joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f610
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x40f634
mov eax, dword [0x4209f8]
test eax, eax
jg 0x40f634
call fcn.0040efd0
test eax, eax
jle 0x40f77c
push edi
push 0x68
call fcn.004028e0
mov edi, eax
add esp, 4
test edi, edi
je 0x40f77b
push esi
push 0x40ebe0
push 0x40f2c0
push edi
call fcn.004075d0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0xc]
mov dword [edi + 0x4c], edx
mov ecx, dword [eax + 0xc]
mov dx, word [ecx]
mov word [edi + 0x50], dx
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x10]
mov dword [edi + 0x54], edx
mov ecx, dword [eax + 0xc]
mov dx, word [ecx + 2]
add esp, 0xc
mov word [edi + 0x58], dx
mov byte [edi + 0x60], bl
mov ecx, dword [eax + 0x3c]
push 0x11
inc ecx
push 2
mov dword [eax + 0x3c], ecx
push 2
mov dword [edi + 0x64], eax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [edi + 0x20], eax
je 0x40f70e
push eax
mov byte [edi + 0x1c], 1
call fcn.00405650
mov eax, dword [0x41ff58]
add esp, 4
push 0
mov word [ebp - 0x10], 2
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_htonl]
push 0x10
lea ecx, [ebp - 0x10]
mov word [ebp - 0xe], ax
mov edx, dword [edi + 0x20]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jl 0x40f70e
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x64]
push eax
call fcn.0040ecd0
add esp, 4
test eax, eax
jl 0x40f70e
mov esi, edi
call fcn.0040ec20
test eax, eax
jl 0x40f70e
push edi
call fcn.004072c0
add esp, 4
test eax, eax
je 0x40f73d
mov eax, dword [edi + 0x20]
cmp eax, 0xffffffff
je 0x40f71d
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [edi + 0x64]
test eax, eax
je 0x40f72d
push eax
call fcn.00408c30
add esp, 4
push edi
call fcn.00402836
add esp, 4
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x21
mov esi, edi
call fcn.0040a690
push edi
lea esi, [edi + 0x30]
push 0x40f410
push esi
call fcn.004097f0
mov ecx, dword [0x420b5c]
mov eax, dword [0x420a04]
mov dword [edi + 0x40], ecx
mov edx, dword [0x420b58]
add edx, eax
push esi
mov dword [edi + 0x3c], edx
call fcn.00409810
add esp, 0x10
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f850
Capabilities:
Connect socket
Connect udp socket
Create raw socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
push 0x70
mov edi, eax
mov dword [ebp - 8], 1
call fcn.004028e0
mov esi, eax
add esp, 4
test esi, esi
je 0x40f9dc
push fcn.0040edf0
push 0x40f790
push esi
call fcn.004075d0
mov eax, dword [0x41f368]
add esp, 0xc
test eax, eax
mov dword [esi + 0x38], esi
jle 0x40f8c7
cmp dword [0x41f360], 0x41f35c
jne 0x40f8c7
mov edx, dword [0x420b58]
mov ecx, dword [0x420b5c]
add edx, eax
push 0x420a08
mov dword [0x420a18], ecx
mov dword [0x420a14], edx
call fcn.00409810
add esp, 4
mov ecx, dword [0x41f35c]
mov dword [esi + 0x30], ecx
mov cx, word [ebp + 0xc]
mov dword [esi + 0x34], 0x41f35c
mov edx, dword [0x41f35c]
lea eax, [esi + 0x30]
mov dword [edx + 4], eax
mov edx, dword [ebp + 0x10]
mov dword [0x41f35c], eax
mov eax, dword [ebp + 8]
push 0x22
mov dword [esi + 0x3c], eax
push edx
lea eax, [esi + 0x42]
push eax
mov word [esi + 0x40], cx
call fcn.00417a70
mov ecx, dword [0x420b58]
add esp, 0xc
push 0
push 3
push 2
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x68], edi
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x20], eax
je 0x40f9d3
push eax
mov byte [esi + 0x1c], 1
call fcn.00405650
add esp, 4
push 0
push 0
lea edx, [ebp - 4]
push edx
push 0x10
lea eax, [ebp - 0x28]
push eax
push 0x10
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x14], edi
mov edi, dword [sym.imp.WS2_32.dll_WSAIoctl]
mov word [ebp - 0x18], 2
mov word [ebp - 0x16], 0
mov edx, dword [esi + 0x20]
push 0xc8000014
push edx
call edi
cmp eax, 0xffffffff
je 0x40f9d3
cmp dword [ebp - 4], 0x10
jne 0x40f9d3
mov ecx, dword [esi + 0x20]
push 0x10
lea eax, [ebp - 0x28]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x40f9d3
mov ecx, dword [esi + 0x20]
mov edx, dword [ebp - 0x24]
push 0x10
lea eax, [ebp - 0x18]
push eax
push ecx
mov dword [esi + 0x64], edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x40f9d3
push eax
push eax
lea edx, [ebp - 4]
push edx
push eax
push eax
push 4
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 1
mov ecx, dword [esi + 0x20]
push 0x98000001
push ecx
call edi
push esi
call fcn.004072c0
add esp, 4
test eax, eax
je 0x40f9e4
push esi
call fcn.0040edf0
add esp, 4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x21
call fcn.0040a690
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4100d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov dword [ebp - 4], eax
cmp dword [esi + 0x24], 2
push edi
mov edi, dword [esi + 0xc]
mov dword [ebp - 8], edi
jge 0x4101bd
mov ecx, dword [esi + 0x2c]
add ecx, 0x88
push 0
push ecx
call fcn.00408be0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x410241
mov ecx, dword [ebx + 0x44]
mov edx, dword [ebx + 0x48]
mov eax, 0x80
add ecx, eax
add edx, eax
mov dword [ebx + 0x44], ecx
mov ecx, dword [ebx + 0x4c]
mov eax, edx
cmp eax, ecx
mov dword [ebx + 0x48], edx
jbe 0x410156
push str.SkBuff_Reserve_over
push 0xbc
push str.c:ob_bora_18463_bora_apps_vmnat_skbuff.h
push str.BUG__s:_d:__s_n
push 0x41f3d0
call fcn.00413a68
add esp, 0x14
mov byte [0], 0
mov edx, 8
mov eax, ebx
call fcn.00408c50
mov byte [eax], 0
mov byte [eax + 1], 0
mov dx, word [edi + 4]
mov word [eax + 4], dx
mov cx, word [edi + 6]
mov word [eax + 6], cx
mov edx, dword [esi + 0x2c]
mov eax, ebx
call fcn.00408c50
mov ecx, dword [esi + 0x2c]
mov esi, dword [esi + 0x44]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x420c88]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push eax
push edx
mov esi, ebx
call fcn.0040fb20
push ebx
call fcn.00408c30
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x420a24]
test eax, eax
je 0x410241
mov eax, dword [ebp - 4]
mov si, word [edi + 6]
mov di, word [edi + 4]
mov ebx, dword [eax + 0x10]
mov ecx, eax
mov edx, dword [ecx + 0xc]
call fcn.00410040
test eax, eax
je 0x410241
mov edx, dword [ebp - 4]
mov ecx, dword [0x420a24]
mov esi, dword [ebp + 8]
mov word [ebp - 0x18], 2
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x28]
mov word [ebp - 0x16], 0
cmp dword [ecx + 0x30], eax
je 0x410211
mov dword [ecx + 0x30], eax
mov ecx, dword [0x420a24]
mov eax, dword [ebp - 8]
push 0x10
lea edx, [ebp - 0x18]
push edx
mov edx, dword [esi + 0x48]
push 0
sub edx, eax
push edx
push eax
mov eax, dword [ecx + 0x20]
push eax
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jge 0x410241
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call fcn.0040fdb0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4106f0
Capabilities:
Create raw socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0x34
call fcn.004028e0
mov esi, eax
add esp, 4
test esi, esi
je 0x410793
push 0x405a80
push 0x4105d0
push esi
call fcn.004075d0
add esp, 0xc
push 1
push 3
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x20], eax
je 0x41077b
push eax
mov byte [esi + 0x1c], 1
mov dword [esi + 0x30], 0xffffffff
call fcn.00405650
mov eax, dword [0x41ff58]
add esp, 4
push 0x10
lea ecx, [ebp - 0x10]
mov word [ebp - 0x10], 2
mov dword [ebp - 0xc], eax
mov word [ebp - 0xe], 0
mov edx, dword [esi + 0x20]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x41077b
push esi
call fcn.004072c0
add esp, 4
test eax, eax
je 0x41079b
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
je 0x41078a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00402836
add esp, 4
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x21
call fcn.0040a690
mov dword [0x420a24], esi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410b30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [eax + 0x44]
mov eax, dword [eax + 0x20]
push 0x10
lea edx, [ebp - 0x10]
push edx
mov edx, dword [esi + 0x44]
push 0
mov dword [ebp - 0xc], ecx
mov ecx, dword [esi + 0x2c]
push ecx
push edx
push eax
mov word [ebp - 0x10], 2
mov word [ebp - 0xe], 0x2f
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x410b77
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call fcn.0040fdb0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x410d10
Capabilities:
Connect socket
Create raw socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x41f384]
cmp eax, 0x41f380
push ebx
mov bx, word [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
je 0x410d4c
jmp 0x410d30
mov ecx, dword [eax + 8]
cmp word [ecx + 0x40], bx
jne 0x410d42
cmp dword [ecx + 0x44], edi
je 0x410e5b
mov eax, dword [eax + 4]
cmp eax, 0x41f380
jne 0x410d30
push esi
push 0x50
call fcn.004028e0
mov esi, eax
add esp, 4
test esi, esi
je 0x410e52
push fcn.00410ce0
push 0x410bc0
push esi
call fcn.004075d0
mov eax, dword [ebp + 8]
mov cx, word [ebp + 0x14]
mov dword [esi + 0x3c], eax
mov dword [esi + 0x38], esi
mov word [esi + 0x40], bx
mov dword [esi + 0x44], edi
mov word [esi + 0x48], cx
mov edx, dword [0x41f380]
add esp, 0xc
lea eax, [esi + 0x30]
mov dword [eax], edx
mov dword [eax + 4], 0x41f380
mov ecx, dword [0x41f380]
push 0x2f
push 3
mov dword [ecx + 4], eax
push 2
mov dword [0x41f380], eax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x20], eax
je 0x410e49
push 4
lea edx, [ebp - 4]
push edx
mov eax, 1
mov byte [esi + 0x1c], al
push 2
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x20]
push 0
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x410e49
mov ecx, dword [esi + 0x20]
push ecx
call fcn.00405650
add esp, 4
push 0x10
lea edx, [ebp - 0x18]
mov word [ebp - 0x18], 2
mov dword [ebp - 0x14], edi
mov word [ebp - 0x16], 0
mov eax, dword [esi + 0x20]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x410e49
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
mov dword [ebp - 8], 0x10
mov eax, dword [esi + 0x20]
push edx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x410e49
mov ecx, dword [ebp - 0x24]
push esi
mov dword [esi + 0x4c], ecx
call fcn.004072c0
add esp, 4
test eax, eax
je 0x410e63
push esi
call fcn.00410ce0
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x21
call fcn.0040a690
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415c05
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x421f08]
mov eax, dword [0x41f180]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x415dcb
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x421f20]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x415dcb
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x415c6f
xor eax, eax
jmp 0x415ddf
test al, 0x20
je 0x415c80
push 2
push edi
push edi
push ecx
call fcn.00416c2b
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x415d55
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x415d9c
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x415ce2
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x415cd3
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x415cb5
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x415d22
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x415d2e
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x415ca9
jmp 0x415d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x415dc6
cmp dword [ebp + 0x3a4], edi
je 0x415d9c
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x415d8e
mov dword [0x41fc10], eax
jmp 0x415dd2
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x415d80
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x415d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x415d30
push dword [ebp + 0x3a4]
call fcn.00415e4c
pop ecx
jmp 0x415ddc
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x415db4
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x415c68
mov dword [0x41fc0c], 0x1c
mov dword [0x41fc10], edi
jmp 0x415ddc
sub eax, dword [ebp - 0x7c]
jmp 0x415ddf
and dword [0x41fc10], 0
mov dword [0x41fc0c], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.004023fc
add ebp, 0x39c
leave
ret
Function at 0x4169f9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x421f08]
push edi
jae 0x416bce
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x421f20]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x416bce
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x416aa4
test dl, 2
jne 0x416aa4
test dl, 0x48
je 0x416a6e
cmp byte [eax + 5], 0xa
je 0x416a6e
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416ab7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x416a9f
mov dword [0x41fc10], ecx
jmp 0x416bd5
cmp eax, 0x6d
jne 0x416aab
xor eax, eax
jmp 0x416be2
push eax
call fcn.00415e4c
pop ecx
jmp 0x416bdf
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x416bc9
test eax, eax
je 0x416ade
cmp byte [ebx], 0xa
jne 0x416ade
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x416ae7
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x416bc3
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x416bb3
cmp al, 0xd
je 0x416b19
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x416ba5
dec ecx
cmp dword [ebp - 8], ecx
jae 0x416b33
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x416b2e
add dword [ebp - 8], 2
jmp 0x416b87
mov dword [ebp - 8], eax
jmp 0x416ba1
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416b5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x416ba1
cmp dword [ebp - 0x10], 0
je 0x416ba1
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x416b7c
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x416b87
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x416ba4
cmp ebx, dword [ebp + 0xc]
jne 0x416b8c
cmp byte [ebp - 1], 0xa
jne 0x416b8c
mov byte [ebx], 0xa
jmp 0x416ba4
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00415941
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x416ba5
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x416afd
jmp 0x416bc3
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x416bc3
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x416be2
and dword [0x41fc10], 0
mov dword [0x41fc0c], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416cca
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00401f10
mov eax, dword [0x41f180]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x421f08]
mov dword [ebp - 4], eax
jae 0x416e0d
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x421f20]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x416e0d
push 1
push esi
push ebx
call fcn.00415941
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x416e17
push 2
push esi
push ebx
call fcn.00415941
add esp, 0xc
cmp eax, 0xffffffff
je 0x416e17
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x416db7
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00404690
push 0x8000
push ebx
call fcn.004176f3
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x416d76
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.00415c05
add esp, 0xc
cmp eax, 0xffffffff
je 0x416d94
sub edi, eax
test edi, edi
jg 0x416d6b
jmp 0x416daa
cmp dword [0x41fc10], 5
jne 0x416da7
mov dword [0x41fc0c], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.004176f3
pop ecx
pop ecx
jmp 0x416df7
jge 0x416df7
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00415941
push ebx
call fcn.00416039
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x416df7
mov dword [0x41fc0c], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x41fc10], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.00415941
add esp, 0xc
mov eax, esi
pop edi
jmp 0x416e1a
mov dword [0x41fc0c], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.004023fc
leave
ret
Function at 0x41805f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41807f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00415e4c
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4180a0
test byte [esp + 8], 2
je 0x4180a0
mov dword [0x41fc0c], 0xd
mov dword [0x41fc10], 5
jmp 0x41807b
xor eax, eax
ret

Function at 0x41857e
Capabilities:
Get common file path

Disassembly:
push 0x120
push 0x41d520
call fcn.00401db0
mov eax, dword [0x41f180]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
and dword [ebp - 0x128], 0
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x12c], esi
cmp esi, 0x104
jle 0x418622
and dword [ebp - 4], 0
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.00401f10
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x130], edi
jmp 0x41860f
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x418622
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x41863d
cmp byte [edi + 1], 0x3a
jne 0x41863d
movzx eax, byte [edi]
push eax
call fcn.00418e32
pop ecx
mov ebx, eax
sub ebx, 0x40
cmp dword [ebp - 0x128], 0
je 0x41864d
push edi
call fcn.00402836
pop ecx
mov eax, ebx
lea esp, [ebp - 0x13c]
mov ecx, dword [ebp - 0x1c]
call fcn.004023fc
call fcn.00401deb
ret

Function at 0x418d01
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x418d2f
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x418d34
cmp eax, 1
je 0x418d34
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x418d38
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x41f180]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x418dae
push ebx
call fcn.00418d01
test eax, eax
pop ecx
jne 0x418d7d
mov dword [0x41fc10], 0xf
mov dword [0x41fc0c], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.004023fc
leave
ret
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x418dc0
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x418d70
inc eax
cmp eax, 0x104
ja 0x418d70
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x418df7
cmp eax, dword [ebp + 0x10]
jg 0x418ddb
mov eax, dword [ebp + 0x10]
push eax
call fcn.004028e0
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x418e0b
mov dword [0x41fc0c], 0xc
jmp 0x418d70
cmp eax, dword [ebp + 0x10]
jle 0x418e0b
mov dword [0x41fc0c], 0x22
jmp 0x418d70
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.00402110
pop ecx
pop ecx
jmp 0x418d72