joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40893d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x17c
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edi, dword [0x4e2228]
test ebx, ebx
js 0x4089c5
lea esi, [ebx - 0x80]
cmp esi, 0x40
jbe 0x408981
mov dword [esp + 8], 0x185
mov dword [esp + 4], str.drive.c
mov dword [esp], str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
call dword [0x494088]
xor eax, eax
test ecx, ecx
jne 0x40898b
test edx, edx
je 0x4089e0
cmp edi, ebx
jne 0x4089cc
cmp dword [eax*8 + 0x4e224c], ecx
je 0x4089a0
inc eax
cmp eax, 0x10
jne 0x40898f
jmp 0x4089ab
cmp dword [eax*8 + 0x4e2248], edx
jne 0x408998
jmp 0x4089e0
cmp dword [ebp + 0x18], 0
jne 0x4089c5
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp], str.Error:_Could_not_find_a_partition_at_offset__lld_on_this_disk
call fcn.0043efa9
xor eax, eax
jmp 0x408b04
cmp dword [ebp + 0x18], 0
jne 0x4089c5
mov dword [esp], str.Error:_Searching_for_a_partition_on_a_non_matching_disk
call fcn.0043efa9
jmp 0x4089c5
inc eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x15c]
mov dword [esp + 8], str.Harddisk_luPartition_lu
mov dword [esp + 4], 0x40
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__snprintf]
mov ebx, dword [str._GLOBALROOT]
mov ecx, 1
mov byte [ebp - 0x11d], 0
test ebx, ebx
je 0x408a33
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
lea ecx, [eax + 1]
mov eax, 0x104
cmp ecx, eax
cmova ecx, eax
mov esi, ebx
lea edi, [ebp - 0x11c]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], ebx
mov ebx, 0x103
call sub.msvcrt.dll_strlen
lea edx, [eax + 1]
cmp edx, 0x104
cmovae eax, ebx
mov byte [ebp + eax - 0x11c], 0
lea eax, [ebp - 0x10e]
mov dword [esp + 4], eax
lea eax, [ebp - 0x15c]
mov dword [esp + 8], 0xf6
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
sub esp, 0xc
test eax, eax
je 0x408a99
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cmp eax, 0x13
ja 0x408ac7
cmp dword [ebp + 0x18], 0
jne 0x4089c5
call fcn.0043f53d
mov dword [esp], str.Could_not_find_a_DOS_volume_name_for__s:__s
mov dword [esp + 8], eax
lea eax, [ebp - 0x15c]
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x4089c5
cmp dword [ebp + 0x14], 0
je 0x408af5
mov edx, ebx
mov dword [esp + 4], 0x49844d
sub edx, eax
mov eax, 2
cmp edx, eax
cmova edx, eax
lea eax, [ebp - 0x11c]
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_strncat
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strdup]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x409fd4
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
xor edi, edi
push esi
lea eax, [ebp - 0xe0]
lea esi, [ebp - 0xf0]
push ebx
sub esp, 0x10c
mov dword [ebp - 0xf0], ecx
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov edi, dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0xc8
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x560000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call edi
sub esp, 0x20
test eax, eax
je 0x40a045
cmp dword [ebp - 0xf0], 0
je 0x40a045
mov edx, dword [ebp - 0xe0]
test edx, edx
jne 0x40a0b5
xor eax, eax
xor edx, edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0xec]
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp + 4], 0x2d1080
mov eax, dword [ebp + 8]
mov dword [esp], eax
call edi
sub esp, 0x20
test eax, eax
je 0x40a092
cmp dword [ebp - 0xf0], 0
jne 0x40a0ad
mov eax, str._empty_data_
jmp 0x40a097
call fcn.0043f53d
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], str.Could_not_get_device_number_for_device__s__s
call fcn.0043efa9
jmp 0x40a0ce
mov eax, dword [ebp - 0xe8]
jmp 0x40a0d3
dec edx
mov eax, dword [ebp - 0xd8]
je 0x40a0d3
mov dword [esp + 4], ebx
mov dword [esp], str.Ignoring_drive__s_as_it_spans_multiple_disks__RAID__
call fcn.0043efa9
or eax, 0xffffffff
jmp 0x40a0fa
cmp eax, 0x3f
jle 0x40a0fa
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], str.Device_Number_for_device__s_is_too_big___d____ignoring_device
call fcn.0043efa9
mov dword [esp], str.NOTE:_This_may_be_due_to_an_excess_of_Virtual_Drives__such_as_hidden_ones_created_by_the_XBox_PC_app
call fcn.0043efa9
jmp 0x40a0ce
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40a5e5
Capabilities:
Get disk information

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.0040a102

Function at 0x40a80f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp - 0x71]
add esp, 0xffffff80
mov bl, byte [ebp + 8]
mov dword [esp + 4], esi
mov dword [esp], 0x69
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsA]
push edx
push edx
test eax, eax
jne 0x40a84b
call fcn.0043f53d
mov dword [esp], str.GetLogicalDriveStrings_failed:__s
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x40a868
cmp eax, 0x69
jbe 0x40a888
mov dword [esp + 8], 0x69
mov dword [esp + 4], eax
mov dword [esp], str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
call fcn.0043efa9
mov eax, 1
jmp 0x40a891
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_toupper]
cmp bl, al
je 0x40a868
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea esi, [esi + eax + 1]
movsx eax, byte [esi]
test al, al
jne 0x40a86f
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40af42
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov eax, 0x103c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00487b00
mov ecx, 0x400
xor ebx, ebx
xor esi, esi
sub esp, eax
lea edi, [ebp - 0x1018]
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], 1
xor edi, edi
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00408902
cmp eax, 0xffffffff
je 0x40b067
mov ebx, eax
lea eax, [ebp - 0x101c]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x1018]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0x1000
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x70050
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
sub esp, 0x20
test eax, eax
je 0x40afe6
cmp dword [ebp - 0x101c], 0
lea edi, [ebp - 0xfc8]
jne 0x40b01a
call fcn.0043f53d
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], str.Could_not_get_layout_for_drive_0x_02x:__s
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x40b051
mov eax, dword [ebp - 0x1018]
test eax, eax
jne 0x40b024
cmp byte [edi], 0xef
je 0x40b03b
inc esi
add edi, 0x90
cmp esi, dword [ebp - 0x1014]
jb 0x40b004
jmp 0x40b051
dec eax
jne 0x40b013
mov dword [esp + 4], 0x4caa3c
mov dword [esp], edi
call fcn.0043e378
test eax, eax
je 0x40b013
imul esi, esi, 0x90
mov edi, dword [ebp + esi - 0xfdc]
mov esi, dword [ebp + esi - 0xfe0]
jmp 0x40b055
xor esi, esi
xor edi, edi
lea eax, [ebx - 1]
cmp eax, 0xfffffffd
ja 0x40b067
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
lea esp, [ebp - 0xc]
mov eax, esi
mov edx, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40b8b4
Capabilities:
Get disk information

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x7c
mov edi, dword [ebp + 8]
mov dword [ebp - 0x4b], 0x5c2e5c5c
mov dword [ebp - 0x48], 0x3a235c
movsx ebx, byte [edi]
mov byte [ebp - 0x47], bl
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x4b]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 8], 3
mov dword [esp + 4], 0xc0000000
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
jne 0x40b93e
call fcn.0043f53d
mov dword [ebp - 0x5c], eax
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_toupper]
mov edx, dword [ebp - 0x5c]
mov dword [esp], str.Failed_to_open__c:_for_flushing:__s
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0043efa9
jmp 0x40b992
mov dword [esp], eax
mov dword [ebp - 0x5c], eax
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
test eax, eax
push edx
mov edx, dword [ebp - 0x5c]
jne 0x40b980
mov dword [ebp - 0x60], edx
call fcn.0043f53d
mov dword [ebp - 0x5c], eax
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_toupper]
mov ecx, dword [ebp - 0x5c]
mov dword [esp], str.Failed_to_flush__c:__s
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0043efa9
mov edx, dword [ebp - 0x60]
lea eax, [edx - 1]
cmp eax, 0xfffffffd
ja 0x40b992
mov dword [esp], edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
mov dword [esp + 8], 0x33
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_GetVolumeNameForVolumeMountPointA]
sub esp, 0xc
test eax, eax
jne 0x40b9b5
mov ebx, 1
jmp 0x40ba2e
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.0040b53e
mov ebx, eax
test eax, eax
je 0x40b9ef
cmp dword [ebp + 0xc], 0
jne 0x40b9ae
movsx eax, byte [edi]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_toupper]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Successfully_remounted__s_as__c:
call fcn.0043efa9
jmp 0x40b9ae
cmp dword [ebp + 0xc], 0
jne 0x40ba24
call fcn.0043f53d
mov dword [ebp - 0x5c], eax
movsx eax, byte [edi]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_toupper]
mov edx, dword [ebp - 0x5c]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp], str.Could_not_remount__s_as__c:__s
call fcn.0043efa9
mov dword [0x4e2900], 0xe0031209
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40e198
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov eax, 0x1030
mov ebp, esp
push edi
push ebx
call fcn.00487b00
mov ecx, 0x400
xor ebx, ebx
sub esp, eax
lea edi, [ebp - 0x1008]
xor eax, eax
mov dword [ebp - 0x100c], ebx
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [esp + 0xc], 1
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00408902
mov ebx, eax
inc eax
jne 0x40e1e9
xor edi, edi
jmp 0x40e2c3
lea eax, [ebp - 0x100c]
xor ecx, ecx
xor edx, edx
mov dword [esp], ebx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x1008]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0x1000
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x70050
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
sub esp, 0x20
test eax, eax
je 0x40e1e2
cmp dword [ebp - 0x100c], 0
je 0x40e1e2
cmp dword [ebp - 0x1008], 1
jne 0x40e1e2
cmp dword [ebp - 0x1004], 2
jne 0x40e1e2
lea eax, [ebp - 0xfb8]
mov dword [esp + 4], 0x4cabec
mov dword [esp], eax
call fcn.0043e378
test eax, eax
je 0x40e1e2
lea eax, [ebp - 0xf28]
mov dword [esp + 4], 0x4cabac
mov dword [esp], eax
call fcn.0043e378
test eax, eax
je 0x40e1e2
cmp dword [ebp - 0xf34], 4
jle 0x40e1e2
mov edx, dword [ebp - 0xf3c]
mov eax, dword [ebp - 0xf40]
mov dword [esp], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.0040b073
mov dword [esp + 4], 0x498f06
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
sete al
movzx eax, al
mov edi, eax
lea eax, [ebx - 1]
cmp eax, 0xfffffffd
ja 0x40e2d5
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
lea esp, [ebp - 8]
mov eax, edi
pop ebx
pop edi
pop ebp
ret
Function at 0x40edd7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ecx, 0x41
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x11c]
push ebx
sub esp, 0x16c
mov dword [ebp - 0x13c], eax
xor eax, eax
rep stosd dword es:[edi], eax
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x13c]
mov dword [edx], ecx
mov dword [ebp - 0x124], 0xffffffff
mov dword [ebp - 0x120], 4
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [ebp - 0x11c]
mov ecx, eax
mov ebx, eax
test ebx, ebx
je 0x40eeeb
mov eax, dword [ebp - 0x13c]
cmp byte [eax + ebx], 0x5c
je 0x40ee53
dec ebx
jmp 0x40ee3c
cmp ebx, 0x103
ja 0x40efe8
mov eax, 0x104
inc ecx
mov esi, dword [ebp - 0x13c]
mov edi, edx
cmp ecx, eax
cmova ecx, eax
mov eax, dword [ebp - 0x13c]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [ebp - 0x11c]
lea ecx, [eax + 1]
cmp ecx, 0x104
mov ecx, 0x103
cmovae eax, ecx
mov byte [ebp + eax - 0x11c], 0
lea eax, [ebp - 0x12c]
mov byte [ebp + ebx - 0x11c], 0
inc ebx
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x40ef7e
xor eax, eax
mov dword [ebp - 0x12c], eax
jmp 0x40efc0
lea eax, [ebp - 0x130]
mov dword [esp + 0xc], 0x2001d
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x49ad96
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x40ef2c
xor eax, eax
mov dword [ebp - 0x130], eax
jmp 0x40efc0
lea eax, [ebp - 0x128]
xor edi, edi
xor esi, esi
mov dword [esp + 0x14], 7
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x12c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 0x49ad9f
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
jne 0x40eede
lea eax, [ebp - 0x120]
xor ecx, ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x140]
mov dword [esp + 8], ecx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x124]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x13c]
add eax, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x40efd4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x40efe8
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40f08b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
add eax, 8
sub esp, 0x24
mov dword [eax + 0x14], 0
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, eax
sub esp, 0x14
mov eax, 1
test edx, edx
jne 0x40f0dc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
sete al
movzx eax, al
neg eax
mov dword [ebx + 4], eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x41ad27
Capabilities:
Read file on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push ebx
mov ebx, eax
add eax, 8
sub esp, 0x24
mov dword [eax + 0x14], ecx
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10000
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, eax
sub esp, 0x14
mov eax, 1
test edx, edx
jne 0x41ad7a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
sete al
movzx eax, al
neg eax
mov dword [ebx + 4], eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x41b2a1
Capabilities:
Read file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xffffffc0
mov eax, 0x1188
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
call fcn.00487b00
sub esp, eax
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
lea edi, [ebp - 0x1138]
mov dword [ebp - 0x114c], eax
mov eax, dword [ecx + 8]
mov ecx, 0x40
mov dword [ebp - 0x1150], eax
xor eax, eax
rep stosd dword es:[edi], eax
xor eax, eax
test edx, edx
mov dword [ebp - 0x113c], eax
sete al
cmp dword [ebp - 0x1150], 0
sete cl
or al, cl
jne 0x41b470
cmp dword [ebp - 0x114c], 3
ja 0x41b470
mov eax, edx
xor ebx, ebx
lea esi, [ebp - 0x1138]
call fcn.0041abfd
mov dword [esp + 0x18], ebx
mov edi, eax
xor eax, eax
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
sub esp, 0x1c
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test edi, edi
je 0x41b374
mov dword [ebp - 0x1154], eax
mov dword [esp], edi
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x1154]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push ecx
cmp ebx, 0xffffffff
jne 0x41b3a7
call fcn.0043f53d
mov dword [esp], str.Could_not_open_file:__s
mov dword [esp + 4], eax
call fcn.0043efa9
mov dword [0x4e2900], 0xc003006e
jmp 0x41b473
mov dword [esp], esi
mov eax, dword [ebp - 0x114c]
call dword [eax*4 + 0x48cea0]
mov eax, dword [0x4e2900]
test eax, eax
jns 0x41b3ca
cmp ax, 0x4c7
je 0x41b473
xor edx, edx
lea eax, [ebp - 0x113c]
mov dword [esp], ebx
lea edi, [ebp - 0x1038]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x41b41d
mov dword [0x4e2900], 0xc003001e
call fcn.0043f53d
mov dword [esp], str.__Read_error:__s
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x41b473
mov eax, dword [ebp - 0x113c]
test eax, eax
je 0x41b444
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov eax, dword [ebp - 0x114c]
call dword [eax*4 + 0x48ce90]
jmp 0x41b3b7
mov dword [esp], esi
mov eax, dword [ebp - 0x114c]
call dword [eax*4 + 0x48ce80]
mov eax, dword [ebp - 0x114c]
mov edi, dword [ebp - 0x1150]
mov ecx, dword [eax*4 + 0x48ceb0]
rep movsb byte es:[edi], byte [esi]
mov esi, 1
jmp 0x41b475
or ebx, 0xffffffff
xor esi, esi
lea eax, [ebx - 1]
cmp eax, 0xfffffffd
ja 0x41b487
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x41c5c2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x158]
sub esp, 0x1ac
mov eax, dword [ebp + 8]
mov dword [esp + 8], str._sautorun.inf
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x40
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__snprintf]
mov byte [ebp - 0x119], 0
mov dword [esp + 4], 0x49dc56
mov dword [esp], ebx
call sub.msvcrt.dll_fopen
test eax, eax
je 0x41c62b
mov dword [esp + 4], ebx
mov esi, eax
mov dword [esp], str._s_already_exists___keeping_it
call fcn.0043efa9
mov dword [esp], esi
call sub.msvcrt.dll_fclose
jmp 0x41c65d
mov dword [esp + 4], 0x49dc77
mov dword [esp], ebx
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
jne 0x41c664
mov dword [esp + 4], ebx
mov dword [esp], str.Unable_to_create__s
call fcn.0043efa9
mov dword [esp], str.NOTE:_This_may_be_caused_by_a_poorly_designed_security_solution._See_https:__goo.gl_QTobxX.
call fcn.0043efa9
xor eax, eax
jmp 0x41c74a
lea edi, [ebp - 0x118]
mov dword [esp + 8], pe_nt_image_headers32
mov ecx, dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [esp + 4], edi
mov eax, dword [0x526d0c]
mov dword [esp], eax
mov dword [ebp - 0x19c], ecx
call ecx
lea edx, [ebp - 0x198]
sub esp, 0xc
mov dword [esp + 4], edx
mov dword [esp + 8], 0x20
mov eax, dword [0x526d5c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x19c]
call ecx
lea edx, [ebp - 0x198]
sub esp, 0xc
mov dword [esp + 8], edx
mov dword [esp + 4], str.__Created_by__s_n__https:__rufus.ie_n
mov dword [esp], esi
call sub.msvcrt.dll_fwprintf_s
mov dword [esp + 8], edi
mov dword [esp + 4], str._autorun__nicon___autorun.ico_nlabel___s_n
mov dword [esp], esi
call sub.msvcrt.dll_fwprintf_s
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp + 4], ebx
mov dword [esp], str.Created:__s
call fcn.0043efa9
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
cmp eax, 1
ja 0x41c724
mov dword [esp + 8], 0xbd
mov dword [esp + 4], str.icon.c
mov dword [esp], str.strlen_filename____2
call dword [0x494088]
mov byte [ebp + eax - 0x159], 0x6f
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov byte [ebp + eax - 0x15a], 0x63
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0041c218
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41db64
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
call fcn.0041d93b
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wmkdir]
test ebx, ebx
je 0x41db87
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x422428
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x42243f
mov dword [ebp + 8], str.localization:_invalid_parameter_for_add_message_command_n
jmp 0x422457
mov eax, dword [ebx + 4]
lea edx, [eax - 0xbb9]
cmp edx, 0x15d
jbe 0x422461
mov dword [ebp + 8], str.localization:_invalid_MSG__index_n
add esp, 0x14
pop ebx
pop ebp
jmp fcn.0043efa9
mov edx, dword [0x5139e0]
mov eax, dword [edx + eax*4 - 0x2ee0]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov edx, dword [ebx + 4]
mov eax, dword [0x5139e0]
xor ecx, ecx
lea eax, [eax + edx*4 - 0x2ee0]
xor edx, edx
mov dword [eax], edx
mov edx, dword [ebx + 0x18]
mov dword [eax], edx
mov dword [ebx + 0x18], ecx
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x4224db
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xac
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x9c], eax
test ebx, ebx
je 0x422503
mov edx, dword [ebx + 0x14]
test edx, edx
je 0x422503
cmp eax, 9
jbe 0x422519
mov dword [ebp + 8], str.localization:_invalid_parameter_for_add_dialog_command_n
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0043efa9
mov al, byte [ebp - 0x9c]
mov dword [ebp - 0xa0], edx
mov esi, 0x7e
lea edi, [ebp - 0x96]
add eax, 0x30
mov byte [ebp - 0x98], al
mov al, byte [ebx]
mov dword [esp], edx
add eax, 0x30
mov byte [ebp - 0x97], al
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0xa0]
lea ecx, [eax + 1]
cmp ecx, esi
cmova ecx, esi
mov esi, edx
rep movsb byte es:[edi], byte [esi]
mov dword [esp], edx
call sub.msvcrt.dll_strlen
mov dword [esp + 4], 0x523a38
lea edx, [eax + 1]
cmp edx, 0x7e
mov edx, 0x7d
cmovae eax, edx
mov byte [ebp + eax - 0x96], 0
lea eax, [ebp - 0x98]
mov dword [esp], eax
call fcn.0043c7c7
test eax, eax
je 0x4225ca
imul esi, eax, 0xc
mov eax, dword [0x523a38]
mov eax, dword [eax + esi + 8]
test eax, eax
je 0x4225c1
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x20]
mov dword [ecx], edx
mov dword [edx + 4], ecx
xor edx, edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], edx
mov dword [esp], eax
call fcn.00422499
mov eax, dword [0x523a38]
mov dword [eax + esi + 8], ebx
mov eax, dword [ebp - 0x9c]
lea ecx, [ebx + 0x1c]
shl eax, 4
mov esi, dword [eax + 0x4926ec]
lea edx, [eax + 0x4926e0]
add eax, 0x4926e8
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], esi
mov dword [esi], ecx
mov dword [edx + 0xc], ecx
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret