joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4187a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x4189e3
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
cmp ebx, 0x110
jne 0x4187e8
push 1
call fcn.00418750
mov eax, dword [esp + 0x20]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edi
call fcn.00407110
mov ecx, esi
call fcn.004189f0
jmp 0x41885e
cmp ebx, 0xf
jne 0x418808
push 1
mov ecx, esi
call fcn.00418750
push ecx
mov ecx, esi
mov eax, esp
mov dword [esp + 0x20], esp
mov dword [eax], edi
call fcn.00418aa0
jmp 0x418821
cmp ebx, 0x113
jne 0x418843
push 1
mov ecx, esi
call fcn.00418750
push edi
mov ecx, esi
call fcn.00418cc0
mov ecx, esi
mov dword [ebp], 0
call fcn.00418740
test eax, eax
je 0x418914
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ebx, 0x4a
jne 0x41887c
push 1
mov ecx, esi
call fcn.00418750
mov ecx, dword [esp + 0x20]
push ecx
push edi
mov ecx, esi
call fcn.00419d90
mov ecx, esi
mov dword [ebp], eax
call fcn.00418740
test eax, eax
je 0x418914
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ebx, 0x111
jne 0x4188b8
cmp di, 0x3f2
jne 0x41889e
mov ecx, esi
call fcn.00418c70
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp di, 0x3f6
jne 0x418914
mov ecx, esi
call fcn.00419ea0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ebx, 0x7e9
jne 0x4188e6
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push 1
push edx
push eax
push ebx
mov ecx, esi
call fcn.00418e10
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ebx, 0xbd1
jne 0x418914
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push 1
push edx
push eax
push ebx
mov ecx, esi
call fcn.0041a3c0
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
push ebp
push edx
push edi
push ebx
push eax
lea ecx, [esi + 0x1c]
call fcn.0041bb20
test eax, eax
jne 0x4189d7
cmp ebx, 5
lea eax, [esi + 0x78]
jne 0x4189ac
test eax, eax
je 0x418944
lea esi, [eax - 0x78]
jmp 0x418946
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x41897b
mov ecx, dword [esi + 4]
push 0xe801
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x41896c
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x418980
test edi, edi
jne 0x41897b
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x418980
cmp edi, 1
je 0x4189d0
mov eax, dword [esp + 0x20]
mov edx, eax
shr edx, 0x10
movsx ecx, dx
movsx edx, ax
push ecx
push edx
lea ecx, [esi + 0x78]
call fcn.0041aed0
mov dword [ebp], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ebx, 0x24
jne 0x4189e3
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x4189d0
cmp dword [eax + 0x18], ecx
je 0x4189d0
mov ecx, dword [esp + 0x20]
mov edx, dword [eax + 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [eax + 0x18]
mov dword [ecx + 0x1c], eax
mov dword [ebp], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x419490
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push edi
push 1
mov eax, dword [esi + 0x264]
push 0
push eax
mov dword [esi + 0x2e8], 0x42c80000
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x394]
test eax, eax
je 0x4194c6
mov dword [esi + 0x390], 1
pop edi
pop esi
ret
mov eax, dword [esi + 0x70]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4194ef
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0041a3d0
pop edi
pop esi
ret
mov ecx, esi
call fcn.0041a210
pop edi
pop esi
ret
Function at 0x419d90
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov eax, dword [esp + 8]
push edi
test eax, eax
mov edi, ecx
jne 0x419d9f
pop edi
ret 8
cmp dword [eax], 0xe10
jne 0x419e75
mov eax, dword [edi + 0x70]
push ebp
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
je 0x419e64
mov eax, dword [edi + 0x340]
test eax, eax
jne 0x419e64
lea esi, [edi + 0x2f0]
lea edx, [esp + 0x14]
push ebx
push edx
mov ecx, esi
call fcn.00425250
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [0x457054]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ebx, eax
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x419e1b
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x419e1b
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0042d34c
add esp, 4
test ebx, ebx
pop ebx
je 0x419e64
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.00425250
mov ecx, dword [eax]
push 4
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x457054]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x419e64
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x419e64
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0042d34c
add esp, 4
mov edi, dword [edi + 0x70]
push edi
mov ecx, dword [edi]
call dword [ecx + 0x10]
pop esi
pop ebp
xor eax, eax
pop edi
ret 8
mov eax, 1
pop edi
ret 8
Function at 0x41a210
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44ddb8
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebp
push edi
mov edi, ecx
mov eax, dword [edi + 0x3e8]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor ebp, ebp
cmp eax, ebp
jne 0x41a3a7
mov eax, dword [0x4575b0]
push ebx
cmp eax, ebp
push esi
lea ebx, [edi + 0x3e4]
jne 0x41a25a
mov dword [0x4575b0], ebp
lea ecx, [ebx + 0x1c]
push ecx
push 0x457580
push 0x45d408
call fcn.0041ad70
push ebp
push eax
push ebp
push 0x80000
push SysReAllocString
push str.PictureAnimation
push 0x457428
push ebp
mov ecx, ebx
call fcn.0041b8e0
mov eax, dword [edi + 0x70]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov esi, eax
lea eax, [esp + 0x40]
push eax
push esi
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], esi
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [esp + 0x38], eax
xor ecx, ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x2c], ecx
push edx
mov dword [esp + 0x34], ecx
push esi
mov dword [esp + 0x90], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x3c], ecx
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
push ecx
mov dword [esp + 0x24], eax
push esi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
sub edx, eax
push ebp
push edx
mov edx, dword [esp + 0x28]
sub edx, ecx
push edx
push eax
mov eax, dword [edi + 0x3e8]
push ecx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [edi + 4]
push ecx
mov ecx, ebx
call fcn.0040feb0
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x28]
push edx
push eax
call fcn.00421770
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x41a378
push 0x10
call fcn.0042b550
xor ecx, ecx
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x41a370
lea edx, [esp + 0x10]
mov dword [eax], 0x44f938
push edx
push ecx
push ebp
mov dword [esp + 0x1c], ecx
call fcn.0042bd00
mov ecx, dword [esp + 0x14]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 4], eax
push ecx
mov ecx, ebx
call fcn.0040f9d0
mov ecx, dword [edi + 0x3e8]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push ecx
call edi
mov ecx, ebx
call fcn.0040fa50
push 0
push esi
call edi
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x40]
push edx
push eax
call dword [sym.imp.USER32.dll_EndPaint]
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x7c
ret
Function at 0x41bf20
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x44de7c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 0x18], ebx
or eax, 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov byte [esi + 0x94], bl
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
lea edi, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, edi
call fcn.0041ba60
mov dword [esi], 0x44fa18
mov dword [edi], 0x44fa0c
mov dword [esi + 0x58], 0x44f9e4
lea eax, [esi + 0x98]
mov dword [esp + 0x18], 2
cmp eax, ebx
je 0x41bfb2
lea ebx, [eax - 0x98]
push eax
lea ecx, [ebx + 8]
push 0x40
push 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esi + 0xa0]
mov byte [esp + 0x18], 3
call fcn.0040cb10
mov ecx, dword [esp + 0x10]
mov dword [edi], 0x44f9d8
mov dword [esi], 0x44f9cc
mov dword [esi + 0x58], 0x44f9a4
mov dword [esi + 0x74], 4
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41c230
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x41c3bd
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
cmp ebx, 0xf
jne 0x41c288
push 1
call fcn.0041c1e0
push ecx
mov ecx, esi
mov eax, esp
mov dword [esp + 0x2c], esp
mov dword [eax], edi
call fcn.0041c480
mov ecx, esi
mov dword [ebp], 0
call fcn.0041c1d0
test eax, eax
je 0x41c2ee
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ebx, 0x110
jne 0x41c2cc
push 1
mov ecx, esi
call fcn.0041c1e0
mov eax, dword [esp + 0x20]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.00407110
mov ecx, esi
call fcn.0041c3d0
mov ecx, esi
mov dword [ebp], eax
call fcn.0041c1d0
test eax, eax
je 0x41c2ee
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ebx, 0x111
jne 0x41c2ee
cmp di, 0x402
jne 0x41c2ee
mov ecx, esi
call fcn.0041c520
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push 0
push ebp
push ecx
push edi
push ebx
push edx
lea ecx, [esi + 0x1c]
call fcn.0041bb20
test eax, eax
jne 0x41c3b1
cmp ebx, 5
lea eax, [esi + 0x78]
jne 0x41c386
test eax, eax
je 0x41c31e
lea esi, [eax - 0x78]
jmp 0x41c320
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x41c355
mov eax, dword [esi + 4]
push 0xe801
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x41c346
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41c35a
test edi, edi
jne 0x41c355
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41c35a
cmp edi, 1
je 0x41c3aa
mov eax, dword [esp + 0x20]
mov ecx, eax
shr ecx, 0x10
movsx edx, cx
movsx eax, ax
push edx
push eax
lea ecx, [esi + 0x78]
call fcn.0041cb80
mov dword [ebp], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ebx, 0x24
jne 0x41c3bd
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x41c3aa
cmp dword [eax + 0x18], ecx
je 0x41c3aa
mov ecx, dword [esp + 0x20]
mov edx, dword [eax + 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [eax + 0x18]
mov dword [ecx + 0x1c], eax
mov dword [ebp], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x41dbc0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x41ddeb
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
cmp ebx, 0xf
jne 0x41dbff
push 1
call fcn.0041db70
push ecx
mov ecx, esi
mov eax, esp
mov dword [esp + 0x20], esp
mov dword [eax], edi
call fcn.0041e2c0
jmp 0x41dcfe
cmp ebx, 0x110
jne 0x41dc47
push 1
mov ecx, esi
call fcn.0041db70
mov eax, dword [esp + 0x20]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edi
call fcn.00407110
mov ecx, esi
call fcn.0041e490
mov ecx, esi
mov dword [ebp], eax
call fcn.0041db60
test eax, eax
je 0x41dd1c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ebx, 0x111
jne 0x41dcb7
cmp di, 0x3ea
jne 0x41dc69
mov ecx, esi
call fcn.0041de00
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp di, 0x3f4
jne 0x41dc83
mov ecx, esi
call fcn.0041e550
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp di, 0x3f3
jne 0x41dc9d
mov ecx, esi
call fcn.0041ea70
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp di, 0x405
jne 0x41dd1c
mov ecx, esi
call fcn.0041ead0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ebx, 0xbd0
jne 0x41dce5
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push 1
push ecx
push edx
push ebx
mov ecx, esi
call fcn.0041ef70
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ebx, 0x113
jne 0x41dd1c
push 1
mov ecx, esi
call fcn.0041db70
push edi
mov ecx, esi
call fcn.0041e200
mov ecx, esi
mov dword [ebp], 0
call fcn.0041db60
test eax, eax
je 0x41dd1c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
push ebp
push edx
push edi
push ebx
push eax
lea ecx, [esi + 0x1c]
call fcn.0041bb20
test eax, eax
jne 0x41dddf
cmp ebx, 5
lea eax, [esi + 0x78]
jne 0x41ddb4
test eax, eax
je 0x41dd4c
lea esi, [eax - 0x78]
jmp 0x41dd4e
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x41dd83
mov ecx, dword [esi + 4]
push 0xe801
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x41dd74
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41dd88
test edi, edi
jne 0x41dd83
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41dd88
cmp edi, 1
je 0x41ddd8
mov eax, dword [esp + 0x20]
mov edx, eax
shr edx, 0x10
movsx ecx, dx
movsx edx, ax
push ecx
push edx
lea ecx, [esi + 0x78]
call fcn.0041f300
mov dword [ebp], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ebx, 0x24
jne 0x41ddeb
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x41ddd8
cmp dword [eax + 0x18], ecx
je 0x41ddd8
mov ecx, dword [esp + 0x20]
mov edx, dword [eax + 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [eax + 0x18]
mov dword [ecx + 0x1c], eax
mov dword [ebp], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x41fcc0
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x44e2d1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x457050]
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov dword [esp + 0x10], ebx
mov dword [ebx + 4], eax
mov ecx, dword [0x457050]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx + 8], ecx
mov edx, dword [0x457050]
mov dword [ebx + 0xc], edx
mov byte [esp + 0x1c], 2
mov dword [ebx], 0x44fad8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp esi, edi
jne 0x41fd1b
xor ebp, ebp
jmp 0x41fd24
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
mov eax, dword [ebx + 0xc]
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
cmp edx, 1
jg 0x41fd37
cmp ebp, dword [eax - 4]
jle 0x41fd9e
mov edx, dword [0x457054]
add eax, 0xfffffff4
cmp eax, edx
je 0x41fd67
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41fd5e
mov eax, dword [ebx + 0xc]
sub eax, 0xc
push eax
call fcn.0042d34c
add esp, 4
mov ecx, dword [0x457050]
mov dword [ebx + 0xc], ecx
cmp ebp, edi
jne 0x41fd76
mov edx, dword [0x457050]
mov dword [ebx + 0xc], edx
jmp 0x41fd9e
lea eax, [ebp + ebp + 0xe]
push eax
call fcn.00438f1a
add esp, 4
cmp eax, edi
je 0x41fdcc
mov dword [eax], 1
mov word [eax + ebp*2 + 0xc], di
mov dword [eax + 4], ebp
mov dword [eax + 8], ebp
add eax, 0xc
mov dword [ebx + 0xc], eax
lea eax, [ebp + ebp]
lea ecx, [ebp + ebp + 2]
cmp ecx, eax
jb 0x41fdbd
mov edi, dword [ebx + 0xc]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0xc]
mov dword [ecx - 8], ebp
mov edx, dword [ebx + 0xc]
mov word [edx + eax], 0
mov ecx, ebx
call fcn.0041fea0
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x420510
Capabilities:
Get disk size

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x224
push esi
xor esi, esi
cmp edx, esi
je 0x42059d
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x22]
mov word [esp + 0x20], si
push esi
rep stosd dword es:[edi], eax
push esi
lea eax, [esp + 0x28]
push esi
push eax
push edx
call fcn.0043a280
add esp, 0x14
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
lea eax, [esp + 8]
push ecx
push edx
lea ecx, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
pop edi
je 0x42059d
mov eax, dword [esp + 0x230]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
mov eax, 1
add esp, 0x224
ret
xor eax, eax
pop esi
add esp, 0x224
ret
Function at 0x421430
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
lea eax, [esp]
push 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x42144e
test byte [esp], 7
mov eax, 1
jne 0x421453
call fcn.004213a0
pop ecx
ret

Function at 0x421460
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x44e3ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80c
push ebx
push ebp
push esi
push edi
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ebx, ebx
lea esi, [esp + 0x1c]
cmp word [esp + 0x1c], bx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
je 0x42155f
mov edi, dword [esp + 0x830]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ecx, dword [0x457050]
mov dword [esp + 0x10], ecx
xor edx, edx
lea eax, [esp + 0x10]
mov dx, word [esi]
mov dword [esp + 0x824], ebx
push edx
push str._c:_
push eax
call fcn.00414b00
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.00420510
mov eax, dword [esp + 0x2c]
add esp, 0x14
cmp eax, edi
jg 0x42157b
jl 0x421513
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x82c]
cmp ecx, eax
ja 0x42157b
push esi
call fcn.00439c05
mov ecx, dword [0x457054]
lea esi, [esi + eax*2 + 2]
mov eax, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x824], 0xffffffff
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x421556
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x421556
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0042d34c
add esp, 4
cmp word [esi], bx
jne 0x4214c2
xor ax, ax
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x818
ret
mov eax, dword [esp + 0x10]
mov edx, dword [0x457054]
mov si, word [esi]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4215a9
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4215a9
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0042d34c
add esp, 4
mov ax, si
jmp 0x421562
Function at 0x4215b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x614
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea eax, [esp + 0x218]
push 0x20
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0xc]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [0x457050]
lea eax, [esp + 0xc]
test eax, eax
mov dword [esp + 8], edx
je 0x4216fd
lea ecx, [esp + 0xc]
shr ecx, 0x10
jne 0x4216bd
xor edi, edi
lea edx, [esp + 0xc]
lea eax, [esp + 0x41c]
mov di, dx
push 0x100
push eax
push edi
call fcn.00403f50
mov ecx, 0x100
sub ecx, eax
cmp ecx, 1
jle 0x421671
lea edx, [esp + 0x41c]
lea ecx, [esp + 8]
push edx
call fcn.004030d0
jmp 0x4216fd
push 0x1ff
lea ecx, [esp + 0xc]
mov esi, 0x200
call fcn.00403b50
test eax, eax
je 0x4216b0
push esi
push eax
push edi
call fcn.00403f50
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x4216b0
add esi, 0x100
lea ecx, [esp + 8]
lea edx, [esi - 1]
push edx
call fcn.00403b50
test eax, eax
jne 0x421688
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.00403c10
jmp 0x4216fd
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x4216fd
push esi
lea ecx, [esp + 0xc]
call fcn.00403d10
test eax, eax
je 0x4216fd
lea ecx, [esi + esi]
lea edx, [esi + esi + 2]
cmp edx, ecx
jb 0x4216fd
mov edi, dword [esp + 8]
mov eax, ecx
lea esi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jl 0x421725
lea ecx, [esp + 0x214]
push ecx
push eax
call fcn.00438980
add esp, 8
test eax, eax
je 0x421725
sub eax, dword [esp + 8]
sar eax, 1
jmp 0x421728
or eax, 0xffffffff
xor edx, edx
test eax, eax
mov eax, dword [esp + 8]
setge dl
mov esi, edx
mov edx, dword [0x457054]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x421760
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x421760
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.0042d34c
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x614
ret

Function at 0x4228e0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x42292f
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x4228fa
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x422909
cmp eax, 1
jne 0x422909
test ecx, ecx
je 0x422909
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0x18]
mov dword [esi + 0xc], 0
push ecx
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0xffffffff
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret