joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407334
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x47c
mov eax, dword [0x42d0b4]
xor eax, esp
mov dword [esp + 0x478], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4074a9
mov eax, 0x104
mov byte [esp + 0x224], 1
push eax
xor esi, esi
mov dword [esp + 0x22c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x224], esi
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [esp + 0x24]
add esp, 0xc
cmp byte [esp + 0x224], al
sete al
dec eax
and eax, 0xfdc6
add eax, 0x208
push eax
call fcn.0040e3f0
test eax, eax
js 0x4074ad
mov eax, dword [esp + 0x220]
test eax, eax
je 0x41a823
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esp + 0x230]
mov ecx, edi
call fcn.00410060
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
mov ebx, eax
test ebx, ebx
je 0x407452
mov esi, dword [esp + 0x220]
test esi, esi
je 0x41a82c
push 4
push 0x402008
push esi
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x41a835
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41a89d
xor edi, edi
cmp word [eax], di
je 0x41a89d
lea eax, [esp + 0x14]
mov edx, esi
push eax
lea eax, [esp + 0x234]
mov ecx, fcn.004159d0
push eax
push edi
push 0x1037
call fcn.0041589a
mov ecx, dword [esp + 0x14]
movzx ebx, al
call fcn.00408b4d
test ebx, ebx
je 0x407483
xor esi, esi
mov eax, dword [esp + 0x220]
mov dword [esp + 0x220], esi
test eax, eax
je 0x40746c
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, ebx
mov ecx, dword [esp + 0x484]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416b50
mov esp, ebp
pop ebp
ret
movzx eax, word [esi + 2]
push 0x5c
pop ecx
cmp ax, cx
je 0x41a885
cmp eax, 0x3a
jne 0x407450
cmp word [esi + 4], cx
jne 0x407450
cmp word [esi + 6], di
jne 0x407450
jmp 0x41a885
xor eax, eax
jmp 0x40746e
mov ebx, esi
jmp 0x407452
lea eax, [esp + 0x18]
jmp 0x4073c1
lea esi, [esp + 0x18]
jmp 0x4073f1
add esi, 8
push esi
push edi
mov dword [esp + 0x18], esi
call dword [sym.imp.msvcrt.dll_wcsstr]
mov dword [esp + 0x18], eax
pop ecx
pop ecx
test eax, eax
je 0x41a86c
cmp eax, edi
jbe 0x41a86c
movzx esi, word [eax]
xor ecx, ecx
push edi
mov word [eax], cx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ebx, eax
mov eax, dword [esp + 0x10]
mov word [eax], si
jmp 0x41a875
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ebx, eax
xor esi, esi
cmp ebx, 0xffffffff
jne 0x407452
jmp 0x4074ad
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x407450
xor ebx, ebx
inc ebx
jmp 0x407450
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
jmp 0x407450
Function at 0x407f47
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x104
mov byte [ebp - 0x1c], 1
xor ebx, ebx
mov dword [ebp - 0x18], edi
push edi
lea eax, [ebp - 0x228]
mov dword [ebp - 0x20], ebx
push ebx
push eax
mov si, cx
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x228]
add esp, 0xc
cmp byte [ebp - 0x1c], al
sete al
dec eax
and eax, 0x7ee3
add eax, edi
push eax
call fcn.0040e3f0
test eax, eax
js 0x408001
push 0x3a
pop eax
mov word [ebp - 0xe], ax
push 0x5c
pop eax
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x10], si
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41aff1
cmp eax, 2
je 0x408001
cmp eax, 5
je 0x408001
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x408024
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x230]
push ecx
push dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
test eax, eax
je 0x41affe
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], ebx
test eax, eax
je 0x408013
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416b50
leave
ret
lea eax, [ebp - 0x228]
jmp 0x407fe0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], ebx
test eax, eax
je 0x41b01f
push eax
jmp 0x41b018
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 5
jne 0x408001
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ebx
test ecx, ecx
je 0x41b01f
push ecx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
xor eax, eax
inc eax
jmp 0x408015
Function at 0x40802c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov byte [ebp - 0x14], 1
mov esi, 0x104
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x10], esi
push eax
mov edi, ecx
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x220]
add esp, 0xc
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.0040e3f0
test eax, eax
js 0x4081ae
push 0x24
pop ecx
call fcn.0040dcd0
mov esi, eax
test esi, esi
je 0x41b050
mov ecx, esi
mov dword [esi], edi
call fcn.00408f21
mov eax, dword [esi + 0x18]
mov ecx, 0xffce
mov ebx, dword [esi]
mov edi, dword [esi + 0xc]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], ebx
call fcn.0040dcd0
test eax, eax
je 0x41b050
push 0
mov edx, 0x7fe7
mov dword [0x4357a4], eax
mov ecx, eax
call fcn.00408e9e
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41b027
mov edx, dword [ebp - 0x10]
push ebx
call fcn.00411cd5
test eax, eax
jne 0x4081ae
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41b032
push 0x5c
pop eax
mov edx, eax
call fcn.004101f5
xor ecx, ecx
mov word [eax + 2], cx
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41b03d
push eax
mov ecx, 0x447bf0
call fcn.0040a641
test edi, edi
je 0x4081da
movzx eax, word [edi]
push 0x3a
pop edx
cmp ax, dx
je 0x4081da
push 0x5c
pop ecx
cmp ax, cx
jne 0x40817e
cmp edi, ebx
je 0x41b048
mov eax, ebx
xor ecx, ecx
cmp word [eax], cx
je 0x408166
mov ecx, eax
add eax, 2
cmp eax, edi
jne 0x408156
movzx eax, word [ecx]
cmp ax, dx
je 0x41b048
push 0x5c
pop ecx
cmp ax, cx
je 0x41b048
movzx ebx, word [edi]
xor eax, eax
push dword [ebp - 0x224]
mov word [edi], ax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4081d6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x4357a8], eax
mov word [edi], bx
cmp dword [0x4357a8], 0
je 0x4081da
xor esi, esi
inc esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x4081c5
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416b50
leave
ret
xor eax, eax
jmp 0x40819d
mov ecx, esi
call fcn.00408f21
mov eax, dword [ebp - 0x228]
mov dword [esi + 0x18], eax
jmp 0x4081b1
lea ecx, [ebp - 0x220]
jmp 0x4080eb
lea ecx, [ebp - 0x220]
jmp 0x408107
lea eax, [ebp - 0x220]
jmp 0x408122
add edi, 2
jmp 0x40817e
call fcn.004298e4
push 1
push 0x43fa30
call dword [sym.imp.msvcrt.dll_longjmp]
int3
Function at 0x408e9e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x42d0b4]
xor eax, esp
mov dword [esp + 0xc], eax
cmp word [ebp + 8], 0
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x408ede
push esi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCurrentDirectoryW]
xor eax, eax
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor ecx, esp
call fcn.00416b50
mov esp, ebp
pop ebp
ret 4
push 0x3d
pop eax
push dword [ebp + 8]
mov word [esp + 0x10], ax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
mov word [esp + 0xe], ax
lea ecx, [esp + 0xc]
push 0x3a
pop eax
mov word [esp + 0x10], ax
xor eax, eax
mov word [esp + 0x12], ax
call fcn.0040ec2e
test eax, eax
je 0x41b745
push eax
mov edx, edi
mov ecx, esi
call fcn.0040f3a0
jmp 0x408ec9
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
mov word [esi], ax
push 0x3a
pop eax
mov word [esi + 2], ax
push 0x5c
pop eax
mov word [esi + 4], ax
xor eax, eax
mov word [esi + 6], ax
inc eax
jmp 0x408ecb
Function at 0x409b3b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push ecx
mov dword [ebp - 0xc], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
cmp byte [0x448050], 0
pop ecx
mov dword [ebp - 4], eax
jne 0x41c072
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov ecx, 0x2000
cmp esi, ecx
ja 0x41c085
test esi, esi
je 0x409bb1
push eax
push eax
push ecx
push 0x4397f0
push 0xffffffffffffffff
push ebx
push eax
push dword [0x4315a0]
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
push 0
push edi
lea esi, [eax - 1]
push esi
push 0x4397f0
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x409bc0
cmp dword [edi], esi
jne 0x409bc0
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x409bb9
push 0
push dword [ebp + 0xc]
push esi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
jmp 0x409bba
push eax
push eax
push ecx
push 0x4397f0
push 0x1000
push ebx
push eax
push dword [0x4315a0]
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
push 0
push edi
push eax
push 0x4397f0
push dword [ebp - 4]
mov ecx, 0x2000
mov dword [ebp - 8], eax
add ebx, ecx
sub esi, ecx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x409bc0
mov eax, dword [ebp - 8]
cmp dword [edi], eax
jne 0x409bc0
push 0
pop eax
jmp 0x409b6b
Function at 0x40a976
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
mov byte [0x4355c6], bl
push esi
test edx, edx
je 0x40a9a2
mov esi, edx
push edi
lea edi, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x40a98c
sub esi, edi
sar esi, 1
neg esi
pop edi
sbb esi, esi
and edx, esi
push edx
push ecx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
push dword [0x431594]
mov esi, eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
call fcn.0040a9d4
mov dword [0x431594], eax
xor eax, eax
test esi, esi
pop esi
sete al
pop ebx
ret

Function at 0x40a9d4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentStringsW]
mov esi, eax
xor edi, edi
test esi, esi
je 0x40aa19
push ebx
mov ecx, esi
call fcn.0040aa20
mov ebx, eax
push ebx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40aa11
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x40ad26
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
je 0x40ad40
cmp dword [0x435748], 0
je 0x40ad45
pop edi
pop esi
pop ebx
leave
ret
cmp dword [0x435758], 0
jne 0x40ad40
jmp 0x41cb2f
mov ecx, 0x20c
call fcn.0040dcd0
mov edi, eax
test edi, edi
je 0x40ad40
push 0x104
push edi
call dword [sym.imp.api_ms_win_core_console_l2_2_0.dll_GetConsoleTitleW]
mov edx, eax
test edx, edx
je 0x40ad40
and dword [ebp - 8], 0
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x41cb62
mov eax, dword [0x435718]
sub ecx, esi
sar ecx, 1
add edx, 0xa
add eax, ecx
mov ecx, edi
add eax, edx
mov dword [ebp - 4], eax
lea edx, [eax + eax]
call fcn.0040dd20
mov esi, eax
test esi, esi
je 0x41cbf1
cmp byte [0x43575c], 0
mov edi, esi
mov edx, dword [ebp - 4]
je 0x41cbb1
mov eax, dword [0x435718]
sub edx, eax
push ebx
lea ecx, [esi + eax*2]
call fcn.0040f3a0
jmp 0x41cbea
push 0x403f8c
mov ecx, esi
call fcn.0040fc40
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x41cbc2
sub ecx, edx
mov edx, dword [ebp - 4]
sar ecx, 1
mov dword [0x435718], ecx
mov ecx, esi
push ebx
call fcn.0040fc40
mov byte [0x43575c], 1
push esi
call dword [sym.imp.api_ms_win_core_console_l2_2_0.dll_SetConsoleTitleW]
mov ecx, edi
call fcn.0040dc60
jmp 0x40ad40
Function at 0x40ec2e
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov ebx, 0x2000
mov edi, 0x42d590
push ebx
mov esi, ecx
xor eax, eax
push edi
push esi
mov word [0x42d590], ax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40ec64
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x435755], 0
je 0x40ed1d
push 0x402394
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed61
push 0x40239c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed47
push 0x4023d8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed7f
push 0x4023c0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41ddad
push 0x4023b4
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed71
push 0x4023f4
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed24
push 0x4024ac
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41ddb8
push 0x402480
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41ddc4
xor eax, eax
jmp 0x40ec5d
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.00409310
add eax, eax
cmp eax, 0x4000
jae 0x40ed83
xor ecx, ecx
mov word [eax + 0x42d590], cx
jmp 0x40ec5b
push dword [0x4355dc]
push 0x402050
push ebx
push edi
call fcn.00409abf
add esp, 0x10
jmp 0x40ec5b
push 0
mov edx, ebx
mov ecx, edi
call fcn.00408e9e
jmp 0x40ec5b
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.00406854
jmp 0x40ed30
push 2
jmp 0x40ed4d
call fcn.00416c98
int3
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
jmp 0x40ec5d
call dword [sym.imp.msvcrt.dll_rand]
push eax
jmp 0x40ed4d
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
push dword [esp + 0xc]
jmp 0x40ed4d
Function at 0x4100e9
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x104
mov byte [ebp - 0xc], 1
xor ebx, ebx
mov dword [ebp - 8], esi
push esi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x10], ebx
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x218]
add esp, 0xc
cmp byte [ebp - 0xc], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.0040e3f0
test eax, eax
js 0x41e5d3
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41e5e5
push dword [ebp - 8]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
mov esi, 0x402500
mov ecx, esi
call fcn.0040ec2e
test eax, eax
je 0x41e5f0
mov esi, 0x4024f0
mov ecx, esi
call fcn.0040ec2e
test eax, eax
je 0x41e601
mov esi, 0x4024e0
mov ecx, esi
call fcn.0040ec2e
test eax, eax
je 0x41e612
mov ecx, 0x4024d0
call fcn.0040ec2e
test eax, eax
je 0x41e623
mov ecx, 0x4024c4
call fcn.0040ec2e
test eax, eax
jne 0x41e6d2
mov ecx, dword [0x447df8]
test ecx, ecx
je 0x4101ee
xor edx, edx
inc edx
call fcn.00408bc7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], ebx
pop esi
pop ebx
test eax, eax
je 0x4101e2
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416b50
leave
ret
mov ecx, 0x447bf0
jmp 0x4101c6
push ebx
call fcn.00411e70
test eax, eax
je 0x41e5d3
push 1
call dword [sym.imp.msvcrt.dll_exit]
lea eax, [ebp - 0x218]
jmp 0x410151
mov edx, 0x4020b8
mov ecx, esi
call fcn.0040a976
jmp 0x410170
mov edx, 0x403ad0
mov ecx, esi
call fcn.0040a976
jmp 0x410184
mov edx, 0x403ce4
mov ecx, esi
call fcn.0040a976
jmp 0x410198
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x41e630
lea ecx, [ebp - 0x218]
push 0x2e
pop edx
call fcn.0040a62f
test eax, eax
jne 0x41e6b6
push 0x403b1e
call dword [sym.imp.msvcrt.dll__wcsupr]
pop ecx
mov ecx, dword [ebp - 0x10]
mov esi, ecx
test ecx, ecx
jne 0x41e657
lea esi, [ebp - 0x218]
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x41e65a
sub esi, edx
sar esi, 1
push edi
mov edi, ecx
test ecx, ecx
jne 0x41e678
lea edi, [ebp - 0x218]
mov ecx, edi
push 0x5c
pop edx
call fcn.004101f5
lea ecx, [edi - 2]
lea ecx, [ecx + esi*2]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
pop edi
je 0x41e69f
test ecx, ecx
jne 0x41e698
lea ecx, [ebp - 0x218]
push 0x403b1c
jmp 0x41e6ae
test ecx, ecx
jne 0x41e6a9
lea ecx, [ebp - 0x218]
push 0x403b1e
mov edx, dword [ebp - 8]
call fcn.0040fc40
mov edx, dword [ebp - 0x10]
test edx, edx
jne 0x41e6c3
lea edx, [ebp - 0x218]
mov ecx, 0x4024d0
call fcn.0040a976
jmp 0x4101aa
push 0x403cf0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4101bc
mov dword [0x448518], 1
jmp 0x4101bc
Function at 0x410b12
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3a
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], cx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00416b50
leave
ret
Function at 0x4123f0
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x230], 0
mov eax, 0x104
push ebx
push esi
push edi
push eax
mov dword [ebp - 0x228], eax
xor ebx, ebx
lea eax, [ebp - 0x438]
inc ebx
push 0
push eax
mov esi, edx
mov byte [ebp - 0x22c], bl
mov edi, ecx
call sub.msvcrt.dll_memset
and dword [ebp - 0x18], 0
add esp, 0xc
mov eax, 0x104
mov byte [ebp - 0x14], bl
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0x220]
push 0
push eax
call sub.msvcrt.dll_memset
and dword [ebp - 0x448], 0
add esp, 0xc
mov eax, 0x104
mov byte [ebp - 0x444], bl
mov dword [ebp - 0x440], eax
push eax
lea eax, [ebp - 0x650]
push 0
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x438]
add esp, 0xc
cmp byte [ebp - 0x22c], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040e3f0
test eax, eax
js 0x41f2d4
xor eax, eax
lea ecx, [ebp - 0x220]
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040e3f0
test eax, eax
js 0x41f2d4
xor eax, eax
lea ecx, [ebp - 0x220]
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040e3f0
test eax, eax
js 0x41f2d4
and dword [0x4357a8], 0
mov eax, dword [ebp - 0x448]
test eax, eax
jne 0x412513
lea eax, [ebp - 0x650]
push dword [ebp - 0x440]
mov edx, esi
mov ecx, edi
push eax
call fcn.00407d65
test al, al
je 0x4125af
mov eax, dword [ebp - 0x448]
test eax, eax
jne 0x41253b
lea eax, [ebp - 0x650]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040a641
push 0x40250c
lea ecx, [ebp - 0x220]
call fcn.0041232c
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x41f2a1
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41f2ac
push dword [ebp - 0x228]
xor edx, edx
push ecx
push edx
lea ecx, [ebp - 0x654]
push ecx
push edx
push edx
push edx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
test eax, eax
je 0x41f2b7
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x4125fb
push 0x4025c8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x412603
xor bl, bl
cmp dword [ebp - 0x448], 0
jne 0x41f2e3
mov eax, dword [ebp - 0x18]
and dword [ebp - 0x18], 0
test eax, eax
je 0x4125d1
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [ebp - 0x230]
and dword [ebp - 0x230], 0
test eax, eax
je 0x4125ea
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416b50
leave
ret
lea eax, [ebp - 0x438]
jmp 0x41259d
cmp dword [ebp - 0x654], 0xc
je 0x4125b1
jmp 0x4125af
lea ecx, [ebp - 0x438]
jmp 0x412565
lea eax, [ebp - 0x220]
jmp 0x412570
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea ecx, [eax - 0x90]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [0x4357a8], ecx
jmp 0x4125af
mov dword [0x4357a8], 8
jmp 0x4125af
push dword [ebp - 0x448]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
jmp 0x4125be
Function at 0x414759
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
test edx, 0x400
jne 0x42092c
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U_WithStatus]
test eax, eax
js 0x42092c
cmp word [ebp - 0x24], di
ja 0x420912
mov eax, edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
push 0x5040
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x14]
push 4
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x18
push eax
push 0x10000
lea eax, [ebp - 4]
mov dword [ebp - 0x30], 0x40
push eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
js 0x42092c
mov ecx, dword [ebp - 4]
call fcn.00414823
test eax, eax
jne 0x42091d
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
je 0x42092c
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
jmp 0x4147a2
mov ecx, dword [ebp - 4]
call fcn.0042a0f5
mov esi, eax
jmp 0x41480b
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x41481c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x41481c