joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aa2e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40aa34
lea eax, [esp]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
lea ebp, [esp]
cmp word [ebp], 0
je 0x40aa5b
mov eax, 1
jmp 0x40aa5d
xor eax, eax
add esp, 0x24
pop ebp
ret

Function at 0x40b2ad
Capabilities:
Copy file

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
mov edx, dword [esp + 0x20]
lea ecx, [esp]
call fcn.0040d060
mov edx, dword [esp + 0x24]
lea ecx, [esp + 4]
call fcn.0040d060
mov edx, dword [esp + 0x28]
lea ecx, [esp + 8]
call fcn.0040d060
push 1
push dword [esp + 8]
push dword [esp + 8]
call sub.KERNEL32.dll_CopyFileA
and eax, eax
je 0x40b348
push dword [esp + 8]
call fcn.0040d660
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_BeginUpdateResourceA
mov dword [esp + 0xc], eax
mov ebp, 0x43d748
mov ebx, ebp
mov ebp, str.__xml_version_1.0__encoding_UTF_8__standalone_yes_____assembly_xmlns_urn:schemas_microsoft_com:asm.v1__manifestVersion_1.0____dependency___dependentAssembly___assemblyIdentity_type_win32__name_Microsoft.Windows.Common_Controls__version_6.0.0.0__processorArchitecture___publicKeyToken_6595b64144ccf1df__language________dependentAssembly____dependency___v3:trustInfo_xmlns:v3_urn:schemas_microsoft_com:asm.v3____v3:security___v3:requestedPrivileges_______level_can_be__asInvoker____highestAvailable___or__requireAdministrator_______v3:requestedExecutionLevel_level_requireAdministrator_______v3:requestedPrivileges____v3:security____v3:trustInfo____assembly_
sub ebx, ebp
push ebx
mov ebp, str.__xml_version_1.0__encoding_UTF_8__standalone_yes_____assembly_xmlns_urn:schemas_microsoft_com:asm.v1__manifestVersion_1.0____dependency___dependentAssembly___assemblyIdentity_type_win32__name_Microsoft.Windows.Common_Controls__version_6.0.0.0__processorArchitecture___publicKeyToken_6595b64144ccf1df__language________dependentAssembly____dependency___v3:trustInfo_xmlns:v3_urn:schemas_microsoft_com:asm.v3____v3:security___v3:requestedPrivileges_______level_can_be__asInvoker____highestAvailable___or__requireAdministrator_______v3:requestedExecutionLevel_level_requireAdministrator_______v3:requestedPrivileges____v3:security____v3:trustInfo____assembly_
push ebp
push 0
push 1
push 0x18
push dword [esp + 0x20]
call sub.KERNEL32.dll_UpdateResourceA
mov dword [esp + 0x10], eax
push 0
push dword [esp + 0x10]
call sub.KERNEL32.dll_EndUpdateResourceA
mov eax, dword [esp + 0x10]
jmp 0x40b350
push dword [esp + 4]
call fcn.0041d140
push dword [esp]
call fcn.0041d140
push dword [esp + 8]
call fcn.0041d140
add esp, 0x14
pop ebx
pop ebp
ret 0xc
Function at 0x40b466
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40b46c
mov dword [esp], 0
mov edx, 0x43c01e
lea ecx, [esp + 4]
call fcn.0040d068
mov edx, str.SOFTWAREMicrosoftSpeechVoicesTokens
lea ecx, [esp + 8]
call fcn.0040d068
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
mov eax, dword [esp + 0x14]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [esp + 0x10], 0xff
push dword [0x43f97c]
push dword [0x43f97c]
push dword [esp + 0x18]
call fcn.0040dc10
lea eax, [esp + 0x18]
push eax
call fcn.0041cfd0
mov dword [esp], 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
and ebx, ebx
jne 0x40b5c3
push dword [0x43f97c]
mov edx, str.SOFTWAREMicrosoftSpeechVoicesTokens_
call fcn.0041d050
mov edx, dword [esp + 0x18]
call fcn.0041d050
mov edx, str.Attributes_
call fcn.0041d050
lea eax, [esp + 0xc]
push eax
call fcn.0041cfd0
push dword [0x43f97c]
push str.Name
push dword [esp + 0x10]
push 0x80000002
call fcn.00409e76
lea eax, [esp + 0x1c]
push eax
call fcn.0041cfd0
mov edx, dword [esp + 4]
push dword [0x43f97c]
call fcn.0041d050
mov edx, dword [esp + 0x1c]
call fcn.0041d050
mov edx, 0x43c10f
call fcn.0041d050
lea eax, [esp + 8]
push eax
call fcn.0041cfd0
mov ebx, dword [esp]
inc ebx
mov dword [esp], ebx
mov dword [esp + 0x10], 0xff
mov edx, 0x43c01e
lea ecx, [esp + 0x18]
call fcn.0040d068
jmp 0x40b4f0
push dword [0x43f97c]
push dword [0x43f97c]
mov eax, dword [esp + 8]
cdq
push edx
push eax
call fcn.0040d5d0
mov edx, 0x43c10f
call fcn.0041d050
mov edx, dword [esp + 8]
call fcn.0041d050
lea eax, [esp + 8]
push eax
call fcn.0041cfd0
push dword [0x43f97c]
push dword [0x43f97c]
push dword [esp + 0xc]
call fcn.0040d410
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x10]
call fcn.0040d340
lea eax, [esp + 8]
push eax
call fcn.0041cfd0
mov edx, dword [esp + 4]
push dword [0x43f97c]
call fcn.0041d050
pop eax
add eax, dword [0x43d79c]
jmp 0x40b64a
push dword [esp + 0x18]
call fcn.0041d140
push dword [esp + 4]
call fcn.0041d140
push dword [esp + 0x14]
call fcn.0041d140
push dword [esp + 8]
call fcn.0041d140
add esp, 0x1c
pop ebx
ret
Function at 0x40e992
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40ea76
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test byte [ebp + 0x10], 1
mov ebx, eax
je 0x40ea2c
push edi
push edi
push edi
push dword [ebp + 0xc]
call fcn.0040f65b
mov ebx, eax
cmp ebx, edi
je 0x40ea6b
push dword [ebp + 8]
push dword [0x43f37c]
call fcn.0041c4ee
mov esi, eax
mov eax, 0x10000
push eax
push ebx
mov dword [esi + 0x18], eax
call fcn.0040f734
push eax
push ebx
call fcn.0040f71a
push eax
call fcn.0040f267
mov dword [esi], eax
cmp eax, edi
je 0x40ea24
mov dword [esi + 0x14], ebx
mov dword [ebp - 4], esi
jmp 0x40ea6b
push ebx
call fcn.0040f741
jmp 0x40ea6b
push ebx
push edi
push dword [0x43f0b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
je 0x40ea6b
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push esi
push dword [ebp + 8]
call fcn.0040f251
push esi
push edi
push dword [0x43f0b0]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc
Function at 0x40ebbb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
push dword [0x43f37c]
xor ebx, ebx
call fcn.0041c573
mov esi, eax
test esi, esi
je 0x40ed41
mov eax, dword [esi]
mov dword [ebp - 4], eax
cmp dword [esi + 0x14], ebx
je 0x40ec6d
push dword [ebp + 8]
call fcn.0040f399
jmp 0x40ebfe
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x1d], bl
jne 0x40ebf6
push dword [esi + 0x14]
call fcn.0040f76a
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x20], eax
xor ebx, ebx
push ebx
mov eax, esi
mov byte [esi + 0x1c], 1
call fcn.0040ea90
pop ecx
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push 0x40eb03
push 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x40ec42
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x10], 0xffffffff
je 0x40ec53
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040f469
mov eax, dword [esi]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x34]
mov esi, dword [esi]
mov eax, dword [esi]
push 1
push ebx
push ebx
push esi
call dword [eax + 0x30]
jmp 0x40ed41
test byte [ebp + 0xc], 1
je 0x40ec76
xor ebx, ebx
inc ebx
test byte [ebp + 0xc], 2
je 0x40ed03
push esi
call fcn.0040ef06
lea eax, [esi + 4]
push 0x10
push eax
call fcn.0041cc18
pop ecx
pop ecx
lea edx, [ebp - 4]
push edx
push dword [ebp - 4]
mov edi, eax
mov eax, dword [0x43f390]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jne 0x40ed41
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov byte [edi + 5], bl
mov byte [edi + 4], 1
mov eax, dword [ebp - 4]
push dword [esi + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
push dword [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x40]
cmp dword [ebp + 0x10], 0xffffffff
je 0x40ece7
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040f3c9
jmp 0x40ecf3
mov eax, dword [ebp - 4]
push dword [esi + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push 0
push 0
push eax
call dword [ecx + 0x30]
jmp 0x40ed41
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x34]
cmp dword [ebp + 0x10], 0xffffffff
je 0x40ed25
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040f469
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push 0
push 0
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x40ed41
xor edi, edi
inc edi
mov byte [esi + 0x1c], 1
mov byte [esi + 0x1e], bl
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4101b1
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x410200
push dword [esp + 0x10]
push 0x41012f
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x43f4f4]
cmp esi, ebx
je 0x410254
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x4101f8
cmp byte [esi + 0x10], bl
je 0x4101f8
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x4101d5
jmp 0x410254
mov esi, dword [0x43f4f4]
cmp esi, ebx
je 0x410254
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x41024d
cmp byte [esi + 0x11], bl
je 0x41022a
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x410240
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x43f4f4
call fcn.0041cc61
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x41020b
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x413f24
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
mov dword [0x43f7e4], eax
cmp eax, edi
je 0x413f57
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x43f7e8], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x43f7e0], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x413f95
cmp dword [ebp - 0xc], 1
je 0x413fa6
cmp dword [ebp - 0xc], 2
jne 0x413f95
cmp dword [ebp - 0x18], 5
jb 0x413fa6
jne 0x413f95
cmp dword [ebp - 0x14], edi
jne 0x413f95
mov dword [0x43f7e0], edi
cmp dword [0x43f7e0], edi
je 0x413fac
call fcn.00413e6b
test eax, eax
jne 0x413fac
mov dword [0x43f7e0], edi
pop edi
add ebp, 0x78
leave
ret
Function at 0x41533b
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push ebx
xor ebx, ebx
inc ebx
cmp dword [0x43f808], 0
jne 0x415367
push 0x415293
push 0x10
push 0x2c
mov dword [0x43f808], ebx
call fcn.0041c5d3
mov dword [0x43f7f0], eax
cmp word [0x43f804], 0
jne 0x4153fe
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
test eax, eax
jne 0x41538d
mov eax, ebx
jmp 0x41538f
xor eax, eax
push str.ws2_32.dll
mov word [0x43f804], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x43f7ec], eax
test eax, eax
je 0x4153fe
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x43f7ec]
mov dword [0x43f7f8], eax
call esi
push str.getnameinfo
push dword [0x43f7ec]
mov dword [0x43f7fc], eax
call esi
cmp dword [0x43f7f8], 0
mov dword [0x43f800], eax
pop esi
je 0x4153fe
cmp dword [0x43f7fc], 0
je 0x4153fe
test eax, eax
je 0x4153fe
mov dword [0x43f7f4], ebx
movsx eax, word [0x43f804]
pop ebx
add esp, 0x190
ret
Function at 0x4157d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 1
jne 0x4157f2
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WSOCK32.DLL_send]
jmp 0x415831
push 2
pop eax
mov word [ebp - 0x10], ax
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], eax
movzx eax, word [esi + 8]
push eax
call dword [sym.imp.WSOCK32.DLL_htons]
mov word [ebp - 0xe], ax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x415819
mov eax, dword [eax]
jmp 0x41581c
mov eax, dword [esi + 0x10]
push 0x10
lea ecx, [ebp - 0x10]
push ecx
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WSOCK32.DLL_sendto]
pop esi
leave
ret 0xc

Function at 0x415836
Capabilities:
Get socket status
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x920
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
inc eax
xor edi, edi
xor ebx, ebx
cmp dword [esi], eax
jne 0x4158b9
mov esi, dword [esi + 8]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
lea eax, [ebp - 0x120]
push eax
lea eax, [esi + 1]
push eax
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.WSOCK32.DLL_select]
cmp eax, edi
jl 0x4158b0
je 0x4158b5
lea eax, [ebp - 0x120]
push eax
push esi
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
je 0x4158b5
lea eax, [ebp + 8]
push eax
push 0x4004667f
push esi
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
test eax, eax
jne 0x4158b0
cmp dword [ebp + 8], edi
je 0x4158b0
push 2
jmp 0x4158b2
push 4
pop ebx
jmp 0x415913
xor ebx, ebx
jmp 0x415913
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push 0x800
lea eax, [ebp - 0x920]
push eax
push dword [esi + 0x10]
mov dword [ebp - 4], 0x10
call dword [sym.imp.WSOCK32.DLL_recvfrom]
mov dword [ebp + 8], eax
cmp eax, edi
jle 0x415913
push 2
pop ebx
push eax
push edi
push dword [0x43f0b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
push ecx
mov dword [esi + 0x18], ecx
lea ecx, [ebp - 0x920]
push ecx
push eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x41591c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi], 1
jne 0x41593f
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WSOCK32.DLL_recv]
mov edi, eax
jmp 0x415980
cmp dword [esi + 0x14], edi
je 0x415980
mov eax, dword [esi + 0x18]
mov edi, dword [ebp + 0x10]
cmp edi, eax
jle 0x415950
mov edi, eax
push edi
push dword [esi + 0x1c]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0x18], edi
mov eax, dword [esi + 0x18]
add dword [esi + 0x1c], edi
add esp, 0xc
test eax, eax
jne 0x415980
push dword [esi + 0x14]
push eax
push dword [0x43f0b0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi + 0x14], 0
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x415a43
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x1c]
push eax
mov ebx, 0xc8
mov dword [ebp - 0x1c], 0x94
call edi
test eax, eax
je 0x415b2c
mov eax, dword [ebp - 0xc]
dec eax
je 0x415b0f
dec eax
jne 0x415b2c
lea eax, [ebp - 0xb8]
push eax
xor esi, esi
mov dword [ebp - 0xb8], 0x9c
call edi
test eax, eax
je 0x415aa2
cmp byte [ebp - 0x1e], 1
jne 0x415aa2
inc esi
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x415b0b
dec eax
je 0x415b07
dec eax
je 0x415ae5
dec eax
jne 0x415b2c
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x415ad9
dec eax
je 0x415acd
dec eax
jne 0x415b2c
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x5f]
jmp 0x415b2c
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x55]
jmp 0x415b2c
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x4b]
jmp 0x415b2c
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x415b03
dec eax
je 0x415aff
dec eax
jne 0x415b2c
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x41]
jmp 0x415b2c
push 0x3c
jmp 0x415b2b
push 0x32
jmp 0x415b2b
push 0x14
jmp 0x415b2b
push 5
jmp 0x415b2b
cmp dword [ebp - 0x14], 0
je 0x415b29
cmp dword [ebp - 0x14], 0xa
je 0x415b25
cmp dword [ebp - 0x14], 0x5a
jne 0x415b2c
push 0x28
jmp 0x415b2b
push 0x1e
jmp 0x415b2b
push 0xa
pop ebx
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x78
leave
ret
Function at 0x415ba1
Capabilities:
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x248
push ebx
push esi
or esi, 0xffffffff
xor ebx, ebx
push edi
mov edi, esi
cmp eax, ebx
je 0x415ce2
cmp byte [eax], bl
je 0x415ce2
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], bl
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea ecx, [ebp + eax - 0x109]
cmp eax, 2
je 0x415bfc
cmp eax, 3
jne 0x415c3b
cmp byte [ebp - 0x107], 0x3a
jne 0x415c3b
cmp eax, 2
jne 0x415c1d
lea eax, [ebp - 0x108]
push 0x435354
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x415ce2
or esi, 0xffffffff
jmp 0x415cdf
mov al, byte [ecx]
cmp al, 0x5c
je 0x415c45
cmp al, 0x2f
jne 0x415c4a
mov byte [ecx], bl
dec ecx
jmp 0x415c3b
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
or ebx, 0xffffffff
cmp eax, ebx
je 0x415c90
test byte [ebp - 0x248], 0x10
je 0x415c75
push 0xfffffffffffffffe
pop edi
mov esi, ebx
jmp 0x415c87
mov esi, dword [ebp - 0x22c]
xor edi, edi
or edi, dword [ebp - 0x228]
xor edx, edx
or esi, edx
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x415ce2
cmp byte [ebp - 0x108], 0x5c
jne 0x415ca2
cmp byte [ebp - 0x107], 0x5c
je 0x415cb4
cmp byte [ebp - 0x108], 0x2e
jne 0x415ce2
cmp byte [ebp - 0x107], 0x2e
jne 0x415ce2
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, ebx
je 0x415ccb
test al, 0x10
je 0x415ce2
jmp 0x415cdd
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x415ce2
mov esi, ebx
push 0xfffffffffffffffe
pop edi
mov eax, edi
pop edi
mov edx, esi
pop esi
pop ebx
leave
ret 4
Function at 0x415f5c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [0x43f810], edi
jne 0x415f86
push fcn.00415f29
push 0x10
push 0x148
call fcn.0041c5d3
mov dword [0x43f810], eax
cmp dword [ebp + 0xc], edi
jne 0x415f92
mov dword [ebp + 0xc], 0x43500f
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x415f9e
cmp byte [ebx], 0
jne 0x415fa3
mov ebx, 0x435358
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
push ebx
mov esi, eax
call sub.MSVCRT.dll_strlen
pop ecx
pop ecx
lea eax, [eax + esi + 2]
push eax
push edi
push dword [0x43f0b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x416063
push dword [ebp + 0xc]
push edi
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
test esi, esi
je 0x415ff7
mov eax, dword [ebp + 0xc]
cmp byte [esi + eax - 1], 0x5c
je 0x415ff7
push 0x435354
push edi
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push ebx
push edi
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push dword [ebp + 8]
push dword [0x43f810]
call fcn.0041c4ee
mov esi, eax
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x416028
and dword [esi + 4], 0
jmp 0x41603a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x41603f
mov dword [esi + 4], 1
mov dword [ebp - 4], esi
jmp 0x416054
cmp dword [ebp + 8], 0xffffffff
jne 0x416051
push esi
push dword [0x43f810]
call fcn.0041c598
and dword [esi], 0
push edi
push 0
push dword [0x43f0b0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4160c2
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x4160eb
test byte [esp + 8], 2
je 0x4160df
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4160ed
xor eax, eax
ret 8

Function at 0x4161a0
Capabilities:
Get file attributes

Disassembly:
or eax, 0xffffffff
cmp dword [esp + 4], 0
je 0x4161b0
jmp dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 4

Function at 0x4161b3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x416223
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x416205
mov dl, byte [eax - 1]
cmp dl, 0x20
je 0x416204
cmp dl, 0x5c
je 0x416204
cmp dl, 0x2f
jne 0x41620f
dec eax
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x4161f2
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x416225
xor eax, eax
leave
ret 4
Function at 0x416229
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4162fe
push edi
push esi
push pe_nt_image_headers32
push 3
push esi
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4162fd
mov esi, dword [ebp + 0x10]
push esi
call fcn.004177ed
push esi
mov word [ebp - 0x20], ax
call fcn.00417815
push esi
mov word [ebp - 0x1e], ax
call fcn.00417838
push esi
mov word [ebp - 0x1c], ax
call fcn.0041785a
push esi
mov word [ebp - 0x1a], ax
call fcn.0041787c
push esi
mov word [ebp - 0x18], ax
call fcn.0041789e
push esi
mov word [ebp - 0x16], ax
call fcn.004178c0
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
xor eax, eax
xor edx, edx
xor ecx, ecx
cmp dword [ebp + 0xc], 1
jne 0x4162dc
lea edx, [ebp - 8]
jmp 0x4162ea
cmp dword [ebp + 0xc], 2
jne 0x4162e7
lea ecx, [ebp - 8]
jmp 0x4162ea
lea eax, [ebp - 8]
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x416305
Capabilities:
Set file attributes

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x416313
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 8

Function at 0x416370
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x4163a5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x416860
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x43fe44]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.0041c573
test eax, eax
je 0x4168b2
cmp dword [eax + 4], 0
je 0x416898
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call fcn.00416f30
pop ecx
ret 0xc
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
push 0
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 0xc