joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bff0
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x42c07a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 4], 0
jne 0x42c061
mov eax, dword [0x4d4794]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x42c02f
push ebx
push 0x42c088
call fcn.00445714
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x42c05d
lea edx, [ebp - 4]
mov eax, dword [0x4d4314]
call fcn.00405e48
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x407cc8]
call fcn.0040be28
call fcn.0040368c
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c081
lea eax, [ebp - 4]
call fcn.00403b94
ret

Function at 0x42c128
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42c206
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0042bff0
xor edx, edx
push ebp
push 0x42c1e9
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x42c1b2
mov edx, ebx
mov eax, dword [0x41946c]
call fcn.0041d8a0
test al, al
je 0x42c1a2
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0041d774
call fcn.0040372c
jmp 0x42c1f0
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x42c16d
lea edx, [ebp - 8]
mov eax, dword [0x4d4404]
call fcn.00405e48
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407cc8]
call fcn.0040be28
call fcn.0040368c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c1f0
mov eax, dword [ebp - 4]
call fcn.0042bfc4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c20d
lea eax, [ebp - 8]
call fcn.00403b94
ret

Function at 0x42c214
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0042bff0
xor eax, eax
push ebp
push 0x42c26c
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c273
mov eax, dword [ebp - 4]
call fcn.0042bfc4
ret
Function at 0x42c27c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0042bff0
xor edx, edx
push ebp
push 0x42c2d1
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c2d8
mov eax, dword [ebp - 4]
call fcn.0042bfc4
ret

Function at 0x42c348
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0042bff0
xor eax, eax
push ebp
push 0x42c3bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0042bfa8
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0041d874
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x42c3a7
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c3c4
mov eax, dword [ebp - 4]
call fcn.0042bfc4
ret

Function at 0x42c3cc
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0042bff0
xor eax, eax
push ebp
push 0x42c441
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0042bfa8
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x42c42b
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c448
mov eax, dword [ebp - 4]
call fcn.0042bfc4
ret
Function at 0x457c44
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x457c80
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x457c7b
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x457c65
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x457c6d
cmp edx, ebx
jne 0x457dbb
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x457c3c
add eax, dword [eax + 4]
jmp 0x457c29
mov dword [ebp + 0xc], ebx
jmp 0x457c8b
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x457ca3
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x457cc1
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x457d1f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x457d06
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x457d0f
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x457d19
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x457cfb
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x457c85
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x457d6c
dec eax
je 0x457d63
sub eax, 3
je 0x457d5a
mov dword [ebp - 4], 0x40
jmp 0x457d89
mov dword [ebp - 4], 4
jmp 0x457d6f
mov dword [ebp - 4], 0x20
jmp 0x457d6f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x457dbb
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
push dword [esi - 0x60]
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004575cc
xchg edi, eax
aad 0x34
mov edi, edi
jne 0x457dc6
push 1
push esi
call edi
mov eax, esi
jmp 0x457dc7
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x458550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
invalid
invalid
invalid

Function at 0x45ef94
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45f06c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d588c], 0
jne 0x45f050
lea eax, [ebp - 4]
mov edx, 0x45f084
call fcn.00403c2c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403fd4
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x45f050
mov eax, ebx
call fcn.004027b0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45f049
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x45f033
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x45f094
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45f033
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4d588c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f050
mov eax, dword [ebp - 0xc]
call fcn.004027c8
ret
mov ebx, dword [0x4d588c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f073
lea eax, [ebp - 4]
call fcn.00403b94
ret

Function at 0x47c05b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4d3b4e
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47c0b3
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4d3b6f
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47c0a9
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x47c0b7
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4a9d88
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
lea eax, [esp + 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x4a9dcc
lea eax, [esp + 0x10c]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
mov eax, esp
call fcn.004091b4
add esp, 0x200
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40cc7d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4120a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004088d0
and dword [ebp - 0x14], 0
cmp dword [0x4139ec], 0
mov dword [ebp - 0x18], eax
jne 0x40cd30
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40cdd8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40cdd8
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4139ec], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4139f0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4139f4], eax
call edi
push eax
call esi
mov dword [0x4139fc], eax
test eax, eax
je 0x40cd30
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4139f8], eax
mov eax, dword [0x4139f8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40cd89
cmp dword [0x4139fc], ecx
je 0x40cd89
push eax
call esi
push dword [0x4139fc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40cd89
test ebx, ebx
je 0x40cd89
call edi
test eax, eax
je 0x40cd80
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40cd80
test byte [ebp - 8], 1
jne 0x40cd89
or dword [ebp + 0x10], 0x200000
jmp 0x40cdbc
mov eax, dword [0x4139f0]
cmp eax, dword [ebp - 0x18]
je 0x40cdbc
push eax
call esi
test eax, eax
je 0x40cdbc
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40cdbc
mov eax, dword [0x4139f4]
cmp eax, dword [ebp - 0x18]
je 0x40cdbc
push eax
call esi
test eax, eax
je 0x40cdbc
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4139ec]
call esi
test eax, eax
je 0x40cdd8
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40cdda
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040556e
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40605d
Capabilities:
Get disk information

Disassembly:
push 0x3c
mov eax, 0x411520
call fcn.004105ff
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x34]
push eax
push edx
call fcn.0040dbd5
mov ebx, eax
mov dword [ebp - 0x48], ebx
test ebx, ebx
js 0x4061b8
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
sub eax, esi
push 0x18
pop ecx
cdq
idiv ecx
mov ecx, 0x415408
test eax, eax
je 0x4061ac
push eax
call fcn.00408ad6
mov edx, 0x403320
mov ecx, eax
call fcn.00405c37
cmp esi, dword [ebp - 0x30]
je 0x4061f3
xor ebx, ebx
push esi
lea ecx, [ebp - 0x28]
call fcn.00407fec
mov byte [ebp - 4], 1
mov edx, 0x403340
mov ecx, 0x415408
call fcn.00405c37
lea edx, [ebp - 0x28]
mov ecx, eax
call fcn.0040b852
mov edx, 0x40333c
mov ecx, eax
call fcn.00405c37
push 0x104
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
call fcn.00407db9
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x40]
sub ecx, edi
mov eax, dword [ebp - 0x28]
sar ecx, 1
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x44], ebx
jae 0x40612b
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x44]
push edx
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x406181
jmp 0x40617c
mov edx, 0x403348
mov ecx, 0x415408
call fcn.00405c37
mov edx, edi
mov ecx, eax
call fcn.0040b68e
mov edx, 0x40333c
mov ecx, eax
call fcn.00405c37
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x406167
sub ecx, edx
sar ecx, 1
lea edi, [edi + ecx*2]
add edi, 2
cmp word [edi], bx
jne 0x40613e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00407d9a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00409d62
add esi, 0x18
cmp esi, dword [ebp - 0x30]
jne 0x4060c6
mov ebx, dword [ebp - 0x48]
jmp 0x4061f3
mov edx, 0x403354
call fcn.0040b68e
jmp 0x4061f3
push 0x405540
push ebx
push 0x405560
mov edx, 0x403388
mov ecx, 0x415408
call fcn.0040b68e
mov ecx, eax
call fcn.00408cd0
mov ecx, eax
call fcn.00408bd3
mov ecx, eax
call fcn.00408cd0
mov edx, 0x40333c
mov ecx, eax
call fcn.00405c37
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00407e50
mov eax, ebx
call fcn.004105ae
ret
Function at 0x4067c5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ecx + 0x14], 8
push ebx
push esi
push edi
mov edi, edx
jb 0x4067d7
mov ecx, dword [ecx]
xor eax, eax
xor ebx, ebx
push eax
push 0x80
inc ebx
push ebx
push eax
push eax
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x40682a
cmp esi, 0xffffffff
je 0x40682a
mov eax, edi
mul dword [ebp + 8]
push 0
push 0
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x40681d
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x40681f
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x40682c
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40bb41
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x14
mov eax, 0x41219f
call fcn.004105cc
mov edi, ecx
mov dword [ebp - 0x14], edi
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040bcb3
mov dword [ebp - 4], ebx
lea esi, [edi + 8]
or dword [edi + 0x20], 0xffffffff
mov dword [edi], fcn.00405910
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x10], ebx
jb 0x40bb7d
mov eax, dword [esi]
jmp 0x40bb7f
mov eax, esi
lea ecx, [ebp - 0x10]
push ecx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ebx, eax
lea ecx, [ebp - 0x20]
xor eax, eax
push ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call fcn.00407db9
mov byte [ebp - 4], 1
cmp dword [esi + 0x14], 8
jb 0x40bbb0
mov eax, dword [esi]
jmp 0x40bbb2
mov eax, esi
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x20]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x40bbdb
push dword [ebp - 0x20]
call fcn.00404334
pop ecx
push eax
push dword [ebp - 0x20]
mov ecx, esi
call fcn.00409eca
jmp 0x40bbe6
push 0
push 0
mov ecx, esi
call fcn.0040c0b1
cmp dword [esi + 0x14], 8
jb 0x40bbf0
mov eax, dword [esi]
jmp 0x40bbf2
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [edi + 0x20], eax
cmp eax, 0xffffffff
je 0x40bc28
test al, 0x10
je 0x40bc28
cmp dword [esi + 0x14], 8
jb 0x40bc0f
mov ecx, dword [esi]
jmp 0x40bc11
mov ecx, esi
mov eax, dword [esi + 0x10]
push 0x5c
pop edx
cmp word [ecx + eax*2 - 2], dx
je 0x40bc28
push edx
push 1
mov ecx, esi
call fcn.0040c0e1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00407d9a
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.0041059a
ret 0xc
Function at 0x40d908
Capabilities:
Get disk information via ioctl

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x415338]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push esi
push ecx
push 0xc
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], esi
push ecx
push esi
push esi
push 0x2d1080
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40d951
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
jmp 0x40d966
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40d966
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00410430
leave
ret 8
Function at 0x40dbd5
Capabilities:
Enumerate disk volumes

Disassembly:
push 0x60
mov eax, 0x4125c1
call fcn.004105ff
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x58]
xor ebx, ebx
mov dword [ebp - 0x64], eax
push 0x104
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
call fcn.00407db9
mov dword [ebp - 4], ebx
inc ebx
push 1
mov dword [ebp - 0x60], ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, dword [ebp - 0x54]
sub edi, dword [ebp - 0x58]
sar edi, 1
push edi
push dword [ebp - 0x58]
mov dword [ebp - 0x6c], eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov esi, eax
mov dword [ebp - 0x5c], esi
cmp esi, 0xffffffff
je 0x40dd45
xor ebx, ebx
push dword [ebp - 0x58]
lea ecx, [ebp - 0x28]
call fcn.00407fb9
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0x28]
jae 0x40dc4e
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
dec eax
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.0040b055
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2c], 8
mov eax, dword [ebp - 0x40]
jae 0x40dc6c
lea eax, [ebp - 0x40]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x68], eax
cmp eax, 0xffffffff
je 0x40dd0b
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
push ecx
push eax
call fcn.0040dd64
mov ebx, dword [ebp - 0x4c]
test eax, eax
jne 0x40dce3
mov esi, ebx
cmp esi, dword [ebp - 0x48]
je 0x40dce0
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0x64]
mov eax, dword [ecx + 4]
cmp eax, dword [esi + 4]
jne 0x40dcd5
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x40dcd5
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.0040ded6
and dword [ebp - 0x60], 0
mov ecx, dword [ebp + 8]
add esi, 8
cmp esi, dword [ebp - 0x48]
jne 0x40dcb5
mov ebx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x5c]
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
test ebx, ebx
je 0x40dd09
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
xor ebx, ebx
pop ecx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
jmp 0x40dd0b
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00409d62
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00409d62
push edi
push dword [ebp - 0x58]
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x40dc33
push esi
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov ebx, dword [ebp - 0x60]
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00407d9a
mov eax, ebx
call fcn.004105ae
ret 8