joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dfa0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set current directory

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffde4
mov esi, edx
cmp word [eax], 0x5c
jne 0x41dfc2
cmp word [eax + 2], 0x5c
jne 0x41dfc2
mov eax, 0x23bd
jmp 0x41e1d4
call fcn.0041df78
mov ebx, eax
mov dword [esp], eax
test eax, eax
jne 0x41dfda
mov eax, 8
jmp 0x41e1d4
mov eax, ebx
call fcn.00419fe4
mov edx, eax
mov eax, edx
cmp eax, 1
jl 0x41dfff
cmp word [ebx + eax*2 - 2], 0x20
je 0x41dffa
mov word [ebx + eax*2], 0
jmp 0x41dfff
dec eax
test eax, eax
jne 0x41dfea
lea eax, [esp + 0x10]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
movzx edx, word [esp + 0x10]
mov eax, edx
add edx, 0xffffff9f
sub dx, 0x1a
jae 0x41e027
movzx eax, word [esp + 0x10]
and ax, 0xffdf
mov edi, eax
mov word [esp + 8], 0x3d
movzx eax, word [ebx]
call fcn.0041a0fc
test al, al
je 0x41e060
cmp word [ebx + 2], 0x3a
jne 0x41e060
movzx edx, word [ebx]
mov eax, edx
mov ecx, edx
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x41e059
mov eax, edx
and ax, 0xffdf
mov word [esp + 0xa], ax
jmp 0x41e065
mov word [esp + 0xa], di
mov word [esp + 0xc], 0x3a
mov word [esp + 0xe], 0
mov word [esp + 0x216], 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x14]
push eax
push 0x104
push ebx
call sub.kernel32.dll_GetFullPathNameW
test eax, eax
jne 0x41e0a0
call sub.kernel32.dll_GetLastError_2
jmp 0x41e1d4
cmp eax, 0x104
jbe 0x41e0b1
mov eax, 0xce
jmp 0x41e1d4
cmp word [esp + 0x10], 0
je 0x41e0c1
cmp word [esp + 0x12], 0x3a
je 0x41e0cb
mov eax, 3
jmp 0x41e1d4
cmp dword [esp + 4], 0
jne 0x41e0e7
lea eax, [esp + 0x10]
call fcn.00419fe4
add eax, eax
lea edx, [esp + 0x10]
add eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp word [eax], 0
jne 0x41e114
lea eax, [esp + 0x16]
cmp eax, dword [esp + 4]
jae 0x41e114
mov eax, dword [esp + 4]
cmp word [eax - 2], 0x5c
jne 0x41e114
sub dword [esp + 4], 2
mov eax, dword [esp + 4]
mov word [eax], 0
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x41e13b
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x41e13b
cmp eax, 3
je 0x41e13b
cmp eax, 0x7b
jne 0x41e1d4
mov eax, dword [0x433adc]
cmp byte [eax], 0
je 0x41e150
lea eax, [esp + 0x10]
xor edx, edx
call fcn.0041de58
cmp esi, 2
je 0x41e17c
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x41e175
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
jne 0x41e1d4
mov eax, 3
jmp 0x41e1d4
test eax, 0x410
je 0x41e1cf
test esi, esi
je 0x41e18a
dec esi
jne 0x41e198
cmp di, word [esp + 0xa]
jne 0x41e198
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
je 0x41e1c8
lea edx, [esp + 0x10]
lea eax, [esp + 8]
call fcn.0041c020
test eax, eax
jne 0x41e1c1
mov eax, dword [0x433dec]
xor edx, edx
call fcn.0041ddbc
mov eax, dword [esp]
call fcn.0042bf24
xor eax, eax
jmp 0x41e1d4
mov eax, 8
jmp 0x41e1d4
call sub.kernel32.dll_GetLastError_2
jmp 0x41e1d4
mov eax, 0x10b
add esp, 0x21c
pop edi
pop esi
pop ebx
ret
Function at 0x41e204
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff994
mov edi, eax
mov eax, edi
call fcn.0042d7f0
mov ebx, eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x25c]
push eax
push 0x208
push ebx
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
test esi, esi
je 0x41e346
lea ebx, [esp + 0x258]
mov edx, 0x41e358
mov ecx, 4
mov eax, ebx
call fcn.00414c6c
test eax, eax
jne 0x41e2cc
add ebx, 8
mov dword [esp + 4], ebx
mov edx, ebx
mov eax, edi
call fcn.00414d5c
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x41e2ad
cmp edi, dword [esp + 4]
jae 0x41e2ad
mov eax, dword [esp + 4]
movzx ebx, word [eax]
mov eax, dword [esp + 4]
mov word [eax], 0
push edi
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
mov eax, dword [esp + 4]
mov word [eax], bx
cmp esi, 0xffffffff
je 0x41e2a6
cmp esi, 1
sbb eax, eax
inc eax
jmp 0x41e34c
xor eax, eax
jmp 0x41e34c
push edi
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x41e2c5
cmp esi, 1
sbb eax, eax
inc eax
jmp 0x41e34c
xor eax, eax
jmp 0x41e34c
cmp dword [esp + 4], 0
je 0x41e2dd
mov eax, dword [esp + 4]
cmp word [eax], 0
jne 0x41e2f0
push ebx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne al
mov esi, eax
and esi, 0x7f
jmp 0x41e346
push esp
lea ecx, [esp + 0xc]
mov edx, 0x37
mov eax, ebx
call fcn.0041d934
mov esi, eax
and esi, 0x7f
mov eax, dword [esp]
call fcn.0041d9b8
test esi, esi
jne 0x41e346
lea eax, [ebx + 2]
cmp word [eax], 0x5c
je 0x41e336
lea eax, [ebx + 2]
cmp word [eax], 0x3a
jne 0x41e346
lea eax, [ebx + 4]
cmp word [eax], 0x5c
jne 0x41e346
lea eax, [ebx + 6]
cmp word [eax], 0
jne 0x41e346
push ebx
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 1
jbe 0x41e346
mov esi, 1
cmp esi, 1
sbb eax, eax
inc eax
add esp, 0x66c
pop edi
pop esi
pop ebx
ret
Function at 0x42628c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x430], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x42643a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test esi, esi
jne 0x426374
xor esi, esi
push 0x20a
lea eax, [ebp - 0x212]
push eax
push esi
push edi
call sub.advapi32.dll_RegEnumKeyW
mov ebx, eax
test ebx, ebx
je 0x4262ea
cmp ebx, 0x103
jne 0x42641e
xor ebx, ebx
jmp 0x42641e
cmp word [ebp - 0x212], 0x2e
jne 0x426358
mov dword [ebp - 8], 0x20a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x212]
push eax
push edi
call sub.advapi32.dll_RegQueryValueW
mov ebx, eax
test ebx, ebx
jne 0x42641e
lea eax, [ebp - 0x212]
mov dword [ebp - 0x42c], eax
mov byte [ebp - 0x428], 0xa
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x424], eax
mov byte [ebp - 0x420], 0xa
lea edx, [ebp - 0x42c]
mov eax, 0x42644c
mov ecx, 1
call fcn.0041e4c0
mov eax, dword [0x433c40]
cmp dword [eax], 0
je 0x42636e
mov dword [ebp - 4], 1
jmp 0x426421
inc esi
jmp 0x4262be
xor edx, edx
mov eax, esi
call fcn.0042d688
mov esi, eax
mov dx, 0x20
mov eax, esi
call fcn.00419f9c
test eax, eax
je 0x426393
mov word [eax], 0
mov dword [ebp - 8], 0x20a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x41c]
push eax
push esi
push edi
call sub.advapi32.dll_RegQueryValueW
mov ebx, eax
test ebx, ebx
jne 0x4263e9
mov dword [ebp - 0x42c], esi
mov byte [ebp - 0x428], 0xa
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x424], eax
mov byte [ebp - 0x420], 0xa
lea edx, [ebp - 0x42c]
mov eax, 0x42644c
mov ecx, 1
call fcn.0041e4c0
jmp 0x42641e
push 0
lea edx, [ebp - 0x430]
mov eax, dword [0x433c58]
call fcn.00409478
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x438], esi
mov byte [ebp - 0x434], 0xa
lea ecx, [ebp - 0x438]
mov edx, 1
call fcn.0042cf54
mov dword [ebp - 4], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426441
lea eax, [ebp - 0x430]
call fcn.00406984
ret
Function at 0x42645c
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x426544
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x42648b
cmp word [ebx], 0
jne 0x4264c4
push edi
push esi
call sub.advapi32.dll_RegDeleteKeyW
mov esi, eax
test esi, esi
je 0x426524
push 0
lea edx, [ebp - 4]
mov eax, dword [0x433c58]
call fcn.00409478
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xa
lea ecx, [ebp - 0xc]
mov edx, 1
call fcn.0042cf54
jmp 0x426524
mov eax, ebx
call fcn.00419fe4
push eax
push ebx
push 1
push edi
push esi
call sub.advapi32.dll_RegSetValueW
mov esi, eax
test esi, esi
jne 0x4264fe
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 0xa
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x10], 0xa
lea edx, [ebp - 0x1c]
mov eax, 0x426554
mov ecx, 1
call fcn.0041e4c0
jmp 0x426524
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x433b24]
call fcn.00409478
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xa
lea ecx, [ebp - 0xc]
mov edx, 1
call fcn.0042cf54
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42654b
lea eax, [ebp - 0x20]
call fcn.00406984
lea eax, [ebp - 4]
call fcn.00406984
ret
Function at 0x4270a0
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
add esp, 0xfffffec8
xor esi, esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
test ebx, ebx
je 0x42713b
lea edx, [esp + 4]
mov ecx, 0x40
mov eax, ebx
call fcn.00414918
cmp word [esp + 4], 0x5a4d
jne 0x427135
xor ecx, ecx
mov edx, dword [esp + 0x40]
mov eax, ebx
call fcn.00414944
mov edx, esp
mov ecx, 4
mov eax, ebx
call fcn.00414918
cmp dword [esp], 0x4550
jne 0x427135
lea edx, [esp + 0x44]
mov ecx, 0x14
mov eax, ebx
call fcn.00414918
cmp word [esp + 0x54], 0
jbe 0x427135
lea edx, [esp + 0x58]
mov ecx, 0xe0
mov eax, ebx
call fcn.00414918
movzx esi, word [esp + 0x9c]
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
add esp, 0x138
pop esi
pop ebx
ret

Function at 0x4272c4
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], edx
mov edi, eax
mov ebp, dword [0x433b1c]
mov eax, edi
call fcn.004272a4
inc eax
jne 0x4273d8
mov eax, edi
call fcn.00406da0
mov dword [esp + 4], eax
mov eax, dword [ebp]
call fcn.00407ad4
mov ebx, eax
lea eax, [ebx + 1]
push eax
mov eax, ebp
mov ecx, 1
mov edx, dword [0x419da8]
call fcn.00407cf0
add esp, 4
mov eax, dword [esp + 4]
lea eax, [eax + eax*2]
call fcn.00403f2c
lea esi, [ebx + ebx*2]
mov edx, dword [ebp]
mov dword [edx + esi*8], eax
lea eax, [ebx + ebx*2]
mov edx, dword [ebp]
mov eax, dword [edx + eax*8]
mov edx, edi
call fcn.00414b50
mov eax, dword [ebp]
mov edx, dword [esp]
mov dword [eax + esi*8 + 4], edx
mov eax, dword [esp]
push eax
call sub.msvcrt.dll__get_osfhandle
pop ecx
mov edx, dword [ebp]
mov dword [edx + esi*8 + 8], eax
push 2
push 0
push 0
lea eax, [ebx + ebx*2]
mov edx, dword [ebp]
mov eax, dword [edx + eax*8 + 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov edx, dword [ebp]
mov dword [edx + esi*8 + 0xc], eax
lea eax, [ebx + ebx*2]
mov edx, dword [ebp]
mov eax, dword [edx + eax*8 + 0xc]
call fcn.00403f2c
mov edx, dword [ebp]
mov dword [edx + esi*8 + 0x10], eax
push 0
push 0
push 0
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 0xc]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 0x10]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 8]
push eax
call sub.kernel32.dll_ReadFile_1
mov eax, dword [ebp]
mov edx, dword [eax + esi*8 + 0xc]
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 0x10]
call fcn.0041a2bc
mov eax, dword [ebp]
xor edx, edx
mov dword [eax + esi*8 + 0x14], edx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x428e50
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00419fe4
mov edi, eax
xor eax, eax
mov ebx, dword [ebp + 8]
jmp 0x428e82
inc eax
jmp 0x428e7c
add ebx, 2
cmp word [ebx], 0
jne 0x428e79
cmp word [ebx], 0
jne 0x428e76
sub ebx, dword [ebp + 8]
sar ebx, 1
jns 0x428e92
adc ebx, 0
inc ebx
add ebx, edi
mov edx, ebx
add edx, edx
imul edx, eax
mov eax, edx
call fcn.0042bf8c
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
jmp 0x428ede
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00419f18
mov eax, edi
add eax, eax
add eax, esi
mov edx, ebx
call fcn.00419ff4
mov eax, edi
add eax, eax
add esi, eax
jmp 0x428ed5
add ebx, 2
add esi, 2
cmp word [ebx], 0
jne 0x428ecf
add esi, 2
cmp word [ebx], 0
jne 0x428eae
mov word [esi], 0
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00429b34
mov ebx, eax
mov eax, dword [ebp - 8]
mov word [eax], 0x2a
mov eax, dword [ebp - 8]
mov word [eax + 2], 0
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov esi, eax
mov eax, dword [ebp - 8]
mov word [eax], 0
cmp esi, 0xffffffff
je 0x428fc2
lea edx, [ebp - 0x234]
mov eax, dword [ebp - 8]
call fcn.00419ff4
test byte [ebp - 0x260], 0x10
je 0x428fa7
mov edx, 0x428fd0
lea eax, [ebp - 0x234]
call fcn.00414be0
test eax, eax
je 0x428fa7
mov edx, 0x428fd4
lea eax, [ebp - 0x234]
call fcn.00414be0
test eax, eax
je 0x428fa7
mov eax, dword [ebp - 8]
call fcn.0041a0e8
mov ebx, eax
add ebx, 2
mov word [ebx], 0x5c
add ebx, 2
mov word [ebx], 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00428e50
mov ebx, eax
lea eax, [ebp - 0x260]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x428f33
push esi
call sub.kernel32.dll_FindClose_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42ab58
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
push eax
call sub.msvcrt.dll__get_osfhandle
pop ecx
mov dword [ebp - 0x10], eax
mov ebx, dword [0x433a90]
push 1
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x433a90]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x42abad
xor eax, eax
jmp 0x42ac53
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x42abbc
xor eax, eax
jmp 0x42ac53
mov edi, dword [ebp + 8]
mov edi, dword [edi]
mov esi, edi
test esi, esi
jbe 0x42ac13
cmp esi, 3
jb 0x42ac0d
cmp byte [ebx], 0xa
jne 0x42abd9
lea eax, [ebx + 1]
cmp byte [eax], 0xd
je 0x42abe6
cmp byte [ebx], 0xd
jne 0x42ac0d
lea eax, [ebx + 1]
cmp byte [eax], 0xa
jne 0x42ac0d
lea eax, [ebx + 2]
mov byte [eax], 0
mov eax, dword [0x433a90]
mov edi, ebx
sub edi, eax
add edi, 2
push 0
push 0
mov eax, dword [ebp - 0xc]
add eax, edi
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer_1
jmp 0x42ac13
dec esi
inc ebx
test esi, esi
ja 0x42abc7
mov eax, dword [0x433c88]
mov eax, dword [eax]
call fcn.004271f4
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push edi
mov edx, dword [0x433a90]
push edx
test eax, eax
setne al
and eax, 0x7f
push eax
mov eax, dword [0x433c88]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42b1d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa8
lea edi, [esp + 8]
mov dword [esp + 0xc], 0x80000002
mov dword [esp + 0x10], 0x80000001
cmp byte [0x43399a], 0
je 0x42b1ff
mov byte [0x433998], 1
mov ebp, 2
lea esi, [esp + 0xc]
push esp
push 0x42b3a4
mov eax, dword [esi]
push eax
call sub.advapi32.dll_RegOpenKeyW
test eax, eax
jne 0x42b38e
xor eax, eax
mov dword [edi], eax
lea ebx, [esp + 0x18]
mov dword [esp + 4], 0x40
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42b3f0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42b271
cmp dword [edi], 4
jne 0x42b25c
cmp dword [ebx], 0
setne al
mov byte [0x433982], al
jmp 0x42b271
cmp dword [edi], 1
jne 0x42b271
push ebx
call sub.msvcrt.dll__wtol
pop ecx
dec eax
sete al
mov byte [0x433982], al
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42b410
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42b2b4
cmp dword [edi], 4
jne 0x42b29f
cmp dword [ebx], 0
setne al
mov byte [0x433998], al
jmp 0x42b2b4
cmp dword [edi], 1
jne 0x42b2b4
push ebx
call sub.msvcrt.dll__wtol
pop ecx
dec eax
sete al
mov byte [0x433998], al
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42b434
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42b2f7
cmp dword [edi], 4
jne 0x42b2e2
cmp dword [ebx], 0
setne al
mov byte [0x433999], al
jmp 0x42b2f7
cmp dword [edi], 1
jne 0x42b2f7
push ebx
call sub.msvcrt.dll__wtol
pop ecx
dec eax
sete al
mov byte [0x433999], al
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42b458
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42b33e
cmp dword [edi], 4
jne 0x42b323
movzx eax, word [ebx]
mov word [0x4339a0], ax
jmp 0x42b33e
cmp dword [edi], 1
jne 0x42b33e
push 0
lea eax, [esp + 0x18]
push eax
push ebx
call sub.msvcrt.dll_wcstol
add esp, 0xc
mov word [0x4339a0], ax
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42b474
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42b385
cmp dword [edi], 4
jne 0x42b36a
movzx eax, word [ebx]
mov word [0x4339a2], ax
jmp 0x42b385
cmp dword [edi], 1
jne 0x42b385
push 0
lea eax, [esp + 0x18]
push eax
push ebx
call sub.msvcrt.dll_wcstol
add esp, 0xc
mov word [0x4339a2], ax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esi, 4
dec ebp
jne 0x42b208
mov al, 1
add esp, 0x58
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42cdbc
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42cecd
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov word [ebp - 0xc], 0x3d
movzx eax, word [ebp - 4]
dec eax
add ax, 0x41
mov word [ebp - 0xa], ax
mov word [ebp - 8], 0x3a
mov word [ebp - 6], 0
xor ebx, ebx
lea eax, [ebp - 0xc]
call fcn.0041bd98
mov esi, eax
test esi, esi
je 0x42ce1e
push esi
call sub.kernel32.dll_SetCurrentDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x42cea8
test esi, esi
je 0x42ce33
push 1
call sub.kernel32.dll_SetErrorMode
mov edi, eax
movzx eax, word [ebp - 0xa]
mov word [ebp - 0x216], ax
movzx eax, word [ebp - 8]
mov word [ebp - 0x214], ax
mov word [ebp - 0x212], 0x5c
mov word [ebp - 0x210], 0
lea edx, [ebp - 0x216]
lea eax, [ebp - 0xc]
call fcn.0041c020
lea eax, [ebp - 0x216]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
jne 0x42ce9e
push 0xffffffffffffffff
lea edx, [ebp - 0x21c]
mov eax, dword [0x433a80]
call fcn.00409478
mov eax, dword [ebp - 0x21c]
lea ecx, [ebp - 0x21c]
xor edx, edx
call fcn.0042cf54
test esi, esi
je 0x42cea8
push edi
call sub.kernel32.dll_SetErrorMode
mov eax, dword [0x433dec]
xor edx, edx
call fcn.0041ddbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ced4
lea eax, [ebp - 0x21c]
call fcn.00406984
ret
Function at 0x42d13c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp + 4], ecx
mov esi, edx
mov dword [esp], eax
mov dword [esp + 0x1c], 0xffffffff
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0xc
mov eax, 3
and eax, esi
cmp eax, 2
ja 0x42d180
mov edx, 1
and edx, esi
mov ecx, 8
and ecx, esi
and edx, ecx
je 0x42d188
or eax, 0xffffffff
jmp 0x42d35d
test eax, eax
je 0x42d1b1
mov edi, 0x40000000
mov edx, 0x42d368
mov eax, dword [esp]
call fcn.00414c0c
test eax, eax
je 0x42d1aa
mov dword [esp + 4], 1
mov ebp, 2
jmp 0x42d1bb
mov edi, 0x80000000
mov ebp, 3
cmp esi, 0x10a
jne 0x42d23c
push 0
push 0x80
push 3
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push eax
mov eax, 0x80000000
or eax, edi
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42d285
push 0
push 0x80
push ebp
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push eax
push edi
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42d285
call sub.kernel32.dll_GetLastError_2
mov dword [0x4339c4], eax
cmp dword [0x4339c4], 0x6e
jne 0x42d234
mov dword [0x4339c4], 2
or eax, 0xffffffff
jmp 0x42d35d
push 0
push 0x80
push ebp
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push eax
push edi
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42d285
call sub.kernel32.dll_GetLastError_2
mov dword [0x4339c4], eax
cmp dword [0x4339c4], 0x6e
jne 0x42d27d
mov dword [0x4339c4], 2
or eax, 0xffffffff
jmp 0x42d35d
push 8
push ebx
call sub.msvcrt.dll__open_osfhandle
add esp, 8
mov edi, eax
test esi, 8
je 0x42d354
mov eax, edi
call fcn.0041dc9c
test eax, eax
jne 0x42d354
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
test eax, eax
je 0x42d354
mov word [esp + 8], 0
mov dword [esp + 0x10], 0xffffffff
push 2
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov ebp, eax
call sub.kernel32.dll_GetLastError_2
mov dword [0x4339c4], eax
cmp ebp, 0xffffffff
jne 0x42d306
cmp dword [0x4339c4], 0
je 0x42d306
cmp edi, 0xffffffff
je 0x42d301
push edi
call sub.msvcrt.dll__close
pop ecx
or eax, 0xffffffff
jmp 0x42d35d
push 0
lea eax, [esp + 0x10]
push eax
push 1
lea eax, [esp + 0x14]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
mov ebp, eax
test ebp, ebp
jne 0x42d335
xor eax, eax
mov dword [esp + 0x10], eax
push 2
lea eax, [esp + 0x14]
push eax
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
cmp word [esp + 8], 0x1a
jne 0x42d354
mov dword [esp + 0x10], 0xffffffff
push 2
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov eax, edi
call fcn.0042d480
mov eax, edi
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42d6ec
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffff8
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0x5c
mov word [esp + 6], 0
push esp
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 1
ja 0x42d718
xor eax, eax
pop ecx
pop edx
ret
mov al, 1
pop ecx
pop edx
ret

Function at 0x42d720
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffddc
mov word [esp + 8], ax
mov word [esp + 0xa], 0x3a
mov word [esp + 0xc], 0x5c
mov word [esp + 0xe], 0
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 1
ja 0x42d753
mov al, 1
jmp 0x42d798
cmp eax, 2
je 0x42d796
cmp eax, 5
je 0x42d796
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x10]
push eax
push 0x104
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
jne 0x42d796
call sub.kernel32.dll_GetLastError_2
cmp eax, 5
jne 0x42d796
mov al, 1
jmp 0x42d798
xor eax, eax
add esp, 0x224
ret

Function at 0x42dc70
Capabilities:
Set console window title

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
test ebx, ebx
je 0x42dd42
mov eax, dword [0x433b08]
cmp dword [eax], 0
jne 0x42dd42
mov eax, dword [0x433a04]
cmp byte [eax], 0
jne 0x42dd42
mov eax, 0x20c
call fcn.00403f2c
mov dword [esp], eax
cmp dword [esp], 0
je 0x42dd42
push 0x104
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GetConsoleTitleW
mov esi, eax
test esi, esi
je 0x42dd42
mov eax, ebx
call fcn.00419fe4
add eax, esi
add eax, dword [0x44c958]
add eax, 0xa
mov edx, eax
add edx, edx
mov eax, esp
call fcn.00403f60
cmp dword [esp], 0
je 0x42dd42
mov eax, dword [0x433bbc]
cmp byte [eax], 0
je 0x42dd05
mov eax, dword [0x44c958]
add eax, eax
add eax, dword [esp]
mov edx, ebx
call fcn.00419ff4
jmp 0x42dd31
mov edx, 0x42dd48
mov eax, dword [esp]
call fcn.0041a008
mov eax, dword [esp]
call fcn.00419fe4
mov dword [0x44c958], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.0041a008
mov eax, dword [0x433bbc]
mov byte [eax], 1
mov eax, dword [esp]
push eax
call sub.kernel32.dll_SetConsoleTitleW
mov eax, dword [esp]
call fcn.00403f48
pop edx
pop esi
pop ebx
ret