joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414134
Capabilities:
Check os version
Get common file path
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ac
mov al, byte [0x441880]
push esi
push edi
push 0x3f
mov byte [ebp - 0x3a8], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x3a7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
mov esi, 0x100
push eax
lea eax, [ebp - 0x3a8]
push eax
push str.SoftwareRealNetworksRealMediaSDK6.0PreferencesCookiesPath
push SysReAllocStringLen
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x414196
lea eax, [ebp - 0x3a8]
push eax
call fcn.00413ee0
test eax, eax
pop ecx
jne 0x414319
mov al, byte [0x441880]
push 0x3f
mov byte [ebp - 0x2a8], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x2a7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x41431e
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x26
pop ecx
xor eax, eax
lea edi, [ebp - 0xa0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x9c
push eax
call esi
test eax, eax
jne 0x414212
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x94
push eax
call esi
test eax, eax
je 0x41431e
mov eax, dword [ebp - 0x94]
dec eax
dec eax
jne 0x41431e
cmp dword [ebp - 0xa0], 6
jb 0x4142b4
mov dl, byte [0x441880]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x1a7]
mov byte [ebp - 0x1a8], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x4ab]
mov byte [ebp - 0x4ac], dl
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x1a8]
push str.C:Users_sAppDataRoamingMicrosoftWindowsCookies_
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x4ac]
push str.C:Users_sAppDataRoamingMicrosoftWindowsCookiesLow_
push eax
call esi
mov esi, fcn.00413ee0
lea eax, [ebp - 0x1a8]
push esi
push eax
call fcn.00413fc2
add esp, 0x14
test eax, eax
jne 0x414319
push esi
lea eax, [ebp - 0x4ac]
jmp 0x41430d
mov al, byte [0x441880]
push 0x40
mov byte [ebp - 0x1a8], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x1a7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
lea eax, [ebp - 0x1a8]
push 0x21
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x414302
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x1a8]
push str.C:Documents_and_Settings_sCookies_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push fcn.00413ee0
lea eax, [ebp - 0x1a8]
push eax
call fcn.00413fc2
pop ecx
test eax, eax
pop ecx
je 0x41431e
push 1
pop eax
jmp 0x414320
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x414324
Capabilities:
Check os version
Get common file path
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ac
mov al, byte [0x441880]
push esi
push edi
push 0x3f
mov byte [ebp - 0x3a8], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x3a7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
mov esi, 0x100
push eax
lea eax, [ebp - 0x3a8]
push eax
push str.SoftwareRealNetworksRealMediaSDK6.0PreferencesCookiesPath
push SysReAllocStringLen
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x414386
lea eax, [ebp - 0x3a8]
push eax
call fcn.00413de2
test eax, eax
pop ecx
jne 0x414509
mov al, byte [0x441880]
push 0x3f
mov byte [ebp - 0x2a8], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x2a7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x41450e
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x26
pop ecx
xor eax, eax
lea edi, [ebp - 0xa0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x9c
push eax
call esi
test eax, eax
jne 0x414402
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x94
push eax
call esi
test eax, eax
je 0x41450e
mov eax, dword [ebp - 0x94]
dec eax
dec eax
jne 0x41450e
cmp dword [ebp - 0xa0], 6
jb 0x4144a4
mov dl, byte [0x441880]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x1a7]
mov byte [ebp - 0x1a8], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x4ab]
mov byte [ebp - 0x4ac], dl
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x1a8]
push str.C:Users_sAppDataRoamingMicrosoftWindowsCookies_
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x4ac]
push str.C:Users_sAppDataRoamingMicrosoftWindowsCookiesLow_
push eax
call esi
mov esi, fcn.00413de2
lea eax, [ebp - 0x1a8]
push esi
push eax
call fcn.00413fc2
add esp, 0x14
test eax, eax
jne 0x414509
push esi
lea eax, [ebp - 0x4ac]
jmp 0x4144fd
mov al, byte [0x441880]
push 0x40
mov byte [ebp - 0x1a8], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x1a7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
lea eax, [ebp - 0x1a8]
push 0x21
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4144f2
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x1a8]
push str.C:Documents_and_Settings_sCookies_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push fcn.00413de2
lea eax, [ebp - 0x1a8]
push eax
call fcn.00413fc2
pop ecx
test eax, eax
pop ecx
je 0x41450e
push 1
pop eax
jmp 0x414510
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4167b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [ebp + 0xc]
push esi
push 0x43ff18
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x416821
test byte [esi + 0xc], 0x10
jne 0x416817
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 0x200
lea ecx, [ebp - 0x200]
push 1
push ecx
call edi
add esp, 0x10
test eax, eax
jle 0x41680f
push ebx
push eax
lea edx, [ebp - 0x200]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
test byte [esi + 0xc], 0x10
je 0x4167e3
pop edi
pop ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4174b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0xc]
call fcn.00414590
mov eax, dword [esi + 0x39]
lea edx, [ebp - 4]
push edx
mov edx, dword [esi + 0x55]
mov ecx, dword [eax]
push edx
mov edx, dword [esi + 0x51]
push edx
mov edx, dword [esi + 0x3d]
push edx
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 4]
test eax, eax
jle 0x41764a
mov ecx, dword [esi + 0x49]
sub ecx, 0
je 0x417560
dec ecx
jne 0x417626
mov ecx, dword [esi + 0x59]
mov edx, dword [esi + 0x5d]
cmp ecx, edx
jle 0x41752f
mov ecx, dword [esi + 0x45]
mov edx, dword [esi + 0x3d]
push ecx
push eax
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ebx, dword [esi + 0x5d]
mov ecx, dword [esi + 0x59]
add ebx, eax
mov eax, ecx
mov edx, ebx
add esp, 0x10
sub eax, edx
mov dword [esi + 0x5d], ebx
cmp eax, 0x8000
jge 0x41752f
mov dword [esi + 0x55], eax
cmp ecx, dword [esi + 0x5d]
jne 0x417626
mov eax, dword [esi + 0x45]
test eax, eax
je 0x417549
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 0x200
mov dword [esi + 0x49], 0
mov dword [esi + 0x51], eax
mov dword [esi + 0x55], eax
jmp 0x417626
mov edi, dword [esi + 0x3d]
lea ecx, [ebp - 0x14]
mov dword [esi + 0x4d], edi
mov eax, dword [str.rnempty0]
push eax
call fcn.004146d0
cmp byte [eax + 7], 0xff
jne 0x41757c
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
lea ecx, [ebp - 0x14]
test eax, eax
sete bl
call fcn.004146c0
test bl, bl
je 0x4175bc
mov edx, dword [esi + 0x4d]
mov eax, dword [esi + 0x14]
lea ecx, [ebp - 0xc]
add edx, 0x159
push ecx
push edx
push eax
call fcn.00416990
add esp, 0xc
test eax, eax
jl 0x41765b
jmp 0x417626
mov eax, dword [esi + 0x4d]
mov edx, dword [esi + 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
add eax, 0x159
push eax
push edx
call fcn.004168f0
xor edi, edi
add esp, 0x10
cmp eax, edi
mov dword [esi + 0x45], eax
je 0x41765b
mov eax, dword [esi + 0x4d]
push 0xb
add eax, 0x7c
push eax
call fcn.004168b0
add esp, 8
cmp eax, edi
mov dword [esi + 0x59], eax
mov dword [esi + 0x5d], edi
jle 0x417619
cmp eax, 0x8000
mov dword [esi + 0x49], 1
mov dword [esi + 0x51], edi
jge 0x417610
mov dword [esi + 0x55], eax
jmp 0x417626
mov dword [esi + 0x55], 0x8000
jmp 0x417626
mov ecx, dword [esi + 0x45]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, dword [esi + 0x39]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 0x55]
mov edx, dword [eax]
push ecx
mov ecx, dword [esi + 0x51]
push ecx
mov ecx, dword [esi + 0x3d]
push ecx
push eax
call dword [edx + 0x24]
mov eax, dword [ebp - 4]
test eax, eax
jg 0x4174e7
lea ecx, [ebp - 0xc]
call fcn.004146c0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
mov byte [esi + 0x20], 5
call fcn.004146c0
pop edi
pop esi
mov eax, 0x8004008a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
push ebx
mov ecx, dword [esi + 0x35]
call fcn.0041abf0
mov eax, dword [esi + 0x41]
xor edi, edi
test eax, eax
je 0x417a68
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edi, eax
lea ecx, [ebp - 0x30]
call fcn.0041f5b0
lea edx, [ebp - 0x30]
push edi
push edx
call fcn.0041f880
test edi, edi
jbe 0x417a92
mov esi, dword [esi + 0x41]
push edi
push esi
mov eax, dword [esi]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x30]
push eax
push ecx
call fcn.0041fb80
lea edx, [ebp - 0x30]
push ebx
push edx
call fcn.0041f680
push eax
lea eax, [ebp - 0x30]
push 1
push eax
call fcn.0041f660
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.0041f6a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x417e50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov esi, dword [eax + 0x3d]
lea ecx, [ebp - 0xc]
call fcn.00414590
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x417e89
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
push edi
push 0x5c
push eax
push str._s_c_s
push ecx
call fcn.004150e0
add esp, 0x14
jmp 0x417e98
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
push edx
call fcn.004147e0
mov edi, dword [ebp + 0xc]
mov al, byte [ebp - 5]
cmp al, 0xff
lea eax, [ebp - 0xc]
jne 0x417ea5
mov eax, dword [ebp - 0xc]
push 0x43ff18
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov ebx, eax
test ebx, ebx
push edi
jne 0x417ee3
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push str.Cant_open_file__s_for_reading__skipping_n
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.004146c0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push str.Processing_file__s_for_compression_n
add ecx, 0x20
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
mov ecx, 0x80
xor eax, eax
mov edi, esi
add esp, 0xc
rep stosd dword es:[edi], eax
mov al, byte [ebp - 5]
cmp al, 0xff
lea eax, [ebp - 0xc]
jne 0x417f13
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x30]
push edx
push ebx
push eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
push esi
call fcn.00417c60
mov edi, eax
add esp, 0x18
test edi, edi
jge 0x417f63
mov edx, dword [ebp + 0xc]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push edx
add eax, 0x40
push str.Cant_stat__s__skipping_n
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.004146c0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [edi + 0x35]
push edx
call fcn.0041aba0
mov eax, dword [edi + 0x39]
lea edx, [ebp - 4]
push edx
push 0x200
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
test byte [ebx + 0xc], 0x10
jne 0x417fbd
push ebx
push 0x8000
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
jle 0x417fb7
mov ecx, dword [edi + 0x39]
lea edi, [ebp - 4]
push edi
push eax
mov edx, dword [ecx]
push esi
push ecx
call dword [edx + 0x14]
mov edi, dword [ebp + 0x10]
test byte [ebx + 0xc], 0x10
je 0x417f8f
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [ebp - 0xc]
call fcn.004146c0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418a50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x441adc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
test eax, eax
mov esi, ecx
je 0x418a80
call ebx
sub eax, dword [0x441adc]
cmp eax, 0xc8
jae 0x418a80
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x1c]
push edi
xor edi, edi
test eax, eax
je 0x418ae5
lea edx, [ebp - 4]
mov dword [ebp - 4], edi
mov ecx, dword [eax]
push edx
push 0x439910
push eax
call dword [ecx]
mov eax, dword [ebp - 4]
test eax, eax
je 0x418ae5
call ebx
mov edx, dword [ebp + 8]
mov dword [0x441adc], eax
mov eax, dword [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x418ac5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, 0x80040088
jne 0x418ae5
mov eax, dword [esi + 0x41]
test eax, eax
je 0x418ae5
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [esi + 0x41], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x419f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
push ebx
mov ecx, dword [esi + 0x35]
call fcn.0041abf0
mov eax, dword [esi + 0x3d]
xor edi, edi
test eax, eax
je 0x419fb8
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edi, eax
lea ecx, [ebp - 0x30]
call fcn.0041f5b0
lea edx, [ebp - 0x30]
push edi
push edx
call fcn.0041f880
test edi, edi
jbe 0x419fe2
mov esi, dword [esi + 0x3d]
push edi
push esi
mov eax, dword [esi]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x30]
push eax
push ecx
call fcn.0041fb80
lea edx, [ebp - 0x30]
push ebx
push edx
call fcn.0041f680
push eax
lea eax, [ebp - 0x30]
push 1
push eax
call fcn.0041f660
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.0041f6a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41aa20
Capabilities:
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
lea eax, [ebp - 0x34]
push edi
push eax
mov edi, 0x400
call fcn.00420650
mov eax, dword [ebp - 0x2e]
add esp, 4
cmp eax, 8
jne 0x41aae5
push esi
lea ecx, [ebp - 0x18]
call fcn.00414590
push 0x104
lea ecx, [ebp - 0x18]
call fcn.00414ce0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00414d20
test esi, esi
pop esi
je 0x41aadd
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.00414d80
cmp eax, 0xffffffff
je 0x41aadd
lea ecx, [ebp - 0x20]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00415040
push eax
lea ecx, [ebp - 0x18]
call fcn.00414770
lea ecx, [ebp - 0x20]
call fcn.004146c0
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.00414c70
mov al, byte [ebp - 0x11]
cmp al, 0xff
lea eax, [ebp - 0x18]
jne 0x41aabb
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x10]
push edx
push ecx
lea edx, [ebp - 8]
lea ecx, [ebp - 4]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x41aadd
mov edi, dword [ebp - 4]
imul edi, dword [ebp - 8]
lea ecx, [ebp - 0x18]
call fcn.004146c0
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41abf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x60]
call fcn.0041f5b0
push esi
lea ecx, [ebp - 0x60]
call fcn.0041f6e0
lea eax, [ebp - 0x60]
push eax
call fcn.0041f680
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.0041f5b0
mov cl, byte [esi + 0x23]
lea eax, [esi + 0x1c]
cmp cl, 0xff
jne 0x41ac2c
mov eax, dword [eax]
push 4
lea ecx, [ebp - 0x30]
push eax
push ecx
call fcn.0041fb80
lea edx, [ebp - 0x30]
push edi
push edx
call fcn.0041f880
lea eax, [ebp - 0x30]
push eax
call fcn.0041f680
mov ebx, dword [ebp + 8]
mov esi, eax
push ebx
push esi
lea ecx, [ebp - 0x30]
push 1
push ecx
call fcn.0041f660
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, esi
je 0x41ac70
lea ecx, [ebp - 0x2c]
jmp 0x41ac8e
push ebx
push edi
lea edx, [ebp - 0x60]
push 1
push edx
call fcn.0041f660
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, edi
lea ecx, [ebp - 0x2c]
je 0x41aca7
call fcn.0041f6a0
lea ecx, [ebp - 0x5c]
call fcn.0041f6a0
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0041f6a0
lea ecx, [ebp - 0x5c]
call fcn.0041f6a0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41e360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.0041e300
cmp byte [eax + 7], 0xff
jne 0x41e37a
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [ebp - 8]
mov ebx, eax
call fcn.004146c0
cmp ebx, 0xffffffff
je 0x41e3a0
test bl, 0x10
je 0x41e3a0
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e3b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.0041e300
cmp byte [eax + 7], 0xff
jne 0x41e3ca
mov eax, dword [eax]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.004146c0
mov eax, esi
pop esi
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov esp, ebp
pop ebp
ret

Function at 0x41e560
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0xc]
test eax, eax
je 0x41e5ea
add esi, 4
push 0x440c60
mov ecx, esi
call fcn.004150a0
cmp eax, 0xffffffff
je 0x41e5ea
add eax, 2
lea ecx, [ebp - 0x18]
push eax
push ecx
mov ecx, esi
call fcn.00415040
mov al, byte [ebp - 0x11]
xor esi, esi
cmp al, 0xff
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
lea eax, [ebp - 0x18]
jne 0x41e5b0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
lea ecx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x10]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x41e5e2
cmp dword [ebp - 4], esi
je 0x41e5e2
lea ecx, [ebp - 0x18]
call fcn.004146c0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
call fcn.004146c0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41e770
Capabilities:
Create directory

Disassembly:
push esi
mov esi, ecx
mov cl, byte [esi + 0xb]
lea eax, [esi + 4]
cmp cl, 0xff
jne 0x41e780
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.dll__mkdir]
mov eax, dword [esi]
add esp, 4
mov ecx, esi
call dword [eax + 0xc]
pop esi
ret
Function at 0x41e7a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov al, byte [ecx + 0xb]
push ebx
push esi
lea esi, [ecx + 4]
mov bl, 0xff
cmp al, bl
je 0x41e83b
xor ecx, ecx
cmp al, 7
sete cl
mov eax, ecx
test eax, eax
jne 0x41e88e
mov al, byte [esi + 7]
cmp al, bl
mov eax, esi
jne 0x41e7d7
mov eax, dword [esi]
cmp byte [eax], 0x2e
je 0x41e88e
mov ecx, esi
call fcn.00414740
cmp eax, 3
jne 0x41e855
mov al, byte [esi + 7]
cmp al, bl
mov eax, esi
jne 0x41e7f7
mov eax, dword [esi]
cmp byte [eax + 1], 0x3a
jne 0x41e855
mov al, byte [esi + 7]
cmp al, bl
mov eax, esi
jne 0x41e808
mov eax, dword [esi]
cmp byte [eax + 2], 0x5c
jne 0x41e855
cmp byte [esi + 7], bl
jne 0x41e815
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x41e830
cmp eax, 4
je 0x41e830
cmp eax, 2
je 0x41e830
cmp eax, 6
jne 0x41e88e
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 4]
test al, al
jne 0x41e7cc
mov al, byte [esi + 5]
test al, al
jne 0x41e7cc
mov al, byte [esi + 6]
test al, al
je 0x41e88e
jmp 0x41e7cc
cmp byte [esi + 7], bl
jne 0x41e85c
mov esi, dword [esi]
lea edx, [ebp - 0x140]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41e88e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x140]
and eax, 0x10
cmp al, 0x10
jne 0x41e88e
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret