joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4077e2
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x20]
mov dword [0x7f379c], 0x4c
mov dword [0x7f3798], 0x55004e
test esi, esi
je 0x407863
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
sub esp, 0x1c
mov dword [esp + 0x14], ecx
movaps xmm0, xmmword [0x40b420]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push 0x7f3798
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x4079d0
cmp eax, 0x400
jg 0x4079d0
push 0x400
push 0x7f2f94
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x4079d0
cmp eax, 0x400
jg 0x4079d0
mov esi, 0x7f2f94
push esi
push 0x7f3798
push str._ls_ls_r_n
push 0x7f2b94
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edi, eax
mov eax, dword [0x40a004]
mov eax, dword [eax]
push dword [eax + 0x128]
push esi
call fcn.004079d8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
sub esp, 0x1c
mov dword [esp + 0x14], ecx
movaps xmm0, xmmword [0x40b430]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4079d0
mov esi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
add eax, edi
add eax, 0xa
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x4079c9
mov ebx, eax
mov eax, esp
push 0
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4079c9
cmp dword [esp], ebp
jne 0x4079c9
push str._Rename__r_n
push ebx
call fcn.004075ac
test eax, eax
je 0x407979
add eax, 0xa
push 0x40b6a7
push eax
call fcn.004075ac
test eax, eax
je 0x40798b
mov ecx, ebp
add ecx, ebx
cmp ecx, eax
jbe 0x407974
mov dl, byte [ecx]
mov byte [ecx + edi], dl
lea edx, [ecx - 1]
mov ecx, edx
cmp edx, eax
ja 0x407966
sub eax, ebx
inc eax
jmp 0x40798d
lea eax, [ebx + ebp]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add ebp, 0xa
mov eax, ebp
test edi, edi
je 0x4079a5
mov ecx, ebx
add ecx, eax
xor eax, eax
mov dl, byte [eax + 0x7f2b94]
mov byte [ecx + eax], dl
inc eax
cmp edi, eax
jne 0x407997
add ebp, edi
xor edi, edi
push edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 4]
push edi
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407d7f
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp dword [esp + 0x28], 0
mov dword [esp + 8], 0x4000
setne dl
shl edx, 8
or edx, 0x20019
mov esi, esp
push esi
push edx
push ecx
push eax
call fcn.00407d16
test eax, eax
jne 0x407df9
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
push edi
push ecx
push 0
push dword [esp + 0x30]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [edi + 0x3ffe], 0
test esi, esi
jne 0x407df9
mov eax, dword [esp + 4]
add eax, 0xfffffffd
cmp eax, 0xfffffffd
ja 0x407dfe
mov word [edi], 0
add esp, 0xc
pop esi
pop edi
ret 0x14

Function at 0x407ee1
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push edi
push esi
push eax
cmp dword [esp + 0x10], 0
je 0x407f0e
mov eax, dword [0x418040]
cmp eax, 0xffffffff
je 0x407efc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x418040], 0xffffffff
add esp, 4
pop esi
pop edi
ret 4
cmp dword [0x7fbf98], 0
je 0x407f06
cmp word [0x7fbf9c], 0
mov eax, dword [0x418040]
je 0x407f7d
cmp eax, 0xffffffff
jne 0x407f7d
mov edi, 0x7fbf9c
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
cmove eax, esi
sub esp, 0x1c
mov dword [esp + 0x14], eax
movaps xmm0, xmmword [0x40b440]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x418040], eax
cmp eax, 0xffffffff
je 0x407f06
push 2
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [0x418040]
cmp eax, 0xffffffff
je 0x407f06
mov esi, 0x7fc79c
push 0x40b76a
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [0x418040]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov ecx, esp
push 0
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x407f06

Function at 0x40816e
Capabilities:
Get common file path

Disassembly:
push edi
push esi
sub esp, 0x23c
mov edi, dword [esp + 0x248]
mov esi, esp
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, 0x105
cmovb ecx, eax
test ecx, ecx
je 0x4081a6
xor eax, eax
cmp word [esp + ecx*2 - 2], 0x5c
sete al
jmp 0x4081a9
xor eax, eax
inc eax
lea ecx, [esp + ecx*2]
lea eax, [eax*2 + 0x40b4ae]
push edi
push eax
push str._s_S.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add esp, 0x23c
pop esi
pop edi
ret 4
Function at 0x4082a8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
cmp dword [0x7fd9f0], 0
jne 0x4082e4
xor eax, eax
mov edx, 8
mov esi, eax
mov edi, esi
shr edi, 1
and esi, 1
neg esi
and esi, 0xedb88320
xor esi, edi
dec edx
jne 0x4082c1
mov dword [eax*4 + 0x7fd9ec], esi
inc eax
cmp eax, 0x100
jne 0x4082ba
mov eax, dword [esp + 0x10]
test ecx, ecx
je 0x40830d
mov edx, dword [esp + 0x14]
not eax
xor esi, esi
mov bl, byte [edx + esi]
xor bl, al
movzx edi, bl
shr eax, 8
xor eax, dword [edi*4 + 0x7fd9ec]
inc esi
cmp ecx, esi
jne 0x4082f4
not eax
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x43b617
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
mov edx, dword [esp]
add esp, 4
mov edi, ebx
call fcn.0043b652
add ebx, 0xb3ba4b37
xor dword [ecx], edx
mov edi, 0x10c4b91a
dec ebx
and ebx, edi
inc ecx
dec edi
add ebx, 0x21b86e81
add ebx, ebx
cmp ecx, eax
jne fcn.0043b617
sub ebx, edi
or edi, edi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x53ff56be
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x12205040
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x405680
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov byte [ebp - 0x25], al
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 5]
call fcn.00405720
lea ecx, [ebp - 0x20]
call fcn.004079a0
movzx edx, al
test edx, edx
jne 0x405705
lea eax, [ebp - 0x24]
push eax
push 0x4824c0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x405705
mov dword [ebp - 0x30], 1
lea ecx, [ebp - 0x20]
call fcn.00407a20
shl eax, 1
push eax
lea ecx, [ebp - 0x20]
call fcn.00407a40
push eax
push 1
push 0
push str.Self
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x20]
call fcn.00407b40
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret

Function at 0x405820
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 8]
test eax, eax
je 0x405888
lea ecx, [ebp - 0xc]
push ecx
push 0xf003f
push 0
push 0x4824f0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x405886
mov dword [ebp - 8], 1
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push 0x482564
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4058c5
lea edx, [ebp - 0x10]
push edx
push 0xf003f
push 0
push 0x482598
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4058c5
push str.EnableLinkedConnections
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret
Function at 0x415cb0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
je 0x415cc6
mov al, 1
jmp 0x415d23
push 0xf0000000
push 1
push 0x494ac8
push 0
mov ecx, dword [ebp - 8]
add ecx, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x415d21
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x80090016
jne 0x415d1d
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
mov edx, dword [ebp - 8]
add edx, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x415d14
mov byte [ebp - 1], 1
jmp 0x415d18
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
jmp 0x415d23
xor al, al
jmp 0x415d23
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x415d30
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
je 0x415d46
mov al, 1
jmp 0x415d9a
push 0
push 0x18
push 0
push 0
mov ecx, dword [ebp - 8]
add ecx, 8
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x415d98
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x80090016
jne 0x415d94
push 8
push 0x18
push 0
push 0
mov edx, dword [ebp - 8]
add edx, 8
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x415d8b
mov byte [ebp - 1], 1
jmp 0x415d8f
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
jmp 0x415d9a
xor al, al
jmp 0x415d9a
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x415da0
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 9], 0
mov ecx, dword [ebp + 8]
call fcn.004079a0
movzx eax, al
test eax, eax
je 0x415dce
mov al, byte [ebp - 9]
jmp 0x415e73
mov dword [ebp - 8], 0
push 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.00407e90
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x415e70
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x415e70
push 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.00407e90
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x415e5d
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x415e5d
mov byte [ebp - 9], 1
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov al, byte [ebp - 9]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4
Function at 0x416ba0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4710c0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], ecx
xor eax, eax
mov byte [ebp - 0x41], al
push 0xc
lea ecx, [ebp - 0x20]
call fcn.004015c0
lea ecx, [ebp - 0x20]
call fcn.004066a0
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], 0
jmp 0x416bfd
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x1a
jae 0x416cae
movzx edx, word [ebp - 0x40]
add edx, 0x41
mov word [ebp - 0x3c], dx
movzx eax, word [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x11]
call fcn.00416cf0
lea ecx, [ebp - 0x38]
call fcn.004079a0
movzx edx, al
test edx, edx
jne 0x416c49
lea eax, [ebp - 0x38]
push eax
call fcn.00401650
add esp, 4
push eax
lea ecx, [ebp - 0x20]
call fcn.00411e50
jmp 0x416ca1
mov edx, 1
mov ecx, dword [ebp - 0x40]
shl edx, cl
and edx, dword [ebp - 0x4c]
je 0x416ca1
mov ax, word [ebp - 0x3c]
mov word [ebp - 0x48], ax
lea ecx, [ebp - 0x46]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x58]
call fcn.00401bb0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x38]
call fcn.00416e90
push 0x48369c
lea ecx, [ebp - 0x38]
call fcn.00416920
lea eax, [ebp - 0x38]
push eax
call fcn.00401650
add esp, 4
push eax
lea ecx, [ebp - 0x20]
call fcn.00411e50
lea ecx, [ebp - 0x38]
call fcn.00407b40
jmp 0x416bf4
lea ecx, [ebp - 0x20]
push ecx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407460
lea ecx, [ebp - 0x20]
call fcn.004078b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4

Function at 0x417ce0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470ed0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 0xc]
call fcn.004079a0
movzx eax, al
test eax, eax
jne 0x417d7f
push 0
push 0x104
lea ecx, [ebp - 0x28]
call fcn.00407c30
lea ecx, [ebp - 0x28]
call fcn.00407a20
push eax
push 0
lea ecx, [ebp - 0x28]
call fcn.00407a90
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00407a40
push eax
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov dword [ebp - 0x2c], eax
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004079d0
lea edx, [ebp - 0x28]
push edx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407ba0
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov eax, dword [ebp + 8]
jmp 0x417d8f
push 0x488edc
mov ecx, dword [ebp + 8]
call fcn.00407cd0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 8
Function at 0x418ba0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471280
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x49f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x70]
call fcn.0041a6a0
push eax
push 1
mov ecx, dword [ebp - 0x10]
call fcn.004198c0
lea ecx, [ebp - 0x70]
call fcn.00419100
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00418920
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x30], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41c590
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470ed0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0x104
push 0
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407c30
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp - 0x28]
call fcn.00407a90
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x41c618
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004079d0
lea edx, [ebp - 0x28]
push edx
call fcn.00401650
add esp, 4
push eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call fcn.0041c9f0
jmp 0x41c620
lea ecx, [ebp - 0x28]
call fcn.00407ac0
lea ecx, [ebp - 0x28]
push ecx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407ba0
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 8

Function at 0x41c770
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471760
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x14]
call fcn.00403840
push 0xc
lea ecx, [ebp - 0x20]
call fcn.004015c0
lea ecx, [ebp - 0x20]
call fcn.004066a0
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], 0
jmp 0x41c7d4
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x1a
jae 0x41c86e
movzx edx, word [ebp - 0x40]
add edx, 0x41
mov word [ebp - 0x3c], dx
movzx eax, word [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041c8b0
lea ecx, [ebp - 0x38]
call fcn.004079a0
movzx edx, al
test edx, edx
je 0x41c861
mov eax, 1
mov ecx, dword [ebp - 0x40]
shl eax, cl
and eax, dword [ebp - 0x4c]
jne 0x41c861
mov cx, word [ebp - 0x3c]
mov word [ebp - 0x44], cx
lea edx, [ebp - 0x42]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x54]
call fcn.00401bb0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x38]
call fcn.00416e90
push 0x494d74
lea ecx, [ebp - 0x38]
call fcn.00416920
lea eax, [ebp - 0x38]
push eax
call fcn.00401650
add esp, 4
push eax
lea ecx, [ebp - 0x20]
call fcn.00411e50
lea ecx, [ebp - 0x38]
call fcn.00407b40
jmp 0x41c7cb
lea ecx, [ebp - 0x20]
push ecx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407460
lea ecx, [ebp - 0x20]
call fcn.004078b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4
Function at 0x41d370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470e50
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 8]
call fcn.004079a0
movzx eax, al
test eax, eax
je 0x41d3b1
xor al, al
jmp 0x41d48f
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401650
add esp, 4
push eax
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp - 0x38]
call fcn.0041d4b0
lea ecx, [ebp - 0x2c]
call fcn.004079a0
movzx eax, al
test eax, eax
je 0x41d3ed
mov byte [ebp - 0x2d], 0
lea ecx, [ebp - 0x2c]
call fcn.00407b40
mov al, byte [ebp - 0x2d]
jmp 0x41d48f
mov ecx, 0x4a3ac0
call fcn.00412340
push eax
lea ecx, [ebp - 0x2c]
call fcn.00416940
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x2c]
call fcn.00407a40
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffff
je 0x41d480
mov dword [ebp - 0x14], 0
push 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, 0x4a3ac0
call fcn.00412360
mov ecx, eax
call fcn.00407a20
push eax
mov ecx, 0x4a3ac0
call fcn.00412360
mov ecx, eax
call fcn.00407e90
push eax
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov byte [ebp - 0x2e], 1
lea ecx, [ebp - 0x2c]
call fcn.00407b40
mov al, byte [ebp - 0x2e]
jmp 0x41d48f
mov byte [ebp - 0x2f], 0
lea ecx, [ebp - 0x2c]
call fcn.00407b40
mov al, byte [ebp - 0x2f]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4