joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402360
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x46b140]
test eax, eax
jne 0x4023a6
push str.NtFsControlFile
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x46b140], eax
jne 0x4023a6
push 0x10000
push str.Fatal_Error
push str.Could_not_find_NtFsControlFile_entry_point_in_NTDLL.DLL_n
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0041c4fb
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edi
push edx
mov edx, dword [esp + 0x30]
push ecx
push edx
push ebx
call eax
mov esi, eax
cmp esi, 0x103
jne 0x4023f2
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [edi]
cmp esi, 0x80000005
jne 0x40240d
push 0xea
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
ret 0x28
cmp esi, 0xc0000011
jne 0x402425
push 0x26
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
ret 0x28
cmp esi, 0xc0000010
jne 0x402442
push esi
call fcn.00402310
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
ret 0x28
cmp esi, 0xc0000021
jne 0x40245d
push 0x4d5
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
ret 0x28
cmp esi, 0xc000000d
jne 0x402475
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
ret 0x28
test esi, esi
je 0x402486
push esi
call fcn.00402310
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
ret 0x28

Function at 0x402490
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x46b12c]
test eax, eax
jne 0x4024d6
push str.NtFlushBuffersFile
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x46b12c], eax
jne 0x4024d6
push 0x10000
push str.Fatal_Error
push str.Could_not_find_NtFlushBuffersFile_entry_point_in_NTDLL.DLL_n
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0041c4fb
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
push ebx
call eax
mov esi, eax
cmp esi, 0x103
jne 0x4024fa
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [edi]
test esi, esi
je 0x40250b
push esi
call fcn.00402310
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
Function at 0x402520
Capabilities:
Compress data via winapi
Terminate process

Disassembly:
mov eax, dword [0x46b128]
test eax, eax
jne 0x402566
push str.RtlDecompressBuffer
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x46b128], eax
jne 0x402566
push 0x10000
push str.Fatal_Error
push str.Could_not_find_RtzDecompressBuffer_entry_point_in_NTDLL.DLL_n
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0041c4fb
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push esi
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push ecx
push edx
call eax
mov esi, eax
test esi, esi
je 0x40259a
push esi
call fcn.00402310
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
ret 0x18
Function at 0x402950
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x46b148
mov dword [0x46b148], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x46b14c], 4
jb 0x4029b2
cmp dword [0x46b158], 2
jne 0x4029b2
push 0xe0000000
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
jne 0x4029a9
push 0x10000
push str.Oops_
push str.You_are_not_an_Administrator_
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4029b4
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4029b4
xor edi, edi
mov eax, dword [esp + 0x1c]
push eax
call fcn.00406670
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
mov dword [esp + 0x1c], esi
jne 0x4029d6
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [0x46bb84]
mov al, byte [ecx + 0x140]
test al, al
jne 0x402ae9
push edi
push edi
push esi
call fcn.004046e0
push edi
push edi
push 0x80
push eax
push esi
mov dword [0x46bb88], eax
call fcn.00404100
mov esi, eax
add esp, 0x20
cmp esi, edi
jne 0x402a16
xor ecx, ecx
mov dword [esp + 0x14], edi
jmp 0x402a30
mov al, byte [esi + 8]
test al, al
jne 0x402a26
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x14], edi
jmp 0x402a30
mov edx, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x14], edx
mov edi, dword [0x46bb84]
xor edx, edx
mov dword [0x46bd6c], ecx
mov eax, ecx
div dword [edi + 0x2c]
mov dword [0x46bd70], eax
mov ebp, dword [edi + 0x38]
mov ebx, dword [edi + 0x3c]
mov eax, ecx
cdq
cmp eax, ebp
jne 0x402a59
cmp edx, ebx
je 0x402a85
or ebp, ebx
je 0x402a85
push str.mftsizeVcb__MftValidDataLength__Vcb__MftValidDataLength_0
push 0x2b2
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x402a7f
push eax
call fcn.0041c4fb
mov edi, dword [0x46bb84]
test esi, esi
jne 0x402a8d
xor eax, eax
jmp 0x402aa1
mov al, byte [esi + 8]
test al, al
jne 0x402a9b
mov eax, dword [esi + 0x10]
xor esi, esi
jmp 0x402aa1
mov eax, dword [esi + 0x30]
mov esi, dword [esi + 0x34]
mov dword [edi + 0x38], eax
mov eax, dword [0x46bb84]
mov dword [eax + 0x3c], esi
mov ecx, dword [0x46bb84]
mov eax, dword [0x46bd6c]
mov esi, dword [ecx + 0x38]
add ecx, 0x38
cdq
cmp eax, esi
jne 0x402ac7
cmp edx, dword [ecx + 4]
je 0x402aff
push str.mftsizeVcb__MftValidDataLength
push 0x2b4
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x402aff
push eax
call fcn.0041c4fb
mov dword [0x46bd6c], edi
mov dword [0x46bd70], edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x402b10
Capabilities:
Read file on windows
Terminate process

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push esi
mov esi, dword [0x46bb84]
push edi
push ecx
xor ebx, ebx
push edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov eax, dword [esi + 0x2c]
push ebx
push eax
call fcn.0041c860
cmp esi, ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
jne 0x402b6e
push str.Vcb_0
push 0x2d1
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x402b68
push eax
call fcn.0041c4fb
mov esi, dword [0x46bb84]
cmp byte [esi + 0x140], bl
je 0x402c20
mov eax, dword [esi + 0x68]
xor ecx, ecx
mov cx, word [eax + 0xe]
cmp cx, bx
je 0x402bf2
xor edx, edx
mov dl, byte [eax + 6]
and ecx, 0xffff
mov edi, edx
xor edx, edx
imul edi, ecx
mov dx, word [eax + 8]
xor ecx, ecx
mov cx, word [eax + 4]
mov eax, edx
shl eax, 5
add eax, 0x1ff
add edi, ecx
imul edi, dword [esi + 0x28]
cdq
and edx, 0x1ff
add eax, edx
sar eax, 9
shl eax, 9
add edi, eax
cmp dword [esi + 0x74], edi
je 0x402bf2
push str.Vcb__AllocationSupport.FileAreaLbo__Vcb__pBpb__FatsVcb__pBpb__SectorsPerFatVcb__pBpb__ReservedSectors_Vcb__BytesPerSector____Vcb__pBpb__RootEntries32511__512_512_
push 0x2dc
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x402bec
push eax
call fcn.0041c4fb
mov esi, dword [0x46bb84]
mov eax, dword [esi + 0x74]
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
add ecx, eax
adc edi, ebx
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edi
mov ecx, dword [esi + 0x2c]
shl ecx, 1
sub edx, ecx
mov eax, edi
sbb eax, ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x18]
push ebx
lea edx, [esp + 0x14]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x402c40
call fcn.004028e0
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x402caa
mov edx, dword [0x46bb84]
mov edi, dword [esp + 0x28]
push ebx
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], ebx
mov ecx, dword [edx + 0x2c]
imul ecx, edi
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402c74
call fcn.004028e0
mov edx, dword [0x46bb84]
mov eax, dword [edx + 0x2c]
mov ecx, dword [esp + 0x1c]
imul eax, edi
cmp ecx, eax
je 0x402caa
push str.bytesReadVcb__BytesPerClusternumberToRead
push 0x2ed
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x402caa
push eax
call fcn.0041c4fb
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x402cc0
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov eax, dword [0x46bb80]
sub esp, 0x10
push ebx
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
push edi
jg 0x402cf4
push str.VolumeBitmapRuncount___0
push 0x31d
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x402cf4
push eax
call fcn.0041c4fb
cmp dword [0x46b22c], ebp
jg 0x402d28
jl 0x402d06
cmp dword [0x46b228], ebp
ja 0x402d28
push str.VolumeBitmapRun_0_.lcn___0
push 0x31e
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x402d28
push eax
call fcn.0041c4fb
cmp dword [0x46bb80], ebp
mov dword [esp + 0x14], ebp
jle 0x402dfd
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov esi, 0x46b230
mov eax, dword [0x46bb84]
mov edx, dword [esi - 4]
push edx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov ecx, dword [eax + 0x2c]
mov eax, dword [esi - 8]
push eax
push ebp
push ecx
call fcn.0041c860
push ebp
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x402d84
call fcn.004028e0
cmp edi, ebp
je 0x402dfd
mov eax, dword [0x46bb84]
mov dword [esp + 0x10], ebp
mov ecx, dword [eax + 0x2c]
imul ecx, dword [esi]
push ebp
lea edx, [esp + 0x14]
push edx
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402daf
call fcn.004028e0
mov edx, dword [0x46bb84]
mov eax, dword [edx + 0x2c]
imul eax, dword [esi]
cmp dword [esp + 0x10], eax
je 0x402ddd
push str.bytesReadVolumeBitmapRun_i_.RUNlengthVcb__BytesPerCluster
push 0x331
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
je 0x402e05
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x46bb80]
add edi, edx
inc eax
add esi, 0x18
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x402d45
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 1
call fcn.0041c4fb
nop
nop
nop
nop
Function at 0x404510
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp edi, 0x64
jae 0x404597
mov eax, dword [edi*4 + 0x46bb88]
test eax, eax
je 0x404597
push 4
push str.FILE
push eax
call fcn.0041caf0
add esp, 0xc
test eax, eax
je 0x40455c
push str.strncmp__char__mftrecptr_static_cast_long__recordNumber____MultiSectorHeader.Signature__FILE__4_0
push 0x94b
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x40455c
push eax
call fcn.0041c4fb
mov eax, dword [edi*4 + 0x46bb88]
cmp word [eax + 0x14], 0x400
jb 0x40458d
push str.mftrecptr_static_cast_long__recordNumber____FirstAttributeOffset___1024
push 0x94c
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x40458d
push eax
call fcn.0041c4fb
mov eax, dword [edi*4 + 0x46bb88]
pop edi
pop esi
ret
inc dword [0x46bdd8]
xor esi, esi
cmp dword [esi*4 + 0x46349c], edi
jne 0x4045b3
mov eax, dword [esi*4 + 0x46bd1c]
test eax, eax
jne 0x4045e9
inc esi
cmp esi, 0xa
jl 0x40459f
xor esi, esi
cmp dword [esi*4 + 0x4634c4], edi
jne 0x4045d3
mov eax, dword [esi*4 + 0x46bd44]
test eax, eax
jne 0x404661
inc esi
cmp esi, 0xa
jl 0x4045bb
mov eax, dword [0x46bdd8]
dec eax
pop edi
mov dword [0x46bdd8], eax
xor eax, eax
pop esi
ret
mov ecx, dword [esi*4 + 0x46bd1c]
push 4
push str.FILE
push ecx
call fcn.0041caf0
add esp, 0xc
test eax, eax
je 0x404626
push str.strncmp__char__last10mftptr_i___MultiSectorHeader.Signature__FILE__4_0
push 0x956
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x404626
push eax
call fcn.0041c4fb
mov edx, dword [esi*4 + 0x46bd1c]
cmp word [edx + 0x14], 0x400
jb 0x404657
push str.last10mftptr_i___FirstAttributeOffset___1024
push 0x957
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x404657
push eax
call fcn.0041c4fb
mov eax, dword [esi*4 + 0x46bd1c]
pop edi
pop esi
ret
mov eax, dword [esi*4 + 0x46bd44]
push 4
push str.FILE
push eax
call fcn.0041caf0
add esp, 0xc
test eax, eax
je 0x40469e
push str.strncmp__char__last10dirptr_i___MultiSectorHeader.Signature__FILE__4_0
push 0x95d
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x40469e
push eax
call fcn.0041c4fb
mov ecx, dword [esi*4 + 0x46bd44]
cmp word [ecx + 0x14], 0x400
jb 0x4046cf
push str.last10dirptr_i___FirstAttributeOffset___1024
push 0x95e
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x4046cf
push eax
call fcn.0041c4fb
mov eax, dword [esi*4 + 0x46bd44]
pop edi
pop esi
ret
Function at 0x404e60
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor ebx, ebx
cmp edi, ebx
jne 0x404e8f
push str.mftptr_0
push 0xb55
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x404e8f
push eax
call fcn.0041c4fb
inc dword [0x46bdec]
mov eax, 0x46bb88
cmp dword [eax], edi
jne 0x404ea0
mov dword [eax], ebx
add eax, 4
cmp eax, 0x46bd18
jl 0x404e9a
xor eax, eax
or ecx, 0xffffffff
cmp dword [eax + 0x46bd1c], edi
jne 0x404ec3
mov dword [eax + 0x46bd1c], ebx
mov dword [eax + 0x46349c], ecx
add eax, 4
cmp eax, 0x28
jl 0x404eaf
xor eax, eax
cmp dword [eax + 0x46bd44], edi
jne 0x404ee1
mov dword [eax + 0x46bd44], ebx
mov dword [eax + 0x4634c4], ecx
add eax, 4
cmp eax, 0x28
jl 0x404ecd
mov esi, dword [0x46bb84]
lea edx, [esi + 0x148]
xor eax, eax
mov ecx, edx
cmp dword [ecx], ebx
je 0x404f2c
inc eax
add ecx, 4
cmp eax, 4
jl 0x404ef9
cmp dword [edx], ebx
jne 0x404f48
push str.Vcb__pLastUsedMftBuffer_0__0
push 0xb82
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x404f42
push eax
call fcn.0041c4fb
mov dword [esi + eax*4 + 0x148], edi
mov ecx, dword [0x46bb84]
mov edx, dword [ecx + eax*4 + 0x148]
jmp 0x404f78
mov esi, dword [0x46bb84]
mov edx, dword [esi + 0x148]
push 0x8000
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
inc dword [0x46bdf0]
mov eax, dword [0x46bb84]
mov dword [eax + 0x148], edi
mov ecx, dword [0x46bb84]
mov edx, dword [ecx + 0x148]
mov eax, dword [str.FREE]
pop edi
pop esi
mov dword [edx], eax
mov cl, byte [0x463f60]
mov byte [edx + 4], cl
pop ebx
ret
Function at 0x405560
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44f680
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x46b1e4]
push ebx
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], ebx
je 0x4055a4
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push ebx
push eax
call edi
mov dword [0x46b1e4], ebx
jmp 0x4055aa
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [0x46b204]
cmp eax, ebx
je 0x4055c2
push 0x8000
push ebx
push eax
call edi
mov dword [0x46b204], ebx
mov esi, 0x63
cmp esi, ebx
jl 0x4055e9
mov eax, dword [esi*4 + 0x46bb88]
cmp eax, ebx
je 0x4055df
push eax
call fcn.00404e60
add esp, 4
mov dword [esi*4 + 0x46bb88], ebx
dec esi
jmp 0x4055c7
xor esi, esi
cmp esi, 0xa
jge 0x40560e
mov eax, dword [esi*4 + 0x46bd1c]
cmp eax, ebx
je 0x40560b
push eax
call fcn.00404e60
add esp, 4
mov dword [esi*4 + 0x46bd1c], ebx
inc esi
jmp 0x4055eb
mov eax, dword [0x46bb84]
cmp eax, ebx
mov esi, dword [ebp + 8]
mov dword [0x46bd18], ebx
je 0x4056e5
cmp dword [eax + 0x60], esi
je 0x40564b
push str.Vcb__hVolumehFile
push 0x11f3
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x40564b
push eax
call fcn.0041c4fb
mov eax, dword [0x46bb84]
mov eax, dword [eax + 0x60]
cmp eax, esi
jne 0x40565a
or esi, 0xffffffff
cmp eax, ebx
je 0x40567e
cmp eax, 0xffffffff
je 0x40567e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x405675
call fcn.004028e0
jmp 0x40567e
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x60], ebx
mov edx, dword [0x46bb84]
mov eax, dword [edx + 0x158]
cmp eax, ebx
je 0x4056a2
push 0x8000
push ebx
push eax
call edi
mov eax, dword [0x46bb84]
mov dword [eax + 0x158], ebx
mov ecx, dword [0x46bb84]
mov eax, dword [ecx + 0x68]
cmp eax, ebx
je 0x4056b8
push eax
call fcn.004353f0
add esp, 4
mov edx, dword [0x46bb84]
mov eax, dword [edx + 0x144]
cmp eax, ebx
je 0x4056d1
push eax
call fcn.004353f0
add esp, 4
mov eax, dword [0x46bb84]
push eax
call fcn.004353f0
add esp, 4
mov dword [0x46bb84], ebx
cmp esi, ebx
je 0x40571f
cmp esi, 0xffffffff
je 0x40571f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40571f
call fcn.004028e0
jmp 0x40571f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov byte [0x46bd79], bl
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405950
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov eax, dword [0x46b158]
sub esp, 8
cmp eax, 2
push ebx
push esi
push edi
je 0x405a73
mov eax, dword [esp + 0x20]
test eax, eax
mov edi, dword [esp + 0x1c]
jg 0x405984
jl 0x40597a
cmp edi, 0x77359400
jae 0x405984
test eax, eax
jg 0x4059a3
jl 0x405984
test edi, edi
jae 0x4059a3
push str.sectorNumber___2000000000__sectorNumber___0
push 0x6a
push str.E:_srcundeleteRawIO.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x4059a3
push eax
call fcn.0041c4fb
mov esi, dword [esp + 0x28]
cmp esi, 0xfde8
jge 0x4059b3
test esi, esi
jge 0x4059d2
push str.numberToRead___65000__numberToRead__0
push 0x6b
push str.E:_srcundeleteRawIO.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x4059d2
push eax
call fcn.0041c4fb
cmp dword [0x46b14c], 4
jne 0x405a37
mov eax, dword [0x46b150]
test eax, eax
jne 0x405a37
mov eax, dword [0x46b154]
and eax, 0xffff
cmp eax, 0x3b6
jne 0x405a37
mov eax, dword [0x46bb84]
mov ecx, dword [esp + 0x24]
xor edx, edx
mov dl, byte [eax + 0x64]
mov eax, dword [eax + 0x60]
push ecx
sub dl, 0x40
push esi
push edi
push edx
push eax
call fcn.004142c0
add esp, 0x14
test eax, eax
jne 0x405a30
push 0x10000
push str.fatal_error
push str.ReadLogicalSectors_failed
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [0x46bb84]
mov ebx, dword [esp + 0x24]
mov edx, dword [eax + 0x60]
xor ecx, ecx
mov cl, byte [eax + 0x64]
push ebx
sub cl, 0x40
push esi
push edi
push ecx
push edx
call fcn.00414350
add esp, 0x14
test eax, eax
jne 0x405a30
mov eax, dword [0x46bb84]
mov edx, dword [eax + 0x60]
xor ecx, ecx
mov cl, byte [eax + 0x64]
push ebx
sub cl, 0x40
push esi
push edi
push ecx
push edx
jmp 0x405a0e
mov eax, dword [0x46bb84]
mov edx, dword [esp + 0x20]
push edx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov ecx, dword [eax + 0x28]
mov eax, dword [esp + 0x20]
push eax
push 0
push ecx
call fcn.0041c860
mov esi, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x405ac2
call fcn.004028e0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x405a30
mov ecx, dword [0x46bb84]
mov edi, dword [esp + 0x28]
push 0
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0
mov edx, dword [ecx + 0x28]
imul edx, edi
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405aff
call fcn.004028e0
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x28]
mov eax, dword [esp + 0x18]
imul ecx, edi
cmp eax, ecx
je 0x405a30
push str.bytesReadVcb__BytesPerSectornumberToRead
push 0x97
push str.E:_srcundeleteRawIO.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x405a30
push eax
call fcn.0041c4fb
nop
nop
nop
nop
Function at 0x4061d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x46bb84]
test eax, eax
jne 0x406235
push edi
push 0x160
call fcn.004353c7
mov edi, eax
xor eax, eax
mov dword [0x46bb84], edi
mov ecx, 0x58
push 0x30
rep stosd dword es:[edi], eax
call fcn.004353c7
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x68], eax
mov edx, dword [0x46bb84]
mov edi, dword [edx + 0x68]
add esp, 8
xor eax, eax
mov ecx, 0xc
rep stosd dword es:[edi], eax
mov eax, dword [0x46bb84]
mov dword [eax + 0x28], 0x200
mov ecx, dword [0x46bb84]
mov edx, dword [ecx + 0x68]
mov word [edx], 0x200
pop edi
push esi
push 4
push 0x1000
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40626d
push 0x10000
push str.Fatal_error
push str.Cannot_allocate_memory_to_read_boot_sector
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0041c4fb
mov ecx, dword [0x46bb84]
mov eax, dword [ecx + 0x28]
cmp eax, 0x80
jb 0x406284
cmp eax, 0x1000
jbe 0x40628b
mov dword [ecx + 0x28], 0x200
mov eax, dword [esp + 8]
push 1
push esi
push 0
push 0
push eax
call fcn.00405950
add esp, 0x14
mov eax, esi
pop esi
ret

Function at 0x406340
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
cmp ebx, 2
push esi
jae 0x40636d
push str._FatIndex____2
push 0x376
push str.E:_srcundeleteRawIO.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x40636d
push eax
call fcn.0041c4fb
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x78]
inc eax
cmp ebx, eax
jbe 0x40639b
push str._FatIndex______Vcb___AllocationSupport.NumberOfClusters__1_
push 0x377
push str.E:_srcundeleteRawIO.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x40639b
push eax
call fcn.0041c4fb
mov al, byte [esi + 0x80]
cmp al, 0xc
jne 0x4063d6
mov edx, dword [esp + 0x14]
lea ecx, [ebx + ebx*2]
shr ecx, 1
test bl, 1
mov ax, word [ecx + edx]
mov dword [esp + 0x10], 0
mov word [esp + 0x10], ax
mov eax, dword [esp + 0x10]
je 0x4063ce
pop esi
shr eax, 4
pop ebx
ret
pop esi
and eax, 0xfff
pop ebx
ret
cmp al, 0x20
jne 0x4063e4
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + ebx*4]
pop esi
pop ebx
ret
mov edx, dword [esp + 0x14]
xor eax, eax
mov ax, word [edx + ebx*2]
pop esi
pop ebx
ret