joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403630
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0xc
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
push esi
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea edx, [esp + 4]
push edx
push 1
push esi
push 0x403530
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
pop ecx
ret

Function at 0x403680
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0xc
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
push esi
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea edx, [esp + 4]
push edx
push 1
push esi
push 0x4036d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
pop ecx
ret

Function at 0x403e9e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x403ebe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00405a06
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x403edf
test byte [esp + 8], 2
je 0x403edf
mov dword [0x40b174], 0xd
mov dword [0x40b178], 5
jmp 0x403eba
xor eax, eax
ret
Function at 0x406435
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40ac38
cmp edx, dword [eax]
je 0x406457
add eax, 8
inc ecx
cmp eax, 0x40acc8
jl 0x406448
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40ac38]
jne 0x406585
mov eax, dword [0x40b168]
cmp eax, 1
je 0x40655f
test eax, eax
jne 0x406488
cmp dword [0x40a804], 1
je 0x40655f
cmp edx, 0xfc
je 0x406585
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4064bf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407370
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00406c30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x406502
lea eax, [ebp - 0x1a4]
push eax
call fcn.00406c30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40855c
push edi
call fcn.004074f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407370
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407380
lea eax, [ebp - 0xa0]
push 0x40853c
push eax
call fcn.00407380
push dword [esi + 0x40ac3c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407380
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407460
add esp, 0x2c
pop edi
jmp 0x406585
lea eax, [ebp + 8]
lea esi, [esi + 0x40ac3c]
push 0
push eax
push dword [esi]
call fcn.00406c30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401730
Capabilities:
Get volume information via ioctl

Disassembly:
sub esp, 0x64
push ebp
mov ebp, dword [esp + 0x6c]
push 0
lea eax, [esp + 8]
push eax
push 0x60
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0x90064
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x401778
cmp dword [esp + 0x70], eax
jne 0x40176e
mov eax, dword [0x4dce6c]
push eax
call fcn.00434ad0
add esp, 4
or eax, 0xffffffff
or edx, eax
pop ebp
add esp, 0x64
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x34]
push edi
push ecx
push edx
xor edi, edi
push edi
push esi
call fcn.0046bca0
push edi
sub eax, 0x40000
push esi
sbb edx, edi
push edx
push eax
call fcn.0046bbf0
pop edi
pop esi
test edx, edx
jg 0x4017ad
jl 0x40176e
test eax, eax
jbe 0x40176e
test ebx, ebx
je 0x4017be
mov ecx, dword [esp + 0x18]
mov dword [ebx], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 4], ecx
test ebp, ebp
je 0x4017c9
mov ecx, dword [esp + 0x34]
mov dword [ebp], ecx
pop ebp
add esp, 0x64
ret

Function at 0x401a20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x2010
call fcn.0046be90
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x200c], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push esi
call edi
test eax, eax
jne 0x401a69
mov eax, 1
pop edi
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.0046be7b
add esp, 0x2010
ret
push 0
lea eax, [esp + 0xc]
push eax
push 0x2000
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401a4e
xor eax, eax
jmp 0x401a90
mov dl, byte [esp + eax + 0x10]
not dl
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0x2000
jl 0x401a90
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push esi
call edi
test eax, eax
je 0x401a4e
push 0
lea eax, [esp + 0xc]
push eax
push 0x2000
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401b59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], eax
xor eax, eax
lea ecx, [ecx]
mov dl, byte [esp + eax + 0x10]
not dl
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0x2000
jl 0x401ae0
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
xor ebx, ebx
mov edi, edi
push 1
call ebp
push 0
push 0
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x401b00
push 0
lea eax, [esp + 0x18]
push eax
push 0x2000
lea ecx, [esp + 0x24]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401b00
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
mov eax, 1
pop edi
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.0046be7b
add esp, 0x2010
ret
mov ecx, dword [esp + 0x2010]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0046be7b
add esp, 0x2010
ret
Function at 0x401df0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x34]
push edi
push esi
mov dword [esp + 0x20], eax
call fcn.0046bdb1
mov edi, eax
add esp, 4
test edi, edi
jne 0x401e1f
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x28]
push 0
push 0
push ecx
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x401e47
mov esi, 1
jmp 0x401eec
mov ecx, dword [esp + 0x34]
mov eax, esi
cdq
push edx
push eax
mov eax, dword [esp + 0x40]
push eax
push ecx
call fcn.0046bbf0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
test edx, edx
jl 0x401eea
jg 0x401e71
test eax, eax
jbe 0x401eea
push 0
lea edx, [esp + 0x14]
push edx
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401ec4
push esi
push eax
push edi
call fcn.0046bf90
mov eax, dword [esp + 0x2c]
add esp, 0xc
push 0
push 0
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x401e3d
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401e3d
mov eax, dword [esp + 0x40]
add dword [eax], 1
adc dword [eax + 4], 0
add ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
adc dword [esp + 0x20], 0
add dword [esp + 0x14], 0xffffffff
adc eax, 0xffffffff
mov dword [esp + 0x18], eax
test eax, eax
jg 0x401e71
jl 0x401eea
cmp dword [esp + 0x14], 0
ja 0x401e71
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebx, eax
call fcn.0046bcd4
add esp, 4
pop ebp
test esi, esi
je 0x401f09
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x403960
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x48ad48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4b77c0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.00403770
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4039c0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00403650
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.00403770
cmp dword [esp + 0x28], 8
jb 0x403a0d
mov eax, dword [esp + 0x14]
push eax
call fcn.0046b849
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x4070d0
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x3c
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push 0x4b8c40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40711e
mov eax, dword [0x4dce70]
push 0x10
push eax
push str.CANT_ACCESS_VOL
call fcn.0044c960
mov ecx, dword [esp + 0x54]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
add esp, 0x3c
ret
cmp dword [0x4b5118], esi
je 0x40713e
push 0
lea edx, [esp + 0xc]
push edx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov esi, eax
neg esi
sbb esi, esi
neg esi
push ebx
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov ebx, dword [esp + 0x14]
and ebx, 0x200
test esi, esi
je 0x407171
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x3c
ret

Function at 0x407190
Capabilities:
Get file size
Timestomp file

Disassembly:
sub esp, 0x10
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push 0x4b8c40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4071de
mov eax, dword [0x4dce70]
push 0x10
push eax
push str.CANT_ACCESS_VOL
call fcn.0044c960
mov ecx, dword [esp + 0x28]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
cmp dword [0x4b5118], esi
je 0x4071fe
push 0
lea edx, [esp + 0xc]
push edx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov esi, eax
neg esi
sbb esi, esi
neg esi
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x407253
mov ecx, dword [0x4dce70]
push 0x10
push ecx
push str.CANT_GET_VOLSIZE
call fcn.0044c960
mov edx, dword [esp + 0x28]
add esp, 4
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
test esi, esi
je 0x407244
push 0
lea eax, [esp + 0xc]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
test esi, esi
je 0x407267
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [eax], edx
mov dword [eax + 4], ecx
mov eax, 1
pop esi
add esp, 0x10
ret
Function at 0x407b80
Capabilities:
Get disk information

Disassembly:
sub esp, 0x8c
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
mov ebx, dword [esp + 0x98]
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0xa4]
push edi
mov edi, dword [esp + 0xa0]
push 0x88
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0046bf90
add esp, 0xc
call fcn.00433200
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x407be1
mov dword [esi], 0xfffffffe
mov eax, 0x16
jmp 0x407c44
mov ecx, dword [esp + 0xb0]
push 0
push str.MountVolumesRemovable
mov dword [esp + 0x18], ecx
call fcn.004384a0
mov edx, dword [0x4b5118]
push 1
mov dword [esp + 0x20], eax
xor eax, eax
push eax
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push ebp
mov dword [esp + 0x3c], edx
mov edx, dword [esi]
push ebx
push edx
push edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0xbc], eax
call fcn.0043f440
add esp, 0x2c
cmp eax, 1
jge 0x407c42
mov dword [esi], 0xfffffffd
mov eax, 0x18
jmp 0x407c44
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046be7b
add esp, 0x8c
ret
Function at 0x40ba70
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x4b9494]
test eax, eax
jne 0x40bb01
mov ecx, dword [0x4b9498]
test ecx, ecx
jne 0x40bb01
mov edx, dword [0x4b9490]
test edx, edx
jne 0x40bb01
mov eax, dword [0x4b9408]
test eax, eax
jne 0x40baa3
call fcn.00407290
test eax, eax
je 0x40bb01
call fcn.00434e70
mov ecx, dword [0x4dce6c]
push 0
push 0x1e
push 0x101
mov dword [0x4b940c], 1
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x4b9490], 0
mov dword [0x4b9498], 1
call fcn.0040aca0
mov edx, dword [0x4dce6c]
push edx
push 0
push 0x408d20
mov dword [0x4b9910], 0x49059c
call fcn.0046d420
add esp, 0xc
ret

Function at 0x40d3e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48b423
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push esi
mov eax, dword [0x4b77c0]
xor eax, esp
push eax
lea eax, [esp + 0x150]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x158], ebx
call sub.SHELL32.dll_IsUserAnAdmin
test eax, eax
je 0x40d44f
cmp dword [esp + 0x178], 0x10
jb 0x40d445
mov eax, dword [esp + 0x164]
push eax
call fcn.0046b849
add esp, 4
mov eax, 1
jmp 0x40d572
call fcn.004378f0
test eax, eax
jne 0x40d480
call sub.SHELL32.dll_IsUserAnAdmin
cmp dword [esp + 0x178], 0x10
mov esi, eax
jb 0x40d479
mov ecx, dword [esp + 0x164]
push ecx
call fcn.0046b849
add esp, 4
mov eax, esi
jmp 0x40d572
push 0x104
lea edx, [esp + 0x4c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 7
push str._q_UAC
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.0040c450
lea eax, [esp + 0x160]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x164], 1
call fcn.0040c6d0
mov esi, 0x10
add esp, 0xc
cmp dword [eax + 0x18], esi
jb 0x40d4e2
mov eax, dword [eax + 4]
jmp 0x40d4e5
add eax, 4
mov ecx, dword [0x4dce6c]
push 1
push ebx
push eax
lea eax, [esp + 0x54]
push eax
push 0x490664
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
setg byte [esp + 0xf]
cmp dword [esp + 0x44], esi
jb 0x40d51b
mov edx, dword [esp + 0x30]
push edx
call fcn.0046b849
add esp, 4
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
cmp dword [esp + 0x28], esi
jb 0x40d53e
mov eax, dword [esp + 0x14]
push eax
call fcn.0046b849
add esp, 4
cmp byte [esp + 0xf], bl
je 0x40d54a
push ebx
call fcn.0046cfc7
push str.UAC_INIT_ERROR
call fcn.00433d70
add esp, 4
cmp dword [esp + 0x178], esi
jb 0x40d570
mov ecx, dword [esp + 0x164]
push ecx
call fcn.0046b849
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x150]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0046be7b
add esp, 0x150
ret
Function at 0x41dc80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48bbdb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4b77c0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0
call fcn.0041e1b0
cmp dword [esi + 0x30], 0x10
jb 0x41dcc7
mov eax, dword [esi + 0x1c]
push eax
call fcn.0046b849
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x41f690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48bd70
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4b77c0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
call fcn.0041e6d0
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.0041e5f0
mov esi, eax
mov ecx, dword [esp + 0x2c]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call fcn.0041e5f0
mov edi, dword [esp + 0x34]
mov esi, dword [esi]
mov eax, dword [eax]
mov ecx, dword [0x4b9678]
mov edx, dword [ecx]
push edi
push esi
push eax
mov eax, dword [edx + 0x34]
push ecx
mov byte [esp + 0x34], 1
call eax
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ecx
mov esi, eax
call edi
mov edx, dword [esp + 0x10]
push edx
mov dword [esp + 0x28], 0xffffffff
call edi
test esi, esi
je 0x41f748
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp + 0x14], vtable.TrueCrypt::SystemException.0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
push 0x4abaa8
lea eax, [esp + 0x18]
push eax
call fcn.0046b8cf
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x41f860
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi], 0
je 0x41f8a7
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0xc]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 8]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
movzx eax, byte [esi + 0x14]
push ecx
lea edx, [esi + 0x18]
push edx
push eax
push 0
call fcn.0041f560
mov eax, dword [esp + 0x34]
add esp, 0x20
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
pop esi
add esp, 8
ret 8
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41f8e7
mov dword [esp + 4], vtable.TrueCrypt::SystemException.0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x4abaa8
lea edx, [esp + 8]
push edx
mov dword [esp + 0x10], eax
call fcn.0046b8cf
mov eax, dword [esp + 0x10]
pop esi
add esp, 8
ret 8
Function at 0x420710
Capabilities:
Delete file

Disassembly:
cmp dword [esi + 0x18], 0x10
push edi
lea edi, [esi + 4]
jb 0x42071e
mov eax, dword [edi]
jmp 0x420720
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esi + 0x18], 0x10
jb 0x420738
mov eax, dword [edi]
push eax
call fcn.0046b849
add esp, 4
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [edi], 0
pop edi
ret

Function at 0x421a80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
mov esi, dword [esp + 0x118]
push 0x104
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x421ad9
mov dword [esp + 4], vtable.TrueCrypt::SystemException.0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x4abaa8
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0x10], eax
call fcn.0046b8cf
lea eax, [esp + 0xc]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421af2
sub eax, edx
push eax
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0040c450
mov ecx, dword [esp + 0x110]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0046be7b
add esp, 0x110
ret 4

Function at 0x421b30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
mov esi, dword [esp + 0x118]
lea eax, [esp + 0xc]
push eax
push 0x104
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x421bb8
cmp eax, 0x104
ja 0x421bb8
lea eax, [esp + 0xc]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421b88
sub eax, edx
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0040c450
mov ecx, dword [esp + 0x110]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0046be7b
add esp, 0x110
ret 4
push 0x4abae0
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], vtable.TrueCrypt::ParameterIncorrect.0
mov dword [esp + 0x10], str.TrueCrypt::BootEncryption::GetTempPathA:715
call fcn.0046b8cf
int3
Function at 0x421be0
Capabilities:
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x48c051
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push esi
push edi
mov eax, dword [0x4b77c0]
xor eax, esp
push eax
lea eax, [esp + 0x174]
mov dword fs:[0], eax
mov edi, dword [esp + 0x184]
xor ebx, ebx
lea eax, [esp + 0x6c]
push eax
push ebx
push ebx
push 0x8023
push ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jge 0x421c5f
mov dword [esp + 0x10], vtable.TrueCrypt::SystemException.0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x4abaa8
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x1c], eax
call fcn.0046b8cf
lea eax, [esp + 0x6c]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x421c76
sub eax, edx
push eax
lea edx, [esp + 0x70]
push edx
lea ecx, [esp + 0x20]
call fcn.0040c450
push 0x492c18
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x58]
push ecx
mov dword [esp + 0x188], ebx
call fcn.004211b0
add esp, 0xc
mov esi, 0x10
mov byte [esp + 0x17c], 2
cmp dword [esp + 0x30], esi
jb 0x421ccc
mov edx, dword [esp + 0x1c]
push edx
call fcn.0046b849
add esp, 4
mov eax, dword [esp + 0x54]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
cmp dword [esp + 0x68], esi
jae 0x421cea
lea eax, [esp + 0x54]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x5c
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.00420940
push str.Original_System_Loader
push eax
push edi
mov byte [esp + 0x194], 3
call fcn.004211b0
add esp, 0x18
cmp dword [esp + 0x4c], esi
jb 0x421d2d
mov edx, dword [esp + 0x38]
push edx
call fcn.0046b849
add esp, 4
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
cmp dword [esp + 0x68], esi
jb 0x421d50
mov eax, dword [esp + 0x54]
push eax
call fcn.0046b849
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x174]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.0046be7b
add esp, 0x170
ret 4
Function at 0x421d80
Capabilities:
Get disk information

Disassembly:
sub esp, 0x20
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push esi
mov bl, 0x5a
mov esi, 0x10
mov edi, edi
push 3
push 0x492c24
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.0040c450
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], esi
jae 0x421dd3
lea eax, [esp + 0x10]
mov byte [eax], bl
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], esi
jae 0x421de3
lea eax, [esp + 0x10]
push eax
call ebp
cmp eax, 5
je 0x421e19
cmp dword [esp + 0x24], esi
jb 0x421dfe
mov eax, dword [esp + 0x10]
push eax
call fcn.0046b849
add esp, 4
dec bl
cmp bl, 0x43
jge 0x421da0
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0046be7b
add esp, 0x20
ret
cmp dword [esp + 0x24], esi
jb 0x421e2c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0046b849
add esp, 4
mov ecx, dword [esp + 0x28]
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.0046be7b
add esp, 0x20
ret