joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4054a5
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00405744
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x4054d9
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4243e8], eax
jmp 0x40565e
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x4054f7
test eax, eax
je 0x40560f
test byte [ebp + 0xc], 2
je 0x40560f
mov esi, 0x421960
push edi
push esi
call fcn.00405b57
test ebx, ebx
je 0x405514
push str..
push esi
call sub.KERNEL32.DLL_lstrcatA
jmp 0x40551a
push edi
call fcn.004056ab
push 0x409010
push edi
call sub.KERNEL32.DLL_lstrcatA
push edi
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x405605
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.0040568f
cmp byte [eax], 0
je 0x40556b
cmp byte [ebp - 0x18], 0
je 0x40556b
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405581
mov al, byte [esi + 1]
test al, al
je 0x4055e4
cmp al, 0x2e
jne 0x405581
cmp byte [esi + 2], 0
je 0x4055e4
push esi
push ebx
call fcn.00405b57
mov eax, dword [ebp - 0x148]
test al, 0x10
je 0x4055a7
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4055e4
push dword [ebp + 0xc]
push edi
call fcn.004054a5
jmp 0x4055e4
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x4055dc
test byte [ebp + 0xc], 4
je 0x4055d4
push edi
push 0xfffffffffffffff1
call fcn.00404f06
push 0
push edi
call fcn.0040589f
jmp 0x4055e4
inc dword [0x4243e8]
jmp 0x4055e4
push edi
push 0xfffffffffffffff2
call fcn.00404f06
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x405549
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp dword [ebp - 4], 0
je 0x40560f
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x40565e
cmp dword [ebp - 8], esi
jne 0x405624
inc dword [0x4243e8]
jmp 0x40565e
push edi
call fcn.00405e2c
test eax, eax
je 0x40565e
push edi
call fcn.00405664
push edi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
jne 0x405656
test byte [ebp + 0xc], 4
je 0x40561c
push edi
push 0xfffffffffffffff1
call fcn.00404f06
push esi
push edi
call fcn.0040589f
jmp 0x40565e
push edi
push 0xffffffffffffffe5
call fcn.00404f06
pop edi
pop esi
leave
ret 8
Function at 0x405744
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421d60
push esi
call fcn.00405b57
push esi
call fcn.004056f7
mov edi, eax
test edi, edi
jne 0x405765
xor eax, eax
jmp 0x4057b7
push edi
call fcn.00405d93
test byte [0x424370], 0x80
je 0x40577e
mov al, byte [edi]
test al, al
je 0x405761
cmp al, 0x5c
je 0x405761
sub edi, esi
jmp 0x405796
call fcn.00405e2c
test eax, eax
je 0x405790
test byte [eax], 0x10
je 0x405761
push esi
call fcn.004056ab
push esi
call sub.KERNEL32.DLL_lstrlenA
cmp eax, edi
push esi
jg 0x405782
call fcn.00405664
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405828
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
ret 0xc

Function at 0x405857
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
jne 0x40589b
test edi, edi
jne 0x405862
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405895
Function at 0x40589f
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.00405e6a
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4058cb
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405a11
mov ebx, dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
mov dword [0x422ae8], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422ae8
je 0x40590f
push 1
push 0
push esi
call fcn.00405828
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405a17
cmp eax, edi
jg 0x405a17
mov esi, 0x422560
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405a17
cmp eax, edi
jg 0x405a17
push esi
push ebp
push str._s_s_r_n
push 0x422160
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call sub.KERNEL32.DLL_lstrcatA
xor eax, eax
push eax
push 0x8000080
push 4
push eax
push eax
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x405a11
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405a0a
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x405a0a
cmp edi, dword [esp + 0x18]
jne 0x405a0a
push str._Rename__r_n
push esi
call fcn.004057bc
test eax, eax
jne 0x405a1e
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405b57
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x422160
push eax
call fcn.00405808
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc dword [0x4243f0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409324
push eax
call fcn.004057bc
test eax, eax
je 0x4059d5
inc eax
lea edx, [esi + edi]
cmp eax, edx
mov ecx, eax
jae 0x405a47
mov dl, byte [ecx]
mov byte [ecx + ebx], dl
inc ecx
lea edx, [esi + edi]
cmp ecx, edx
jb 0x405a3a
sub eax, esi
jmp 0x4059d7
Function at 0x405b79
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jge 0x405b9a
mov ecx, dword [0x423b3c]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x424398]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x423300
sub ecx, eax
mov edi, eax
cmp ecx, 0x800
jae 0x405d6d
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405d6d
mov edx, edi
sub edx, eax
cmp edx, 0x400
jge 0x405d7a
inc ebx
cmp cl, 0xfc
jbe 0x405d60
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
or ecx, edx
or eax, edx
inc ebx
mov dword [ebp - 0x14], ecx
inc ebx
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 0xc], eax
jne 0x405d0b
and dword [ebp + 0xc], 0
and byte [edi], 0
push 4
pop esi
cmp dword [ebp - 0x10], esi
jne 0x405c2e
mov dword [ebp + 0xc], str.MicrosoftInternet_ExplorerQuick_Launch
jmp 0x405ca6
mov eax, dword [ebp - 0x18]
cmp eax, 0x2b
jne 0x405c4d
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405a4b
jmp 0x405ca1
cmp eax, 0x26
jne 0x405c7d
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405a4b
cmp byte [edi], 0
jne 0x405d03
push str.C:Program_Files
push edi
call fcn.00405b57
jmp 0x405ca1
cmp eax, 0x25
jne 0x405c90
push 0x400
push edi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x405ca1
cmp eax, 0x24
jne 0x405ca6
push 0x400
push edi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
cmp byte [edi], 0
jne 0x405d03
cmp dword [0x4243e4], 0
jne 0x405cb2
push 2
pop esi
lea eax, [ebp - 4]
dec esi
push eax
push dword [ebp + esi*4 - 0x18]
push dword [0x424364]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405ce8
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call fcn.004053c0
cmp dword [ebp - 8], 0
jne 0x405cef
jmp 0x405ceb
and byte [edi], 0
test esi, esi
jne 0x405cb2
cmp byte [edi], 0
je 0x405d03
cmp dword [ebp + 0xc], 0
je 0x405d03
push dword [ebp + 0xc]
push edi
call sub.KERNEL32.DLL_lstrcatA
push edi
call fcn.00405d93
jmp 0x405d51
cmp byte [ebp + 0xf], 0xfd
jne 0x405d3f
cmp esi, 0x1b
jne 0x405d24
push dword [0x424364]
push edi
call fcn.00405ab5
jmp 0x405d35
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.00405b57
add esi, 0xffffffeb
cmp esi, 6
jae 0x405d51
jmp 0x405d03
cmp byte [ebp + 0xf], 0xff
jne 0x405d51
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.00405b79
push edi
call sub.KERNEL32.DLL_lstrlenA
add edi, eax
mov eax, 0x423300
jmp 0x405d6d
jne 0x405d6a
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405d6d
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405bc5
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405d8f
push eax
push dword [ebp + 8]
call fcn.00405b57
leave
ret 8
Function at 0x401890
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], 0
mov word [esi + 4], 0
cmp dword [eax + 0x10], 0
je 0x4018b3
cmp dword [eax + 0x14], 8
jb 0x4018b5
mov eax, dword [eax]
jmp 0x4018b5
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x4018dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, esi
jne 0x4018df
mov byte [esi + 5], 1
pop esi
ret 4
mov eax, esi
pop esi
ret 4

Function at 0x401894
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], 0
mov word [esi + 4], 0
cmp dword [eax + 0x10], 0
je 0x4018b3
cmp dword [eax + 0x14], 8
jb 0x4018b5
mov eax, dword [eax]
jmp 0x4018b5
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x4018dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, esi
jne 0x4018df
mov byte [esi + 5], 1
pop esi
ret 4
mov eax, esi
pop esi
ret 4

Function at 0x401940
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x401956
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov eax, dword [esp + 8]
mov word [esi + 4], 0
cmp dword [eax + 0x10], 0
je 0x401970
cmp dword [eax + 0x14], 8
jb 0x401972
mov eax, dword [eax]
jmp 0x401972
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x401994
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401994
mov byte [esi + 5], 1
cmp dword [esi], 0
pop esi
setne al
ret 4
Function at 0x4019a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d458
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4be004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x4019e3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.004055b0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x401a0c
lea eax, [esi + 8]
jmp 0x401a0e
xor eax, eax
cmp dword [ebx + 0x10], 0
je 0x401a1e
cmp dword [ebx + 0x14], 8
jb 0x401a20
mov ebx, dword [ebx]
jmp 0x401a20
xor ebx, ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x401a41
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401a41
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x401a6a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x401a7f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.00466b4c
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00466b5a
mov esp, ebp
pop ebp
ret 4
Function at 0x401ac0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d488
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4be004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x401b03
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.004056e0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x401b2d
lea ecx, [esi + 8]
jmp 0x401b2f
xor ecx, ecx
cmp dword [ebx + 0x10], 0
mov dword [ebp - 0x18], ecx
je 0x401b44
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x401b46
mov eax, dword [ebx]
jmp 0x401b46
xor eax, eax
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test eax, eax
jne 0x401b91
call ecx
cmp eax, 5
jne 0x401b8b
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebx + 0x10], 0
je 0x401b7b
cmp dword [ebx + 0x14], 8
jb 0x401b7d
mov ebx, dword [ebx]
jmp 0x401b7d
xor ebx, ebx
push ebx
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
test eax, eax
je 0x401baf
call ecx
cmp eax, 0xb7
jne 0x401ba4
mov byte [edi + 5], 1
mov ecx, dword [edi]
call fcn.00403ba0
mov eax, dword [edi]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x401bd5
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x401bea
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.00466b4c
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00466b5a
mov esp, ebp
pop ebp
ret 4

Function at 0x401ce0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4be004]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 1
mov esi, ecx
call fcn.00466b1c
mov dword [esi], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
call fcn.00468950
add esp, 0x10
mov dword [esp + 4], 0x11c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x401d3c
cmp dword [esp + 8], 6
mov ecx, dword [esi]
setae dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
call fcn.00466b5a
add esp, 0x120
ret
Function at 0x405cc0
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x4be004]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
push 0x118
push 0
lea eax, [esi + 4]
push eax
call fcn.00468950
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x405e02
cmp dword [esi + 4], 6
push edi
ja 0x405d16
jne 0x405d9e
cmp dword [esi + 8], 2
jb 0x405d9e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x405d9e
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x405d9e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405d9e
movups xmm0, xmmword [0x4aaf94]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x4aafa4]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x405d9e
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x405d9e
cmp word [edi + 2], ax
jbe 0x405d9e
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x405de9
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00468950
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x405de9
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.00466b5a
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.00466b5a
add esp, 0x140
ret
Function at 0x409bc0
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x808]
sub esp, 0x808
push 0xffffffffffffffff
push 0x48df50
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4be004]
xor eax, ebp
mov dword [ebp + 0x804], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea eax, [ebp + 4]
push eax
push 0x3fe
call edi
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x409c87
lea edx, [ebp + 4]
mov dword [ebp], 0
xor esi, esi
mov dword [ebp - 0x10], edx
mov dword [ebp], esi
mov dword [ebp - 4], esi
cmp ebx, 0x3fe
jbe 0x409cac
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00467250
add esp, 4
mov dword [ebp - 0x10], eax
mov esi, eax
mov dword [ebp], esi
push eax
push ebx
call edi
test eax, eax
je 0x409c71
cmp eax, ebx
ja 0x409c71
mov edx, esi
xor ecx, ecx
mov ebx, eax
mov dword [ebp - 0x14], ebx
mov dword [edx + eax*2], ecx
jmp 0x409cd4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
test eax, eax
je 0x409c87
push eax
call fcn.00466db6
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x804]
xor ecx, ebp
call fcn.00466b5a
lea esp, [ebp + 0x808]
pop ebp
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x409dd9
xor ecx, ecx
mov word [ebp + eax + 4], cx
add eax, 2
cmp eax, 0x800
jae 0x409dd9
mov word [ebp + eax + 4], cx
xor eax, eax
xor edi, edi
test ebx, ebx
je 0x409dbe
mov ecx, dword [ebp - 0x14]
mov ebx, 2
nop dword [eax + eax]
cmp word [edx + ebx - 2], 0
jne 0x409db2
cmp eax, edi
je 0x409db2
lea edx, [edx + eax*2]
mov dword [ebp - 0x24], 0
mov ecx, edx
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
mov dword [ebp - 0x20], 7
lea eax, [ecx + 2]
mov dword [ebp - 0x18], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409d31
sub ecx, dword [ebp - 0x18]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.004042d0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.00407fa0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x409d95
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409d8b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409dde
push edx
push ecx
call fcn.00466b4c
add esp, 8
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov edx, dword [ebp - 0x10]
mov word [ebp - 0x34], ax
lea eax, [edi + 1]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
inc edi
add ebx, 2
cmp edi, ecx
jb 0x409cf0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x409dd2
push esi
call fcn.00466db6
add esp, 4
mov al, 1
jmp 0x409c89
call fcn.00466edc
call fcn.0046a98a
int3
Function at 0x40a9a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x40a9d8
mov edx, dword [esp + 4]
test edx, edx
je 0x40a9d8
cmp dword [eax], 0xffffffff
je 0x40a9d8
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [esp + 0x10]
mov dword [eax], 0
mov eax, dword [ecx]
push edx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a9d8
mov al, 1
ret 0xc
xor al, al
ret 0xc

Function at 0x40a9e0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx]
push esi
push edi
test eax, eax
je 0x40aa1a
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x40aa1a
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x40aa1a
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push 0
push esi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40aa1a
cmp edi, dword [esi]
jne 0x40aa1a
pop edi
mov al, 1
pop esi
ret 0xc
pop edi
xor al, al
pop esi
ret 0xc

Function at 0x40aa60
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x4be004]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x40aac3
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x40aac3
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40aa9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40aac3
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00466b5a
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00466b5a
add esp, 8
ret 4

Function at 0x40ab70
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x40ac1e
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push 1
push 0
push 0
movlpd qword [esp + 0x28], xmm0
call fcn.0040aae0
test al, al
je 0x40ac1e
mov edi, dword [ebp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0
push edi
push dword [ebp + 8]
xorps xmm0, xmm0
mov ecx, esi
movlpd qword [esp + 0x20], xmm0
call fcn.0040aae0
test al, al
je 0x40ac1e
mov eax, dword [ebp + 8]
xor bl, bl
cmp dword [esp + 0x10], eax
jne 0x40abf4
cmp dword [esp + 0x14], edi
jne 0x40abf4
mov eax, dword [esi]
test eax, eax
jne 0x40abe1
xor bl, bl
jmp 0x40abf4
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x40abdd
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne bl
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x24]
mov ecx, esi
movlpd qword [esp + 0x1c], xmm0
push dword [esp + 0x24]
call fcn.0040aae0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8