joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b9fe
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40ba05
call fcn.00419540
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x10c]
call fcn.00412ef0
mov dword [esp + 4], eax
push dword [ebp + 0x110]
call fcn.00412ef0
push edx
push eax
fild qword [esp]
fstp qword [esp]
pop dword [esp + 0xc]
pop dword [esp + 0xc]
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x40bb0f
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push 0x104
call fcn.00412dd0
lea eax, [esp + 0x14]
push eax
call fcn.004196c0
push 0x104
push dword [esp + 0x14]
call sub.KERNEL32.dll_GetSystemDirectoryW
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push 1
push 1
mov eax, 0x41d028
push eax
mov eax, str.WindowsSystem32
push eax
push dword [esp + 0x28]
call fcn.00412a60
lea eax, [esp + 0x18]
push eax
call fcn.004196c0
mov eax, 0x41d328
push eax
push dword [esp + 0x18]
call fcn.00408cd1
push edx
push eax
pop dword [esp + 0x1c]
pop dword [esp + 0x1c]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
pop edx
mov dword [esp - 8], eax
mov dword [esp - 4], edx
fild qword [esp - 8]
fld qword [esp + 8]
fcompp
fnstsw ax
test ah, 0x41
jne 0x40bb0f
mov dword [0x41fd1c], 1
call fcn.0040362f
xor eax, eax
push dword [esp + 0x14]
call fcn.00419630
push dword [esp + 0x10]
call fcn.00419630
add esp, 0x20
pop ebx
pop ebp
ret 4

Function at 0x40ca4d
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.00419540
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x48]
call fcn.00412ef0
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x40cab2
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x4c]
call fcn.00412ef0
mov dword [esp + 8], eax
push 0
call sub.KERNEL32.dll_GetDriveTypeW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
cmp ebx, dword [esp + 8]
jne 0x40caa8
jmp 0x40cab4
push 0
call sub.KERNEL32.dll_ExitProcess
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
ret 4
Function at 0x40f1bb
Capabilities:
Query environment variable

Disassembly:
xor eax, eax
push eax
push eax
call fcn.00419540
push dword [esp + 0x10]
call fcn.004121d0
mov edx, dword [esp + 0xc]
lea ecx, [esp]
call fcn.00412060
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push 0x104
call fcn.00412dd0
lea eax, [esp + 8]
push eax
call fcn.004196c0
push 0x104
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
and eax, eax
je 0x40f235
mov edx, dword [esp + 4]
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419660
pop eax
push eax
call fcn.004121a0
pop edx
add eax, edx
jmp 0x40f25e
mov edx, 0x41d028
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419660
pop eax
push eax
call fcn.004121a0
pop edx
add eax, edx
jmp 0x40f25e
push dword [esp + 4]
call fcn.00419630
push dword [esp]
call fcn.00419630
add esp, 8
ret 4

Function at 0x40f887
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
call fcn.00419540
push dword [esp + 8]
call fcn.00418ff0
push eax
call fcn.00418f90
mov dword [0x41fd64], eax
push dword [esp + 8]
call fcn.00418ff0
push eax
push dword [0x41fd64]
push dword [esp + 0x10]
call fcn.00418fb0
push 0
push 0
push 0
lea eax, [0x4016ce]
push eax
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [esp], eax
push 0xffffffff
push dword [esp + 4]
call sub.KERNEL32.dll_WaitForSingleObject
xor eax, eax
add esp, 4
ret 4
Function at 0x412636
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x4126ce
push edi
push 0x420870
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x41fec0]
test edi, edi
je 0x4126a2
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41269b
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x41fec0
call fcn.00418af8
pop ecx
pop ecx
jmp 0x41269d
mov edi, dword [edi]
test edi, edi
jne 0x412672
pop ebx
mov eax, dword [0x41f1e8]
mov esi, eax
inc eax
push 0x10
push 0x41fec0
mov dword [0x41f1e8], eax
call fcn.00418b38
pop ecx
pop ecx
push 0x420870
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x412776
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.004125ea
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0x420870
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x41fec0]
jmp 0x4127a7
cmp dword [esi + 0xc], edi
je 0x4127ad
mov esi, dword [esi]
test esi, esi
jne 0x4127a0
jmp 0x4127c5
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x41fec0
call fcn.00418af8
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4
Function at 0x41283a
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4129b0
mov eax, dword [esp + 0x24]
dec eax
je 0x412993
dec eax
jne 0x4129b0
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.004127f3
pop ecx
test eax, eax
je 0x4128f1
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x4128b4
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x41298f
dec ebx
je 0x41298b
dec ebx
je 0x41296a
dec ebx
je 0x412924
sub ebx, 4
jne 0x4129b0
test edi, edi
jne 0x4129b0
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x4129b0
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x4128b4
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x4128af
sub edi, 0
je 0x41295c
dec edi
je 0x41294e
dec edi
je 0x412940
dec edi
jne 0x4129b0
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x4129b0
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x4129b0
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x4129b0
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x4129b0
sub edi, 0
je 0x412987
dec edi
je 0x412983
dec edi
jne 0x4129b0
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x4129b0
push 0x3c
jmp 0x4129af
push 0x32
jmp 0x4129af
push 0x14
jmp 0x4129af
push 5
jmp 0x4129af
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4129ad
cmp eax, 0xa
je 0x4129a9
cmp eax, 0x5a
jne 0x4129b0
push 0x28
jmp 0x4129af
push 0x1e
jmp 0x4129af
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x413ed2
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x420894]
call fcn.004182a8
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x413fd2
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x413f28
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x413f20
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x413f68
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x413faa
push 0x22
pop edx
cmp cx, dx
je 0x413f5a
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x413f4a
xor ecx, ecx
cmp word [eax], cx
je 0x413faa
mov ecx, eax
add eax, 2
jmp 0x413fac
test dx, dx
je 0x413fb2
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x413f5a
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x413fa0
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x413faa
cmp cx, dx
je 0x413f9d
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x413f8d
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x413f72
jmp 0x413f5a
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x413fb4
xor edx, edx
cmp dword [ebp], ebx
jne 0x413fbd
test edi, edi
jne 0x413fda
test edx, edx
je 0x413fc2
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x413f16
test edi, edi
jne 0x413feb
mov eax, ebx
jmp 0x413fef
test esi, esi
je 0x413feb
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x413fef
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4140ff
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebp
push esi
push edi
push dword [esp + 0x38]
xor esi, esi
mov dword [esp + 0x10], esi
call fcn.0041a5c0
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], eax
lea eax, [edi + 0x18]
push eax
push esi
push dword [0x41fcf0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x4141fe
push ebx
mov ebx, dword [esp + 0x30]
lea eax, [edi + 0x18]
push esi
push dword [ebx + 0x18]
push eax
push ebp
push edi
push dword [esp + 0x48]
call fcn.004145ee
mov esi, eax
add esp, 0x18
test esi, esi
je 0x414162
cmp esi, edi
jge 0x414162
mov dword [esp + 0x34], ebp
jmp 0x414164
mov esi, edi
push dword [esp + 0x14]
call sub.MSVCRT.dll_strlen
mov word [esp + 0x2c], ax
mov eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
cdq
mov dword [esp + 0x1c], eax
mov eax, esi
pop ecx
mov dword [esp + 0x1c], edx
cdq
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x40]
push eax
push 0x12
lea eax, [esp + 0x24]
mov dword [esp + 0x30], edx
push eax
push dword [ebx]
call edi
cmp dword [esp + 0x3c], 0x12
jne 0x4141e3
push 0
lea eax, [esp + 0x40]
push eax
movsx eax, word [esp + 0x30]
push eax
push dword [esp + 0x20]
push dword [ebx]
call edi
movsx eax, word [esp + 0x28]
cmp eax, dword [esp + 0x3c]
jne 0x4141e3
push 0
lea eax, [esp + 0x40]
push eax
push esi
push dword [esp + 0x40]
push dword [ebx]
call edi
cmp esi, dword [esp + 0x3c]
jne 0x4141e3
xor esi, esi
inc esi
jmp 0x4141e7
mov esi, dword [esp + 0x10]
push ebx
call fcn.00414808
pop ecx
push ebp
push 0
push dword [0x41fcf0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
push dword [esp + 0x10]
call fcn.0041a5b0
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x1c
ret 0x10
Function at 0x414439
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
or dword [esp], 0xffffffff
xor edx, edx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, edx
test edi, edi
je 0x414470
cmp word [edi], dx
je 0x414470
push edi
call fcn.0041a5c0
mov ebp, dword [esp + 0x20]
mov edi, eax
push edi
push ebp
call fcn.0041484d
pop ecx
pop ecx
mov esi, eax
xor edx, edx
jmp 0x414486
mov ebp, dword [esp + 0x20]
cmp dword [ebp + 8], edx
je 0x41459b
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 4]
mov esi, dword [eax + ecx*4]
test esi, esi
je 0x41459b
cmp dword [esp + 0x30], 0
je 0x4144aa
push dword [esi]
push edx
push dword [0x41fcf0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword [esi]
jmp 0x4144b2
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x41459f
cdq
cmp edx, dword [esi + 4]
jl 0x41459f
jg 0x4144d2
cmp eax, dword [esi]
jb 0x41459f
push 0
lea eax, [esi + 0x14]
push eax
push dword [esi + 0x10]
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jne 0x414524
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 4]
jne 0x414524
push 0
lea eax, [esp + 0x30]
push eax
push dword [esi]
push ebx
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, dword [esp + 0x2c]
mov eax, ebp
cdq
cmp dword [esi], eax
jne 0x41459f
cmp dword [esi + 4], edx
jne 0x41459f
mov dword [esp + 0x10], ebp
jmp 0x4145a3
push dword [esi + 8]
push 0
push dword [0x41fcf0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x41459f
push 0
lea ecx, [esp + 0x30]
push ecx
push dword [esi + 8]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x2c]
cdq
cmp dword [esi + 8], eax
jne 0x414583
cmp dword [esi + 0xc], edx
jne 0x414583
push dword [esp + 0x14]
push ebx
push dword [esp + 0x20]
call fcn.00414aae
cdq
add esp, 0xc
cmp eax, dword [esi]
jne 0x414583
cmp edx, dword [esi + 4]
jne 0x414583
mov ebp, dword [esi]
mov dword [esp + 0x10], ebp
jmp 0x414587
mov ebp, dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [0x41fcf0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4145a3
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x4145cf
cmp ebp, 0xffffffff
jne 0x4145c9
test ebx, ebx
je 0x4145c3
push ebx
push 0
push dword [0x41fcf0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov ebx, eax
jmp 0x4145d5
mov eax, dword [esi]
mov dword [ecx], eax
jmp 0x4145d3
mov ebx, dword [esp + 0x10]
xor eax, eax
test edi, edi
je 0x4145e4
cmp word [edi], ax
je 0x4145e4
push edi
call fcn.0041a5b0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret
Function at 0x41488d
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
mov esi, dword [esp + 0x48]
xor ebx, ebx
push 0x40
pop ebp
cmp dword [esi + 4], ebx
jne 0x414a10
push edi
push 0x100
push ebx
push dword [0x41fcf0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
push ebx
push 4
pop edi
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esi + 0x14], 0x706c7a31
lea eax, [esp + 0x4c]
push 0
push eax
jne 0x414922
push 0x18
lea eax, [esp + 0x3c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x4c], 0x18
jne 0x414a0f
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
mov ax, word [esp + 0x40]
mov word [esp + 0x2c], ax
jmp 0x41493c
push 0x12
lea eax, [esp + 0x28]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x4c], 0x12
jne 0x414a0f
cmp dword [esi + 0xc], ebp
jl 0x41495e
add ebp, 0x40
mov eax, ebp
shl eax, 2
push eax
push dword [esi + 4]
push 8
push dword [0x41fcf0]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [esi + 4], eax
movsx eax, word [esp + 0x2c]
add eax, 0x19
push eax
push 0
push dword [0x41fcf0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0x1c]
mov edx, eax
push 0
lea eax, [esp + 0x50]
mov dword [esp + 0x14], edx
push eax
mov dword [edx], ecx
mov ecx, dword [esp + 0x28]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x30]
mov dword [edx + 0xc], ecx
movsx eax, word [esp + 0x34]
push eax
lea eax, [edx + 0x18]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, word [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0x10]
mov byte [eax + edx + 0x18], cl
cmp dword [esi + 0x14], 0x706c7a31
movsx eax, word [esp + 0x2c]
jne 0x4149d1
add eax, 0x18
jmp 0x4149d4
add eax, 0x12
add edi, eax
mov dword [edx + 0x10], edi
adc ebx, ecx
mov dword [edx + 0x14], ebx
mov ecx, dword [esi + 0xc]
add edi, dword [esp + 0x24]
mov eax, dword [esi + 4]
adc ebx, dword [esp + 0x28]
push 1
mov dword [eax + ecx*4], edx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
inc dword [esi + 0xc]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x1c], ecx
push ecx
jmp 0x4148c4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x415240
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x4200dc], 0
jne 0x41524e
call fcn.004151e0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x4200e0]
call esi
test eax, eax
jne 0x415271
call fcn.004151e0
push dword [0x4200e0]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x415280
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x4152e0
mov ebx, 0x10
test edi, edi
jns 0x4152e9
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x4152b2
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x415300
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x4200dc], 0
jne 0x41530e
call fcn.004151e0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x4200e0]
call esi
mov edx, eax
test edx, edx
jne 0x415335
call fcn.004151e0
push dword [0x4200e0]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x415368
mov ebx, 0x10
test esi, esi
jns 0x415371
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x415380
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x415f8a
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x4160d2
xor ecx, ecx
cmp word [eax], cx
je 0x4160d2
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x415fe3
cmp eax, 3
jne 0x41601d
cmp word [esp + 0xa], 0x3a
jne 0x41601d
cmp eax, 2
jne 0x416001
lea eax, [esp + 8]
push 0x41c058
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4160d2
push 0xfffffffffffffffe
pop edi
jmp 0x4160d2
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x416032
cmp ax, bx
jne 0x41603c
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x416025
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x41607b
test byte [esp + 0x21c], 0x10
je 0x416062
push 0xfffffffffffffffe
pop edi
jmp 0x416072
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4160d0
cmp word [esp + 0x10], bp
jne 0x416089
cmp word [esp + 0x12], bp
je 0x4160a8
cmp word [esp + 0x10], bx
jne 0x416097
cmp word [esp + 0x12], bx
je 0x4160a8
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x4160d0
cmp word [esp + 0x12], ax
jne 0x4160d0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x4160bd
test al, 0x10
je 0x4160d0
jmp 0x4160cd
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4160d0
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x4161b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x416228
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x416209
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x416206
cmp ecx, 0x5c
je 0x416206
cmp ecx, 0x2f
jne 0x416213
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x4161f3
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x41622a
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4163a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x4163dc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x4168e0
Capabilities:
Read file on windows

Disassembly:
push ecx
push dword [esp + 8]
mov dword [esp + 4], 0
push dword [0x420928]
call fcn.00418419
test eax, eax
je 0x41692c
cmp dword [eax + 4], 0
je 0x416916
push 4
lea ecx, [esp + 4]
push ecx
push eax
call fcn.00416cc0
mov eax, dword [esp]
pop ecx
ret 4
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
lea ecx, [esp + 0xc]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 4

Function at 0x416cc0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x416ce1
push esi
call fcn.004163a0
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x416d55
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x416d42
dec ecx
je 0x416d2d
sub ecx, 2
je 0x416d1a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x416d9a
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x416dbb
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc