joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412de0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b1d2
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
push esi
push edi
mov eax, dword [0x44a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
call fcn.004230b2
add esp, 4
push eax
call fcn.00424890
mov edx, dword [ebx + 0x14]
add esp, 4
mov dword [esi + 8], 0
xorps xmm0, xmm0
movq qword [esi], xmm0
test edx, edx
je 0x412e97
mov ecx, edx
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412e50
sub ecx, edi
je 0x412e97
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412e60
sub ecx, edi
cmp ecx, 8
jbe 0x412e75
mov ecx, 8
jmp 0x412e89
mov ecx, edx
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412e80
sub ecx, edi
push ecx
push edx
push esi
mov dword [esi + 8], ecx
call fcn.00438ba0
add esp, 0xc
mov edi, dword [ebx + 8]
mov ecx, edi
mov edx, dword [ebx + 0x10]
call fcn.00412d00
mov dword [esi + 0xc], eax
test eax, eax
jns 0x412ec4
push dword [ebx + 0x10]
push edi
push str._netProxy:_Create_proxy_listen_UDP___s:_d__error._n
call fcn.0040eaf0
add esp, 0xc
or eax, 0xffffffff
jmp 0x412ff0
push 8
call fcn.0041be73
add esp, 4
lea ecx, [ebp - 0x14]
mov dword [eax], 0x4100c0
push ecx
push 0
push eax
push 0x403180
push 0xa00000
push 0
mov dword [eax + 4], esi
call fcn.0041f92d
add esp, 0x18
mov dword [esi + 0x14], eax
cmp byte [edi], 0
jne 0x412efe
xor ecx, ecx
jmp 0x412f0c
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412f03
sub ecx, edx
push ecx
push edi
lea ecx, [esi + 0x24]
call fcn.00403aa0
mov eax, dword [ebx + 0xc]
mov edi, 4
mov dword [esi + 0x3c], eax
push 8
call fcn.0041be73
add esp, 4
lea ecx, [ebp - 0x18]
mov dword [eax], 0x4100e0
push ecx
push 0
push eax
push 0x403180
push 0xa00000
push 0
mov dword [eax + 4], esi
call fcn.0041f92d
add esp, 0x18
sub edi, 1
jne 0x412f21
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
push 0x1f9c
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x40], edi
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], 0x3c
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x2c], fcn.00410100
mov dword [ebp - 0x28], 0x410110
mov dword [ebp - 0x24], 0x410120
mov dword [ebp - 0x20], 0x410140
mov dword [ebp - 0x1c], esi
call fcn.0041be73
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.00415350
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.00415670
test eax, eax
jns 0x412feb
test edi, edi
je 0x412fe9
mov ecx, edi
call fcn.00415420
push 0x1f9c
push edi
call fcn.0041beab
add esp, 8
xor edi, edi
mov dword [esi + 0x44], edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
Function at 0x4150b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push edi
lea edi, [esi + 0x60]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov edx, dword [esi + 0x9c]
lea ebx, [esi + 0x5c]
mov eax, dword [esi + 0x98]
add eax, edx
mov dword [esi + 0x90], esi
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xa0]
mov dword [esi + 0x74], 1
sub eax, edx
movups xmmword [edi], xmm0
push ebx
mov dword [ebp - 0x10], eax
mov dword [edi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [esi + 0x1c], 0
push 0
push edi
je 0x415174
lea ecx, [esi + 0x30]
xorps xmm0, xmm0
lea eax, [esi + 0x20]
mov dword [ecx], 0x10
push ecx
push eax
movups xmmword [eax], xmm0
mov edx, 2
mov word [eax], dx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x18]
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
jns 0x4151dc
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x3e5
je 0x4151dc
push dword [esi + 0x18]
call edi
push eax
push str.___UDP_WSARecvFrom_Error_d__sock_d_n
call fcn.00401410
add esp, 0xc
jmp 0x4151ae
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x18]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jns 0x4151dc
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x3e5
je 0x4151dc
call edi
push eax
push str.___WSARecv_Error_d_n
call fcn.00401410
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4151d2
push dword [esi + 0xb0]
mov eax, dword [esi + 0xac]
push esi
call eax
add esp, 4
mov ecx, esi
call fcn.00415060
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415570
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x44a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 1
push 2
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
test edi, edi
js 0x415633
push 4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
push 4
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x80000
push eax
push 0x1002
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp dword [ebx + 0x18], 0x10
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 0x14], ax
lea eax, [ebx + 4]
jb 0x4155ee
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
movzx eax, word [ebx + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x415646
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.create_listen_socket_bind_err_d_n
call fcn.00401410
add esp, 8
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
push 5
push edi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
js 0x41562c
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.0041be62
mov esp, ebp
pop ebp
ret
Function at 0x415670
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov edx, dword [edi]
mov ebx, dword [edi + 0xc]
mov dword [ebp - 4], ebx
test edx, edx
je 0x4156bc
cmp byte [edx], 0
jne 0x415693
xor ecx, ecx
jmp 0x4156aa
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp + 8], eax
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4156a0
sub ecx, dword [ebp + 8]
push ecx
push edx
lea ecx, [esi + 4]
call fcn.00403aa0
mov eax, dword [edi + 4]
mov dword [esi + 0x1c], eax
jmp 0x4156d2
push 0
push 0x44454e
lea ecx, [esi + 4]
call fcn.00403aa0
mov dword [esi + 0x1c], 0
mov eax, dword [edi + 8]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x1f98], eax
mov eax, dword [edi + 0x14]
push ebx
mov dword [esi + 0x1f88], eax
mov eax, dword [edi + 0x18]
push 0
mov dword [esi + 0x1f8c], eax
mov eax, dword [edi + 0x1c]
push 0
mov dword [esi + 0x1f90], eax
mov eax, dword [edi + 0x20]
push 0xffffffffffffffff
mov dword [esi + 0x1f94], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x41573f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateIoCompletionPort_err_d_n
call fcn.00401410
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi], 0
je 0x4157ac
mov ecx, esi
call fcn.00415570
test eax, eax
jns 0x415778
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.create_listen_socket_err_n
mov dword [esi + 0x2c], 0
call fcn.00401410
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 8
mov dword [esi + 0x28], eax
call fcn.0041be73
add esp, 4
lea ecx, [ebp + 8]
mov dword [eax], 0x4151f0
push ecx
push 0
push eax
push 0x403180
push 0x100000
push 0
mov dword [eax + 4], esi
call fcn.0041f92d
add esp, 0x18
mov dword [esi + 0x34], eax
test ebx, ebx
jle 0x4157ee
lea edi, [esi + 0x38]
push 8
call fcn.0041be73
add esp, 4
lea ecx, [ebp + 8]
mov dword [eax], 0x415200
push ecx
push 0
push eax
push 0x403180
push 0x400000
push 0
mov dword [eax + 4], esi
call fcn.0041f92d
add esp, 0x18
mov dword [edi], eax
lea edi, [edi + 4]
sub ebx, 1
jne 0x4157b3
mov ebx, dword [ebp - 4]
pop edi
mov dword [esi + 0x1f78], ebx
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x416110
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
je 0x41613c
push str.basenet::post_write_message_QUIT._n
call fcn.00401410
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ebx, dword [ebp + 8]
cmp byte [ebx + 0xa7], 0
jne 0x416161
push str.basenet::post_write_message_socket_had_colsed._n
call fcn.00401410
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
call fcn.004152d0
mov esi, eax
test esi, esi
je 0x4162ae
xorps xmm0, xmm0
lea eax, [ebx + 0x5c]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 2
cmp dword [eax], 1
jl 0x416280
cmp byte [ebx + 0xa7], 0
je 0x416280
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x4161ee
mov edx, dword [ebp + 0x18]
test edx, edx
jle 0x4161ee
cmp dword [edi + 0x24], edx
lea eax, [esi + 0x34]
cmovl edx, dword [edi + 0x24]
push edx
push ecx
push eax
mov dword [ebp + 0x18], edx
call fcn.00438ba0
mov edx, dword [ebp + 0xc]
add esp, 0xc
mov eax, dword [ebp + 0x14]
cmp edx, eax
jb 0x4161f1
mov ecx, dword [ebp + 0x18]
add ecx, eax
mov eax, dword [ebp + 0x10]
add eax, edx
cmp eax, ecx
ja 0x4161f1
mov eax, esi
add edx, 0x34
sub eax, dword [ebp + 0x14]
add edx, eax
jmp 0x4161f1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push 0
mov dword [esi + 0x20], eax
push esi
mov dword [esi + 0x1c], edx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x18], 0
push 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x28], edx
push eax
push dword [ebx + 0x18]
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jns 0x416275
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x416275
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSASend_Error_d_n
call fcn.00401410
add esp, 8
mov ecx, edi
push esi
call fcn.00415320
push 0
push ebx
push 0
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x1f84]
mov dword [esi + 0x18], eax
push dword [edi + 0x30]
mov dword [edi + 0x1f84], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str._____SHIT:_post_message__n
call fcn.00401410
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x416530
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx], 0
je 0x416559
push str.basenet::post_write_message_QUIT._n
call fcn.00401410
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 8]
cmp byte [esi + 0xa7], 0
jne 0x41657e
push str.basenet::post_write_message_socket_had_colsed._n
call fcn.00401410
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.004152d0
mov edi, eax
test edi, edi
je 0x4166ac
xorps xmm0, xmm0
lea eax, [esi + 0x5c]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 1
cmp dword [eax], 1
jl 0x41667e
cmp byte [esi + 0xa7], 0
je 0x41667e
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0x18], 0
push 0
push edi
mov eax, dword [ecx + 8]
mov esi, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [edi + 0x20], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0x24], eax
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x28], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x2c], esi
neg esi
mov dword [edi + 0x30], eax
mov dword [edi + 0x1c], edx
sbb esi, esi
mov dword [ebp - 0xc], edx
and esi, 8
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0
push eax
push dword [esi + 0x18]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jns 0x41666c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x41666c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSARecv_Error_d_n
call fcn.00401410
add esp, 8
mov ecx, ebx
push edi
call fcn.00415320
push 0
push esi
push 0
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [esi + 0xa9], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [ebx + 0x30]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x1f84]
mov dword [edi + 0x18], eax
push dword [ebx + 0x30]
mov dword [ebx + 0x1f84], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str._____SHIT:_post_message__n
call fcn.00401410
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4169c0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword fs:[0x2c]
push esi
push edi
mov edi, ecx
mov edx, dword [eax]
mov eax, dword [0x44bbb4]
cmp eax, dword [edx + 4]
jle 0x416a0c
push 0x44bbb4
call fcn.0041c1f0
add esp, 4
cmp dword [0x44bbb4], 0xffffffff
jne 0x416a0c
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x44bbb4
mov dword [0x44bbb0], eax
call fcn.0041c1b1
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeSRWLock
push dword [0x44bbb0]
call esi
push str.AcquireSRWLockExclusive
push dword [0x44bbb0]
mov dword [edi + 0x1c], eax
call esi
push str.ReleaseSRWLockExclusive
push dword [0x44bbb0]
mov dword [edi + 0x24], eax
call esi
push str.AcquireSRWLockShared
push dword [0x44bbb0]
mov dword [edi + 0x2c], eax
call esi
push str.ReleaseSRWLockShared
push dword [0x44bbb0]
mov dword [edi + 0x20], eax
call esi
push str.TryAcquireSRWLockShared
push dword [0x44bbb0]
mov dword [edi + 0x28], eax
call esi
push 0xc350
push edi
mov dword [edi + 0x30], eax
mov byte [edi + 0x34], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov eax, edi
pop edi
pop esi
ret

Function at 0x417c60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, edx
mov dword [ebp - 4], 0
push edi
mov edi, ecx
test esi, esi
je 0x417c8f
cmp byte [esi + 0x34], 0
je 0x417c88
lea eax, [esi + 0x18]
push eax
mov eax, dword [esi + 0x24]
call eax
jmp 0x417c8f
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x417ce4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._file_sync_write:_SetFilePointerEx_err_d_n
call fcn.00401410
add esp, 8
test esi, esi
je 0x417cdb
cmp byte [esi + 0x34], 0
je 0x417cd4
lea eax, [esi + 0x18]
push eax
mov eax, dword [esi + 0x2c]
call eax
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test esi, esi
je 0x417d15
cmp byte [esi + 0x34], 0
je 0x417d0e
lea ecx, [esi + 0x18]
push ecx
mov ecx, dword [esi + 0x2c]
call ecx
jmp 0x417d15
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x417d36
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._file_sync_write:_WriteFile_err_dd_n
call fcn.00401410
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x418020
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x66c
mov eax, dword [0x44a00c]
xor eax, esp
mov dword [esp + 0x668], eax
push ebx
push esi
push edi
mov edi, ecx
push edi
test dl, dl
jne 0x418061
call fcn.00425b14
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x668]
xor ecx, esp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x264]
push str._ws.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4180c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41818a
or eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x668]
xor ecx, esp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
mov ecx, 0x4460a8
lea eax, [esp + 0x3c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4180f6
test dx, dx
je 0x4180f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4180f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4180d0
xor eax, eax
jmp 0x4180fb
sbb eax, eax
or eax, 1
test eax, eax
je 0x41816f
mov eax, 0x4460ac
lea ecx, [esp + 0x3c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x41812e
test dx, dx
je 0x41812a
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41812e
add ecx, 4
add eax, 4
test dx, dx
jne 0x418108
xor eax, eax
jmp 0x418133
sbb eax, eax
or eax, 1
test eax, eax
je 0x41816f
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x3c]
push eax
push edi
lea eax, [esp + 0x470]
shr ebx, 4
push str._ws_ws
push eax
and bl, 1
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [esp + 0x468]
mov dl, bl
call fcn.00418020
test eax, eax
js 0x4181a6
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4180c0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x668]
xor ecx, esp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x674]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
Function at 0x41b640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x3c]
test eax, eax
jle 0x41b676
lea esi, [edi + 0xd4]
mov dword [esi], eax
lea eax, [esp + 0xc]
push eax
push 0
push esi
push 0x416b80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x48], eax
cmp dword [edi + 8], 0
jne 0x41b684
lea ecx, [edi + 4]
call fcn.00401c10
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0xb4
mov dword [esp + 0x20], 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], 0x417fb0
mov dword [esp + 0x28], 0x417fc0
mov dword [esp + 0x2c], 0x417fd0
mov dword [esp + 0x30], 0x417ff0
mov dword [esp + 0x34], edi
call fcn.004168a0
mov dword [edi], eax
test eax, eax
jne 0x41b6f4
push str._Create_error._n
call fcn.00401410
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov dword [edi + 0x38], esi
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41baa0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x214c
call fcn.00438a40
mov eax, dword [0x44a00c]
xor eax, esp
mov dword [esp + 0x2148], eax
mov eax, ecx
mov byte [esp + 0x144], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [eax + 0x2c]
push esi
mov ecx, dword [ebx + 0x10]
add ecx, 0x2022
mov dword [esp + 0x28], ebx
mov esi, dword [eax]
mov dword [esp + 0x24], ecx
push edi
cmp esi, eax
je 0x41bc72
mov ebx, dword [esi + 8]
lea edx, [esp + 0x48]
mov eax, ebx
sub edx, ebx
nop dword [eax + eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x41bb00
lea eax, [esp + 0x48]
push eax
call fcn.00429840
add esp, 4
lea eax, [esp + 0x48]
xor edi, edi
push str.physicaldrive
push eax
call fcn.0041e000
add esp, 8
mov dword [esp + 0x18], 0
test eax, eax
mov dword [esp + 0x1c], 0
mov eax, 1
mov dword [esp + 0x14], 0x200
cmovne edi, eax
mov byte [esp + 0xf], al
mov dword [esp + 0x20], edi
mov edi, dword [ebx + 0x414]
cmp edi, 0xffffffff
je 0x41bb6a
mov byte [esp + 0xf], 0
jmp 0x41bb82
push 0
push 0
push 3
push 0
push 3
push bind
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x41bc5b
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 8
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x7405c
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x41bbbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x34], 0
push eax
push 0x18
lea eax, [esp + 0x3c]
mov dword [esp + 0x50], 0
push eax
push 0
push 0
push 0x70000
xorps xmm0, xmm0
push edi
movups xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41bc0c
mov eax, dword [esp + 0x44]
push eax
push ebx
push str.____Get_HardDisk___s__Sector_size_d_n
mov dword [esp + 0x20], eax
call fcn.00401410
add esp, 0xc
cmp byte [esp + 0xf], 0
je 0x41bc1a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x150]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bc24
lea eax, [ebx + 0x30c]
sub ecx, edx
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x158]
push dword [esp + 0x24]
add eax, ecx
push dword [esp + 0x24]
push dword [esp + 0x30]
push str._d__lld__d__s_r_n
push eax
call fcn.00401480
add esp, 0x1c
mov eax, dword [esp + 0x24]
mov esi, dword [esi]
cmp esi, dword [eax + 0x2c]
jne 0x41baf0
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
lea edx, [esp + 0x150]
lea esi, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x41bc80
lea eax, [esp + 0x150]
sub edx, esi
push eax
push edx
push str.OK_r_nLength:__d_r_n_r_n_s
push ecx
call fcn.00401480
add esp, 0x10
mov ecx, ebx
call fcn.004189f0
mov ecx, dword [esp + 0x2154]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041be62
mov esp, ebp
pop ebp
ret 4

Function at 0x4300fb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042fdbb

Function at 0x435710
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043558f