joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ff30
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4b78ac]
mov ecx, dword [eax]
test ch, 8
je 0x43ff5d
mov ecx, dword [0x4b78a0]
cmp dword [ecx], 1
ja 0x43ff5d
lea edx, [esp + 4]
push edx
push 6
push 1
push 0x80000038
call fcn.00457690
add esp, 0x10
mov eax, dword [esp + 4]
push eax
call fcn.00440040
mov eax, dword [0x4b506c]
add esp, 4
test eax, eax
je 0x43ff7d
mov ecx, dword [esp + 4]
push ecx
call eax
add esp, 4
call fcn.0043fec0
mov edx, dword [0x4b78ac]
mov eax, dword [edx]
test ah, 8
je 0x43ffaf
mov eax, dword [0x4b78a0]
cmp dword [eax], 1
ja 0x43ffaf
lea ecx, [esp + 4]
push ecx
push 5
push 1
push 0x80000039
call fcn.00457690
add esp, 0x10
mov edx, dword [0x4b7920]
push edx
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
push ecx
mov eax, dword [0x4b78ac]
mov dword [esp], 0
mov ecx, dword [eax]
test ch, 8
je 0x43fff1
mov ecx, dword [0x4b78a0]
cmp dword [ecx], 1
ja 0x43fff1
push 7
push 1
push 0x80000038
call fcn.00457690
add esp, 0xc
cmp dword [0x4b4c60], 3
je 0x440004
push 3
call fcn.00440050
add esp, 4
mov edx, dword [0x4b78ac]
mov eax, dword [edx]
test ah, 8
je 0x440031
mov eax, dword [0x4b78a0]
cmp dword [eax], 1
ja 0x440031
lea ecx, [esp]
push ecx
push 7
push 1
push 0x80000039
call fcn.00457690
add esp, 0x10
mov eax, dword [esp]
pop ecx
ret

Function at 0x443760
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
mov ax, word [0x49c244]
push ebx
push esi
mov esi, dword [esp + 0x118]
mov cl, byte [0x49c246]
push edi
lea edi, [esi + 1]
mov word [esp + 0xc], ax
mov byte [esp + 0xe], cl
mov al, byte [edi]
cmp al, 0x20
je 0x4437ae
mov byte [esp + 0xc], al
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x14]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x4437be
lea edx, [esp + 0x14]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebx, eax
test ebx, ebx
je 0x4437ef
mov cl, byte [esp + 0x15]
lea eax, [esp + 0x14]
cmp cl, 0x3a
jne 0x4437d5
lea eax, [esp + 0x17]
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push eax
call fcn.00452400
add esp, 0x10
mov byte [esi], al
and eax, 0xff
mov byte [eax + esi + 1], 0
xor eax, eax
pop edi
test ebx, ebx
pop esi
pop ebx
sete al
add esp, 0x10c
ret

Function at 0x443800
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [esp + 1], 0x3a
jne 0x443833
mov ecx, dword [esp + 0x108]
mov dl, byte [esp]
xor eax, eax
mov byte [ecx], dl
add esp, 0x104
ret
or eax, 0xffffffff
add esp, 0x104
ret

Function at 0x443860
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x44387e
test al, 1
je 0x44387b
test byte [esp + 8], 2
jne 0x44387e
xor eax, eax
ret
or eax, 0xffffffff
ret
Function at 0x443890
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
sub esp, 0x10c
push esi
mov esi, dword [sym.imp.MSVCRT.dll__errno]
call esi
mov dword [eax], 0
mov eax, dword [esp + 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp eax, 1
jne 0x443931
lea ecx, [esp + 8]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x443931
mov eax, dword [esp + 8]
mov edx, dword [0x49c248]
cmp al, 0x5c
mov dword [esp + 4], edx
je 0x4438e2
cmp al, 0x2f
jne 0x4438f0
cmp al, ah
jne 0x4438f0
xor eax, eax
pop esi
add esp, 0x10c
ret
and eax, 0xff
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov byte [esp + 5], al
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x443931
lea edx, [esp + 4]
push edx
call fcn.00443a40
push eax
call fcn.00443af0
add esp, 8
xor eax, eax
pop esi
add esp, 0x10c
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
mov dword [eax], edi
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret

Function at 0x443a40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 8], ecx
jne 0x443a62
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
lea eax, [ecx + 1]
add eax, 3
and al, 0xfc
call fcn.0048d710
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov ebx, esp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
push ecx
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffA]
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
jne 0x443ab4
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, 0x2715
mov ecx, esi
call fcn.0046f310
mov edi, eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec esi
cmp eax, esi
je 0x443ae6
mov edx, 0x2715
mov ecx, edi
call fcn.0046f450
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x443b10
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ecx
add eax, 4
and al, 0xfc
call fcn.0048d710
mov dl, byte [esi]
mov eax, esp
cmp dl, 0x3d
mov edi, eax
mov ecx, esi
je 0x443b50
test dl, dl
je 0x443b50
mov byte [eax], dl
mov dl, byte [ecx + 1]
inc eax
inc ecx
cmp dl, 0x3d
jne 0x443b40
mov byte [eax], 0
mov dl, byte [ecx]
inc eax
cmp dl, 0x3d
jne 0x443b5c
inc ecx
mov dl, byte [ecx]
test dl, dl
je 0x443b71
mov ebx, eax
mov byte [eax], dl
mov dl, byte [ecx + 1]
inc eax
inc ecx
test dl, dl
jne 0x443b64
mov byte [eax], dl
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x443b99
test ebx, ebx
jne 0x443b99
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x443b99
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x443ce0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, 0x104
call fcn.0048d710
mov eax, dword [ebp + 8]
mov esi, esp
xor ecx, ecx
push 0
mov cl, byte [eax]
push 0xffffffffffffffff
push esi
inc eax
push ecx
push eax
call fcn.00452280
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
neg eax
lea esp, [ebp - 4]
sbb eax, eax
inc eax
pop esi
pop ebp
ret

Function at 0x4440e0
Capabilities:
Identify system language via api
Query environment variable

Disassembly:
sub esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov cx, ax
and eax, 0x3ff
shr cx, 0xa
dec eax
cmp eax, 0x1c
ja case.0x444109.18
xor edx, edx
mov dl, byte [eax + 0x444268]
jmp dword [edx*4 + 0x444220]
sub cx, 2
neg cx
sbb ecx, ecx
and ecx, 0xfffffffc
add ecx, 5
mov esi, ecx
jmp 0x4441a7
sub cx, 3
neg cx
sbb ecx, ecx
and ecx, 5
add ecx, 2
mov esi, ecx
jmp 0x4441a7
mov esi, 3
jmp 0x4441a7
mov esi, 4
jmp 0x4441a7
mov esi, 6
jmp 0x4441a7
mov esi, 8
jmp 0x4441a7
mov esi, 9
jmp 0x4441a7
mov esi, 0xa
jmp 0x4441a7
mov esi, 0xb
jmp 0x4441a7
mov esi, 0xc
jmp 0x4441a7
mov esi, 0xd
jmp 0x4441a7
mov esi, 0xe
jmp 0x4441a7
mov esi, 0x14
jmp 0x4441a7
mov esi, 0x15
jmp 0x4441a7
mov esi, 0x16
jmp 0x4441a7
mov esi, 0x18
jmp 0x4441a7
mov esi, 0x19
jmp 0x4441a7
mov esi, 0xff
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0xc]
push 0xa
push eax
push str.COBLANG
call edi
test eax, eax
je 0x4441e5
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push 0x49c298
push edx
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
test eax, eax
je 0x444217
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret
lea eax, [esp + 0xc]
push 0xa
push eax
push str.LANG
call edi
test eax, eax
je 0x444217
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push 0x49c2a4
push edx
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
test eax, eax
mov eax, dword [esp + 8]
jne 0x444219
mov eax, esi
pop edi
pop esi
add esp, 0x10
ret
Function at 0x444510
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
test ecx, ecx
push edi
mov esi, edx
jne 0x444641
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x444641
cmp dword [eax + 4], 0x24
jne 0x444641
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea eax, [ebx + 2]
add eax, 3
and al, 0xfc
call fcn.0048d710
lea ecx, [ebx + 1]
mov eax, esp
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [ebp - 4], eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
je 0x44457e
mov cl, byte [eax + ebx - 1]
cmp cl, 0x5c
je 0x444587
cmp cl, 0x2f
je 0x444587
mov byte [eax + ebx], 0x5c
mov byte [eax + ebx + 1], 0
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x4445f7
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
cmp eax, 5
mov dword [ecx + 8], edx
mov edx, dword [ebp - 8]
mov dword [ecx + 0xc], edx
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x10], edx
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x14], edx
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x18], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 0x1c], edx
mov edx, 0xd
je 0x4445de
mov edx, 0xf
cmp eax, 4
jne 0x4445e6
or edx, 0x10
mov dword [ecx + 0x20], edx
xor eax, eax
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
je 0x444630
cmp eax, 0x35
je 0x44461f
sub eax, 0x3a
neg eax
sbb eax, eax
and al, 0xfd
add eax, 4
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 5
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 6
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esp, [ebp - 0x28]
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4453b0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push 1
push str.COBPRINTER
call fcn.00440c60
mov edi, eax
add esp, 8
test edi, edi
je 0x4453cf
cmp byte [edi], 0
mov eax, edi
jne 0x4453d4
mov eax, 0x48e5e8
push 0x49c3a0
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
push edi
mov esi, eax
call fcn.00440b90
add esp, 0xc
test esi, esi
jne 0x445400
push 0xb8
call fcn.00425880
add esp, 4
pop edi
pop esi
pop ebx
ret
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.MSVCRT.dll_fwrite]
push esi
push edi
push 1
push eax
call ebx
add esp, 0x10
cmp eax, edi
jne 0x445446
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x445438
push esi
push 1
push 1
push 0x49c3a4
call ebx
add esp, 0x10
cmp eax, 1
jne 0x445446
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
ret
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
push 0xb8
call fcn.00425880
add esp, 8
pop edi
pop esi
pop ebx
ret
Function at 0x449110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x49d434]
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
test eax, eax
mov dword [ebp - 8], ebx
jne 0x44913d
call fcn.00481970
call fcn.00481820
mov dword [0x49d434], 1
mov eax, dword [ebx + 0x18]
mov cl, byte [edi + 0x38]
mov esi, dword [ebx + 8]
mov byte [eax + 0x34], cl
mov edx, dword [ebx + 0x18]
mov dword [ebp - 4], esi
mov al, byte [edx + 0x34]
test al, al
jne 0x44915e
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x40]
jmp 0x449173
and eax, 0xff
push eax
push ebx
call fcn.004817d0
mov eax, dword [esi + 4]
add esp, 8
mov ecx, dword [eax + 0x44]
mov eax, dword [edi + 0x30]
mov edx, dword [ebx + 4]
add ecx, eax
xor edi, edi
mov dword [edx + 0x20], ecx
mov eax, dword [0x49d42c]
mov dword [ebx + 0x64], eax
mov ecx, dword [0x49d42c]
mov dword [ebx + 0x68], ecx
mov eax, dword [esi + 4]
cmp dword [eax + 0x5c], edi
je 0x449212
mov ecx, dword [0x49d42c]
mov edx, dword [eax + 0x9c]
mov eax, dword [0x49d430]
add ecx, edx
cmp ecx, eax
mov dword [0x49d42c], ecx
jb 0x4491c3
push 0x9a
call fcn.00425880
add esp, 4
mov edx, dword [esi + 4]
mov ecx, dword [ebx + 0x68]
mov edi, dword [ebx + 0x64]
push 1
mov eax, dword [edx + 0x9c]
add ecx, eax
mov dword [ebx + 0x68], ecx
mov esi, dword [esi + 4]
mov ecx, dword [esi + 0x9c]
mov esi, dword [esi + 0x5c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x5c]
lea edx, [eax + 0x24]
call fcn.004533c0
mov eax, dword [esi + 4]
xor edi, edi
mov dword [eax + 0x5c], 0
jmp 0x449215
mov dword [ebx + 0x78], edi
mov dword [ebx + 0x70], edi
mov dword [ebx + 0x74], edi
mov dword [ebx + 0x80], edi
mov dword [ebx + 0x7c], edi
test byte [esi + 0x29], 4
je 0x44925d
call fcn.004816e0
mov eax, dword [ebx + 0x80]
lea ecx, [ebp - 0x48]
cmp eax, edi
mov dword [ebx + 0x3c], ecx
jbe 0x449246
dec eax
mov dword [ebx + 0x80], eax
lea edx, [ebp - 0x48]
push edi
push edx
call sub.MSVCRT.dll__setjmp3
mov ebx, dword [ebp - 8]
add esp, 8
test eax, eax
jne 0x44922f
mov esi, dword [ebp - 4]
mov al, byte [esi + 0x29]
test al, 1
je 0x44927f
test byte [0x49d265], 1
jne 0x44927f
and al, 0xfe
push 0xaf
mov byte [esi + 0x29], al
call fcn.00425880
add esp, 4
xor edx, edx
mov ecx, ebx
call fcn.00449290
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453d40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov ecx, dword [esp + 8]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 8]
push eax
mov eax, dword [0x4b4ff0]
push 0x40
push eax
lea edx, [eax + ecx + 1]
not eax
and edx, eax
add edx, esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
ret

Function at 0x453d80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x4b4ff0]
mov ecx, dword [esp + 4]
push esi
push edi
lea esi, [ecx + eax*2 + 1]
push 0x40
not eax
and esi, eax
push 0x1000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x453dde
mov eax, dword [0x4b4ff0]
mov edx, edi
sub edx, eax
lea ecx, [eax + 1]
lea eax, [edx + esi - 1]
lea edx, [esp + 0xc]
push edx
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x453dde
push 0x8000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
xor eax, eax
pop esi
ret
mov eax, edi
pop edi
pop esi
ret

Function at 0x4540a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push 1
call fcn.00453df0
add esp, 4
test eax, eax
je 0x4540bc
mov eax, dword [esp + 4]
push eax
call fcn.00453d80
add esp, 4
ret
mov ecx, dword [esp + 4]
push 0x40
push 0x1000
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret

Function at 0x4540e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x45418b
test dword [0x4b4fe0], 0x80000000
je 0x454108
push 0
push 1
push 3
call fcn.004530a0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004526d0
mov esi, eax
add esp, 8
mov cl, byte [esi]
and cl, 0xf
cmp cl, 2
je 0x454140
push 0xccc
push 0x49d0e0
push str.___mmkey.c_t11.5
push 0
push 0xc8
call fcn.00425ce0
add esp, 0x14
mov edx, dword [esp + 0xc]
push edi
mov di, word [esi]
push edx
shr edi, 0xd
push esi
and edi, 4
call fcn.00453580
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [0x4b4fe8]
add ecx, eax
sub edx, ecx
add esp, 8
mov dword [0x4b4fe8], edx
lea edx, [esp + 8]
push edx
push 0x40
push eax
mov eax, esi
sub eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
call fcn.00453610
add esp, 4
pop edi
pop esi
pop ecx
ret
Function at 0x459bf0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x4b7044]
sub esp, 0x3c
lea ecx, [esp + 0x1c]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push edi
push eax
push str._SHAREMEM_MFSHM__08X
push ecx
xor edi, edi
call esi
mov edx, dword [0x4b7044]
lea eax, [esp + 0x14]
push edx
push str._SEM32_MFSHM__08X
push eax
call esi
add esp, 0x18
lea ecx, [esp + 8]
push ecx
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
mov dword [0x4b5130], eax
jne 0x459d1a
lea edx, [esp + 8]
push edx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [0x4b5130], eax
jne 0x459c71
mov eax, dword [esp + 0x48]
mov edi, 1
mov dword [eax], 0xc8
mov eax, edi
pop edi
pop esi
add esp, 0x3c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x459ca7
mov ecx, dword [0x4b5130]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x459ca7
mov edx, dword [esp + 0x48]
pop edi
mov eax, 1
pop esi
mov dword [edx], 0xc8
add esp, 0x3c
ret
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x24]
push eax
push esi
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
je 0x459cf7
push esi
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esp + 0x48]
mov dword [0x4b795c], eax
mov dword [ecx], 0
mov eax, dword [0x4b5130]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
pop edi
pop esi
add esp, 0x3c
ret
mov edx, dword [esp + 0x48]
mov edi, 1
mov dword [edx], 0xc8
mov eax, dword [0x4b5130]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
pop edi
pop esi
add esp, 0x3c
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x24]
push ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test eax, eax
je 0x459d56
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [esp + 0x48]
mov dword [0x4b795c], eax
mov dword [edx], 1
jmp 0x459d65
mov eax, dword [esp + 0x48]
mov edi, 1
mov dword [eax], 0xc8
mov ecx, dword [0x4b5130]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
pop edi
pop esi
add esp, 0x3c
ret

Function at 0x45f620
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x45f645
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], esi
xor eax, eax
pop esi
ret
test al, 0x10
jne 0x45f679
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
cmp byte [ecx + esi - 1], 0x3a
jne 0x45f672
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x45f66e
cmp eax, 1
jne 0x45f672
xor eax, eax
pop esi
ret
mov eax, 0x8000
pop esi
ret
mov eax, 0x4000
pop esi
ret
Function at 0x460370
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov ebp, ecx
mov esi, edx
and edx, 0x7ffff
mov eax, dword [ebp + 8]
mov edi, 0x80000
sub edi, edx
mov dword [esp + 0x10], edx
shr esi, 0x13
cmp edi, ebx
mov byte [eax], 0x39
jbe 0x46039d
mov edi, ebx
lea ecx, [edi + edx]
mov dword [esp + 0x18], esi
push ecx
inc esi
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [esp + 0x1c]
push eax
push 1
mov ecx, ebp
call fcn.004605c0
test eax, eax
jne 0x4603c6
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push edx
push 1
add eax, ecx
push edi
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
sub ebx, edi
add esp, 0x10
cmp ebx, 0x80000
jbe 0x46042a
mov edi, esi
push 0x80000
inc esi
call dword [sym.imp.MSVCRT.dll__errno]
push eax
push 1
mov edx, edi
mov ecx, ebp
call fcn.004605c0
test eax, eax
je 0x460445
mov edx, dword [esp + 0x1c]
push edx
push 1
push 0x80000
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
sub ebx, 0x80000
add esp, 0x10
cmp ebx, 0x80000
ja 0x4603e8
test ebx, ebx
je 0x460461
push ebx
call dword [sym.imp.MSVCRT.dll__errno]
push eax
push 1
mov edx, esi
mov ecx, ebp
call fcn.004605c0
test eax, eax
jne 0x46044f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
push ecx
push 1
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp + 8]
pop edi
pop esi
pop ebp
mov byte [edx], 0x30
mov eax, 1
pop ebx
pop ecx
ret 8

Function at 0x460480
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov ebp, ecx
mov esi, edx
and edx, 0x7ffff
mov eax, dword [ebp + 8]
mov edi, 0x80000
sub edi, edx
mov dword [esp + 0x10], edx
shr esi, 0x13
cmp edi, ebx
mov byte [eax], 0x39
jbe 0x4604ad
mov edi, ebx
lea ecx, [edi + edx]
mov dword [esp + 0x18], esi
push ecx
inc esi
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [esp + 0x1c]
push eax
push 0
mov ecx, ebp
call fcn.004605c0
test eax, eax
jne 0x4604d6
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push edx
push 1
add eax, ecx
push edi
push eax
call dword [sym.imp.MSVCRT.dll_fread]
sub ebx, edi
add esp, 0x10
cmp ebx, 0x80000
jbe 0x46053a
mov edi, esi
push 0x80000
inc esi
call dword [sym.imp.MSVCRT.dll__errno]
push eax
push 0
mov edx, edi
mov ecx, ebp
call fcn.004605c0
test eax, eax
je 0x460555
mov edx, dword [esp + 0x1c]
push edx
push 1
push 0x80000
push eax
call dword [sym.imp.MSVCRT.dll_fread]
sub ebx, 0x80000
add esp, 0x10
cmp ebx, 0x80000
ja 0x4604f8
test ebx, ebx
je 0x460571
push ebx
call dword [sym.imp.MSVCRT.dll__errno]
push eax
push 0
mov edx, esi
mov ecx, ebp
call fcn.004605c0
test eax, eax
jne 0x46055f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
push ecx
push 1
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov edx, dword [ebp + 8]
pop edi
pop esi
pop ebp
mov byte [edx], 0x30
mov eax, 1
pop ebx
pop ecx
ret 8
Function at 0x460b90
Capabilities:
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
test eax, eax
jne 0x460be1
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [ebp + 0xc]
push 0
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x460bbe
xor esi, esi
jmp 0x460bca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x460c06
test bl, 1
je 0x460bda
and ebx, 0xfffffffe
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x460bfa
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x460bda
push esi
call fcn.0045b5f0
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret