joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e4b
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xa48
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa44], eax
push ebx
push ebp
push esi
push edi
xor ebp, ebp
lea eax, [esp + 0x258]
push 0x7fc
push ebp
push eax
mov dword [esp + 0x260], ebp
call fcn.00416380
add esp, 0xc
push 0x3ee
push dword [0x4443bc]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
push 2
push 0xffffffffffffffff
push 0x100c
push esi
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407ef9
mov edx, 0x435660
mov ecx, 0x4357bc
call fcn.00414a7a
push eax
lea eax, [esp + 0x258]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x254]
mov edx, 0x43633c
push 0x30
push eax
mov ecx, 0x4355f8
call fcn.00414a7a
push eax
push dword [0x4443bc]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x40800d
xor eax, eax
push 0x206
mov word [esp + 0x50], ax
lea eax, [esp + 0x52]
push ebp
push eax
call fcn.00416380
add esp, 0xc
mov dword [esp + 0x18], ebp
lea eax, [esp + 0x4c]
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
push ebx
push 0x1073
push esi
call edi
mov ecx, dword [esp + 0x50]
call fcn.00402177
test eax, eax
lea eax, [esp + 0x4c]
jne 0x407f8a
push eax
mov esi, 0x4355f8
mov edx, 0x436344
push eax
mov ecx, esi
call fcn.00414a7a
push eax
lea eax, [esp + 0x260]
push 0x3fc
push eax
call fcn.0040b4a0
add esp, 0x14
mov edx, 0x435a68
mov ecx, esi
push 0x30
call fcn.00414a7a
push eax
lea eax, [esp + 0x25c]
jmp 0x407ee5
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
push ebx
push 0x1073
push esi
mov dword [esp + 0x28], 3
mov dword [esp + 0x38], 0x104
call edi
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407fd9
mov edx, 0x43634c
lea eax, [esp + 0x4c]
mov esi, 0x4355f8
push eax
mov ecx, esi
call fcn.00414a7a
push eax
push str._s_n_n_s
jmp 0x407f5a
lea ecx, [esp + 0x4c]
call fcn.00406017
test eax, eax
jne 0x407fed
mov edx, 0x435a60
jmp 0x407fc0
push ebp
push 0x403d4c
push dword [0x4443bc]
push str.MOUNT_ENC_DISK
push dword [0x4443c0]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
inc eax
mov ecx, dword [esp + 0xa54]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415746
add esp, 0xa48
ret
Function at 0x4087f9
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x410]
sub esp, 0x490
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x40c], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x204], ax
mov edi, edx
lea eax, [ebp + 0x206]
mov esi, ecx
push ebx
push eax
call fcn.00416380
add esp, 0xc
lea eax, [ebp + 0x204]
push 0x443990
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.TempRun_NonElevated.cmd
lea eax, [ebp + 0x204]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push str.w__ccsUTF_8
lea eax, [ebp + 0x204]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004193e2
add esp, 0xc
test eax, eax
jne 0x4089b6
cmp dword [ebp - 8], ebx
je 0x4088ab
push str.chcp_65001_n
push dword [ebp - 8]
call fcn.0040b400
push edi
push esi
push str.chcp_65001_nsubst__s:___s__n
push dword [ebp - 8]
call fcn.0040b400
push dword [ebp - 8]
call fcn.004194a0
add esp, 0x1c
mov eax, dword [0x4443bc]
xorps xmm0, xmm0
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x204]
mov dword [ebp - 0x30], eax
mov eax, dword [0x4443c0]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x44]
push eax
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x440
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], str.Explorer
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0xc], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
je 0x408919
push 0xffffffffffffffff
push dword [ebp - 0xc]
call ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x204
lea eax, [ebp]
mov dword [ebp - 4], 0x30
push 0
push eax
call fcn.00416380
push edi
push esi
push str._s:___s_
lea eax, [ebp - 4]
push 0x104
push eax
call fcn.0040b4a0
push 0x3c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00416380
mov eax, dword [0x4443bc]
lea esi, [ebp - 0x80]
add esp, 0x2c
lea edi, [ebp - 0x44]
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3c], eax
xor ecx, ecx
lea eax, [ebp - 4]
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x30], eax
mov eax, dword [0x4443c0]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x40], 0x440
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], str.Subst
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0xc], 0
je 0x4089b6
push 0xffffffffffffffff
push dword [ebp - 0xc]
call ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x40c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415746
add ebp, 0x410
leave
ret
Function at 0x4089ce
Capabilities:
Create process on windows
Delete file
Schedule task via schtasks

Disassembly:
push ebp
lea ebp, [esp - 0x5dc]
sub esp, 0x65c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x5d8], eax
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp + 0x3d0], ax
lea eax, [ebp + 0x3d2]
push esi
push eax
call fcn.00416380
add esp, 0xc
lea eax, [ebp + 0x3d0]
push 0x443990
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.ExtraDisksMount.exe
lea eax, [ebp + 0x3d0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push str.w__ccsUTF_8
mov edi, 0x443b98
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.004193e2
add esp, 0xc
test eax, eax
jne 0x408b17
cmp dword [ebp - 0x44], esi
je 0x408a72
lea eax, [ebp + 0x3d0]
push eax
push str.schtasks__create__tn__ExtraDisksMount___tr___s___sc_ONLOGON__RL_HIGHEST__n
push dword [ebp - 0x44]
call fcn.0040b450
push dword [ebp - 0x44]
call fcn.004194a0
add esp, 0x10
xor eax, eax
push 0x40e
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push esi
push eax
call fcn.00416380
push edi
push str._ExecutionPolicy_Bypass__Command____s_
lea eax, [ebp - 0x40]
push 0x208
push eax
call fcn.0040b4a0
mov eax, dword [0x4443bc]
add esp, 0x1c
mov dword [ebp - 0x78], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x40]
movlpd qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x6c], eax
mov eax, dword [0x4443c0]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x80]
push eax
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x440
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], str.PowerShell.exe
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x48], esi
je 0x408b07
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x443da0
call esi
push edi
call esi
mov ecx, dword [ebp + 0x5d8]
pop edi
xor ecx, ebp
pop esi
call fcn.00415746
add ebp, 0x5dc
leave
ret
Function at 0x408b2e
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
push esi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push esi
push eax
call fcn.00416380
push str._Command__schtasks__delete__tn__ExtraDisksMount___f_
lea eax, [ebp - 0x44]
push 0x104
push eax
call fcn.0040b4a0
mov eax, dword [0x4443bc]
add esp, 0x18
mov dword [ebp - 0x78], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x44]
movlpd qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x6c], eax
mov eax, dword [0x4443c0]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x80]
push eax
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x440
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], str.PowerShell.exe
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x48], 0
pop esi
je 0x408be2
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x1c4]
xor ecx, ebp
call fcn.00415746
add ebp, 0x1c8
leave
ret
Function at 0x408bf7
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x410]
sub esp, 0x490
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x40c], eax
push esi
push edi
xor eax, eax
movzx esi, cx
push 0x206
mov word [ebp + 0x204], ax
xor edi, edi
lea eax, [ebp + 0x206]
push edi
push eax
call fcn.00416380
add esp, 0xc
lea eax, [ebp + 0x204]
push 0x443990
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.TempRun_NonElevated.cmd
lea eax, [ebp + 0x204]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push str.w__ccsUTF_8
lea eax, [ebp + 0x204]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004193e2
add esp, 0xc
test eax, eax
jne 0x408db0
cmp dword [ebp - 8], edi
je 0x408ca6
push str.chcp_65001_n
push dword [ebp - 8]
call fcn.0040b400
push esi
push str.chcp_65001_nsubst__C:__D_n
push dword [ebp - 8]
call fcn.0040b400
push dword [ebp - 8]
call fcn.004194a0
add esp, 0x18
mov eax, dword [0x4443bc]
xorps xmm0, xmm0
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x204]
mov dword [ebp - 0x30], eax
mov eax, dword [0x4443c0]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x44]
push eax
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x440
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], str.Explorer
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0xc], edi
je 0x408d12
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x204
lea eax, [ebp]
mov dword [ebp - 4], 0x30
push edi
push eax
call fcn.00416380
push esi
push str._C:__D
lea eax, [ebp - 4]
push 0x104
push eax
call fcn.0040b4a0
push 0x3c
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.00416380
mov eax, dword [0x4443bc]
lea esi, [ebp - 0x80]
add esp, 0x28
lea edi, [ebp - 0x44]
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3c], eax
xor ecx, ecx
lea eax, [ebp - 4]
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x30], eax
mov eax, dword [0x4443c0]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x40], 0x440
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], str.Subst
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0xc], 0
je 0x408db0
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x40c]
pop edi
xor ecx, ebp
pop esi
call fcn.00415746
add ebp, 0x410
leave
ret
Function at 0x4096bb
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x468
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x464], eax
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, ecx
push edi
xor edi, edi
push edi
push edi
push 0x1009
push ebx
call ebp
push 0x204
lea eax, [esp + 0x270]
mov dword [esp + 0x26c], 0x30
push edi
push eax
call fcn.00416380
add esp, 0xc
mov dword [esp + 0xc], edi
lea eax, [esp + 0x60]
push 0x4441b0
push 0x104
push eax
push edi
lea eax, [esp + 0x278]
push eax
push str.ENC_DISK
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4098d9
push esi
push edi
push edi
push 0x1004
push ebx
call ebp
mov dword [0x43cfbc], edi
mov esi, str.__C:_
lea edi, [esp + 0x50]
mov dword [0x43cfa4], eax
mov ax, word [esp + 0x64]
push 0x43cfa0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
mov word [esp + 0x58], ax
push edi
push 0x104d
lea eax, [esp + 0x5c]
mov dword [esp + 0x68], edi
push ebx
mov dword [esp + 0x70], edi
mov dword [0x43cfb4], eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x64]
push 0x4441b0
push 0x104
push eax
push edi
lea eax, [esp + 0x27c]
push eax
push str.ENC_LABEL
call esi
lea eax, [esp + 0x64]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push dword [0x43cfa4]
push 0x1074
push ebx
call ebp
push 0x4441b0
push 0x104
lea eax, [esp + 0x6c]
push eax
push edi
lea eax, [esp + 0x27c]
push eax
push str.ENC_SIZE
call esi
lea eax, [esp + 0x64]
mov dword [esp + 0x1c], 2
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push dword [0x43cfa4]
push 0x1074
push ebx
call ebp
push 0x4441b0
push 0x104
lea eax, [esp + 0x6c]
push eax
push edi
lea eax, [esp + 0x27c]
push eax
push str.ENC_PATH
call esi
lea eax, [esp + 0x64]
mov dword [esp + 0x1c], 3
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push dword [0x43cfa4]
push 0x1074
push ebx
call ebp
push 0x4441b0
push 1
lea eax, [esp + 0x274]
push eax
push str.ENC_CHECK
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x409890
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 0xf000
push eax
push dword [0x43cfa4]
mov dword [esp + 0x28], 0x2000
push 0x102b
push ebx
call ebp
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x26c]
push 0xa
push 0x104
inc eax
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.0041a651
add esp, 0x10
lea eax, [esp + 0x64]
push 0x4441b0
push 0x104
push eax
push edi
lea eax, [esp + 0x27c]
push eax
push str.ENC_DISK
call esi
test eax, eax
jne 0x409737
pop esi
push 0x414e85
push 1
push 0x1051
push ebx
mov dword [0x444a18], edi
mov dword [0x444a14], ebx
call ebp
mov ecx, dword [esp + 0x470]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415746
add esp, 0x468
ret
Function at 0x40b4ed
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push esi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push esi
push eax
call fcn.00416380
add esp, 0xc
lea eax, [ebp - 0x7c]
push 0x443990
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.Updates.ini
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x7c]
push eax
push esi
push str.AppVersion
push str.WINTOOLS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x5dc0
jle 0x40b578
cmp dword [0x43cfe4], esi
jne 0x40b578
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push 0x40b4bb
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.00415746
add ebp, 0x190
leave
ret
Function at 0x40b58e
Capabilities:
Create thread
Delete file
Download url
Read .ini file
Receive data

Disassembly:
sub esp, 0x620
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x257
push dword [0x4443bc]
call edi
mov ecx, eax
call fcn.0040bdcf
mov ebx, 0x252
push ebx
push dword [0x4443bc]
call edi
mov ecx, eax
call fcn.0040bdcf
xor ebp, ebp
push ebp
push ebx
push dword [0x4443bc]
mov dword [0x43cfe4], ebp
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
xor eax, eax
push 0x206
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push ebp
push eax
call fcn.00416380
add esp, 0xc
lea eax, [esp + 0x14]
mov esi, str.http:__www.extradisks.com_extradisks.ini
push ebp
push 0x10
push 0x104
push eax
push esi
push ebp
call dword [sym.imp.urlmon.dll_URLDownloadToCacheFileW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x14]
push 0x443990
push eax
call ebp
push str.Updates.ini
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x10
lea eax, [esp + 0x1c]
push eax
push esi
xor esi, esi
push esi
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x40b6f4
lea eax, [esp + 0x14]
push eax
push esi
push str.AppVersion
push str.WINTOOLS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x5dc0
jle 0x40b6c8
push esi
push 0x40b75e
push dword [0x4443bc]
push str.IDD_UPDATEBOX
push dword [0x4443c0]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp dword [0x43cfe4], esi
jne 0x40b733
lea eax, [esp + 0x10]
push eax
push esi
push esi
push 0x40b4bb
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x40b733
mov esi, 0x435f1c
mov edx, 0x435f54
mov ecx, esi
call fcn.00414a7a
push eax
lea eax, [esp + 0x220]
push eax
call ebp
push 0x40
lea eax, [esp + 0x220]
mov edx, 0x435f34
jmp 0x40b71e
mov esi, 0x435f1c
mov edx, 0x435f64
mov ecx, esi
call fcn.00414a7a
push eax
lea eax, [esp + 0x428]
push eax
call ebp
push 0x10
lea eax, [esp + 0x428]
mov edx, 0x4362d4
push eax
mov ecx, esi
call fcn.00414a7a
push eax
push dword [0x4443bc]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
push 0x252
push dword [0x4443bc]
call edi
push eax
call ebx
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415746
add esp, 0x620
ret

Function at 0x40e124
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or esi, 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
jmp 0x40e14c
movzx eax, word [edi]
dec ecx
xor eax, esi
lea edi, [edi + 2]
movzx eax, al
shr esi, 8
xor esi, dword [eax*4 + 0x436958]
test ecx, ecx
jg 0x40e136
not esi
pop edi
mov eax, esi
pop esi
ret
Function at 0x4102ff
Capabilities:
Check if file exists
Create directory
Get common file path
Read .ini file

Disassembly:
sub esp, 0x214
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x210], eax
push ebp
push 0x104
mov ebp, 0x443990
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0
push ebp
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
sub eax, ebp
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x410480
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
xor ecx, ecx
push edi
push ebp
mov edi, 0x4443c8
mov word [eax + 0x443990], cx
push edi
call esi
push str.extrasubst.ini
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
call edi
push ebp
mov ebx, 0x4441b0
push ebx
call esi
push str.extradisks.ini
push ebx
call edi
push ebp
mov ebx, 0x443da0
push ebx
call esi
push str._tempdiskpart.txt
push ebx
call edi
push ebp
mov ebx, 0x443b98
push ebx
call esi
push str._temppowershell.ps1
push ebx
call edi
push ebp
mov ebx, 0x4445d0
push ebx
call esi
push str.langdefault.lng
push ebx
call edi
push ebp
mov ebp, 0x443fa8
push ebp
call esi
push str.help_
push ebp
call edi
push ebx
push 0x104
lea eax, [esp + 0x20]
xor esi, esi
push eax
push esi
push 0x435658
push str.LANGUAGE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x18]
push eax
push ebp
call edi
lea eax, [esp + 0x14]
push eax
push 0x23
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x410467
mov ebx, 0x4441b0
push ebx
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, 1
jne 0x410467
push 0x4374c8
push ebx
call edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.extradisks.ini
push ebx
call edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x410467
push str.w__ccsUTF_16LE
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.004193e2
add esp, 0xc
test eax, eax
jne 0x410467
cmp dword [esp + 0x10], esi
je 0x410467
push str._OPTIONS__n
push dword [esp + 0x14]
call fcn.0040b400
push dword [esp + 0x18]
call fcn.004194a0
add esp, 0xc
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.00415746
add esp, 0x214
ret
call fcn.00415876
int3
Function at 0x4138e8
Capabilities:
Get disk information
Read .ini file

Disassembly:
sub esp, 0x628
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x624], eax
push ebx
push edi
mov edi, 0x4443c8
xor ebx, ebx
push edi
push ebx
push 0x437574
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x413a06
push ebp
push esi
mov esi, 0x206
mov word [esp + 0x1c], ax
push esi
lea eax, [esp + 0x22]
push ebx
push eax
call fcn.00416380
xor eax, eax
push esi
mov word [esp + 0x234], ax
lea eax, [esp + 0x236]
push ebx
push eax
call fcn.00416380
xor eax, eax
push esi
mov word [esp + 0x448], ax
lea eax, [esp + 0x44a]
push ebx
push eax
call fcn.00416380
add esp, 0x24
lea eax, [esp + 0x14]
mov esi, 0x104
push ebx
push ebx
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
push esi
lea eax, [esp + 0x444]
push eax
push 0x436eac
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push dword [esp + 0x10]
lea eax, [esp + 0x20]
push 0x43757c
push esi
push eax
call fcn.0040b4a0
add esp, 0x10
lea eax, [esp + 0x224]
mov ebx, str.Data
mov ebp, str.SYSFILES
push edi
push esi
push eax
mov esi, 0x4355cc
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x224]
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x413a04
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x4375a4
push 0x4375a8
call esi
push edi
lea eax, [esp + 0x20]
push eax
push ebx
push ebp
call esi
pop esi
pop ebp
mov ecx, dword [esp + 0x62c]
pop edi
pop ebx
xor ecx, esp
call fcn.00415746
add esp, 0x628
ret