0x428357
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.msvcrt.dll_memcmp
mov ecx, dword [esi]
add esp, 0xc
test eax, eax
jne 0x428359
call fcn.0040caaa
push ecx
xor edx, edx
push ecx
inc edx
mov ecx, edi
call fcn.004061ee
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x428306
push 2
push 0
push 0
push eax
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428c15
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
push ecx
push ecx
push 2
mov edi, edx
pop edx
call fcn.004061ee
mov esi, eax
cmp esi, 0xffffffff
jne 0x428c4d
push 0x6e
pop ecx
call fcn.0042961f
xor edx, edx
xor ecx, ecx
inc edx
call fcn.004283b9
mov ebx, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push ebx
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
test eax, eax
je 0x428d07
mov eax, dword [ebp - 4]
mov edx, eax
mov ecx, dword [edi + 0x1c]
mov dword [ebp - 8], edx
test ecx, 0xc000
jne 0x428ca6
cmp eax, 2
jbe 0x428c9d
mov edx, 0xfeff
cmp word [ebx], dx
mov edx, eax
jne 0x428c9d
or ecx, 0x4000
jmp 0x428ca3
or ecx, 0x8000
mov dword [edi + 0x1c], ecx
test eax, eax
je 0x428cd7
mov ecx, dword [edi + 0x1c]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
mov edx, ebx
push eax
mov eax, 0x8002
and ecx, eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
call fcn.004271bf
mov edx, dword [ebp - 8]
mov ecx, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x428cda
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x428c50
test ecx, ecx
jne 0x428cfc
push 1
push ecx
sub eax, edx
push eax
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, esi
mov dword [0x443d00], eax
call fcn.0040caaa
push 0
push dword [0x443d00]
call fcn.00414802
pop ecx
pop ecx
jmp 0x428c43
Function at 0x4291a7
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, 0x104
mov byte [ebp - 0x1c], 1
push eax
xor edi, edi
mov dword [ebp - 0x18], eax
and dword [ebp - 0x20], edi
lea eax, [ebp - 0x228]
push edi
push eax
mov esi, ecx
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x228]
add esp, 0xc
cmp byte [ebp - 0x1c], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040fba0
test eax, eax
js 0x429310
push 0x3d
pop eax
mov word [ebp - 0x10], ax
lea ecx, [ebp - 0x10]
lea eax, [esi + 0x40]
mov word [ebp - 0xe], ax
push 0x3a
pop eax
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 0xa], ax
call fcn.0040c222
mov esi, eax
test esi, esi
je 0x42925d
push esi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_SetCurrentDirectoryW]
test al, al
jne 0x4292f4
push 1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetErrorMode]
mov edi, eax
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x42926a
lea ecx, [ebp - 0x228]
mov ax, word [ebp - 0xe]
mov word [ecx], ax
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x42927e
lea ecx, [ebp - 0x228]
mov ax, word [ebp - 0xc]
mov word [ecx + 2], ax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x429293
lea eax, [ebp - 0x228]
push 0x5c
pop ecx
mov word [eax + 4], cx
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4292a7
lea eax, [ebp - 0x228]
xor ecx, ecx
mov word [eax + 6], cx
mov edx, dword [ebp - 0x20]
test edx, edx
jne 0x4292ba
lea edx, [ebp - 0x228]
lea ecx, [ebp - 0x10]
call fcn.00412faa
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4292cf
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x4292e9
push eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
push eax
call fcn.00414802
pop ecx
pop ecx
test esi, esi
je 0x4292f4
push edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetErrorMode]
mov ecx, dword [0x443cc8]
test ecx, ecx
jne 0x429303
mov ecx, 0x443ac0
mov edx, dword [0x443cd0]
push 0
call fcn.00412c1e
push dword [ebp - 0x20]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00416ce0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x42973c
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x224], 0
mov eax, 0x104
and dword [ebp - 0x18], 0
push ebx
push esi
push eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [ebp - 0x220]
inc ebx
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x14], bl
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x220]
add esp, 0xc
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0xfdc6
add eax, 0x208
push eax
call fcn.0040fba0
test eax, eax
js 0x4297f9
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4297b0
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x224]
push ecx
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFullPathNameW]
test eax, eax
je 0x4297f9
cmp eax, 0xffce
jbe 0x4297f9
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4297da
lea eax, [ebp - 0x220]
xor ecx, ecx
mov word [eax + 6], cx
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4297ed
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetDriveTypeW]
cmp eax, 4
je 0x4297fb
xor ebx, ebx
push dword [ebp - 0x18]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ce0
mov esp, ebp
pop ebp
ret

Function at 0x429871
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push 0xd
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 1
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
xor ecx, ecx
test eax, eax
setns cl
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x429e8a
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x224], eax
mov edi, ecx
call fcn.0040b484
mov ecx, 0x104
xor eax, eax
push ecx
push eax
mov dword [ebp - 0x18], eax
xor ebx, ebx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x10], ecx
inc ebx
push eax
mov byte [ebp - 0x14], bl
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x220]
add esp, 0xc
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040fba0
test eax, eax
js 0x429fda
push esi
lea ecx, [ebp - 0x220]
call fcn.0040fcb9
mov eax, dword [ebp - 0x18]
mov ecx, eax
test eax, eax
jne 0x429f1a
lea ecx, [ebp - 0x220]
xor esi, esi
cmp word [ecx], si
je 0x429f41
cmp word [ecx + 2], 0x3a
jne 0x429f41
cmp word [ecx + 4], si
jne 0x429f41
push 0x402374
lea ecx, [ebp - 0x220]
call fcn.0040fc22
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], esi
test eax, eax
jne 0x429f57
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x238]
push ecx
lea ecx, [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x230]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetDiskFreeSpaceExW]
push 6
pop edx
mov ecx, edi
call fcn.00427811
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x429f8a
lea eax, [ebp - 0x220]
push dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x230]
push eax
push 0xe
call fcn.0042aa2f
mov esi, dword [ebp - 0x18]
test esi, esi
jne 0x429fab
lea esi, [ebp - 0x220]
push dword [ebp - 0x224]
mov ebx, 0x443d10
push 0x403bec
push 0x104
push ebx
call fcn.0040c4ef
push esi
push ebx
push 2
push 0x2379
push edi
call fcn.00427a83
add esp, 0x24
mov ebx, eax
push dword [ebp - 0x18]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ce0
mov esp, ebp
pop ebp
ret 8