joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428c7c
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
add esp, 0xfffffec8
xor esi, esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
test ebx, ebx
je 0x428d17
lea edx, [esp + 4]
mov ecx, 0x40
mov eax, ebx
call fcn.00414c44
cmp word [esp + 4], 0x5a4d
jne 0x428d11
xor ecx, ecx
mov edx, dword [esp + 0x40]
mov eax, ebx
call fcn.00414c70
mov edx, esp
mov ecx, 4
mov eax, ebx
call fcn.00414c44
cmp dword [esp], 0x4550
jne 0x428d11
lea edx, [esp + 0x44]
mov ecx, 0x14
mov eax, ebx
call fcn.00414c44
cmp word [esp + 0x54], 0
jbe 0x428d11
lea edx, [esp + 0x58]
mov ecx, 0xe0
mov eax, ebx
call fcn.00414c44
movzx esi, word [esp + 0x9c]
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
add esp, 0x138
pop esi
pop ebx
ret

Function at 0x428ea4
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], edx
mov edi, eax
mov ebp, dword [0x436af8]
mov eax, edi
call fcn.00428e84
inc eax
jne 0x428fae
mov eax, edi
call fcn.00406ecc
mov dword [esp + 4], eax
mov eax, dword [ebp]
test eax, eax
je 0x428edb
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
lea eax, [ebx + 1]
push eax
mov eax, ebp
mov ecx, 1
mov edx, dword [0x41a640]
call fcn.00407e0c
add esp, 4
mov eax, dword [esp + 4]
lea eax, [eax + eax*2]
call fcn.0040404c
lea esi, [ebx + ebx*2]
mov edx, dword [ebp]
mov dword [edx + esi*8], eax
mov eax, dword [ebp]
mov eax, dword [eax + esi*8]
mov edx, edi
call fcn.00414e7c
mov eax, dword [ebp]
mov edx, dword [esp]
mov dword [eax + esi*8 + 4], edx
mov eax, dword [esp]
push eax
call sub.msvcrt.dll__get_osfhandle
pop ecx
mov edi, eax
mov eax, dword [ebp]
mov dword [eax + esi*8 + 8], edi
push 2
push 0
push 0
push edi
call sub.kernel32.dll_SetFilePointer_1
mov edx, dword [ebp]
mov dword [edx + esi*8 + 0xc], eax
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 0xc]
call fcn.0040404c
mov edx, dword [ebp]
mov dword [edx + esi*8 + 0x10], eax
push 0
push 0
push 0
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 0xc]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 0x10]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 8]
push eax
call sub.kernel32.dll_ReadFile_1
mov eax, dword [ebp]
mov edx, dword [eax + esi*8 + 0xc]
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 0x10]
call fcn.0041ab54
mov eax, dword [ebp]
xor edx, edx
mov dword [eax + esi*8 + 0x14], edx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42ad1c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041a87c
mov edi, eax
xor eax, eax
mov ebx, dword [ebp + 8]
jmp 0x42ad4e
inc eax
jmp 0x42ad48
add ebx, 2
cmp word [ebx], 0
jne 0x42ad45
cmp word [ebx], 0
jne 0x42ad42
sub ebx, dword [ebp + 8]
sar ebx, 1
jns 0x42ad5e
adc ebx, 0
inc ebx
add ebx, edi
mov edx, ebx
add edx, edx
imul edx, eax
mov eax, edx
call fcn.0042e438
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
jmp 0x42adaa
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0041a7b0
mov eax, edi
add eax, eax
add eax, esi
mov edx, ebx
call fcn.0041a88c
mov eax, edi
add eax, eax
add esi, eax
jmp 0x42ada1
add ebx, 2
add esi, 2
cmp word [ebx], 0
jne 0x42ad9b
add esi, 2
cmp word [ebx], 0
jne 0x42ad7a
mov word [esi], 0
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0042bafc
mov ebx, eax
mov eax, dword [ebp - 8]
mov word [eax], 0x2a
mov eax, dword [ebp - 8]
mov word [eax + 2], 0
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov esi, eax
mov eax, dword [ebp - 8]
mov word [eax], 0
cmp esi, 0xffffffff
je 0x42ae8e
lea edx, [ebp - 0x234]
mov eax, dword [ebp - 8]
call fcn.0041a88c
test byte [ebp - 0x260], 0x10
je 0x42ae73
mov edx, 0x42ae9c
lea eax, [ebp - 0x234]
call fcn.00414f0c
test eax, eax
je 0x42ae73
mov edx, 0x42aea0
lea eax, [ebp - 0x234]
call fcn.00414f0c
test eax, eax
je 0x42ae73
mov eax, dword [ebp - 8]
call fcn.0041a980
mov ebx, eax
add ebx, 2
mov word [ebx], 0x5c
add ebx, 2
mov word [ebx], 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0042ad1c
mov ebx, eax
lea eax, [ebp - 0x260]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x42adff
push esi
call sub.kernel32.dll_FindClose_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42cc54
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
push eax
call sub.msvcrt.dll__get_osfhandle
pop ecx
mov dword [ebp - 0x10], eax
mov ebx, dword [0x436a84]
push 1
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x436a84]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x42cca9
xor eax, eax
jmp 0x42cd4f
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x42ccb8
xor eax, eax
jmp 0x42cd4f
mov edi, dword [ebp + 8]
mov edi, dword [edi]
mov esi, edi
test esi, esi
jbe 0x42cd0f
cmp esi, 3
jb 0x42cd09
cmp byte [ebx], 0xa
jne 0x42ccd5
lea eax, [ebx + 1]
cmp byte [eax], 0xd
je 0x42cce2
cmp byte [ebx], 0xd
jne 0x42cd09
lea eax, [ebx + 1]
cmp byte [eax], 0xa
jne 0x42cd09
lea eax, [ebx + 2]
mov byte [eax], 0
mov eax, dword [0x436a84]
mov edi, ebx
sub edi, eax
add edi, 2
push 0
push 0
mov eax, dword [ebp - 0xc]
add eax, edi
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer_1
jmp 0x42cd0f
dec esi
inc ebx
test esi, esi
ja 0x42ccc3
mov eax, dword [0x436bfc]
mov eax, dword [eax]
call fcn.00428dd0
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push edi
mov edx, dword [0x436a84]
push edx
test eax, eax
setne al
and eax, 0x7f
push eax
mov eax, dword [0x436bfc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42cfb4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x42d224
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x44f948], 0x44f930
push 0x44f930
call sub.kernel32.dll_InitializeCriticalSection_1
call fcn.0042e0ec
push 0xffffffffffffffff
push 0x42cf84
call sub.kernel32.dll_SetConsoleCtrlHandler
call fcn.004304e0
call fcn.0041c53c
call fcn.0042d4f8
lea eax, [ebp - 0x20]
call fcn.0041a748
push dword [ebp - 0x20]
push 0x42d240
lea eax, [ebp - 0x24]
mov edx, dword [0x436bf8]
mov edx, dword [edx]
call fcn.004071c0
push dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004073b4
mov eax, dword [ebp - 0x1c]
call fcn.00407168
mov edx, eax
mov eax, dword [0x436ba8]
call fcn.0041a88c
mov eax, dword [0x436ba8]
call fcn.0041a87c
mov ecx, eax
mov edx, dword [0x436ba8]
mov eax, dword [0x436ba8]
call fcn.0042066c
mov eax, 0x44f6ec
xor edx, edx
call fcn.0041e5d4
call fcn.0042dda4
mov eax, dword [0x436ba8]
call fcn.0042d7b8
mov ebx, eax
cmp word [0x44f6ec], 0x5c
jne 0x42d0dc
cmp word [0x44f6ee], 0x5c
jne 0x42d0dc
cmp byte [0x4369aa], 0
jne 0x42d0dc
push 0
mov dword [ebp - 0x2c], 0x44f6ec
mov byte [ebp - 0x28], 0xa
lea ecx, [ebp - 0x2c]
mov edx, 1
mov eax, 0x42d258
call fcn.0042f6b4
push 0x105
push 0x44f6ec
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, 0x44f6ec
mov dl, 1
call fcn.0041e9f8
call sub.kernel32.dll_GetConsoleOutputCP_1
mov dword [0x44f90c], eax
push 0x44f8f8
mov eax, dword [0x44f90c]
push eax
call sub.kernel32.dll_GetCPInfo
call fcn.0041ac4c
mov eax, 0x20c
call fcn.0040404c
mov dword [0x44f928], eax
mov eax, 0x20c
call fcn.0040404c
mov dword [0x44f92c], eax
cmp dword [0x44f928], 0
je 0x42d14b
cmp dword [0x44f92c], 0
je 0x42d14b
push 0x104
mov eax, dword [0x44f92c]
push eax
call sub.kernel32.dll_GetConsoleTitleW
mov edx, dword [0x44f92c]
mov eax, dword [0x44f928]
call fcn.0041a88c
cmp byte [0x4369a9], 0
jne 0x42d1a1
mov eax, 1
call fcn.0041e570
test eax, eax
je 0x42d1a1
cmp word [0x4369c8], 0
je 0x42d18b
lea eax, [ebp - 0x16]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_GetConsoleScreenBufferInfo
test eax, eax
je 0x42d18b
movzx eax, word [ebp - 0xe]
mov word [0x4369c8], ax
cmp word [0x4369c8], 0
je 0x42d1a1
movzx eax, word [0x4369c8]
call fcn.00423f58
test ebx, ebx
jne 0x42d1ec
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
xor edx, edx
mov eax, 0x42d340
call fcn.0042f63c
cmp byte [0x4369c2], 0
je 0x42d1d2
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
xor edx, edx
mov eax, 0x42d3f4
call fcn.0042f63c
jmp 0x42d1ec
cmp byte [0x4369c0], 0
je 0x42d1ec
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
xor edx, edx
mov eax, 0x42d468
call fcn.0042f63c
push 0x42d4b8
push 0x42d4dc
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040a210
mov edx, dword [0x436c7c]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d22b
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00406b10
ret
Function at 0x42d4f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa8
lea edi, [esp + 8]
mov dword [esp + 0xc], 0x80000002
mov dword [esp + 0x10], 0x80000001
cmp byte [0x4369c2], 0
je 0x42d523
mov byte [0x4369c0], 1
mov ebp, 2
lea esi, [esp + 0xc]
push esp
push 0x42d6c8
mov eax, dword [esi]
push eax
call sub.advapi32.dll_RegOpenKeyW
test eax, eax
jne 0x42d6b2
xor eax, eax
mov dword [edi], eax
lea ebx, [esp + 0x18]
mov dword [esp + 4], 0x40
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42d714
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42d595
cmp dword [edi], 4
jne 0x42d580
cmp dword [ebx], 0
setne al
mov byte [0x4369aa], al
jmp 0x42d595
cmp dword [edi], 1
jne 0x42d595
push ebx
call sub.msvcrt.dll__wtol
pop ecx
dec eax
sete al
mov byte [0x4369aa], al
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42d734
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42d5d8
cmp dword [edi], 4
jne 0x42d5c3
cmp dword [ebx], 0
setne al
mov byte [0x4369c0], al
jmp 0x42d5d8
cmp dword [edi], 1
jne 0x42d5d8
push ebx
call sub.msvcrt.dll__wtol
pop ecx
dec eax
sete al
mov byte [0x4369c0], al
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42d758
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42d61b
cmp dword [edi], 4
jne 0x42d606
cmp dword [ebx], 0
setne al
mov byte [0x4369c1], al
jmp 0x42d61b
cmp dword [edi], 1
jne 0x42d61b
push ebx
call sub.msvcrt.dll__wtol
pop ecx
dec eax
sete al
mov byte [0x4369c1], al
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42d77c
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42d662
cmp dword [edi], 4
jne 0x42d647
movzx eax, word [ebx]
mov word [0x4369c8], ax
jmp 0x42d662
cmp dword [edi], 1
jne 0x42d662
push 0
lea eax, [esp + 0x18]
push eax
push ebx
call sub.msvcrt.dll_wcstol
add esp, 0xc
mov word [0x4369c8], ax
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42d798
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42d6a9
cmp dword [edi], 4
jne 0x42d68e
movzx eax, word [ebx]
mov word [0x4369ca], ax
jmp 0x42d6a9
cmp dword [edi], 1
jne 0x42d6a9
push 0
lea eax, [esp + 0x18]
push eax
push ebx
call sub.msvcrt.dll_wcstol
add esp, 0xc
mov word [0x4369ca], ax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esi, 4
dec ebp
jne 0x42d52c
mov al, 1
add esp, 0x58
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42f50c
Capabilities:
Set current directory

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdec
xor edi, edi
mov word [esp], 0x3d
dec eax
add ax, 0x41
mov word [esp + 2], ax
mov word [esp + 4], 0x3a
mov word [esp + 6], 0
xor ebx, ebx
mov eax, esp
call fcn.0041c564
mov esi, eax
test esi, esi
je 0x42f550
push esi
call sub.kernel32.dll_SetCurrentDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x42f5bb
test esi, esi
je 0x42f561
push 1
call sub.kernel32.dll_SetErrorMode
mov edi, eax
movzx eax, word [esp + 2]
mov word [esp + 8], ax
movzx eax, word [esp + 4]
mov word [esp + 0xa], ax
mov word [esp + 0xc], 0x5c
mov word [esp + 0xe], 0
lea edx, [esp + 8]
mov eax, esp
call fcn.0041c814
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
jne 0x42f5b1
push 0xffffffffffffffff
lea ecx, [esp + 0x218]
xor edx, edx
mov eax, 0x42f5e0
call fcn.0042f6b4
test esi, esi
je 0x42f5bb
push edi
call sub.kernel32.dll_SetErrorMode
mov eax, dword [0x436d08]
xor edx, edx
call fcn.0041e5d4
add esp, 0x214
pop edi
pop esi
pop ebx
ret
Function at 0x42f89c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp + 4], ecx
mov esi, edx
mov dword [esp], eax
mov dword [esp + 0x1c], 0xffffffff
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0xc
mov eax, 3
and eax, esi
cmp eax, 2
ja 0x42f8e0
mov edx, 1
and edx, esi
mov ecx, 8
and ecx, esi
and edx, ecx
je 0x42f8e8
or eax, 0xffffffff
jmp 0x42fabd
test eax, eax
je 0x42f911
mov edi, 0x40000000
mov edx, 0x42fac8
mov eax, dword [esp]
call fcn.00414f38
test eax, eax
je 0x42f90a
mov dword [esp + 4], 1
mov ebp, 2
jmp 0x42f91b
mov edi, 0x80000000
mov ebp, 3
cmp esi, 0x10a
jne 0x42f99c
push 0
push 0x80
push 3
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push eax
mov eax, 0x80000000
or eax, edi
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42f9e5
push 0
push 0x80
push ebp
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push eax
push edi
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42f9e5
call sub.kernel32.dll_GetLastError_2
mov dword [0x4369ec], eax
cmp dword [0x4369ec], 0x6e
jne 0x42f994
mov dword [0x4369ec], 2
or eax, 0xffffffff
jmp 0x42fabd
push 0
push 0x80
push ebp
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push eax
push edi
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42f9e5
call sub.kernel32.dll_GetLastError_2
mov dword [0x4369ec], eax
cmp dword [0x4369ec], 0x6e
jne 0x42f9dd
mov dword [0x4369ec], 2
or eax, 0xffffffff
jmp 0x42fabd
push 8
push ebx
call sub.msvcrt.dll__open_osfhandle
add esp, 8
mov edi, eax
test esi, 8
je 0x42fab4
mov eax, edi
call fcn.0041e4b4
test eax, eax
jne 0x42fab4
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
test eax, eax
je 0x42fab4
mov word [esp + 8], 0
mov dword [esp + 0x10], 0xffffffff
push 2
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov ebp, eax
call sub.kernel32.dll_GetLastError_2
mov dword [0x4369ec], eax
cmp ebp, 0xffffffff
jne 0x42fa66
cmp dword [0x4369ec], 0
je 0x42fa66
cmp edi, 0xffffffff
je 0x42fa61
push edi
call sub.msvcrt.dll__close
pop ecx
or eax, 0xffffffff
jmp 0x42fabd
push 0
lea eax, [esp + 0x10]
push eax
push 1
lea eax, [esp + 0x14]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
mov ebp, eax
test ebp, ebp
jne 0x42fa95
xor eax, eax
mov dword [esp + 0x10], eax
push 2
lea eax, [esp + 0x14]
push eax
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
cmp word [esp + 8], 0x1a
jne 0x42fab4
mov dword [esp + 0x10], 0xffffffff
push 2
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov eax, edi
call fcn.0042fbe0
mov eax, edi
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42fe4c
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffff8
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0x5c
mov word [esp + 6], 0
push esp
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 1
ja 0x42fe78
xor eax, eax
pop ecx
pop edx
ret
mov al, 1
pop ecx
pop edx
ret

Function at 0x42fe80
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffddc
mov word [esp + 8], ax
mov word [esp + 0xa], 0x3a
mov word [esp + 0xc], 0x5c
mov word [esp + 0xe], 0
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 1
ja 0x42feb3
mov al, 1
jmp 0x42fef8
cmp eax, 2
je 0x42fef6
cmp eax, 5
je 0x42fef6
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x10]
push eax
push 0x104
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
jne 0x42fef6
call sub.kernel32.dll_GetLastError_2
cmp eax, 5
jne 0x42fef6
mov al, 1
jmp 0x42fef8
xor eax, eax
add esp, 0x224
ret

Function at 0x4303d0
Capabilities:
Set console window title

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
test ebx, ebx
je 0x4304a2
mov eax, dword [0x436ae4]
cmp dword [eax], 0
jne 0x4304a2
mov eax, dword [0x436a24]
cmp byte [eax], 0
jne 0x4304a2
mov eax, 0x20c
call fcn.0040404c
mov dword [esp], eax
cmp dword [esp], 0
je 0x4304a2
push 0x104
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GetConsoleTitleW
mov esi, eax
test esi, esi
je 0x4304a2
mov eax, ebx
call fcn.0041a87c
add eax, esi
add eax, dword [0x44f958]
add eax, 0xa
mov edx, eax
add edx, edx
mov eax, esp
call fcn.00404080
cmp dword [esp], 0
je 0x4304a2
mov eax, dword [0x436b60]
cmp byte [eax], 0
je 0x430465
mov eax, dword [0x44f958]
add eax, eax
add eax, dword [esp]
mov edx, ebx
call fcn.0041a88c
jmp 0x430491
mov edx, 0x4304a8
mov eax, dword [esp]
call fcn.0041a8a0
mov eax, dword [esp]
call fcn.0041a87c
mov dword [0x44f958], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.0041a8a0
mov eax, dword [0x436b60]
mov byte [eax], 1
mov eax, dword [esp]
push eax
call sub.kernel32.dll_SetConsoleTitleW
mov eax, dword [esp]
call fcn.00404068
pop edx
pop esi
pop ebx
ret
Function at 0x430c7c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00406b94
xor eax, eax
push ebp
push 0x430e6a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 5
mov eax, dword [ebp - 4]
call fcn.00407168
push eax
mov eax, dword [0x439c4c]
push eax
call sub.kernel32.dll_FindResourceW
mov esi, eax
mov dword [edi + 4], esi
test esi, esi
je 0x430e41
push esi
mov eax, dword [0x439c4c]
push eax
call sub.kernel32.dll_LoadResource
mov dword [edi + 8], eax
cmp dword [edi + 8], 0
je 0x430e41
lea edx, [ebp - 0xc]
mov eax, 0x430e88
call fcn.00430c3c
mov edx, dword [ebp - 0xc]
lea eax, [edi + 0x34]
mov ecx, dword [0x4305a0]
call fcn.00407f74
mov eax, dword [edi + 8]
push eax
call sub.kernel32.dll_LockResource
mov dword [edi + 0xc], eax
mov eax, dword [edi + 4]
push eax
mov eax, dword [0x439c4c]
push eax
call sub.kernel32.dll_SizeofResource
xor edx, edx
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], edx
cmp byte [ebp - 5], 0
je 0x430e16
mov eax, dword [edi + 0x28]
call fcn.0040404c
mov dword [edi + 0x38], eax
mov eax, dword [edi + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 0x38]
mov dword [edi + 0x14], eax
push 0x20
lea eax, [edi + 0x18]
mov ecx, 1
mov edx, dword [0x4305a0]
call fcn.00407e0c
add esp, 4
push 0x20
lea eax, [edi + 0x1c]
mov ecx, 1
mov edx, dword [0x4305a0]
call fcn.00407e0c
add esp, 4
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
jmp 0x430dda
mov edx, dword [edi + 0x18]
mov eax, dword [edi + 0x10]
mov ecx, 0x20
call fcn.004041f0
lea ecx, [ebp - 0x10]
mov edx, dword [edi + 0x34]
mov eax, dword [edi + 0x18]
call fcn.004308bc
mov edx, dword [ebp - 0x10]
lea eax, [edi + 0x1c]
mov ecx, dword [0x4305a0]
call fcn.00407f74
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x1c]
mov ecx, 0x20
call fcn.004041f0
add dword [edi + 0x20], 0x20
adc dword [edi + 0x24], 0
add dword [edi + 0x10], 0x20
add dword [edi + 0x14], 0x20
mov eax, dword [edi + 0x28]
mov edx, dword [edi + 0x2c]
sub eax, dword [edi + 0x20]
sbb edx, dword [edi + 0x24]
cmp edx, 0
jne 0x430df2
cmp eax, 0x20
jae 0x430d8b
jmp 0x430df4
jge 0x430d8b
mov eax, dword [edi + 0x28]
mov ecx, eax
add ecx, dword [edi + 0x38]
dec ecx
mov dword [edi + 0x10], ecx
movzx eax, byte [ecx]
mov byte [edi + 0x30], al
mov bl, 1
movzx eax, al
mov edx, dword [edi + 0x28]
sub edx, eax
dec edx
mov dword [edi + 0x3c], edx
jmp 0x430e38
mov eax, dword [edi + 0x28]
call fcn.0040404c
mov ebx, eax
mov dword [edi + 0x38], ebx
mov edx, ebx
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x28]
call fcn.004041f0
mov bl, 1
mov eax, dword [edi + 0x28]
mov dword [edi + 0x3c], eax
mov eax, dword [edi + 8]
push eax
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430e71
lea eax, [ebp - 0x10]
mov edx, dword [0x4305a0]
mov ecx, 2
call fcn.004076b4
lea eax, [ebp - 4]
call fcn.00406ab0
ret