joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403cc6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6c4]
add edx, 1
mov dword [ebp - 0x6c4], edx
mov eax, dword [ebp - 0x744]
mov ecx, dword [ebp - 0x6c4]
cmp ecx, dword [eax + 0x18]
jae 0x403d9a
mov edx, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x1c3c]
mov ecx, dword [ebp - 0x354]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x74c], ecx
mov edx, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x1c40]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1c44]
mov eax, dword [ebp - 0x354]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c48], eax
mov dword [ebp - 0x158], 0
jmp 0x403bfe
mov ecx, dword [ebp - 0x158]
add ecx, 1
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x74c]
add edx, dword [ebp - 0x158]
movsx eax, byte [edx]
test eax, eax
je 0x403cb0
mov ecx, dword [ebp - 0x158]
movsx edx, byte [ebp + ecx - 0x850]
test edx, edx
je 0x403cb0
push ebx
push eax
add esp, 4
add ebx, 0x17c4
and ebx, 0xb690
add ebx, 0x17dc
and ebx, 0x8e6a
pop ebx
push ecx
and ecx, 0x159af
sub ecx, 0xe881
add ecx, 0x143c0
pop ecx
mov eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0x158]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x158]
movsx eax, byte [ebp + edx - 0x850]
cmp ecx, eax
je 0x403ca2
mov ecx, dword [ebp - 0x74c]
add ecx, dword [ebp - 0x158]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x158]
movsx ecx, byte [ebp + eax - 0x850]
cmp edx, ecx
jne 0x403ca9
jmp 0x403bef
jmp 0x403cb0
push edi
or edi, 0x16c97
call fcn.00403cc6
add byte [eax], bh
cmp al, byte [edi + 0x3c]
xor dh, byte [edx]
dec eax
xor cl, byte [eax - 0x7d]
add esp, 4
sub edi, 0x9c60
add esp, 4
sub edi, 0x9c60
and edi, 0x4b4f
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0xbdf
pop ebx
mov edx, dword [ebp - 0x74c]
add edx, dword [ebp - 0x158]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x158]
movsx edx, byte [ebp + ecx - 0x850]
cmp eax, edx
jne 0x403d0f
mov dword [ebp - 0xc6c], 0
jmp 0x403d7e
push eax
push esi
add esp, 4
xor eax, 0x48a0
call 0x403d27
add byte [eax], bh
cmp al, 0x41
inc edx
xor eax, 0xc4833434
add al, 0xeb
add al, 0x49
cmp byte [ecx + eax*2 + 0x58], cl
push edx
sub edx, 0x15ac5
jmp 0x403d40
pop edx
mov eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0x158]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x158]
movsx eax, byte [ebp + edx - 0x850]
or eax, 0x20
cmp ecx, eax
jge 0x403d74
mov dword [ebp - 0xc6c], 0xffffffff
jmp 0x403d7e
mov dword [ebp - 0xc6c], 1
cmp dword [ebp - 0xc6c], 0
jne 0x403d95
mov ecx, dword [ebp - 0x1c48]
mov dword [ebp - 0x39c], ecx
jmp 0x403da6
jmp 0x403b7f
mov edx, dword [ebp - 0x750]
mov dword [ebp - 0x39c], edx
cmp dword [ebp - 0x39c], 0
je 0x403e81
push edx
push ebx
add esp, 4
call 0x403dc5
add byte [esp + ecx*2], bh
inc ecx
inc ecx
cmp esi, dword [0x8104c483]
ret 0x7b00
Function at 0x403d27
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6c4]
add edx, 1
mov dword [ebp - 0x6c4], edx
mov eax, dword [ebp - 0x744]
mov ecx, dword [ebp - 0x6c4]
cmp ecx, dword [eax + 0x18]
jae 0x403d9a
mov edx, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x1c3c]
mov ecx, dword [ebp - 0x354]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x74c], ecx
mov edx, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x1c40]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1c44]
mov eax, dword [ebp - 0x354]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c48], eax
mov dword [ebp - 0x158], 0
jmp 0x403bfe
mov ecx, dword [ebp - 0x158]
add ecx, 1
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x74c]
add edx, dword [ebp - 0x158]
movsx eax, byte [edx]
test eax, eax
je 0x403cb0
mov ecx, dword [ebp - 0x158]
movsx edx, byte [ebp + ecx - 0x850]
test edx, edx
je 0x403cb0
push ebx
push eax
add esp, 4
add ebx, 0x17c4
and ebx, 0xb690
add ebx, 0x17dc
and ebx, 0x8e6a
pop ebx
push ecx
and ecx, 0x159af
sub ecx, 0xe881
add ecx, 0x143c0
pop ecx
mov eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0x158]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x158]
movsx eax, byte [ebp + edx - 0x850]
cmp ecx, eax
je 0x403ca2
mov ecx, dword [ebp - 0x74c]
add ecx, dword [ebp - 0x158]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x158]
movsx ecx, byte [ebp + eax - 0x850]
cmp edx, ecx
jne 0x403ca9
jmp 0x403bef
jmp 0x403cb0
push edi
or edi, 0x16c97
call fcn.00403cc6
add byte [eax], bh
cmp al, byte [edi + 0x3c]
xor dh, byte [edx]
dec eax
xor cl, byte [eax - 0x7d]
add esp, 4
sub edi, 0x9c60
add esp, 4
sub edi, 0x9c60
and edi, 0x4b4f
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0xbdf
pop ebx
mov edx, dword [ebp - 0x74c]
add edx, dword [ebp - 0x158]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x158]
movsx edx, byte [ebp + ecx - 0x850]
cmp eax, edx
jne 0x403d0f
mov dword [ebp - 0xc6c], 0
jmp 0x403d7e
push eax
push esi
add esp, 4
xor eax, 0x48a0
call 0x403d27
add byte [eax], bh
cmp al, 0x41
inc edx
xor eax, 0xc4833434
add al, 0xeb
add al, 0x49
cmp byte [ecx + eax*2 + 0x58], cl
push edx
sub edx, 0x15ac5
jmp 0x403d40
pop edx
mov eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0x158]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x158]
movsx eax, byte [ebp + edx - 0x850]
or eax, 0x20
cmp ecx, eax
jge 0x403d74
mov dword [ebp - 0xc6c], 0xffffffff
jmp 0x403d7e
mov dword [ebp - 0xc6c], 1
cmp dword [ebp - 0xc6c], 0
jne 0x403d95
mov ecx, dword [ebp - 0x1c48]
mov dword [ebp - 0x39c], ecx
jmp 0x403da6
jmp 0x403b7f
mov edx, dword [ebp - 0x750]
mov dword [ebp - 0x39c], edx
cmp dword [ebp - 0x39c], 0
je 0x403e81
push edx
push ebx
add esp, 4
call 0x403dc5
add byte [esp + ecx*2], bh
inc ecx
inc ecx
cmp esi, dword [0x8104c483]
ret 0x7b00
Function at 0x403dc5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6c4]
add edx, 1
mov dword [ebp - 0x6c4], edx
mov eax, dword [ebp - 0x744]
mov ecx, dword [ebp - 0x6c4]
cmp ecx, dword [eax + 0x18]
jae 0x403d9a
mov edx, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x1c3c]
mov ecx, dword [ebp - 0x354]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x74c], ecx
mov edx, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x1c40]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1c44]
mov eax, dword [ebp - 0x354]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c48], eax
mov dword [ebp - 0x158], 0
jmp 0x403bfe
mov ecx, dword [ebp - 0x158]
add ecx, 1
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x74c]
add edx, dword [ebp - 0x158]
movsx eax, byte [edx]
test eax, eax
je 0x403cb0
mov ecx, dword [ebp - 0x158]
movsx edx, byte [ebp + ecx - 0x850]
test edx, edx
je 0x403cb0
push ebx
push eax
add esp, 4
add ebx, 0x17c4
and ebx, 0xb690
add ebx, 0x17dc
and ebx, 0x8e6a
pop ebx
push ecx
and ecx, 0x159af
sub ecx, 0xe881
add ecx, 0x143c0
pop ecx
mov eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0x158]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x158]
movsx eax, byte [ebp + edx - 0x850]
cmp ecx, eax
je 0x403ca2
mov ecx, dword [ebp - 0x74c]
add ecx, dword [ebp - 0x158]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x158]
movsx ecx, byte [ebp + eax - 0x850]
cmp edx, ecx
jne 0x403ca9
jmp 0x403bef
jmp 0x403cb0
push edi
or edi, 0x16c97
call fcn.00403cc6
add byte [eax], bh
cmp al, byte [edi + 0x3c]
xor dh, byte [edx]
dec eax
xor cl, byte [eax - 0x7d]
add esp, 4
sub edi, 0x9c60
add esp, 4
sub edi, 0x9c60
and edi, 0x4b4f
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0xbdf
pop ebx
mov edx, dword [ebp - 0x74c]
add edx, dword [ebp - 0x158]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x158]
movsx edx, byte [ebp + ecx - 0x850]
cmp eax, edx
jne 0x403d0f
mov dword [ebp - 0xc6c], 0
jmp 0x403d7e
push eax
push esi
add esp, 4
xor eax, 0x48a0
call 0x403d27
add byte [eax], bh
cmp al, 0x41
inc edx
xor eax, 0xc4833434
add al, 0xeb
add al, 0x49
cmp byte [ecx + eax*2 + 0x58], cl
push edx
sub edx, 0x15ac5
jmp 0x403d40
pop edx
mov eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0x158]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x158]
movsx eax, byte [ebp + edx - 0x850]
or eax, 0x20
cmp ecx, eax
jge 0x403d74
mov dword [ebp - 0xc6c], 0xffffffff
jmp 0x403d7e
mov dword [ebp - 0xc6c], 1
cmp dword [ebp - 0xc6c], 0
jne 0x403d95
mov ecx, dword [ebp - 0x1c48]
mov dword [ebp - 0x39c], ecx
jmp 0x403da6
jmp 0x403b7f
mov edx, dword [ebp - 0x750]
mov dword [ebp - 0x39c], edx
cmp dword [ebp - 0x39c], 0
je 0x403e81
push edx
push ebx
add esp, 4
call 0x403dc5
add byte [esp + ecx*2], bh
inc ecx
inc ecx
cmp esi, dword [0x8104c483]
ret 0x7b00
Function at 0x403de1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x1c4c], eax
push edx
push edx
add esp, 4
sub edx, 0x6dee
jmp 0x403e02
jmp 0x403e08
pop edx
push eax
and eax, 0x14503
jmp 0x403e16
and eax, 0x2e21
add eax, 0x8be
pop eax
mov ecx, dword [ebp - 0x1c4c]
mov dword [ebp - 0x1c50], ecx
lea edx, [ebp - 0x15e8]
push edx
call dword [ebp - 0x1c50]
test eax, eax
jne 0x403e81
push edx
xor edx, 0x5f5a
pop edx
push edi
push eax
add esp, 4
or edi, 0xeb20
xor edi, 0x131fb
pop edi
push esi
push esi
add esp, 4
add esi, 0xe9a7
add esi, 0x10852
and esi, 0xc98f
pop esi
mov dword [ebp - 0xa50], 0
jmp 0x40456b
Function at 0x425180
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x4251b1
lfence
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4251a0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x426560
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x426591
lfence
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x426580
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x432140
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov ecx, dword [edi + 4]
mov edx, ecx
mov esi, dword [edi]
sub edx, esi
mov dword [ebp + 0xc], ecx
cmp ebx, edx
jae 0x43216e
lea eax, [esi + ebx]
jmp 0x43219c
jbe 0x43219f
mov eax, dword [edi + 8]
sub eax, esi
cmp ebx, eax
jbe 0x432187
push ecx
push ebx
mov ecx, edi
lfence
call fcn.004147f0
jmp 0x43219f
mov esi, ebx
sub esi, edx
push esi
push 0
push ecx
call fcn.004f32c0
mov eax, dword [ebp + 0xc]
add esp, 0xc
add eax, esi
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push ebx
push dword [edi]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4321c3
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [edi + 4]
mov ecx, ebx
mov edx, dword [edi]
sub ecx, edx
mov esi, dword [ebp - 4]
cmp esi, ecx
jae 0x4321e4
lea eax, [edx + esi]
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
jbe 0x43221a
mov eax, dword [edi + 8]
sub eax, edx
cmp esi, eax
jbe 0x432206
push ecx
push esi
mov ecx, edi
lfence
call fcn.004147f0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esi, ecx
push esi
push 0
push ebx
call fcn.004f32c0
lea eax, [esi + ebx]
add esp, 0xc
mov dword [edi + 4], eax
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x433fb0
Capabilities:
Hash data via wincrypt

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537a55
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x50
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], edx
mov esi, ecx
mov eax, dword [ebx + 8]
mov edi, dword [ebx + 0xc]
push ecx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x50], eax
call fcn.00440490
mov dword [ebp - 4], 0
lea eax, [ebp - 0x5c]
push esi
push eax
lea ecx, [ebp - 0x4c]
call fcn.004405c0
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 2
cmp byte [ebx + 0x10], 0
mov ecx, dword [ebp - 0x50]
je 0x4340bc
mov edx, dword [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x44]
call fcn.00420160
add esp, 4
mov esi, eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
cmp eax, esi
je 0x4340a0
mov ecx, eax
call fcn.00410d30
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
nop word [eax + eax]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00410d30
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
jmp 0x4340bf
mov eax, dword [ebp - 0x58]
push 0
push ecx
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x434154
push 0
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 0
push 2
push dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
call eax
test eax, eax
je 0x434154
mov edx, dword [edi + 4]
mov esi, dword [edi]
sub edx, esi
mov ecx, dword [ebp - 0x54]
cmp ecx, edx
jae 0x43410c
lea eax, [esi + ecx]
mov dword [edi + 4], eax
jmp 0x43413c
jbe 0x43413c
mov eax, dword [edi + 8]
sub eax, esi
cmp ecx, eax
jbe 0x434125
push ecx
push ecx
mov ecx, edi
lfence
call fcn.004147f0
jmp 0x43413c
mov eax, dword [edi + 4]
sub ecx, edx
push ecx
push 0
push eax
lea esi, [ecx + eax]
call fcn.004f32c0
add esp, 0xc
mov dword [edi + 4], esi
push 0
lea eax, [ebp - 0x54]
push eax
push dword [edi]
push 2
push dword [ebp - 0x4c]
call dword [ebp - 0x50]
mov byte [ebp - 0x45], 1
test eax, eax
jne 0x434158
mov byte [ebp - 0x45], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00410d30
mov byte [ebp - 4], 0
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 4], 0xffffffff
push 0
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, byte [ebp - 0x45]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x434bd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537bf7
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x21c], 0
cmp dword [edx + 0x14], 8
jb 0x434c1c
mov edx, dword [edx]
lea eax, [ebp - 0x218]
push eax
push 0
push 0x57620c
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x434ca2
xor eax, eax
mov dword [esi], 0
lea ecx, [ebp - 0x218]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434c57
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004104f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, str.Failed_to_generate_temp_filepath._Error:
lea ecx, [ebp - 0x230]
push eax
call fcn.00412a50
push 0x5a6448
lea eax, [ebp - 0x230]
push eax
call fcn.004f2c1b
int3

Function at 0x434e10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537cdd
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0xac], edi
push 0x64
lea eax, [ebp - 0x74]
mov dword [ebp - 0xb8], edi
push 0
push eax
mov dword [ebp - 0xa8], 0
call fcn.004f32c0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x434e6f
mov esi, dword [esi]
push 0x32
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x434efe
lea ecx, [ebp - 0x74]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434e86
sub ecx, edx
sar ecx, 1
cmp ecx, 0xa
jb 0x434f4e
lea eax, [ecx - 0xa]
mov dword [edi], 0
mov ecx, 0x26
mov dword [edi + 0x10], 0
cmp eax, ecx
mov dword [edi + 0x14], 7
cmovb ecx, eax
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x60]
push ecx
push eax
mov ecx, edi
call fcn.004104f0
mov dword [ebp - 4], 0
mov dword [ebp - 0xa8], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x8c]
call fcn.00433020
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0xa4]
push str.GetVolumeNameForVolumeMountPointW_failed_with_last_error
push eax
call fcn.00432680
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb4]
push eax
call fcn.00415960
push 0x5a6448
lea eax, [ebp - 0xb4]
push eax
call fcn.004f2c1b
call fcn.00423860
int3
Function at 0x434f80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537d35
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x434fb9
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x434fcc
xor al, al
jmp 0x43511b
push ecx
push 0
push 3
push 7
push 0x80000000
push esi
lea ecx, [ebp - 0x30]
call fcn.00431c30
mov dword [ebp - 4], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004324e0
test al, al
je 0x435137
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x18]
xorps xmm0, xmm0
movq qword [ebp - 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x40], 0
mov dword [ebp - 0x44], eax
ja 0x4350da
jb 0x435059
cmp eax, 0xc800000
ja 0x4350da
lea ecx, [ebp - 0x3c]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00432140
test al, al
je 0x4350da
mov eax, dword [0x5ad4c8]
sub eax, dword [0x5ad4c4]
mov edi, dword [ebp - 0x3c]
add eax, edi
cmp edi, eax
je 0x435094
mov esi, dword [ebp - 0x38]
sub esi, eax
push esi
push eax
push edi
call fcn.004f2d40
lea eax, [esi + edi]
add esp, 0xc
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x3c]
call fcn.00433e70
lea ecx, [ebp - 0x50]
call fcn.004121e0
movq xmm0, qword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
movq qword [ebp - 0x50], xmm0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call fcn.004121e0
jmp 0x435173
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call fcn.004121e0
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.004121e0
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x43510a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00410460
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x40]
xorps xmm0, xmm0
push eax
push dword [ebp - 0x18]
movq qword [ebp - 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x40], 0
mov dword [ebp - 0x44], eax
ja 0x4350e6
jb 0x43515e
cmp eax, 0xc800000
ja 0x4350e6
lea ecx, [ebp - 0x50]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00432140
test al, al
je 0x4350e6
mov eax, dword [ebp - 0x4c]
mov ecx, 0x800c
mov edx, dword [ebp - 0x50]
sub eax, edx
push 0
push ebx
push eax
call fcn.00433fb0
add esp, 0xc
test al, al
je 0x4350e6
mov bl, 1
jmp 0x4350e8
Function at 0x4351a0
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537d7d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4351d9
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4351ec
xor al, al
jmp 0x4352af
push ecx
push 0
push 3
push 7
push 0x80000000
push esi
lea ecx, [ebp - 0x2c]
call fcn.00431c30
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x14]
xorps xmm0, xmm0
movq qword [ebp - 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], eax
ja 0x43527a
jb 0x435248
cmp eax, 0xc800000
ja 0x43527a
lea ecx, [ebp - 0x38]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00432140
test al, al
je 0x43527a
mov eax, dword [ebp - 0x34]
mov ecx, 0x800c
mov edx, dword [ebp - 0x38]
sub eax, edx
push 0
push edi
push eax
call fcn.00433fb0
add esp, 0xc
test al, al
je 0x43527a
mov bl, 1
jmp 0x43527c
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.004121e0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
je 0x43529e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00410460
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret

Function at 0x435410
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, ecx
mov dword [eax], 0
xor esi, esi
nop dword [eax]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x43543a
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
je 0x43546c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
cmp eax, 0x20
jne 0x435463
push 0x12c
call ebx
inc esi
cmp esi, 0x64
jb 0x435430
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret