joyce8/EMBER2024-capa huggingface dataset:
Function at 0x996f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x9ab9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x997002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.0099adff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x997002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.009926e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0099b20b
push 0x10
call fcn.0099b1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x996fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.009871c0
jmp 0x996fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00996b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x996ff0
mov ecx, edi
call fcn.009872c0
push edi
call fcn.0099b1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x997021
inc ebx
cmp ebx, 0x20
jb 0x996f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x998250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9ac808
push 0x99c288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x998329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x998329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0099b1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x998329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x998329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x99832c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00998351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x998d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x998d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x998d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x998d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x998d94
push eax
push esi
call fcn.0099b20b
add esp, 8
pop esi
ret 0x10

Function at 0x998da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x998e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x998e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x9b1320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0099adff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x998dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x998e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x998ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x998eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x9b1320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0099adff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x998eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x998e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x999000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x999131
push esi
call fcn.0099c145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0098b080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x999131
push 0
push ebp
call fcn.0098b3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0098b260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x99908b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0098b2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x999121
push 0x9b1918
push edi
call fcn.0099a3f0
push eax
push ebx
push esi
call fcn.00998f60
push 0x9b18f8
push edi
call fcn.0099a3f0
push eax
push ebx
push esi
call fcn.00998f60
push 0x9b18d8
push edi
call fcn.0099a3f0
push eax
push ebx
push esi
call fcn.00998f60
push 0x9b18c0
push edi
call fcn.0099a3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00998f60
push 0x9b18a0
push edi
call fcn.0099a3f0
push eax
push ebx
push esi
call fcn.00998f60
push 0x9b1888
push edi
call fcn.0099a3f0
push eax
push ebx
push esi
call fcn.00998f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x99a1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0099a140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0099a140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0099a140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0099a140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x99abfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x99ac50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x9ac87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x99ac43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x99ac52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4012b0
Capabilities:
Initialize winsock library

Disassembly:
push 0x41ff90
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x4012df
mov ax, word [0x41ff90]
cmp al, 2
jne 0x4012d9
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x4012d9
xor eax, eax
ret
call dword [sym.imp.WSOCK32.dll_WSACleanup]
or eax, 0xffffffff
ret

Function at 0x401400
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push 0
push ecx
call fcn.0040ceeb
mov edx, dword [esp + 0x10]
add esp, 0xc
cmp eax, 0xffffffff
mov dword [edx], eax
jne 0x401439
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.xThread_failure_errno_d_ret_d
call sym.Sure_XLite.exe_xLogMsg
add esp, 8
or eax, 0xffffffff
ret 0xc
xor eax, eax
ret 0xc

Function at 0x401450
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
push 2
push 0x42012c
call sym.Sure_XLite.exe__xMutexLock_8
mov eax, dword [0x460138]
mov ecx, dword [0x46013c]
or eax, ecx
jne 0x401505
lea ecx, [esp + 0x18]
mov dword [0x41ff88], 0
push ecx
mov dword [0x41ff8c], 0x41f00000
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
fild dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
xor esi, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], esi
fmul qword [0x41ff88]
fild qword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
faddp st(1)
fmul qword [0x4192b0]
fstp qword [0x460148]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
fild dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ecx
fmul qword [0x41ff88]
fild qword [esp + 0x20]
faddp st(1)
fld st(0)
fdiv qword [0x460148]
call fcn.0040d084
mov ebp, eax
mov ebx, edx
mov dword [0x460138], ebp
mov dword [0x46013c], ebx
jmp 0x40153c
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
fild dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ebx, dword [0x46013c]
mov ebp, dword [0x460138]
mov dword [esp + 0x20], eax
fmul qword [0x41ff88]
mov dword [esp + 0x24], 0
fild qword [esp + 0x20]
faddp st(1)
fdiv qword [0x460148]
fld st(0)
call fcn.0040d084
mov esi, eax
mov edi, edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
fild qword [esp + 0x20]
fsubr st(1)
fcomp qword [0x4192a8]
fnstsw ax
test ah, 1
fstp st(0)
jne 0x401570
add esi, 1
adc edi, 0
cmp edi, ebx
jg 0x40158c
jl 0x40157a
cmp esi, ebp
ja 0x40158c
mov dword [0x460138], esi
mov dword [0x46013c], edi
xor esi, esi
xor edi, edi
jmp 0x401590
sub esi, ebp
sbb edi, ebx
push 0x42012c
mov dword [0x460140], esi
mov dword [0x460144], edi
call sym.Sure_XLite.exe__xMutexUnLock_4
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x401740
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret 0x18
Function at 0x401910
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call fcn.0040d11d
add esp, 8
test eax, eax
je 0x401983
push esi
call sym.Sure_XLite.exe__xFileExists_4
cmp al, 1
jne 0x401959
push esi
call sym.Sure_XLite.exe__xFileDelete_4
cmp eax, 0xffffffff
jne 0x401959
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.xFileRename_Fail_Err_d
call sym.Sure_XLite.exe_xLogMsg
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
ret 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x401983
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push str.MoveFail_Fail_from__s_to__s_Err_d
call sym.Sure_XLite.exe_xLogMsg
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
ret 8
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x401990
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call fcn.0040d2b2
add esp, 8
test eax, eax
jne 0x4019bc
push str.Rename_files_identical
call sym.Sure_XLite.exe_xLogMsg
add esp, 4
pop edi
xor eax, eax
pop esi
ret 8
push esi
call sym.Sure_XLite.exe__xFileExistsW_4
test eax, eax
je 0x4019da
push str.Rename_newfile_exists
call sym.Sure_XLite.exe_xLogMsg
add esp, 4
xor eax, eax
pop edi
pop esi
ret 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x4019b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push str.MoveFail_Fail_from__s_to__s_Err_d
call sym.Sure_XLite.exe_xLogMsg
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
ret 8

Function at 0x401b60
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
call ebp
cmp eax, 0xffffffff
jne 0x401b7f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call esi
test eax, eax
jne 0x401bab
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call esi
test eax, eax
jne 0x401bab
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push edi
call ebp
cmp eax, 0xffffffff
je 0x401b76
push 1
call ebx
inc esi
cmp esi, 0x7d0
jl 0x401bb3
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x401be0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
call ebp
cmp eax, 0xffffffff
jne 0x401bff
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
test eax, eax
jne 0x401c1b
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call esi
test eax, eax
je 0x401c38
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push edi
call ebp
cmp eax, 0xffffffff
je 0x401bf6
push 1
call ebx
inc esi
cmp esi, 0x7d0
jl 0x401c23
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x401f60
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401f73
xor eax, eax
test al, 0x10
jne 0x401fa0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401fa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.xCreateDirectory_fail_on__s_Err_d
call sym.Sure_XLite.exe_xLogMsg
add esp, 0xc
or eax, 0xffffffff
pop esi
ret 4
xor eax, eax
pop esi
ret 4

Function at 0x401fb0
Capabilities:
Inspect section memory permissions

Disassembly:
mov dl, byte [esp + 0x10]
xor ecx, ecx
neg dl
sbb edx, edx
push esi
and edx, 0xe0000080
mov eax, 3
add edx, 0x20000000
mov esi, edx
mov dl, byte [esp + 0x10]
test dl, 1
je 0x401fdc
mov ecx, closesocket
test dl, 2
je 0x401fe7
or ecx, 0x40000000
test dl, 8
je 0x401ff3
mov eax, 1
jmp 0x401ffd
test dl, 0x10
je 0x401ffd
mov eax, 4
push 0
push esi
mov esi, dword [esp + 0x14]
push eax
push 0
push 3
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov ecx, dword [esp + 8]
mov dword [ecx], eax
jne 0x402038
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.File_Open_Err_on__s__Err_d
call sym.Sure_XLite.exe_xLogMsg
add esp, 0xc
or eax, 0xffffffff
pop esi
ret 0x10
xor eax, eax
pop esi
ret 0x10

Function at 0x402040
Capabilities:
Inspect section memory permissions

Disassembly:
mov dl, byte [esp + 0x10]
xor ecx, ecx
neg dl
sbb edx, edx
push esi
and edx, 0xe0000080
mov eax, 3
add edx, 0x20000000
mov esi, edx
mov dl, byte [esp + 0x10]
test dl, 1
je 0x40206c
mov ecx, closesocket
test dl, 2
je 0x402077
or ecx, 0x40000000
test dl, 8
je 0x402083
mov eax, 1
jmp 0x40208d
test dl, 0x10
je 0x40208d
mov eax, 4
push 0
push esi
mov esi, dword [esp + 0x14]
push eax
push 0
push 1
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov ecx, dword [esp + 8]
mov dword [ecx], eax
jne 0x4020c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.File_Open_Err_on__s__Err_d
call sym.Sure_XLite.exe_xLogMsg
add esp, 0xc
or eax, 0xffffffff
pop esi
ret 0x10
xor eax, eax
pop esi
ret 0x10

Function at 0x402100
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push 0
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
mov ecx, dword [eax]
mov dword [esp + 0x10], 0
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 0xffffffff
jne 0x402132
or eax, eax
pop ecx
ret 0xc
mov eax, dword [esp]
pop ecx
ret 0xc
Function at 0x402140
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push 0
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
mov ecx, dword [eax]
mov dword [esp + 0x10], 0
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 0xffffffff
jne 0x402187
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Write_File_Err___d
call sym.Sure_XLite.exe_xLogMsg
add esp, 8
or eax, 0xffffffff
pop ecx
ret 0xc
mov eax, dword [esp]
pop ecx
ret 0xc

Function at 0x4023f0
Capabilities:
Get file size

Disassembly:
push ecx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 8]
mov ecx, dword [esp + 0x10]
push eax
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x402427
or eax, 0xffffffff
pop edi
or edx, 0xffffffff
pop esi
pop ecx
ret 4
mov eax, dword [esp + 8]
push 1
push 0
push 0
push eax
call fcn.0040dc10
add eax, esi
adc edx, edi
pop edi
pop esi
pop ecx
ret 4

Function at 0x402590
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 4]
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x4025da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4025e1
cmp eax, 3
je 0x4025e1
cmp eax, 0x20
je 0x4025d5
push eax
push str.xFileLocked_Err_d
call sym.Sure_XLite.exe_xLogMsg
add esp, 8
mov al, 1
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
ret 4

Function at 0x4025f0
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40263d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x402644
cmp eax, 3
je 0x402644
cmp eax, 0x20
je 0x402637
push eax
push esi
push str.xFileLocked__s_Err_d
call sym.Sure_XLite.exe_xLogMsg
add esp, 0xc
mov al, 1
pop esi
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
ret 4

Function at 0x402650
Capabilities:
Get disk size

Disassembly:
sub esp, 0x18
xor eax, eax
lea ecx, [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
lea edx, [esp]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x402697
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0x18
ret 4
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x18
ret 4
Function at 0x4026b0
Capabilities:
Clear file content

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 0
push 0
push 4
push 0
push 3
push 0xc0000000
push esi
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x4026f9
push esi
push str.Error_truncating_File___s
call sym.Sure_XLite.exe_xLogMsg
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
lea eax, [esp + 0x18]
push eax
call sym.Sure_XLite.exe__xGetFileSize_4
mov ebx, eax
mov ebp, edx
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
test esi, esi
jl 0x4027aa
jg 0x402721
test edi, edi
jb 0x4027aa
cmp esi, ebp
jg 0x4027aa
jl 0x40272f
cmp edi, ebx
jae 0x4027aa
push esi
lea ecx, [esp + 0x1c]
push edi
push ecx
call sym.Sure_XLite.exe__xFileSeek_12
mov ebx, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edx, dword [esp + 0x18]
push edx
call ebx
test eax, eax
jne 0x40278b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.xTruncate_Error_ret_d
call sym.Sure_XLite.exe_xLogMsg
add esp, 8
push 0x64
call sym.Sure_XLite.exe__xSleep_4
push esi
lea eax, [esp + 0x1c]
push edi
push eax
call sym.Sure_XLite.exe__xFileSeek_12
mov ecx, dword [esp + 0x18]
push ecx
call ebx
test eax, eax
je 0x402793
push str.2nd_try_Success_
call sym.Sure_XLite.exe_xLogMsg
add esp, 4
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebp
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
jne 0x4027bd
cmp esi, ebp
je 0x4027ce
push ebp
push ebx
push esi
push edi
push str.Invalid_Truncate_Marker_I64d__FileSize_I64d
call sym.Sure_XLite.exe_xLogMsg
add esp, 0x14
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 0xc