joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412040
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
mov esi, ecx
xor edi, edi
test esi, esi
je 0x412114
cmp dword [ebp + 8], edi
je 0x412114
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 0x10]
and eax, 0x10
mov dword [ebp + 0x10], eax
je 0x412087
mov edx, dword [ebp + 0x18]
mov ecx, esi
push ebx
call fcn.00411040
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0x14], 2
jne 0x4120d9
xor ecx, ecx
test eax, eax
setne cl
push ecx
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
movzx edi, al
test al, al
jne 0x4120ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x4120f8
mov ecx, esi
call fcn.0041150e
mov esi, eax
test esi, esi
je 0x4120f8
push dword [ebp - 4]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
push esi
movzx edi, al
call fcn.00422ab2
jmp 0x4120ee
cmp dword [ebp + 0x14], 1
jne 0x4120f8
push dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, esi
call fcn.00411f56
mov edi, eax
pop ecx
test edi, edi
je 0x4120f8
and dword [ebx], 0
jmp 0x412110
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x522
setne cl
add ecx, 0xa0000076
mov dword [ebx], ecx
mov eax, edi
jmp 0x412116
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415499
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x44100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 8], eax
lea ebx, [edi + 0x44]
and dword [ebx], 0
cmp dword [edi + 0xc], 0xffffffff
je 0x4154c8
mov eax, dword [edi]
call dword [eax + 0x2c]
mov eax, dword [edi + 0x48]
mov ecx, esi
push dword [eax + 0x64]
push dword [ebp + 0x14]
push ebx
push dword [ebp - 8]
call fcn.0041523e
add esp, 0x10
mov dword [edi + 0xc], eax
cmp eax, 0xffffffff
jne 0x4154eb
xor eax, eax
jmp 0x415541
mov ecx, edi
call fcn.00415b22
push esi
mov ecx, edi
call fcn.00415ae3
test esi, esi
je 0x41553e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x41553e
push 0x3a
pop ecx
cmp word [esi + 2], cx
jne 0x41553e
push 0x5c
pop edx
cmp word [esi + 4], dx
jne 0x41553e
mov ax, word [esi]
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], cx
mov word [ebp - 8], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [edi + 0x10], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bb79
leave
ret 0x10
Function at 0x4155ed
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x44100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
push ebx
push esi
mov esi, ecx
push edi
test edx, edx
je 0x415621
mov ebx, dword [esi + 0x1c]
sub ebx, dword [esi + 0x20]
jns 0x415634
mov dword [esi + 0x44], 0xa0000047
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bb79
leave
ret 0xc
mov ecx, dword [esi + 0x14]
test ecx, ecx
jne 0x415658
cmp dword [esi + 0x18], ecx
je 0x415658
push dword [esi + 0x18]
call fcn.0042346f
pop ecx
mov ecx, eax
mov dword [esi + 0x14], ecx
test ecx, ecx
je 0x415621
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
cmp edi, ebx
ja 0x415687
test ecx, ecx
je 0x415687
mov eax, dword [esi + 0x20]
push edi
add eax, ecx
push eax
push edx
call fcn.0041f800
add dword [esi + 0x20], edi
add esp, 0xc
add dword [esi + 0x28], edi
mov ecx, dword [ebp - 0xc]
adc dword [esi + 0x2c], 0
mov dword [ecx], edi
xor eax, eax
inc eax
jmp 0x415623
and dword [eax], 0
test ebx, ebx
jle 0x4156c7
cmp dword [esi + 0x14], 0
je 0x4156c7
mov eax, dword [esi + 0x20]
add eax, dword [esi + 0x14]
push ebx
push eax
push edx
call fcn.0041f800
mov eax, dword [ebp - 0xc]
add esp, 0xc
and dword [esi + 0x1c], 0
sub edi, ebx
and dword [esi + 0x20], 0
mov ecx, dword [ebp - 8]
add dword [eax], ebx
add ecx, ebx
mov eax, ebx
mov dword [ebp - 8], ecx
cdq
add dword [esi + 0x28], eax
adc dword [esi + 0x2c], edx
jmp 0x4156ca
mov ecx, dword [ebp - 8]
mov ebx, dword [esi + 0x18]
cmp edi, ebx
jb 0x41570b
xor ebx, ebx
lea eax, [ebp - 8]
push ebx
push eax
push edi
push ecx
push dword [esi + 0xc]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4156f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x44], eax
jmp 0x415621
mov eax, dword [ebp - 8]
add dword [esi + 0x28], eax
mov ecx, dword [ebp - 0xc]
adc dword [esi + 0x2c], ebx
add dword [ecx], eax
jmp 0x415682
mov ecx, ebx
lea edx, [edi + 0x1000]
shr ecx, 1
cmp edx, ecx
ja 0x415725
mov eax, ebx
mov ebx, ecx
shr eax, 2
cmp edx, eax
cmovbe ebx, eax
push 0
push 0x1000
push dword [esi + 0x2c]
push dword [esi + 0x28]
call fcn.00431bd0
mov ecx, eax
mov dword [ebp - 0x10], eax
or ecx, edx
je 0x415752
mov eax, ebx
cmp ebx, 0x1000
jbe 0x41574d
sub eax, dword [ebp - 0x10]
cmp eax, edi
cmovae ebx, eax
xor ecx, ecx
lea eax, [esi + 0x1c]
push ecx
push eax
push ebx
push dword [esi + 0x14]
mov dword [eax], ecx
push dword [esi + 0xc]
mov dword [esi + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4156ea
mov ebx, dword [esi + 0x1c]
test ebx, ebx
je 0x415682
cmp edi, ebx
jae 0x41578c
mov ebx, edi
test edi, edi
je 0x415682
mov eax, dword [esi + 0x14]
add eax, dword [esi + 0x20]
push ebx
push eax
push dword [ebp - 8]
call fcn.0041f800
add dword [esi + 0x20], ebx
add esp, 0xc
add dword [esi + 0x28], ebx
mov eax, dword [ebp - 0xc]
adc dword [esi + 0x2c], 0
add dword [eax], ebx
jmp 0x415682
Function at 0x415b22
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x44100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 8]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 8]
xor edx, edx
add edx, eax
mov dword [esi + 0x30], edx
adc ecx, 0
mov dword [esi + 0x34], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041bb79
leave
ret

Function at 0x415b6c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x44100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
xor ecx, ecx
cmp dword [esi + 0x40], ecx
jne 0x415b8c
xor eax, eax
jmp 0x415bc3
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
lea ecx, [ebp - 8]
push ecx
push ebx
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
jne 0x415bb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x44], eax
jmp 0x415bbf
add dword [esi + 0x28], ebx
adc dword [esi + 0x2c], 0
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041bb79
leave
ret 8

Function at 0x415c0f
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor eax, eax
mov dword [ebp - 4], edx
push eax
push eax
push 2
push eax
push 5
mov edi, ecx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x415ceb
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 5
je 0x415c9a
cmp esi, 0x7b
je 0x415c9a
cmp esi, 3
jne 0x415cdc
cmp dword [ebp + 0x10], 0
je 0x415ce5
mov ecx, edi
call fcn.0041150e
mov edi, eax
test edi, edi
je 0x415ce5
xor eax, eax
push eax
push eax
push 2
push eax
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.00422ab2
pop ecx
cmp ebx, 0xffffffff
jne 0x415cea
jmp 0x415cdc
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x415cdc
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push eax
push eax
push 2
push eax
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x415cea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x415ce5
mov esi, 0xa0000031
mov eax, dword [ebp - 4]
mov dword [eax], esi
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x415e41
Capabilities:
Get disk information

Disassembly:
push 0x14
mov eax, 0x433ddb
call fcn.0043195e
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
call fcn.00410f08
mov esi, eax
test esi, esi
je 0x415f6c
mov eax, dword [edi + 0x140]
xor ebx, ebx
cmp dword [eax + 0x1c], ebx
je 0x415eaa
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x415e7f
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jb 0x415eaa
mov ecx, esi
call fcn.0041150e
test eax, eax
je 0x415eaa
push esi
mov esi, eax
call fcn.00422ab2
pop ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp dword [edi + 0xc], 0xffffffff
je 0x415ebe
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax + 0x20]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x415ed4
push 0xffffffffffffffff
push esi
push dword [ebp + 0x14]
push eax
call fcn.00424b82
add esp, 0x10
push ecx
push ecx
push dword [ebp - 0x1c]
mov ecx, edi
push esi
call fcn.00415f74
test eax, eax
jne 0x415f0e
mov edx, dword [edi + 0x140]
mov ecx, esi
push dword [ebp - 0x1c]
mov edx, dword [edx + 0x1c]
call fcn.00411040
pop ecx
test eax, eax
je 0x415f5f
push ecx
push ecx
push dword [ebp - 0x1c]
mov ecx, edi
push esi
call fcn.00415f74
test eax, eax
je 0x415f5f
push esi
call fcn.004239f4
mov dword [edi + 0x14], eax
pop ecx
test esi, esi
je 0x415f5c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x415f5c
push 0x3a
pop ecx
cmp word [esi + 2], cx
jne 0x415f5c
push 0x5c
pop edx
cmp word [esi + 4], dx
jne 0x415f5c
mov ax, word [esi]
mov word [ebp - 0x18], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x18]
push eax
mov word [ebp - 0x16], cx
mov word [ebp - 0x14], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [edi + 0x38], eax
xor ebx, ebx
inc ebx
test esi, esi
je 0x415f6a
push esi
call fcn.00422ab2
pop ecx
mov eax, ebx
call fcn.00431908
ret 0x1c

Function at 0x415fa5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x44100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x13c]
test eax, eax
jne 0x415fc4
inc eax
jmp 0x415ffa
push 0
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [esi + 0x3c]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
cmp ecx, dword [esi + 0x13c]
je 0x415ff3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x144], eax
xor eax, eax
jmp 0x415ffa
and dword [esi + 0x13c], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041bb79
leave
ret
Function at 0x416048
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x44100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
call fcn.00415fa5
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
and dword [ebp - 8], 0
push 0
push eax
push ebx
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4160ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x144], eax
add dword [edi + 0x30], ebx
adc dword [edi + 0x34], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041bb79
leave
ret 8
cmp dword [edi + 0x38], 2
jne 0x416093
mov ebx, dword [edi + 0x30]
mov edx, dword [ebp + 0xc]
mov edi, dword [edi + 0x34]
add edx, ebx
mov ecx, dword [ebp - 0xc]
push 0
pop eax
push 0
adc eax, edi
mov dword [ecx + 0x30], edx
push 0xa00000
push eax
push edx
mov dword [ecx + 0x34], eax
call fcn.00431b20
push 0
push 0xa00000
push edi
push ebx
mov esi, eax
mov dword [ebp - 0x10], edx
call fcn.00431b20
cmp eax, esi
jne 0x4160f7
cmp edx, dword [ebp - 0x10]
je 0x41609a
mov eax, dword [ebp - 0xc]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x41609a

Function at 0x416105
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x433e0f
call fcn.0043195e
mov ebx, ecx
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0x43aed4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
cmp dword [ebx + 0x14], esi
je 0x416146
push dword [ebx + 0x14]
lea ecx, [ebp - 0x1c]
call fcn.00416fed
push dword [ebx + 0x14]
call fcn.00422ab2
pop ecx
cmp dword [ebx + 0xc], 0xffffffff
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x10], esi
jne 0x416157
xor esi, esi
inc esi
jmp 0x4161ce
mov ecx, ebx
call fcn.00415fa5
neg eax
push ecx
push dword [ebx + 0xc]
sbb esi, esi
mov ecx, ebx
mov eax, dword [ebx]
and esi, 1
push esi
call dword [eax + 0x48]
push edx
push eax
lea ecx, [ebx + 0x148]
call fcn.00414b46
mov ecx, dword [ebx + 0xc]
lea edi, [ebx + 0x18]
neg eax
sbb eax, eax
and eax, esi
mov dword [ebp - 0x20], eax
cmp ecx, 0xffffffff
je 0x4161a6
mov edx, edi
call fcn.00414ea6
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebx + 0xc], 0xffffffff
and dword [ebx + 0x38], 0
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
cmp dword [ebp + 8], eax
je 0x4161c4
cmp dword [ebp - 0x18], eax
je 0x4161c4
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebx + 0x144], 0
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
call fcn.00416fc6
mov eax, esi
call fcn.00431908
ret 4

Function at 0x41623c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
push dword [ebp + 8]
call dword [eax + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebp
ret 4
Function at 0x41650c
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x433e43
call fcn.0043195e
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
call fcn.00410f08
mov ebx, eax
test ebx, ebx
je 0x416606
mov dword [ebp - 0x18], ebx
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x68], 0xffffffff
je 0x41654e
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x20]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x416564
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x14]
push eax
call fcn.00424b82
add esp, 0x10
push dword [ebp - 0x1c]
mov ecx, esi
push ebx
call fcn.0041660e
test eax, eax
jne 0x41659a
mov edx, dword [esi + 0x88]
mov ecx, ebx
push dword [ebp - 0x1c]
mov edx, dword [edx + 0x1c]
call fcn.00411040
pop ecx
test eax, eax
je 0x4165fd
push dword [ebp - 0x1c]
mov ecx, esi
push ebx
call fcn.0041660e
test eax, eax
je 0x4165fd
push ebx
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
call fcn.004239f4
lea ecx, [esi + 0x5c]
mov dword [esi + 0x6c], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esp], 0x8000
call fcn.00407264
test eax, eax
jne 0x4165da
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x58], 8
mov dword [eax], 0xa0000063
jmp 0x4165fd
cmp dword [esi + 0xc], edi
jne 0x4165fa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
push edi
push esi
push 0x416a25
push edi
push edi
call fcn.00423c3f
add esp, 0x18
mov dword [esi + 0xc], eax
xor edi, edi
inc edi
push ebx
call fcn.00422ab2
pop ecx
mov eax, edi
call fcn.00431908
ret 0x10

Function at 0x41660e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x44100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [edi + 0x88]
push dword [eax + 0x1c]
push ecx
push ecx
mov ecx, esi
call fcn.00415c0f
add esp, 0xc
mov dword [edi + 0x68], eax
cmp eax, 0xffffffff
je 0x41668c
test esi, esi
je 0x41668c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x41668c
push 0x3a
pop ecx
cmp word [esi + 2], cx
jne 0x41668c
push 0x5c
pop edx
cmp word [esi + 4], dx
jne 0x41668c
mov ax, word [esi]
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], cx
mov word [ebp - 8], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [edi + 0x98], eax
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [edi + 0x68], 0xffffffff
pop edi
setne al
xor ecx, ebp
pop esi
call fcn.0041bb79
leave
ret 8
Function at 0x4166a5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x44100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0xc], eax
mov esi, ecx
xor eax, eax
inc eax
push edi
cmp dword [esi + 0x54], eax
je 0x416703
call fcn.004151c1
mov ebx, dword [ebp + 0xc]
cmp ebx, eax
jbe 0x416727
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
test eax, eax
je 0x416703
xor edi, edi
lea eax, [ebp - 8]
push edi
push eax
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x416716
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x58], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bb79
leave
ret 8
add dword [esi + 0x90], ebx
adc dword [esi + 0x94], edi
xor eax, eax
inc eax
jmp 0x416705
lea eax, [esi + 0x30]
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push dword [ebp - 0xc]
lea ecx, [esi + 0x18]
call fcn.00416c07
test eax, eax
jne 0x41674a
mov dword [esi + 0x54], 1
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.004151c1
cmp dword [esi + 0x2c], eax
mov ecx, edi
push 1
pop eax
cmova ecx, eax
mov dword [esi + 0x14], edi
lea eax, [esi + 0x30]
mov dword [ebp - 0x10], ecx
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
mov ecx, 0xbb8
mov dword [ebp - 8], edi
test eax, eax
je 0x4167f4
mov ebx, ecx
test ebx, ebx
je 0x4167eb
test eax, eax
je 0x416797
push 0xa
push dword [esi + 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esi + 0x54], edi
jne 0x4167eb
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0xc], eax
call fcn.004151c1
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jbe 0x4167d7
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
cmp eax, ecx
jne 0x4167c8
dec ebx
jmp 0x4167cd
mov ebx, 0xbb8
cmp eax, ecx
cmovne eax, ecx
mov dword [ebp - 8], eax
jmp 0x4167da
mov dword [ebp - 0x10], edi
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x416784
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
xor eax, eax
inc eax
cmp dword [esi + 0x54], eax
je 0x416703
test ecx, ecx
jle 0x416703
add dword [esi + 0x90], ebx
adc dword [esi + 0x94], edi
jmp 0x416705
Function at 0x416a36
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x44100c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov ebx, dword [esi + 0x2c]
mov dword [ebp - 0x14], ecx
test eax, eax
jne 0x416a89
test ecx, ecx
jne 0x416a89
cmp ebx, 0x8000
sbb edi, edi
and edi, 0xffff8000
add edi, 0x8000
jmp 0x416a93
mov edi, 0x8000
cmp ebx, edi
cmovb edi, ebx
test edi, edi
jne 0x416aa7
mov ecx, dword [ebp - 0xc]
test eax, eax
push 1
pop eax
cmovne ecx, eax
mov dword [ebp - 0xc], ecx
jmp 0x416ac3
xor eax, eax
lea ecx, [esi + 0x18]
inc eax
push eax
push edi
push dword [ebp - 0x10]
call fcn.00416ca4
push dword [esi + 0x50]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, dword [esi + 0x2c]
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x416afe
push 0
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 0x10]
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x416aed
cmp dword [ebp - 8], edi
je 0x416b09
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x58], eax
xor eax, eax
inc eax
mov dword [esi + 0x54], eax
jmp 0x416b09
push 2
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x14], 0
je 0x416b26
cmp dword [esi + 0x54], 0
jne 0x416b19
test ebx, ebx
jne 0x416b26
push dword [esi + 0x4c]
and dword [esi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 0xc], 0
lea eax, [esi + 0x30]
je 0x416a58
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bb79
leave
ret
Function at 0x4175ef
Capabilities:
Accept command line arguments
Set current directory

Disassembly:
push 0x7c
mov eax, 0x433fb0
call fcn.0043195e
mov esi, ecx
cmp dword [esi], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x78], eax
jne 0x417612
xor eax, eax
jmp 0x4177b7
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.0041e150
add esp, 0xc
mov dword [ebp - 0x64], ebx
lea eax, [ebp - 0x74]
xor ebx, ebx
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
call dword [esi]
test eax, eax
je 0x41765b
push dword [ebp - 0x74]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x70]
call esi
jmp 0x4177b4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
jne 0x417684
push 5
push dword [ebp - 0x78]
push eax
push edi
push str.open
push eax
call dword [esi + 4]
jmp 0x4177b4
cmp dword [ebp - 0x1c], 0
je 0x4177b4
push dword [ebx]
xor edi, edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], edi
call fcn.00401eb6
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
call fcn.00401723
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
call fcn.00401723
mov byte [ebp - 4], 2
inc edi
cmp dword [ebp - 0x1c], 1
jle 0x417780
push dword [ebx + edi*4]
lea ecx, [ebp - 0x14]
call fcn.00401e7b
push ecx
push 0x43c248
lea ecx, [ebp - 0x14]
call fcn.0040301f
test eax, eax
jle 0x417725
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x80]
call fcn.00402d50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7c]
mov edx, eax
mov dword [esp], 0x43af10
call fcn.00401582
pop ecx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.00403084
lea ecx, [ebp - 0x7c]
call fcn.00401f18
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.00401f18
push 0x43c248
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x88]
call fcn.00401582
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
push ecx
mov edx, eax
lea ecx, [ebp - 0x84]
call fcn.00402db7
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.00403084
lea ecx, [ebp - 0x84]
call fcn.00401f18
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 2
call fcn.00401f18
inc edi
cmp edi, dword [ebp - 0x1c]
jl 0x4176c5
push 5
push dword [ebp - 0x78]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push str.open
push 0
call dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x18]
call fcn.00401f18
lea ecx, [ebp - 0x14]
call fcn.00401f18
lea ecx, [ebp - 0x20]
call fcn.00401f18
xor eax, eax
inc eax
call fcn.00431908
ret 8