joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411fb0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x54
mov eax, dword [0x467fd4]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
mov ebx, dword [esp + 0x6c]
mov eax, ebx
push ebp
mov ebp, dword [esp + 0x60]
and eax, 0x7fffeff
push esi
push edi
or eax, 0xe0000000
mov edi, ecx
mov esi, dword [edi + 8]
lea ecx, [edi + 8]
push eax
mov eax, dword [esp + 0x70]
mov edx, eax
push dword [esp + 0x78]
or edx, 0x80000000
mov byte [edi + 0x20], 1
push dword [esp + 0x78]
test eax, eax
cmovs edx, eax
mov eax, dword [esi + 0x30]
or edx, 0x40000000
push edx
push ebp
call eax
shr ebx, 0x1c
lea esi, [edi + 0x18]
not bl
mov byte [esp + 0x13], al
and bl, 1
movzx ecx, bl
push ecx
push dword [esp + 0x80]
push dword [edi + 0xc]
push esi
call fcn.00420310
mov ecx, eax
call fcn.0041ffc0
mov bl, byte [esp + 0x13]
test bl, bl
je 0x412074
push 0x34
lea eax, [esp + 0x28]
push 0
push eax
call fcn.00424960
add esp, 0xc
lea eax, [esp + 0x24]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x412074
mov ecx, dword [esi]
push 0
push 0
push dword [esp + 0x4c]
add ecx, 0x18
push dword [esp + 0x54]
call fcn.004205d0
push 2
push ebp
lea eax, [esp + 0x60]
push 3
push eax
call fcn.0040bc50
xor eax, eax
add esp, 0x10
mov word [esp + 0x5c], ax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x4120b7
mov eax, dword [esp + 0x14]
mov dword [edi + 0x1c], eax
mov ecx, dword [esp + 0x60]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00422c85
add esp, 0x54
ret 0x18
Function at 0x4128e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44315b
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x467fd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
cmp ecx, 3
je 0x412934
push dword [ebp + 0x18]
mov eax, dword [edi]
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
push esi
call eax
jmp 0x412a0f
test esi, esi
je 0x412a0d
cmp word [esi], 0
je 0x412a0d
push 0
push 0x108
push 2
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x26c]
call fcn.004031c0
mov eax, dword [ebp - 0x25c]
xor ecx, ecx
mov word [eax], cx
push 0x466210
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x26c]
push esi
call fcn.00408c90
test al, al
je 0x4129fb
push 0x38
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00424960
add esp, 0xc
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4129bf
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x25c]
call fcn.00433240
add esp, 8
test eax, eax
je 0x4129bf
xor bl, bl
jmp 0x4129c1
mov bl, 1
lea ecx, [ebp - 0x26c]
mov dword [ebp - 4], 1
call fcn.00403250
mov dword [ebp - 4], 0xffffffff
test bl, bl
je 0x412a0d
push dword [ebp + 0x18]
mov eax, dword [edi]
mov ecx, edi
push 4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
push esi
call eax
test al, al
je 0x412a0d
mov al, 1
jmp 0x412a0f
lea ecx, [ebp - 0x26c]
mov dword [ebp - 4], 2
call fcn.00403250
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422c85
mov esp, ebp
pop ebp
ret 0x14
Function at 0x412f60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443238
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x467fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x2f4]
test ecx, ecx
je 0x41305e
mov ecx, dword [ecx + 0x374]
or eax, 0xffffffff
test ecx, ecx
je 0x412fc3
mov ecx, dword [ecx + 0x29c]
test ecx, ecx
je 0x412fc3
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x412fc3
or eax, 0xffffffff
or ecx, 0xffffffff
mov dword [ebp - 0x14], vtable.HandleClass.0
test eax, eax
cmovne ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
cmp ecx, 0xffffffff
je 0x412fea
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [esi + 0x2f4]
mov eax, dword [edi + 0x1cc]
lea ecx, [edi + 0x1cc]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x413018
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x7c]
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
call dword [eax + 0x88]
mov ecx, dword [esi + 0x2f4]
test ecx, ecx
je 0x413028
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x2f4], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], vtable.HandleClass.0
call fcn.00414e50
test al, al
je 0x41305e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
call dword [eax + 0x1c]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4138a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443298
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x467fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test bl, 2
je 0x4138f6
push edi
push esi
call fcn.00417af0
add esp, 8
test al, al
jne 0x4138f6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test bl, 4
je 0x4139b8
test esi, esi
je 0x4139a4
cmp word [esi], 0
je 0x4139a4
lea ecx, [ebp - 0x1c]
call fcn.0040ca30
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
and bl, 1
mov ecx, 0x469a88
movzx eax, bl
push eax
push esi
call fcn.004067d0
sub eax, 1
je 0x413960
sub eax, 1
je 0x41398c
push edi
push esi
call fcn.00416640
add esp, 8
test al, al
je 0x41397e
mov eax, dword [0x469b9c]
test eax, eax
je 0x413960
push 0
push esi
push 5
push 4
call eax
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.0040ca90
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
sete bl
jmp 0x413962
mov esi, dword [edi]
lea ecx, [ebp - 0x14]
push 0
call fcn.0040d1e0
push eax
mov eax, dword [esi + 4]
mov ecx, edi
call eax
mov bl, al
jmp 0x413962
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push esi
call fcn.00416640
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413af7
Capabilities:
Create process on windows

Disassembly:
cmp dword [0x469ae0], 0
push esi
mov esi, ecx
je 0x413bf3
mov eax, dword [esi + 0x14]
shr eax, 0x19
test al, 1
je 0x413b2b
mov eax, dword [esi + 0x37c]
test eax, eax
je 0x413bf3
push eax
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
jne 0x413bbe
mov al, 1
pop esi
ret
mov eax, dword [esi + 0x374]
test eax, eax
je 0x413bf3
or dword [eax + 0x268], 3
mov ecx, dword [esi + 0x374]
push ebx
lea eax, [ecx + 0x294]
push eax
lea eax, [ecx + 0x2b0]
push eax
push dword [ecx + 0x260]
push 0
push dword [ecx + 0x268]
push 1
push 0
push 0
push dword [ecx + 0x4c]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
cmp byte [0x4eb528], 0
je 0x413bad
cmp byte [0x4eb570], 0
je 0x413bad
mov eax, dword [esi + 0x374]
push dword [eax + 0x294]
push str.CreateProcess:_Info.hProcess__p
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x14
push dword [esi + 0x368]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test bl, bl
pop ebx
je 0x413bf3
movzx eax, byte [esi + 0x380]
push eax
call dword [0x469ae0]
mov ecx, esi
call fcn.00413240
mov ecx, dword [esi + 0x37c]
test ecx, ecx
je 0x413bf3
mov eax, dword [0x469adc]
test eax, eax
je 0x413be9
push ecx
call eax
mov dword [esi + 0x37c], 0
mov al, 1
pop esi
ret
Function at 0x413c00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4432cb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x467fd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x413cb2
cmp word [esi], 0
je 0x413cb2
push 0
push 0x108
push 2
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x234]
call fcn.004031c0
mov eax, dword [ebp - 0x224]
xor ecx, ecx
mov word [eax], cx
push 0x466210
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x234]
push esi
call fcn.00408c90
test al, al
je 0x413ca0
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 1
call fcn.00403250
mov al, bl
jmp 0x413cb4
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 2
call fcn.00403250
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422c85
mov esp, ebp
pop ebp
ret

Function at 0x414d90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4432cb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x467fd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x220]
push 0
push 0x108
push 2
push eax
lea ecx, [ebp - 0x234]
call fcn.004031c0
mov eax, dword [ebp - 0x224]
xor ecx, ecx
mov word [eax], cx
push 0x466210
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x234]
push esi
call fcn.00408c90
test al, al
je 0x414e17
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x414e17
test al, 1
je 0x414e17
mov bl, 1
jmp 0x414e19
xor bl, bl
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 2
call fcn.00403250
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422c85
mov esp, ebp
pop ebp
ret
Function at 0x415a40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
push esi
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
push 0
push dword [esp + 0x34]
movlpd qword [esp + 0x14], xmm0
push dword [esp + 0x34]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
sete bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x415ab9
cmp eax, 0x3e5
jne 0x415ab9
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
test bl, bl
jne 0x415acb
pop esi
xor al, al
pop ebx
add esp, 0x14
ret 0x14
test bl, bl
jne 0x415aaf
test eax, eax
jne 0x415aaf
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov eax, dword [esp + 8]
test eax, eax
je 0x415ade
cmp eax, 0x103
je 0x415ade
test ecx, ecx
je 0x415aaf
pop esi
mov al, 1
pop ebx
add esp, 0x14
ret 0x14

Function at 0x416380
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443680
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x467fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x284]
lea ecx, [esi + 0x284]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x416492
push 0
push dword [esi + 0x288]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x416492
mov dword [ebp - 0x18], 0x44789c
mov dword [ebp - 0x14], 0
push 1
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00403190
push 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00403270
test al, al
je 0x416469
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push dword [esi + 0x288]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416431
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
inc eax
push eax
call fcn.0040cee0
test eax, eax
je 0x416469
mov ecx, dword [ebp - 0x10]
push ecx
push dword [ebp - 0x1c]
inc ecx
push ecx
push eax
call fcn.0040beb0
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.0040d1e0
push eax
lea ecx, [esi + 0x34]
call fcn.0040cb10
mov bl, al
jmp 0x41646b
xor bl, bl
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00403250
lea ecx, [ebp - 0x18]
call fcn.0040ca60
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416640
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4436ab
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x467fd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x416728
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 3
je 0x4166a0
sub eax, 2
je 0x416711
sub eax, 0xc9
jne 0x416745
push 0
push 0x108
push 2
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x234]
call fcn.004031c0
mov eax, dword [ebp - 0x224]
xor ecx, ecx
mov word [eax], cx
push ebx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x234]
push esi
call fcn.00408c90
test al, al
je 0x41672c
push 0x80
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x41672c
push dword [ebp - 0x224]
call edi
test eax, eax
je 0x41672c
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 1
call fcn.00403250
mov al, 1
jmp 0x41674d
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x416745
push esi
call edi
test eax, eax
je 0x416745
mov al, 1
jmp 0x41674d
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 2
call fcn.00403250
mov dword [ebp - 4], 0xffffffff
push esi
mov ecx, ebx
call fcn.004056b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422c85
mov esp, ebp
pop ebp
ret

Function at 0x417270
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1cc]
lea ecx, [esi + 0x1cc]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x417296
push 0
push dword [esi + 0x1d0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret
Function at 0x4172a0
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x430]
sub esp, 0x430
push 0xffffffffffffffff
push 0x443778
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x467fd4]
xor eax, ebp
mov dword [ebp + 0x42c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test byte [esi + 0x17], 1
je 0x417417
cmp dword [0x469eb4], 0
je 0x417417
cmp dword [0x469ebc], 0
je 0x417417
push 0
push 0x108
push 2
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp]
call fcn.004031c0
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
push 0x208
push ecx
lea eax, [ebp + 0x224]
mov dword [ebp - 4], ecx
push eax
call fcn.00424960
add esp, 0xc
lea ecx, [ebp]
push 0
call fcn.004083a0
push 0x44b7fc
lea ecx, [ebp]
call fcn.004088e0
lea ecx, [ebp]
call fcn.004080b0
push 0
lea eax, [ebp + 0x224]
push 0
push eax
call fcn.00404590
add esp, 4
lea ecx, [ebp]
push eax
call fcn.00407c00
push 1
push 0x44be68
lea ecx, [ebp]
call fcn.00408800
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0x10]
mov edi, 0x104
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
test ebx, ebx
je 0x417408
cmp dword [0x469ebc], 2
mov eax, 0x106
push 0
push 0
push 0
cmove edi, eax
push edi
push ebx
push dword [esi + 0x37c]
push dword [esi + 0x360]
call dword [0x469eb4]
test eax, eax
jne 0x417401
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x417401
cmp byte [0x4eb528], 0
je 0x417401
cmp byte [0x4eb570], 0
je 0x417401
push str.Debugger:_MiniDump_Failed_to_write._n
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp]
mov dword [ebp - 4], 1
call fcn.00403250
push 1
push dword [esi + 0x360]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 0x360], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x42c]
xor ecx, ebp
call fcn.00422c85
lea esp, [ebp + 0x430]
pop ebp
ret
Function at 0x417af0
Capabilities:
Get disk size
Get file size
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x228]
sub esp, 0x228
push 0xffffffffffffffff
push 0x443838
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x467fd4]
xor eax, ebp
mov dword [ebp + 0x224], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x230]
mov eax, dword [ebp + 0x234]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x44af58
push 0
push 0x108
push 2
lea eax, [ebp + 0x14]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp]
call fcn.004031c0
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.00408b80
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x417c79
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x14]
imul edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
push 0
push 3
push 3
mov eax, dword [eax + 0x30]
push 0xc0000000
push ebx
mov dword [ebp - 0x18], edi
call eax
test al, al
je 0x417c79
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, 0xffffffff
jne 0x417bf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x417bf1
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
lea ecx, [ebp - 0x44]
push 1
call fcn.00403190
push 1
push edi
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00403270
test al, al
je 0x417c66
mov eax, esi
or eax, ebx
je 0x417c4d
nop word [eax + eax]
test ebx, ebx
jl 0x417c2a
jg 0x417c2c
cmp esi, edi
ja 0x417c2c
mov edi, esi
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0x34]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, edi
mov edi, dword [ebp - 0x18]
mov eax, esi
sbb ebx, 0
or eax, ebx
jne 0x417c20
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 3
call fcn.00403250
mov bl, 1
jmp 0x417c84
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 5
call fcn.00403250
mov ebx, dword [ebp - 0x30]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
push ebx
call fcn.004056b0
mov bl, al
lea ecx, [ebp]
mov byte [ebp - 4], 6
call fcn.00403250
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 7
mov dword [ebp - 0x14], vtable.HandleClass.0
call fcn.00414e50
test al, al
je 0x417cbc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
call dword [eax + 0x1c]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.00422c85
lea esp, [ebp + 0x228]
pop ebp
ret
Function at 0x417f30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
push esi
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
push 0
push dword [esp + 0x34]
movlpd qword [esp + 0x14], xmm0
push dword [esp + 0x34]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
sete bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x417fa9
cmp eax, 0x3e5
jne 0x417fa9
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
test bl, bl
jne 0x417fbb
pop esi
xor al, al
pop ebx
add esp, 0x14
ret 0x14
test bl, bl
jne 0x417f9f
test eax, eax
jne 0x417f9f
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
cmp dword [esp + 8], 0
je 0x417fc6
test ecx, ecx
je 0x417f9f
pop esi
mov al, 1
pop ebx
add esp, 0x14
ret 0x14

Function at 0x418f70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443980
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x467fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x80050]
push 0
push esi
call fcn.00414c00
add esp, 8
test eax, eax
je 0x418fdc
cmp dword [edi + 0x80010], 0
je 0x418fd1
push 0
push esi
call fcn.00414c00
push eax
push 0x44c728
push 0
push 0xffffffffffffffff
push edi
call fcn.00419800
add esp, 0x1c
jmp 0x418fdc
push str.Messages_missed__likely_during_startup._r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [edi + 0x8003c]
call fcn.0040ca60
lea ecx, [edi + 0x80020]
call fcn.00406d70
lea ecx, [edi + 0x8000c]
mov dword [ebp - 4], 0
call fcn.00419070
lea ecx, [edi + 0x8000c]
mov byte [ebp - 4], 1
call fcn.00403250
mov ecx, edi
call fcn.004036f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret