joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x74e41000
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x595e1d6f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x414dd0
Capabilities:
Encode data using xor

Disassembly:
xor dword [esi], ebx
sub ecx, edx
dec edi
add esi, 4
sub edi, 0x5c10b2d1
and edx, edi
sub edi, 0xaa17580d
cmp esi, eax
jne fcn.00414dd0
sub ecx, 1
and ecx, ecx
add ecx, ecx
ret
Function at 0x401210
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x52c
lea edx, [esp + 0x144]
push ebx
mov ebx, dword [esp + 0x534]
push ebp
push edi
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40122b
lea edi, [esp + 0x150]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
mov eax, dword [0x403024]
mov cl, byte [0x403028]
dec edi
push edx
mov dword [edi], eax
lea eax, [esp + 0x154]
push eax
mov byte [edi + 4], cl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0xc], ebp
je 0x40131a
push esi
test byte [esp + 0x14], 0x10
je 0x401305
mov edi, dword [esp + 0x544]
mov ecx, 5
lea esi, [esp + 0x40]
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x401305
mov esi, dword [0x41c810]
mov eax, ebx
lea ecx, [esi + esi*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ebp, [ecx*8 + 0x4039a0]
mov edx, ebp
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4012b4
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x403020]
or ecx, 0xffffffff
mov word [edi - 1], ax
lea edi, [esp + 0x40]
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x41c810], esi
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ebp, dword [esp + 0x10]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401276
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebp
pop ebx
add esp, 0x52c
ret
Function at 0x401330
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x41c810]
sub esp, 0x7d8
cmp eax, 0x63
push ebx
push ebp
push esi
push edi
ja 0x401433
mov ebx, dword [esp + 0x7ec]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push str.Inno_Setup:_Icon_Group
push ebx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0x3e8
call ebp
test eax, eax
jne 0x401433
mov ecx, 2
mov edi, 0x403050
lea esi, [esp + 0x18]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x401433
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push 0
mov edi, 1
mov esi, 0x3e8
push str.Inno_Setup:_App_Path
push ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], esi
call ebp
test eax, eax
jne 0x401433
mov eax, dword [0x41c810]
lea ecx, [esp + 0x18]
lea edx, [eax + eax*4]
inc eax
mov dword [0x41c810], eax
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
lea edx, [edx*8 + 0x4039a0]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4013ec
lea eax, [esp + 0x14]
lea ecx, [esp + 0x400]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push str.DisplayName
push ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], esi
call ebp
test eax, eax
jne 0x401433
lea eax, [esp + 0x400]
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00401210
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7d8
ret

Function at 0x401440
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x3ec
lea eax, [esp + 4]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push esi
push edi
mov edi, dword [esp + 0x3fc]
xor esi, esi
push 0x3e8
push eax
push esi
push edi
call ebx
test eax, eax
jne 0x4014b5
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0xf003f
push 0
push edx
push edi
inc esi
call ebp
test eax, eax
jne 0x4014a2
mov eax, dword [esp + 0x10]
push eax
call fcn.00401330
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x14]
push 0x3e8
push edx
push esi
push edi
call ebx
test eax, eax
je 0x401471
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x3ec
ret

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rdata
mov ebx, 0x40de38
nop
mov ecx, 0x388d604f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x807283
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4911bf]
shl eax, 2
mov dword [0x4911c3], eax
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
shr al, 1
dec edx
adc eax, 0xe85a0008
dec esp
or byte [eax], cl
add al, ch
inc ebx
adc eax, 0x6a0008
call fcn.00483880
pop ecx
push 0x491168
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4911c7], eax
push 0
jmp fcn.0048d5a8
Function at 0x406184
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
cmp edx, 0x11
jle 0x4061a4
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x44], ecx
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x38], ecx
xor ecx, ecx
mov dword [eax + edx*4], ecx
dec edx
cmp edx, 0x11
jg 0x40618b
cmp dword [eax], 0x11
jbe 0x4061bf
mov dword [eax], 0x11
jmp 0x4061b3
dec dword [eax]
mov edx, dword [eax]
test edx, edx
je 0x4061bf
cmp dword [eax + edx*4], 0
je 0x4061b1
ret

Function at 0x4069f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [esi]
cmp eax, dword [ebx]
jae 0x406a3f
mov eax, 1
jmp 0x406a18
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi]
jbe 0x406a0e
mov ecx, dword [ebx]
mov edx, eax
sub ecx, dword [esi]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, ebx
add edx, edi
push ecx
push edx
call fcn.00482810
add esp, 0xc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x406aa4
mov eax, dword [esi]
cmp eax, dword [ebx]
jbe 0x406a7d
mov eax, 1
jmp 0x406a56
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebx]
jbe 0x406a4c
mov ecx, dword [esi]
mov edx, eax
sub ecx, dword [ebx]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, esi
add edx, edi
push ecx
push edx
call fcn.00482810
add esp, 0xc
mov eax, dword [esi]
mov dword [edi], eax
jmp 0x406aa4
mov eax, dword [ebx]
test eax, eax
jbe 0x406a90
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
jne 0x406a90
dec eax
test eax, eax
ja 0x406a83
mov dword [edi], eax
test eax, eax
jbe 0x406aa4
mov ecx, dword [esi + eax*4]
xor ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
ja 0x406a96
pop edi
pop esi
pop ebx
ret
Function at 0x408270
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff790
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 0x35], dl
mov ebx, eax
mov eax, 0x491bb8
call fcn.00482ea0
cmp byte [ebx + 0x5d71], 0
mov eax, dword [ebx + 0x13b8]
je 0x4082ae
cmp byte [eax + 0x18c9], 0
jne 0x4082ae
cmp byte [ebx + 0x5d6c], 0
je 0x4082bf
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
mov eax, edx
jmp 0x408453
mov word [ebp - 0x24], 8
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.0040d718
inc dword [ebp - 0x18]
xor edx, edx
mov word [ebp - 0x24], 0x14
movzx eax, word [ebx + 0x3694]
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebx + 0x3698]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, ebx
xor edx, edx
call fcn.004091a4
mov eax, ebx
call fcn.00404b38
cmp byte [ebp - 0x35], 0
je 0x40833c
push pe_nt_image_headers32
lea edx, [ebp - 0x238]
push edx
push dword [0x4ad5b4]
call sub.USER32.DLL_GetWindowTextA
mov eax, 0x34a
call fcn.00410804
call fcn.0046c1ec
call fcn.0046b7e4
mov edx, dword [ebx + 0x3670]
sub edx, 0x76
je 0x408354
sub edx, 3
je 0x40838e
dec edx
je 0x4083a0
jmp 0x4083d9
test byte [ebx + 0x368c], 0x20
jne 0x40837c
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040d784
mov ecx, dword [ebp - 0x34]
mov dword fs:[0], ecx
jmp 0x408453
lea ecx, [ebp - 0x870]
mov dl, byte [ebp - 0x35]
mov eax, ebx
call fcn.00407b7c
jmp 0x4083d9
lea ecx, [ebp - 0x870]
mov dl, byte [ebp - 0x35]
mov eax, ebx
call fcn.0040845c
jmp 0x4083d9
push 0x491aac
lea eax, [ebx + 0x43d4]
push eax
call fcn.004829b4
add esp, 8
test eax, eax
sete dl
and edx, 1
test dl, dl
je 0x4083d2
lea ecx, [ebp - 0x870]
mov dl, byte [ebp - 0x35]
mov eax, ebx
call fcn.0040869c
jmp 0x4083d9
mov byte [ebp - 0x23a], 1
cmp byte [ebp - 0x35], 0
je 0x4083ef
lea eax, [ebp - 0x238]
call fcn.0046c1ec
call fcn.0046b7e4
test esi, esi
je 0x408404
push esi
mov edi, esi
lea esi, [ebp - 0x870]
mov ecx, 0x18e
rep movsd dword es:[edi], dword [esi]
pop esi
cmp byte [ebp - 0x23a], 0
je 0x408439
cmp byte [ebp - 0x35], 0
je 0x408439
mov eax, 0x2a9
call fcn.00410804
push eax
add ebx, 0x15
push ebx
call fcn.0044142c
add esp, 8
mov eax, 0x49e7d8
mov edx, 1
call fcn.00427738
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040d784
mov ecx, dword [ebp - 0x34]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408b50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x14], 0
mov edi, ecx
je 0x408b73
mov al, 1
cmp byte [ebp + 8], 0
mov esi, 0x80000000
je 0x408b84
or esi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x408b93
or dword [ebp - 8], 2
call fcn.0040e9e0
test eax, eax
je 0x408bbf
test edi, edi
je 0x408bbf
cmp word [edi], 0
je 0x408bbf
push 0
push 0x8000000
push 3
push 0
push dword [ebp - 8]
push esi
push edi
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
jmp 0x408bd8
push 0
push 0x8000000
push 3
push 0
push dword [ebp - 8]
push esi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x408bf1
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x408bf1
mov dword [ebx + 0xc18], 1
xor eax, eax
cmp esi, 0xffffffff
mov byte [ebx + 0x12], 0
setne dl
mov dword [ebx + 0xc], eax
and edx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x408c3e
mov dword [ebx + 4], esi
test edi, edi
je 0x408c26
lea eax, [ebx + 0x416]
mov edx, edi
call fcn.0040eac4
jmp 0x408c2f
mov word [ebx + 0x416], 0
push dword [ebp - 4]
add ebx, 0x15
push ebx
call fcn.00482a00
add esp, 8
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x408e40
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0xc], 0
jne 0x408e4f
cmp byte [ebx + 0x13], 0
jne 0x408e53
xor eax, eax
pop ebx
ret
cmp dword [ebx + 4], 0xffffffff
je 0x408e60
mov eax, ebx
call fcn.00408db4
call fcn.0040e9e0
test eax, eax
je 0x408e89
cmp word [ebx + 0x416], 0
je 0x408e89
add ebx, 0x416
push ebx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
setne al
and eax, 1
jmp 0x408e9a
add ebx, 0x15
push ebx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
setne al
and eax, 1
pop ebx
ret
Function at 0x408eec
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, ecx
test esi, esi
mov edi, eax
mov dword [esp], edx
je 0x40904c
mov eax, dword [edi + 0xc]
test eax, eax
je 0x408f27
dec eax
je 0x408f11
dec eax
je 0x408f1d
jmp 0x408f27
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x408f27
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x408f79
xor ebp, ebp
cmp esi, ebp
jle 0x408f95
push 0
lea eax, [esp + 8]
push eax
mov edx, esi
sub edx, ebp
cmp edx, 0x4000
jge 0x408f4c
mov ecx, esi
sub ecx, ebp
jmp 0x408f51
mov ecx, 0x4000
push ecx
mov eax, dword [esp + 0xc]
add eax, ebp
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x408f95
add ebp, 0x4000
cmp esi, ebp
jg 0x408f33
jmp 0x408f95
push 0
lea eax, [esp + 8]
push eax
push esi
push dword [esp + 0xc]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
jne 0x409048
cmp dword [edi + 0xc], 0
jne 0x409048
mov eax, edi
call fcn.00409220
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lea ebp, [edi + 0x15]
mov eax, ebp
call fcn.00409820
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x408fd4
cmp eax, dword [esp]
pop edx
pop eax
jae 0x409021
jmp 0x408fd8
pop edx
pop eax
jge 0x409021
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x408ffa
cmp eax, 0xffffffff
ja 0x409021
jmp 0x408ffc
jg 0x409021
mov eax, esi
cdq
add eax, dword [esp + 8]
adc edx, dword [esp + 0xc]
cmp edx, 0
jne 0x409013
cmp eax, 0xffffffff
jbe 0x409021
jmp 0x409015
jle 0x409021
mov edx, ebp
mov eax, 0x49e7d8
call fcn.004275b8
mov edx, ebp
mov eax, 0x49e7d8
call fcn.004275ec
test al, al
jne 0x408f27
mov edx, ebp
mov eax, 0x49e7d8
call fcn.00427584
jmp 0x409048
mov byte [edi + 8], 1
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x409124
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x40914b
cmp esi, 0x4e20
jle 0x409141
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40919c
mov eax, ebx
call fcn.00409478
test al, al
je 0x409183
cmp esi, 0x4e20
jle 0x409183
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.00409124
jmp 0x40919f
cmp dword [ebx + 0xc], 1
jne 0x409197
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x409197
xor eax, eax
jmp 0x40919f
or eax, 0xffffffff
jmp 0x40919f
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x409580
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.0040e9e0
test eax, eax
je 0x4095a6
test ebx, ebx
je 0x4095a6
cmp word [ebx], 0
je 0x4095a6
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x4095ae
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x4095c1
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.00409cb4
xor eax, eax
jmp 0x4095dc
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x4095d0
cmp eax, 3
jne 0x4095d7
mov eax, 2
jmp 0x4095dc
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x4097e4
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffc00
mov edx, esp
call fcn.0040b2d8
cmp byte [esp], 0
je 0x4097fb
mov eax, esp
jmp 0x4097fd
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x409811
cmp eax, 5
je 0x409811
xor edx, edx
jmp 0x409816
mov edx, 1
mov eax, edx
add esp, 0x400
ret

Function at 0x409820
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
add esp, 0xfffffbd0
mov ebx, eax
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.0040b2d8
cmp dword [0x491cc4], 0
jne 0x40985e
push 0x491cc8
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
test esi, esi
je 0x40985e
push str.GetDiskFreeSpaceExA
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x491cc4], eax
cmp dword [0x491cc4], 0
je 0x4098cd
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.0040ae44
xor ecx, ecx
lea eax, [esp + 8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
push eax
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x18]
push eax
cmp byte [esp + 0x3c], 0
je 0x409898
lea edx, [esp + 0x3c]
jmp 0x40989a
xor edx, edx
push edx
call dword [0x491cc4]
test eax, eax
je 0x4098cd
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0xc]
ja 0x4098cd
mov eax, dword [esp + 0x14]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [esp + 0x18]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
jmp 0x40993a
lea ecx, [esp + 0x24]
push ecx
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x24]
push ecx
cmp byte [esp + 0x40], 0
je 0x4098ee
lea eax, [esp + 0x40]
jmp 0x4098f0
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
jne 0x409903
mov eax, 0x163e00
xor edx, edx
jmp 0x40993a
mov eax, dword [esp + 0x18]
imul dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
call fcn.00489b8c
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
add esp, 0x430
pop esi
pop ebx
ret
Function at 0x409944
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040e9e0
test eax, eax
je 0x40996f
test ebx, ebx
je 0x40996f
cmp word [ebx], 0
je 0x40996f
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x409c88
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040e9e0
test eax, eax
je 0x409caa
test ebx, ebx
je 0x409caa
cmp word [ebx], 0
je 0x409caa
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
pop esi
pop ebx
ret

Function at 0x409cb4
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.0040e9e0
test eax, eax
je 0x409ce1
test ebx, ebx
je 0x409ce1
cmp word [ebx], 0
je 0x409ce1
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x409cf0
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x409e38
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9b4
push ebx
push esi
push edi
mov edi, eax
mov eax, 0x491d98
call fcn.00482ea0
mov word [ebp - 0x30], 8
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.0040d718
inc dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov word [ebp - 0x30], 0x14
mov word [ebp - 0x30], 0x20
mov edx, 0x10000
call fcn.004027d0
inc dword [ebp - 0x24]
xor ecx, ecx
mov word [ebp - 0x30], 0x14
or esi, 0xffffffff
mov dword [ebp - 0x44], ecx
cmp dword [0x4ad5b4], 0
je 0x409eb8
lea eax, [ebp - 0x24c]
call fcn.0046c214
push pe_nt_image_headers32
lea edx, [ebp - 0x44c]
push edx
push dword [0x4ad5b4]
call sub.USER32.DLL_GetWindowTextA
mov eax, edi
call fcn.0040940c
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push 0
push 0
xor edx, edx
mov eax, edi
call fcn.004091a4
jmp 0x409f52
inc dword [ebp - 0x44]
mov edx, dword [ebp - 0x44]
test dl, 0xf
jne 0x409f2c
cmp dword [0x4ad5b4], 0
je 0x409f27
mov eax, dword [ebp - 0x44]
shl eax, 0x10
cdq
push edx
push eax
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call fcn.0040d5f8
push eax
mov eax, 0x51e
call fcn.00410804
push eax
lea edx, [ebp - 0x64c]
push edx
call fcn.00486578
add esp, 0xc
lea eax, [ebp - 0x64c]
call fcn.0046c224
call fcn.0046b7e4
call fcn.0040e520
mov ecx, ebx
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040ef9c
cmp dword [ebp + 0xc], 0x80000000
mov esi, eax
jne 0x409f47
cmp dword [ebp + 8], 0
je 0x409f52
mov eax, ebx
cdq
sub dword [ebp + 8], eax
sbb dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0x80000000
jne 0x409f68
cmp dword [ebp + 8], 0
jne 0x409f68
mov ecx, 0x10000
jmp 0x409f87
cmp dword [ebp + 0xc], 0
jne 0x409f79
cmp dword [ebp + 8], 0x10000
jbe 0x409f82
jmp 0x409f7b
jle 0x409f82
mov ecx, 0x10000
jmp 0x409f87
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [ebp - 0x1c]
mov eax, edi
call fcn.00409054
mov ebx, eax
test eax, eax
jne 0x409ed4
cmp dword [0x4ad5b4], 0
je 0x409fbf
lea eax, [ebp - 0x24c]
call fcn.0046c224
lea eax, [ebp - 0x44c]
call fcn.0046c1ec
call fcn.0046b7e4
mov eax, esi
mov edx, 2
xor eax, 0xffffffff
push eax
lea eax, [ebp - 0x1c]
dec dword [ebp - 0x24]
call fcn.00401780
dec dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040d784
pop eax
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40e520
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x49292c], 0
jne 0x40e539
call fcn.0048e410
mov dword [0x492928], eax
inc byte [0x49292c]
call fcn.0048e410
sub eax, dword [0x492928]
cmp eax, 0x64
jle 0x40e575
cmp dword [0x4afc18], 0
je 0x40e570
mov eax, 0x49e7d8
mov edx, 0xff
call fcn.00427738
mov eax, 0x49e7d8
mov edx, 0xff
call fcn.00427720
call fcn.00440e74
ret