joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4086a0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
mov eax, 0x2808
call fcn.00442300
mov eax, dword [esp + 0x280c]
test eax, eax
jne 0x4086bc
add esp, 0x2808
ret
push ebp
mov ebp, dword [esp + 0x2818]
push esi
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
push eax
mov dword [esp + 0x24], 0
mov dword [ebp], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4087cb
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
test edx, edx
jne 0x40870d
mov dword [ebp], 2
jmp 0x408775
push edi
mov ecx, 0x9ff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x2800
pop edi
cmp edx, eax
jae 0x40872f
mov eax, edx
lea ecx, [esp + 0xc]
push 0
push ecx
lea edx, [esp + 0x18]
push eax
push edx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40876e
lea eax, [esp + 0x10]
push 0x2800
push eax
call fcn.00408530
add esp, 8
test eax, eax
jne 0x408775
mov dword [ebp], 3
jmp 0x408775
mov dword [ebp], 5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp], 0
jne 0x4087dd
mov eax, dword [esp + 0x2818]
test eax, eax
je 0x4087b6
mov ecx, dword [esp + 0x2814]
push eax
push ecx
call fcn.00408580
add esp, 8
test eax, eax
jne 0x4087b6
mov eax, dword [esp + 8]
mov dword [ebp], 4
pop esi
pop ebp
add esp, 0x2808
ret
mov dword [esp + 8], 1
pop esi
mov eax, dword [esp + 4]
pop ebp
add esp, 0x2808
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4087dd
mov dword [ebp], 1
mov eax, dword [esp + 8]
pop esi
pop ebp
add esp, 0x2808
ret
Function at 0x40cd40
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x18]
mov eax, 0x1f3
not ecx
dec ecx
push edi
mov ebx, ecx
push ebp
sub eax, ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x40cd80
pop edi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
push esi
mov esi, 1
test byte [edi], 0x10
je 0x40ce6c
mov al, byte [edi + 0x2c]
lea edx, [edi + 0x2c]
cmp al, 0x2e
jne 0x40cdb3
mov al, byte [edi + 0x2d]
cmp al, 0x2e
jne 0x40cdab
mov cl, byte [edi + 0x2e]
test cl, cl
je 0x40ce41
test al, al
je 0x40ce41
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
cmp eax, ecx
jb 0x40ce3d
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov byte [ebx + ebp - 1], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x6391c0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x24]
mov ecx, edx
mov edx, dword [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
push ebp
call fcn.0040cd40
mov byte [ebx + ebp - 1], 0x2a
add esp, 0x10
mov esi, eax
mov byte [ebx + ebp], 0
mov edi, dword [esp + 0x1c]
test esi, esi
je 0x40ce59
mov edx, dword [esp + 0x18]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40cd86
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x24]
lea ecx, [edi + 0x2c]
push eax
push ecx
push ebp
mov byte [ebx + ebp - 1], 0
call dword [esp + 0x2c]
mov esi, eax
mov byte [ebx + ebp - 1], 0x2a
jmp 0x40ce41
Function at 0x40dea0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x664
push ebx
push esi
mov esi, dword [esp + 0x670]
xor ebx, ebx
cmp esi, ebx
je 0x40e078
push esi
call fcn.00441d20
add esp, 4
test eax, eax
je 0x40e078
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x18]
push ebx
push eax
push esi
mov dword [esp + 0x24], ebx
call fcn.0040aa60
add esp, 0x1c
test eax, eax
je 0x40e078
mov eax, dword [esp + 8]
cmp eax, 0xffffffff
je 0x40e078
test al, 1
je 0x40df0c
and al, 0xfe
push eax
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 8]
test al, 0x10
push ebp
je 0x40e050
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46e]
mov word [esp + 0x46c], bx
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x470]
push ecx
stosw word es:[edi], ax
call fcn.00441cbe
lea edx, [esp + 0x474]
push 0x6391c4
push edx
call fcn.00441c94
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x230]
mov dword [esp + 0x22c], ebx
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x21c]
lea ecx, [esp + 0x46c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, dword [esp + 0x67c]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40e02c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea edx, [esp + 0x248]
push 0x6380ac
push edx
call edi
test eax, eax
je 0x40e00e
lea eax, [esp + 0x248]
push 0x6380a8
push eax
call edi
test eax, eax
je 0x40e00e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push esi
push ecx
stosw word es:[edi], ax
call fcn.00441cbe
lea edx, [esp + 0x1c]
push 0x633490
push edx
call fcn.00441c94
lea eax, [esp + 0x258]
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.00441c94
lea edx, [esp + 0x2c]
push ebp
push edx
call fcn.0040dea0
add esp, 0x20
lea eax, [esp + 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40df92
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
pop edi
jne 0x40e06e
test ebp, ebp
je 0x40e06e
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop ebp
pop esi
pop ebx
add esp, 0x664
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, ebx
jne 0x40e06e
cmp dword [esp + 0x678], ebx
je 0x40e06e
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop ebp
pop esi
pop ebx
add esp, 0x664
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x664
ret

Function at 0x40e5f0
Capabilities:
Copy file

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, eax
test edi, edi
jne 0x40e632
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40e632
push edi
push esi
call fcn.0040dc40
add esp, 8
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40e640
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
sub esp, 0x204
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebp
mov ebp, dword [esp + 0x214]
push esi
push edi
push ebp
call ebx
cmp eax, 0xffffffff
jne 0x40e675
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x218]
push eax
push ebp
push ecx
jmp 0x40e71b
test al, 1
je 0x40e68b
and al, 0xfe
push eax
push ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x10]
test al, 0x10
je 0x40e70a
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push eax
push ebp
lea edx, [esp + 0x1c]
push str._s.bak_08X
push edx
call fcn.00441c02
add esp, 0x10
lea eax, [esp + 0x14]
xor esi, esi
push eax
call ebx
cmp eax, 0xffffffff
je 0x40e6fe
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push eax
push ebp
lea ecx, [esp + 0x1c]
push str._s.bak_08X
push ecx
call fcn.00441c02
add esp, 0x10
lea edx, [esp + 0x14]
push edx
call ebx
inc esi
cmp esi, 0xa
jge 0x40e739
cmp eax, 0xffffffff
jne 0x40e6ce
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x220]
mov edx, dword [esp + 0x218]
push ecx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebp
mov esi, eax
call fcn.00410250
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x204
ret
Function at 0x40e750
Capabilities:
Check for time delay via gettickcount
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5e083b
push eax
mov dword fs:[0], esp
sub esp, 0x208
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x228]
xor ebx, ebx
cmp edi, ebx
je 0x40e931
mov esi, dword [esp + 0x22c]
cmp esi, ebx
je 0x40e931
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [esp + 0x230]
mov dword [esp + 0x14], eax
cmp ecx, ebx
je 0x40e7ae
cmp eax, 0xffffffff
jne 0x40e931
push esi
lea ecx, [esp + 0x14]
call fcn.005d0e15
push str._tmp
lea ecx, [esp + 0x14]
mov dword [esp + 0x224], ebx
call fcn.005d1183
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call ebp
mov ecx, dword [esp + 0x10]
push 0
push ecx
push edi
call fcn.0040e640
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40e91d
mov eax, dword [esp + 0x234]
test eax, eax
je 0x40e814
mov edx, dword [esp + 0x10]
push edx
push edi
call eax
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40e94c
mov eax, dword [esp + 0x10]
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ebx, eax
test ebx, ebx
jne 0x40e91d
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x40e955
test al, 1
je 0x40e847
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
stosw word es:[edi], ax
stosb byte es:[edi], al
call ebp
push eax
push esi
lea ecx, [esp + 0x20]
push str._s.bak_08X
push ecx
call fcn.00441c02
add esp, 0x10
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edi, edi
cmp eax, 0xffffffff
je 0x40e8be
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
push eax
push esi
lea eax, [esp + 0x20]
push str._s.bak_08X
push eax
call fcn.00441c02
add esp, 0x10
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc edi
cmp edi, 0xa
jge 0x40e912
cmp eax, 0xffffffff
jne 0x40e88a
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileA]
lea edx, [esp + 0x18]
push edx
push esi
call ebp
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 1
push esi
push eax
call edi
mov ebx, eax
test ebx, ebx
jne 0x40e8fd
mov eax, dword [esp + 0x238]
test eax, eax
je 0x40e8f9
mov ecx, dword [esp + 0x10]
push 5
push esi
push ecx
call edi
mov ebx, eax
test ebx, ebx
je 0x40e90a
push 4
lea edx, [esp + 0x1c]
push 0
push edx
call edi
jmp 0x40e91d
lea eax, [esp + 0x18]
push esi
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x220], 0xffffffff
call fcn.005d0da7
mov ecx, dword [esp + 0x218]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x214
ret
mov edx, dword [esp + 0x10]
push edx
call ebp
jmp 0x40e91d
mov eax, dword [esp + 0x10]
push eax
call ebp
jmp 0x40e91d
Function at 0x40e960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5e0892
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, dword [esp + 0x170]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x40eb75
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40eb75
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40eb75
test al, 0x10
je 0x40eb75
push esi
lea ecx, [esp + 0x10]
call fcn.005d0e15
push 0x5c
lea ecx, [esp + 0x10]
mov dword [esp + 0x170], ebx
call fcn.005ce7ed
mov ecx, 0x4e
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push 0x6391c0
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.005d103c
mov eax, dword [eax]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.005d0da7
cmp edi, 0xffffffff
mov ebx, 1
je 0x40eb5d
mov esi, dword [esp + 0x178]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [esp + 0x54]
push 0x6394b4
push eax
call ebp
test eax, eax
je 0x40eb41
lea ecx, [esp + 0x54]
push 0x6394b0
push ecx
call ebp
test eax, eax
je 0x40eb41
lea edx, [esp + 0x54]
lea ecx, [esp + 0x14]
push edx
call fcn.005d0e15
mov al, byte [esp + 0x28]
mov byte [esp + 0x170], bl
test al, 0x10
push 0x6333c8
je 0x40ead4
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.005d103c
lea edx, [esp + 0x14]
mov byte [esp + 0x170], 2
push edx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.005d0fd6
mov eax, dword [eax]
push esi
push eax
mov byte [esp + 0x178], 3
call fcn.0040e960
add esp, 8
lea ecx, [esp + 0x24]
mov byte [esp + 0x170], 2
call fcn.005d0da7
mov byte [esp + 0x170], bl
lea ecx, [esp + 0x18]
jmp 0x40eb2b
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.005d103c
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push eax
push edx
mov byte [esp + 0x17c], 4
call fcn.005d0fd6
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x178], 5
call fcn.005cf4a6
lea ecx, [esp + 0x1c]
mov byte [esp + 0x170], 4
call fcn.005d0da7
mov byte [esp + 0x170], bl
lea ecx, [esp + 0x20]
call fcn.005d0da7
lea ecx, [esp + 0x14]
mov byte [esp + 0x170], 0
call fcn.005d0da7
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40ea31
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
lea ecx, [esp + 0xc]
mov dword [esp + 0x16c], 0xffffffff
call fcn.005d0da7
mov eax, ebx
jmp 0x40eb77
xor eax, eax
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x40eb90
Capabilities:
Get graphical window text

Disassembly:
call fcn.004783f0
test eax, eax
je 0x40ebaf
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
test edi, edi
je 0x40ec30
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x40ec30
lea ecx, [esi + esi]
xor eax, eax
mov edx, ecx
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.005d1478
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40ec30
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebp, eax
test ebp, ebp
je 0x40ec30
push esi
mov esi, dword [esp + 0x1c]
push esi
push 0xffffffffffffffff
push ebx
xor ebp, ebp
call fcn.004244c0
add esp, 0x10
test eax, eax
je 0x40ec30
push esi
call fcn.00441d20
add esp, 4
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x40ec90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
xor ecx, ecx
xor edi, edi
xor eax, eax
mov esi, 0x200
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x40ecba
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, 1
jne 0x40ecc6
mov esi, 0x400
jmp 0x40ed3a
cmp eax, 2
jne 0x40ed3a
xor eax, eax
lea edx, [esp + 0x38]
mov dword [esp + 0x1c], eax
push ecx
mov dword [esp + 0x24], eax
push edx
mov dword [esp + 0x2c], eax
push 0x18
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x38], eax
lea eax, [esp + 0x24]
push eax
push ecx
push ecx
push 0x70000
push ebp
mov dword [esp + 0x58], ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov eax, dword [0x66fd48]
je 0x40eda4
test eax, eax
je 0x40ed2e
push str.CDiskInfoHelper::ReadFileBySectorSize_2
push str.Asset
push 0xf
push 0x66fcdc
call fcn.004277c0
add esp, 0x10
mov esi, dword [esp + 0x2c]
cmp esi, 0x200
jb 0x40ed9a
push esi
call fcn.005d1478
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebx]
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test edi, edi
jne 0x40ed90
mov edx, dword [ebx]
push edx
call fcn.005d14a1
mov eax, dword [esp + 0x14]
add esp, 4
inc eax
mov dword [ebx], edi
cmp eax, 3
mov dword [esp + 0x10], eax
jl 0x40ecb4
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test eax, eax
je 0x40ed9a
push str.CDiskInfoHelper::ReadFileBySectorSize_1
push str.Asset
push 0xf
push 0x66fcdc
call fcn.004277c0
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x40eec0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x28
xor edx, edx
xor eax, eax
push ebx
mov ebx, dword [esp + 0x34]
cmp ebx, edx
je 0x40f06e
cmp dword [esp + 0x38], 0x200
jne 0x40f06e
push esi
push edi
mov ecx, 7
lea edi, [esp + 0x16]
mov word [esp + 0x14], dx
push 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x44], edx
rep stosd dword es:[edi], eax
mov eax, dword [0x6396c8]
mov ecx, dword [0x6396cc]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
add eax, 0x41
mov dword [esp + 0x14], ecx
mov word [esp + 0x10], ax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x40]
push ecx
push eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x48], edx
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x40f034
lea edx, [esp + 0x14]
push edx
call fcn.00441d20
lea esi, [ebx + 0x36]
push 5
push str.FAT16
push esi
mov edi, eax
call fcn.004491e0
add esp, 0x10
test eax, eax
jne 0x40ef94
cmp edi, 5
jne 0x40efcd
push edi
lea eax, [esp + 0x18]
push 0x6396b4
push eax
call fcn.005a2033
add esp, 0xc
test eax, eax
je 0x40efe9
push 5
push str.FAT12
push esi
call fcn.004491e0
add esp, 0xc
test eax, eax
jne 0x40eff5
cmp edi, 3
jne 0x40eff5
push edi
lea edx, [esp + 0x18]
push 0x6396a4
push edx
call fcn.005a2033
add esp, 0xc
test eax, eax
jne 0x40eff5
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x28
ret
cmp edi, 3
jne 0x40ef94
push edi
lea ecx, [esp + 0x18]
push 0x6396a4
push ecx
call fcn.005a2033
add esp, 0xc
test eax, eax
jne 0x40ef94
pop edi
pop esi
mov eax, 3
pop ebx
add esp, 0x28
ret
push 5
lea eax, [ebx + 0x52]
push str.FAT32
push eax
call fcn.004491e0
add esp, 0xc
test eax, eax
jne 0x40f034
cmp edi, 5
jne 0x40f034
push edi
lea ecx, [esp + 0x18]
push 0x639690
push ecx
call fcn.005a2033
add esp, 0xc
test eax, eax
jne 0x40f034
pop edi
pop esi
mov eax, 2
pop ebx
add esp, 0x28
ret
lea esi, [ebx + 3]
push 5
push str.EXFAT
push esi
call fcn.004491e0
add esp, 0xc
test eax, eax
jne 0x40f057
pop edi
pop esi
mov eax, 5
pop ebx
add esp, 0x28
ret
push 4
push str.NTFS
push esi
call fcn.004491e0
add esp, 0xc
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x40fd80
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5e08d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
test ebp, ebp
je 0x40fecd
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40fecd
push ebp
lea ecx, [esp + 0x10]
call fcn.005d0e15
push 3
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
call fcn.005d12d6
push 2
push 0x639a14
push ebp
mov esi, eax
call fcn.004424c4
add esp, 0xc
test eax, eax
jne 0x40fdfb
inc esi
lea ecx, [esp + 0xc]
push esi
push 0x5c
call fcn.005d12d6
mov esi, eax
cmp esi, 0xffffffff
je 0x40fe86
mov ebp, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [esp + 0x20]
push esi
push eax
lea ecx, [esp + 0x14]
call fcn.005ce1f9
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x18], 1
push ecx
call edi
cmp eax, 0xffffffff
jne 0x40fe60
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40feae
mov ecx, dword [esp + 0x20]
push ecx
call edi
mov edx, ebp
or edx, 0x10
cmp eax, edx
je 0x40fe64
mov eax, dword [esp + 0x20]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x40fe64
test al, 0x10
je 0x40feae
inc esi
lea ecx, [esp + 0xc]
push esi
push 0x5c
call fcn.005d12d6
lea ecx, [esp + 0x20]
mov esi, eax
mov byte [esp + 0x18], 0
call fcn.005d0da7
cmp esi, 0xffffffff
jne 0x40fe0e
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.005d0da7
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.005d0da7
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.005d0da7
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret