joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407b73
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xfc
push ebx
push ebp
mov ebp, dword [esp + 0x108]
push esi
xor esi, esi
push edi
mov ebx, ecx
mov edi, eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
mov eax, ebx
mov edx, ebp
mov ecx, dword [eax]
add dword [esp + ecx*4 + 0x4c], 1
lea ecx, [esp + ecx*4 + 0x4c]
add eax, 4
sub edx, 1
jne 0x407bd7
cmp dword [esp + 0x4c], ebp
jne 0x407c08
mov eax, dword [esp + 0x120]
mov dword [eax], esi
mov dword [edi], esi
mov ebp, dword [edi]
mov dword [esp + 0x10], ebp
mov ecx, 1
cmp dword [esp + ecx*4 + 0x4c], esi
jne 0x407c21
add ecx, 1
cmp ecx, 0xf
jbe 0x407c13
cmp ebp, ecx
mov eax, ecx
mov dword [esp + 0x1c], eax
jae 0x407c31
mov dword [esp + 0x10], ecx
mov ebp, ecx
mov edx, 0xf
cmp dword [esp + edx*4 + 0x4c], esi
jne 0x407c41
sub edx, 1
jne 0x407c36
cmp ebp, edx
mov dword [esp + 0x2c], edx
jbe 0x407c4f
mov dword [esp + 0x10], edx
mov ebp, edx
mov dword [edi], ebp
mov edi, 1
shl edi, cl
cmp ecx, edx
jae 0x407c76
lea esp, [esp]
sub edi, dword [esp + ecx*4 + 0x4c]
js 0x407d8f
add ecx, 1
add edi, edi
cmp ecx, edx
jb 0x407c63
lea ecx, [edx*4]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + ecx + 0x4c]
sub edi, ecx
mov dword [esp + 0x48], edi
js 0x407d8f
add ecx, edi
mov edi, dword [esp + 0x14]
mov dword [esp + edi + 0x4c], ecx
xor ecx, ecx
sub edx, 1
mov dword [esp + 0x90], esi
je 0x407cc6
xor edi, edi
jmp 0x407cb3
add ecx, dword [esp + edi + 0x50]
add edi, 4
sub edx, 1
mov dword [esp + edi + 0x90], ecx
jne 0x407cb3
mov edx, ebx
xor edi, edi
mov ecx, dword [edx]
add edx, 4
cmp ecx, esi
mov dword [esp + 0x20], edx
je 0x407cf8
mov edx, dword [esp + ecx*4 + 0x8c]
mov ebx, dword [esp + 0x12c]
lea ecx, [esp + ecx*4 + 0x8c]
mov dword [ebx + edx*4], edi
add edx, 1
mov dword [ecx], edx
mov edx, dword [esp + 0x20]
add edi, 1
cmp edi, dword [esp + 0x110]
jb 0x407cca
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + edx + 0x8c]
mov edx, dword [esp + 0x12c]
mov ebx, ebp
or edi, 0xffffffff
neg ebx
cmp eax, dword [esp + 0x2c]
mov dword [esp + 0x110], ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x8c], esi
mov dword [esp + 0x20], edx
mov dword [esp + 0xd0], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x18], esi
jg 0x407fe1
mov esi, dword [esp + 0x34]
lea ecx, [eax - 1]
lea edx, [esp + eax*4 + 0x4c]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], edx
lea esp, [esp]
Function at 0x404de0
Capabilities:
Get file system object information

Disassembly:
push edi
sub esp, 0x2e8
call fcn.00418e50
mov eax, dword [esp + 0x2f0]
mov dword [esp + 4], eax
lea eax, [esp + 0x2f0]
mov dword [esp], eax
call fcn.00418eb0
sub esp, 8
lea edi, [esp + 0x2c]
mov ecx, 0xad
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0x110
mov dword [esp + 0xc], 0x2b4
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2f0]
mov dword [esp], eax
call sub.SHELL32.dll_SHGetFileInfoW
sub esp, 0x14
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x2f0]
mov dword [esp], eax
call fcn.00418f00
sub esp, 4
mov eax, edi
add esp, 0x2e8
pop edi
ret 4
Function at 0x404f90
Capabilities:
Get file system object information

Disassembly:
push edi
push esi
push ebx
sub esp, 0x2f0
call fcn.00418e50
mov eax, dword [esp + 0x300]
mov dword [esp + 4], eax
lea eax, [esp + 0x300]
mov dword [esp], eax
call fcn.00418eb0
sub esp, 8
mov dword [esp + 0x2c], 0
lea ebx, [esp + 0x3c]
mov ecx, 0xad
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x300]
mov dword [esp], eax
call fcn.00411a1f
sub esp, 4
test edx, edx
js 0x405080
mov dword [esp + 0x10], 0x4000
mov dword [esp + 0xc], 0x2b4
mov dword [esp + 8], ebx
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x300]
mov dword [esp], eax
call sub.SHELL32.dll_SHGetFileInfoW
sub esp, 0x14
mov dword [esp + 4], str.shell32.dll
mov dword [esp], 0xffffffff
call fcn.0040c044
push edx
push edx
mov ebx, eax
test eax, eax
jne 0x4050a2
mov eax, dword [esp + 0x30]
mov edx, dword [eax]
mov edx, dword [edx + 0x28]
mov ecx, dword [esp + 0x40]
lea ebx, [esp + 0x34]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [esp], eax
call edx
sub esp, 0x10
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x4050df
lea esi, [esi]
xor ebx, ebx
mov eax, dword [esp + 0x300]
mov dword [esp], eax
call fcn.00418f00
sub esp, 4
mov eax, ebx
add esp, 0x2f0
pop ebx
pop esi
pop edi
ret 0xc
lea eax, [esp + 0x30]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4cfca0
xor edi, edi
mov dword [esp + 8], edi
mov dword [esp + 4], str.SHGetImageList
mov dword [esp], ebx
call fcn.0040c09e
sub esp, 0x14
mov edi, eax
mov dword [esp], ebx
call fcn.0040c0c3
push eax
test edi, edi
jne 0x405080
jmp 0x40504c
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0x20
mov dword [esp], 0xffffffff
call fcn.00413775
sub esp, 0x14
mov ebx, eax
test eax, eax
je 0x405080
mov dword [esp], eax
call fcn.0041391d
push ecx
mov dword [esp], eax
call fcn.004135f6
push esi
test eax, eax
je 0x405082
mov eax, dword [esp + 0x30]
mov edx, dword [eax]
mov edx, dword [edx + 0x40]
lea ecx, [esp + 0x2c]
mov dword [esp + 8], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 4], ecx
mov dword [esp], eax
call edx
sub esp, 0xc
mov eax, dword [esp + 0x38]
cmp eax, 0x20
jg 0x405165
mov eax, dword [esp + 0x2c]
cmp eax, 0x20
jle 0x4051a5
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0xc], 0x20
xor edx, edx
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041365b
sub esp, 0x14
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sub.USER32.dll_DestroyIcon
push eax
call fcn.004136c5
jmp 0x405082
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x34]
mov esi, 2
cdq
idiv esi
neg eax
add eax, 0x10
mov dword [esp + 8], eax
mov eax, ecx
cdq
idiv esi
neg eax
add eax, 0x10
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0041370d
sub esp, 0xc
jmp 0x40518e
Function at 0x4086c8
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x408760
push edi
push 0x4d22ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4d1b40]
test edi, edi
je 0x408734
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40872d
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x4d1b40
call fcn.00418a0f
pop ecx
pop ecx
jmp 0x40872f
mov edi, dword [edi]
test edi, edi
jne 0x408704
pop ebx
mov eax, dword [0x4cfce4]
mov esi, eax
inc eax
push 0x10
push 0x4d1b40
mov dword [0x4cfce4], eax
call fcn.00418a4f
pop ecx
pop ecx
push 0x4d22ec
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x40af01
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x40af56
push dword [esp + 0x10]
push 0x40ae80
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x4d1b44]
test esi, esi
je 0x40afaf
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x40af4e
cmp byte [esi + 0x10], 0
je 0x40af4e
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x40af2a
jmp 0x40afaf
mov esi, dword [0x4d1b44]
test esi, esi
je 0x40afaf
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x40afa8
cmp byte [esi + 0x11], 0
je 0x40af84
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x40af9b
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x4d1b44
call fcn.00418a0f
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x40af63
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x40c1df
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push ebp
push edi
xor edi, edi
mov ebp, edi
test eax, eax
je 0x40c27a
cmp word [eax], di
je 0x40c27a
push esi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c275
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push edi
push dword [0x4d1afc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40c26d
push ebp
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x18], ebx
jne 0x40c25e
push dword [esp + 0x1c]
push ebx
push edi
push dword [esp + 0x20]
call fcn.0040c9b5
mov ebp, eax
push edi
push 0
push dword [0x4d1afc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, ebp
pop esi
jmp 0x40c27c
xor eax, eax
pop edi
pop ebp
ret 0xc

Function at 0x40e6a2
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x4d2350]
call fcn.004182e0
mov ebx, eax
test ebx, ebx
je 0x40e706
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x40e6cb
push dword [esp + 0xc]
push ebx
call eax
jmp 0x40e706
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.004193a0
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.00419480
pop edi
pop esi
pop ebx
ret 8
Function at 0x4104cd
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x410643
mov eax, dword [esp + 0x24]
dec eax
je 0x410626
dec eax
jne 0x410643
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.00410486
pop ecx
test eax, eax
je 0x410584
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x410547
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x410622
dec ebx
je 0x41061e
dec ebx
je 0x4105fd
dec ebx
je 0x4105b7
sub ebx, 4
jne 0x410643
test edi, edi
jne 0x410643
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x410643
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x410547
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x410542
sub edi, 0
je 0x4105ef
dec edi
je 0x4105e1
dec edi
je 0x4105d3
dec edi
jne 0x410643
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x410643
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x410643
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x410643
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x410643
sub edi, 0
je 0x41061a
dec edi
je 0x410616
dec edi
jne 0x410643
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x410643
push 0x3c
jmp 0x410642
push 0x32
jmp 0x410642
push 0x14
jmp 0x410642
push 5
jmp 0x410642
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x410640
cmp eax, 0xa
je 0x41063c
cmp eax, 0x5a
jne 0x410643
push 0x28
jmp 0x410642
push 0x1e
jmp 0x410642
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x410b4e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x4d2380]
call fcn.004182e0
mov esi, eax
test esi, esi
je 0x410c28
cmp dword [ebp + 0xc], 0
je 0x410b9a
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x410b8b
cmp dword [esi + 0x1c], 0
jne 0x410b8b
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x410c28
test byte [ebp + 0x10], 3
je 0x410bb5
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.00411598
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x410bda
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x410bee
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x410c0b
test ebx, ebx
je 0x410bff
push 8
jmp 0x410c11
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x410c1e
test ebx, ebx
je 0x410c14
push 3
pop ecx
jmp 0x410c1e
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x41172b
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x4117c3
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4117c0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x4117c0
lea eax, [esi - 1]
push eax
push dword [0x4d2380]
call fcn.004182e0
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x4117c2
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x4117b7
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x4118aa
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x41179d
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x411869
push eax
call esi
test al, al
jns 0x411869
push 0x11
call esi
test al, al
js 0x411869
push 0x10
call esi
test al, al
js 0x411869
push 0x12
call esi
test al, al
js 0x411869
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x411869
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x41183d
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x411854
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x4118b4
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x4118b4
test ebp, ebp
je 0x41188d
push 0x11
call esi
test al, al
js 0x411885
push 0x10
call esi
test al, al
js 0x411885
push 0x12
call esi
test al, al
jns 0x41188d
push 1
push ebp
call fcn.004118c0
test ebx, ebx
je 0x4118a1
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x4118b4
test edi, edi
je 0x4118b4
mov eax, dword [edi + 8]
jmp 0x4118b6
and dword [esp + 0x14], 0
jmp 0x4117c2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x411a1f
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x411b67
xor ecx, ecx
cmp word [eax], cx
je 0x411b67
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x411a78
cmp eax, 3
jne 0x411ab2
cmp word [esp + 0xa], 0x3a
jne 0x411ab2
cmp eax, 2
jne 0x411a96
lea eax, [esp + 8]
push 0x4a0404
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x411b67
push 0xfffffffffffffffe
pop edi
jmp 0x411b67
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x411ac7
cmp ax, bx
jne 0x411ad1
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x411aba
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x411b10
test byte [esp + 0x21c], 0x10
je 0x411af7
push 0xfffffffffffffffe
pop edi
jmp 0x411b07
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x411b65
cmp word [esp + 0x10], bp
jne 0x411b1e
cmp word [esp + 0x12], bp
je 0x411b3d
cmp word [esp + 0x10], bx
jne 0x411b2c
cmp word [esp + 0x12], bx
je 0x411b3d
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x411b65
cmp word [esp + 0x12], ax
jne 0x411b65
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x411b52
test al, 0x10
je 0x411b65
jmp 0x411b62
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x411b65
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x411b76
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x411b9f
test byte [esp + 8], 2
je 0x411b93
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x411ba1
xor eax, eax
ret 8

Function at 0x412160
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x41219c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x4121e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x412245
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x41223d
push dword [esp + 0x10]
push dword [0x4d2394]
call fcn.004182e0
test eax, eax
je 0x412233
cmp dword [eax + 4], 0
je 0x412222
push edi
push esi
push eax
call fcn.004123b0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc

Function at 0x4123b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x4124b7
cmp dword [esi + 0x14], 1
jne 0x4123fb
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x412478
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x412463
dec eax
je 0x41244c
sub eax, 2
je 0x412437
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00412160
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x4124a5
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x412421
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x4124c0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x4124e1
push esi
call fcn.00412160
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x412555
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x412542
dec ecx
je 0x41252d
sub ecx, 2
je 0x41251a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x41259a
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x4125bb
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc