joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017f0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x464c60
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ebx, dword [esp + 0x14]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00422ba0
cmp eax, 9
ja case.default.0x401830
xor ecx, ecx
mov cl, byte [eax + 0x401970]
jmp dword [ecx*4 + 0x401964]
push 0x12c
call fcn.0042d143
add esp, 4
mov esi, eax
push 0xc8
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push str._sdesktop
push ebx
call fcn.00411d7c
push esi
call fcn.0042d16c
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret
push str.UserEnv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je case.default.0x401830
push str.GetUserProfileDirectoryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je case.default.0x401830
lea edx, [esp + 0xc]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je case.default.0x401830
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x14]
push eax
push ecx
push edx
mov dword [esp + 0x20], 0
call edi
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4018e6
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
inc eax
push eax
call fcn.0042d143
mov ecx, dword [esp + 0x18]
mov esi, eax
add esp, 4
lea edx, [esp + 0x14]
mov byte [ecx + esi], 0
mov eax, dword [esp + 0xc]
push edx
push esi
push eax
call edi
test eax, eax
je 0x40191a
push esi
push 0x446ecc
push ebx
call fcn.00411d7c
add esp, 0xc
push esi
call fcn.0042d16c
mov ecx, dword [esp + 0x10]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je case.default.0x401830
push str.SHGetSpecialFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je case.default.0x401830
push 0
push 0
push ebx
push 0
call eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x401980
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov edi, 0x464c60
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ebx, dword [esp + 0x10]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00422ba0
cmp eax, 9
ja case.default.0x4019bf
xor ecx, ecx
mov cl, byte [eax + 0x401abc]
jmp dword [ecx*4 + 0x401ab0]
push 0x12c
call fcn.0042d143
add esp, 4
mov esi, eax
push 0xc8
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push str._sdesktop
push ebx
call fcn.00411d7c
push esi
call fcn.0042d16c
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
ret
push str.UserEnv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je case.default.0x4019bf
push str.GetAllUsersProfileDirectoryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je case.default.0x4019bf
lea edx, [esp + 0x10]
lea eax, [esp + 0x10]
push edx
push eax
mov dword [esp + 0x18], 0
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je case.default.0x4019bf
inc eax
push eax
call fcn.0042d143
mov ecx, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 0x10]
mov esi, eax
push edx
push esi
mov byte [ecx + esi], 0
call edi
test eax, eax
je 0x401a70
push esi
push 0x446ecc
push ebx
call fcn.00411d7c
add esp, 0xc
push esi
call fcn.0042d16c
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je case.default.0x4019bf
push str.SHGetSpecialFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je case.default.0x4019bf
push 0
push 0x19
push ebx
push 0
call eax
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x401e50
Capabilities:
Get disk information
Set file attributes

Disassembly:
sub esp, 0x20
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push ebx
push esi
push edi
mov edi, 0x446ee8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov cl, bl
lea edx, [esp + 0xc]
add cl, 0x40
push edx
mov byte [esp + 0x10], cl
call esi
cmp eax, 3
jne 0x401eaf
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00411dfa
add esp, 8
test eax, eax
je 0x401ebf
inc ebx
cmp ebx, 0x1a
jle 0x401e87
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x20
ret
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push ecx
push str._supmc_
push esi
call fcn.00411d7c
push esi
call fcn.00411dce
add esp, 0x10
push 0x22
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x4023d0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x464c5c]
sub esp, 0x12c
test eax, eax
push esi
jne 0x4024c4
mov esi, dword [esp + 0x134]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x464c5c], eax
jne 0x40241b
push esi
lea eax, [esp + 8]
push 0x446fec
push eax
call fcn.00411d7c
add esp, 0xc
mov eax, 0xfffffffe
pop esi
add esp, 0x12c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x446fd8
push eax
call esi
mov ecx, dword [0x464c5c]
push 0x446fc4
push ecx
mov dword [0x464c38], eax
call esi
mov edx, dword [0x464c5c]
push 0x446fb4
push edx
mov dword [0x464c3c], eax
call esi
mov dword [0x464c40], eax
mov eax, dword [0x464c5c]
push 0x446fa4
push eax
call esi
mov ecx, dword [0x464c5c]
push 0x446f90
push ecx
mov dword [0x464c44], eax
call esi
mov edx, dword [0x464c5c]
push 0x446f7c
push edx
mov dword [0x464c48], eax
call esi
mov dword [0x464c4c], eax
mov eax, dword [0x464c5c]
push 0x446f68
push eax
call esi
mov ecx, dword [0x464c5c]
push 0x446f54
push ecx
mov dword [0x464c50], eax
call esi
mov edx, dword [0x464c5c]
push 0x446f40
push edx
mov dword [0x464c54], eax
call esi
mov dword [0x464c58], eax
xor eax, eax
pop esi
add esp, 0x12c
ret

Function at 0x405600
Capabilities:
Get disk size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x144
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00411d7c
add esp, 8
lea edx, [esp + 0x10]
lea eax, [esp]
lea ecx, [esp + 8]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x405695
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x405695
cmp eax, 0x56
jne 0x405650
or eax, 0xffffffff
add esp, 0x144
ret
cmp eax, 5
jne 0x40565f
or eax, 0xffffffff
add esp, 0x144
ret
cmp eax, 0x35
jne 0x40566e
or eax, 0xffffffff
add esp, 0x144
ret
push eax
lea eax, [esp + 0x1c]
push str.LZGP_CheckNetPathIfLoginOk_:_d
push eax
call fcn.00411d7c
add esp, 0xc
lea ecx, [esp + 0x18]
push 0
push str.jfdjkafjk
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x144
ret

Function at 0x4056a0
Capabilities:
Connect network resource

Disassembly:
sub esp, 0x14c
mov edx, dword [esp + 0x154]
push edi
xor ecx, ecx
mov eax, 0x20
lea edi, [esp + 4]
xor eax, eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 4], 1
mov dword [esp + 0xc], 2
mov dword [esp + 8], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
pop edi
je 0x405701
mov eax, dword [esp + 0x150]
push edx
push eax
lea ecx, [esp + 0x28]
push 0x448798
push ecx
call fcn.00411d7c
add esp, 0x10
jmp 0x40571b
mov edx, dword [esp + 0x150]
lea eax, [esp + 0x20]
push edx
push str._s
push eax
call fcn.00411d7c
add esp, 0xc
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x15c]
lea ecx, [esp + 0x20]
push 1
mov dword [esp + 0x18], ecx
push edx
lea ecx, [esp + 8]
push eax
push ecx
call sub.MPR.dll_WNetAddConnection2A
neg eax
sbb eax, eax
add esp, 0x14c
ret
Function at 0x405750
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x465290]
sub esp, 0x12c
test eax, eax
push esi
je 0x40576a
xor eax, eax
pop esi
add esp, 0x12c
ret
mov esi, dword [esp + 0x134]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x465290], eax
jne 0x4057a1
push esi
lea eax, [esp + 8]
push 0x446fec
push eax
call fcn.00411d7c
add esp, 0xc
mov eax, 0xfffffffe
pop esi
add esp, 0x12c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._GetNumberOfDrive__YAEH_Z
push eax
call esi
mov ecx, dword [0x465290]
push str._SetCurrentDriveNumber__YAHE_Z
push ecx
mov dword [0x465264], eax
call esi
mov edx, dword [0x465290]
push str._GetCurrentDriveInfo__YAHPADPAE_Z
push edx
mov dword [0x465268], eax
call esi
mov dword [0x46526c], eax
mov eax, dword [0x465290]
push str._pFileOpen__YAKEAAKPAD_Z
push eax
call esi
mov ecx, dword [0x465290]
push str._pFileClose__YAKK_Z
push ecx
mov dword [0x465270], eax
call esi
mov edx, dword [0x465290]
push str._pFileWrite__YAKKPAEAAK_Z
push edx
mov dword [0x465274], eax
call esi
mov dword [0x465278], eax
mov eax, dword [0x465290]
push str._pFileRead__YAKKPAEAAK_Z
push eax
call esi
mov ecx, dword [0x465290]
push str._AuthenticatePrivateArea__YAHPAD_Z
push ecx
mov dword [0x46527c], eax
call esi
mov edx, dword [0x465290]
push str._pInitialFileSystem__YAKXZ
push edx
mov dword [0x465280], eax
call esi
mov dword [0x465284], eax
mov eax, dword [0x465290]
push str._pCloseFileSystem__YAKXZ
push eax
call esi
mov ecx, dword [0x465290]
push str._UnAuthenticatePrivateArea__YAHXZ
push ecx
mov dword [0x465288], eax
call esi
mov edx, dword [0x465264]
or ecx, 0xffffffff
test edx, edx
mov dword [0x46528c], eax
je 0x4058e6
mov edx, dword [0x465268]
test edx, edx
je 0x4058e6
mov edx, dword [0x46526c]
test edx, edx
je 0x4058e6
mov edx, dword [0x465270]
test edx, edx
je 0x4058e6
mov edx, dword [0x465274]
test edx, edx
je 0x4058e6
mov edx, dword [0x465278]
test edx, edx
je 0x4058e6
mov edx, dword [0x46527c]
test edx, edx
je 0x4058e6
mov edx, dword [0x465280]
test edx, edx
je 0x4058e6
mov edx, dword [0x465284]
test edx, edx
je 0x4058e6
mov edx, dword [0x465288]
test edx, edx
je 0x4058e6
test eax, eax
je 0x4058e6
xor ecx, ecx
pop esi
mov eax, ecx
add esp, 0x12c
ret
mov dword [0x465290], 0
mov eax, ecx
pop esi
add esp, 0x12c
ret

Function at 0x406790
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x194
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_socket]
push 0
push 2
mov esi, ecx
push 2
mov dword [esp + 0x14], 0x3e8
call edi
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4067de
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x276d
jne 0x4067d4
lea eax, [esp + 0xc]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 2
push 2
call edi
mov dword [esi], eax
mov edx, dword [esi]
lea ecx, [esp + 8]
push 4
push ecx
push 0x1006
push 0xffff
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00406a50
mov eax, esi
pop edi
pop esi
add esp, 0x194
ret
Function at 0x406830
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x1a8
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x22b8
mov byte [esp + 0x2c], 0x3e
mov byte [esp + 0x2d], 0xf2
mov word [esp + 0x1c], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1a], ax
mov eax, dword [edi + 4]
xor esi, esi
xor ebx, ebx
test eax, eax
jle 0x4068bf
mov ebp, dword [sym.imp.WS2_32.dll_sendto]
mov eax, dword [edi + 8]
lea ecx, [eax + ebx*8]
mov eax, dword [eax + ebx*8]
cmp eax, 0x100007f
je 0x4068af
test eax, eax
je 0x4068af
mov esi, dword [ecx + 4]
lea ecx, [esp + 0x18]
not esi
push 0x10
push ecx
or esi, eax
mov eax, dword [edi]
push 0
lea edx, [esp + 0x34]
push 2
push edx
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], 0x10
call ebp
cmp eax, 0xffffffff
je 0x4068ff
mov eax, dword [edi + 4]
inc ebx
cmp ebx, eax
jl 0x40686e
test esi, esi
jne 0x406964
mov edx, dword [edi + 4]
lea eax, [esp + 0x8c]
push edx
push 0x448ab4
push eax
call fcn.00411d7c
add esp, 0xc
lea ecx, [esp + 0x8c]
push 0
push str.test
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1a8
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
mov ebp, eax
push edx
mov edx, dword [ecx + ebx*8]
lea eax, [ecx + ebx*8]
mov ecx, dword [ecx + ebx*8 + 4]
lea eax, [esp + 0x90]
push ecx
push edx
push esi
push ebx
push ebp
push 0x448a80
push eax
call fcn.00411d7c
add esp, 0x20
lea ecx, [esp + 0x8c]
push 0
push str.test
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
cmp ebp, 0x2738
pop edi
pop esi
setne al
pop ebp
add eax, 0xfffffffe
pop ebx
add esp, 0x1a8
ret 8
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, dword [sym.imp.WS2_32.dll_recvfrom]
xor ebx, ebx
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0xa
jg 0x4069b4
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov edx, dword [edi]
push eax
push ebx
lea ecx, [esp + 0x34]
push 0x64
push ecx
push edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x2c], 0x10
call esi
cmp eax, 0xffffffff
jne 0x4069e2
call ebp
cmp eax, 0x274c
jne 0x4069c6
inc dword [esp + 0x10]
jmp 0x406976
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
add esp, 0x1a8
ret 8
xor ecx, ecx
cmp eax, 0x2738
setne cl
pop edi
add ecx, 0xfffffffc
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x1a8
ret 8
mov edx, dword [esp + 0x1f]
mov eax, dword [esp + 0x1e]
mov ecx, dword [esp + 0x1d]
and edx, 0xff
push edx
mov edx, dword [esp + 0x20]
and eax, 0xff
and ecx, 0xff
push eax
mov eax, dword [esp + 0x1c4]
and edx, 0xff
push ecx
push edx
push str._d._d._d._d
push eax
call fcn.00411d7c
mov ecx, dword [esp + 0x32]
add esp, 0x18
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x1c0]
and eax, 0xffff
pop edi
pop esi
mov dword [edx], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a8
ret 8
Function at 0x406b10
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x4652dc]
sub esp, 0x12c
test eax, eax
push esi
je 0x406b2a
xor eax, eax
pop esi
add esp, 0x12c
ret
mov esi, dword [esp + 0x134]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x4652dc], eax
jne 0x406b61
push esi
lea eax, [esp + 8]
push 0x446fec
push eax
call fcn.00411d7c
add esp, 0xc
mov eax, 0xfffffffe
pop esi
add esp, 0x12c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.UDLL_CreateCUSBDevice
push eax
call esi
mov ecx, dword [0x4652dc]
push str.UDLL_DestroyCUSBDevice
push ecx
mov dword [0x4652b4], eax
call esi
mov edx, dword [0x4652dc]
push str.UDLL_GetDriveLetter
push edx
mov dword [0x4652b8], eax
call esi
mov dword [0x4652bc], eax
mov eax, dword [0x4652dc]
push str.UDLL_GetLUNDriveLetter
push eax
call esi
mov ecx, dword [0x4652dc]
push str.UDLL_DeviceExist
push ecx
mov dword [0x4652c0], eax
call esi
mov edx, dword [0x4652dc]
push str.UDLL_GetSerialNumber
push edx
mov dword [0x4652c4], eax
call esi
mov dword [0x4652c8], eax
mov eax, dword [0x4652dc]
push str.UDLL_GetHiddenArea1Size
push eax
call esi
mov ecx, dword [0x4652dc]
push str.UDLL_IsPasswordRegistered
push ecx
mov dword [0x4652cc], eax
call esi
mov edx, dword [0x4652dc]
push str.UDLL_WriteHiddenArea1
push edx
mov dword [0x4652d0], eax
call esi
mov dword [0x4652d4], eax
mov eax, dword [0x4652dc]
push str.UDLL_ReadHiddenArea1
push eax
call esi
mov edx, dword [0x4652b4]
or ecx, 0xffffffff
test edx, edx
mov dword [0x4652d8], eax
je 0x406c89
mov edx, dword [0x4652b8]
test edx, edx
je 0x406c89
mov edx, dword [0x4652bc]
test edx, edx
je 0x406c89
mov edx, dword [0x4652c0]
test edx, edx
je 0x406c89
mov edx, dword [0x4652c4]
test edx, edx
je 0x406c89
mov edx, dword [0x4652c8]
test edx, edx
je 0x406c89
mov edx, dword [0x4652cc]
test edx, edx
je 0x406c89
mov edx, dword [0x4652d0]
test edx, edx
je 0x406c89
mov edx, dword [0x4652d4]
test edx, edx
je 0x406c89
test eax, eax
je 0x406c89
xor ecx, ecx
pop esi
mov eax, ecx
add esp, 0x12c
ret
mov dword [0x4652dc], 0
mov eax, ecx
pop esi
add esp, 0x12c
ret
Function at 0x407a20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x130
lea eax, [esp + 4]
push ebx
push esi
push 0x465350
push str._sloglzerror.txt
push eax
call fcn.00411d7c
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0xc]
push 0
push 0x10000080
push 4
push 0
push 3
push 0xc0000000
push ecx
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407aa0
push 0x448e10
call fcn.00411dce
add esp, 4
lea edx, [esp + 0xc]
push 0
push 0x10000080
push 4
push 0
push 3
push 0xc0000000
push edx
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407aa0
pop esi
mov eax, 1
pop ebx
add esp, 0x130
ret
push ebp
push edi
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x144]
lea eax, [esp + 0x10]
push 0
push eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call ebp
mov edi, 0x447220
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
lea edi, [esp + 0x18]
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 0x130
ret

Function at 0x407dc0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x25c
lea ecx, [esp + 4]
push esi
push edi
push eax
push str.real_
push str.g:_temp_sheetdest_
push 0x448e28
push ecx
call fcn.00411d7c
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0xc]
push 0
push 0x10000080
push 4
push 0
push 3
push 0xc0000000
push edx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x407e4a
lea eax, [esp + 0xc]
push eax
call fcn.00422dc0
add esp, 4
lea ecx, [esp + 0xc]
push 0
push 0x10000080
push 4
push 0
push 3
push 0xc0000000
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x407e4a
pop edi
mov eax, 1
pop esi
add esp, 0x25c
ret
mov edi, dword [esp + 0x26c]
push 0
mov eax, dword [edi + 0x130]
lea edx, [edi + 0x12c]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [edi + 0x134]
mov eax, dword [edi + 0x150]
lea ecx, [esp + 8]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x25c
ret
Function at 0x408750
Capabilities:
Get disk size

Disassembly:
sub esp, 0x144
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x158]
mov ebp, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov bl, 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
je 0x408808
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call ebp
test eax, eax
jne 0x4087cf
lea eax, [esi - 1]
test eax, eax
jl 0x40878a
cmp byte [esp + eax + 0x28], bl
je 0x4087c8
dec eax
jns 0x4087bd
jmp 0x40878a
mov byte [esp + eax + 0x28], 0
jmp 0x40878a
mov edx, dword [esp + 0x15c]
test edx, edx
je 0x4087fb
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x144
ret
Function at 0x408820
Capabilities:
Get disk size

Disassembly:
sub esp, 0x270
lea eax, [esp + 0x18]
push esi
push str.g:_temp_sheetdest_
push 0x446f04
push eax
call fcn.00411d7c
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push ecx
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
call esi
test eax, eax
jne 0x4088e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x4088a3
lea edx, [esp + 0x148]
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.00408750
add esp, 8
test eax, eax
jne 0x4088a3
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push ecx
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x150]
push eax
push ecx
call esi
test eax, eax
jne 0x4088e4
lea edx, [esp + 0x1c]
lea eax, [esp + 0x1c]
push edx
push 0x464ff0
push eax
call fcn.00411d7c
mov edx, dword [esp + 0x284]
add esp, 0xc
lea ecx, [esp + 0x1c]
push 0x1000
push 0x448940
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop esi
add esp, 0x270
ret
push ebx
mov ebx, dword [esp + 8]
mov ecx, 0x448ca4
push edi
mov edi, dword [esp + 0x10]
or esi, 0xffffffff
sub ecx, 0x10
mov eax, dword [ecx + 0xc]
add ecx, 0x10
inc esi
test eax, eax
je 0x408971
mov eax, dword [ecx]
cdq
cmp edi, edx
ja 0x4088f9
jb 0x408911
cmp ebx, eax
ja 0x4088f9
mov eax, dword [ecx + 4]
cdq
cmp edi, edx
jb 0x4088f9
ja 0x40891f
cmp ebx, eax
jb 0x4088f9
mov ecx, dword [esp + 0x18]
shl esi, 4
mov eax, dword [esi + 0x448cac]
cdq
cmp ecx, edx
ja 0x408971
jb 0x40893b
mov edx, dword [esp + 0x14]
cmp edx, eax
jae 0x408971
mov eax, dword [esi + 0x448cb0]
lea ecx, [esp + 0x24]
push eax
push 0x465054
push ecx
call fcn.00411d7c
mov eax, dword [esp + 0x28c]
add esp, 0xc
lea edx, [esp + 0x24]
push 0x1000
push 0x448940
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x270
ret

Function at 0x408980
Capabilities:
Get disk size

Disassembly:
sub esp, 0x144
lea eax, [esp + 0x18]
push str.g:_temp_sheetdest_
push 0x446f04
push eax
call fcn.00411d7c
add esp, 0xc
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
lea eax, [esp]
push ecx
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x4089f3
lea edx, [esp + 0x18]
push 0x465180
push edx
call fcn.00411d7c
mov ecx, dword [esp + 0x150]
add esp, 8
lea eax, [esp + 0x18]
push 0x1000
push 0x448940
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x144
ret
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x150]
cmp edx, eax
mov eax, dword [esp]
ja 0x408a53
jb 0x408a11
cmp eax, dword [esp + 0x14c]
jae 0x408a53
mov ecx, 0x14
call fcn.00412c90
push edx
mov edx, dword [0x447030]
push eax
push edx
lea eax, [esp + 0x24]
push 0x448e9c
push eax
call fcn.00411d7c
mov edx, dword [esp + 0x15c]
add esp, 0x14
lea ecx, [esp + 0x18]
push 0x1000
push 0x448940
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x144
ret