joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405230
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x42f278]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
push 0x410
xor esi, esi
lea eax, [esp + 8]
push esi
push eax
call fcn.00416890
add esp, 0xc
test ebx, ebx
jne 0x40527e
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004104f3
add esp, 0x414
ret
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405283
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x40529d
push 0x6f
jmp 0x405260
push 0x208
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x405266
push edi
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esp + eax*2 + 6]
lea eax, [esp + 8]
push 0x5c
push eax
call fcn.00412984
add esp, 8
cmp eax, esi
je 0x4052f4
lea edi, [esp + 8]
add edi, 0xfffffffe
jmp 0x4052e0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4052e0
mov ecx, dword [0x42bd8c]
mov dword [edi], ecx
mov eax, ebx
mov edx, ebx
jmp 0x405300
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405300
lea edi, [esp + 8]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x405314
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, eax
push 0
lea edx, [esp + 0x10]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ecx, dword [esp + 0x418]
pop edi
pop esi
xor ecx, esp
call fcn.004104f3
add esp, 0x414
ret
Function at 0x405360
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push esi
mov esi, eax
xor eax, eax
cmp dword [ecx + 4], eax
push edi
jle 0x405380
lea edx, [ecx + 0x10]
nop
mov edi, dword [esi + eax*4]
mov dword [edx], edi
add eax, 1
add edx, 4
cmp eax, dword [ecx + 4]
jl 0x405370
mov eax, dword [ecx + 0xc]
mov esi, dword [ecx + 4]
lea edx, [eax*4 + 4]
cmp esi, edx
jge 0x405473
push ebx
push ebp
lea ebx, [ecx + esi*4 + 0x10]
jmp 0x4053a0
mov eax, dword [ebx - 4]
mov edi, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov eax, esi
cdq
idiv edi
test edx, edx
mov ebp, eax
jne 0x405401
movzx edx, byte [esp + 0x10]
mov al, byte [edx + str.cw]
mov edx, dword [esp + 0x10]
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + str.cw]
xor dl, byte [ebp + 0x431b90]
mov byte [esp + 0x10], dl
movzx edx, byte [esp + 0x12]
movzx edx, byte [edx + str.cw]
mov byte [esp + 0x11], dl
movzx edx, byte [esp + 0x13]
movzx edx, byte [edx + str.cw]
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], al
jmp 0x40544b
cmp edi, 6
jle 0x40544b
cmp edx, 4
jne 0x40544b
movzx eax, byte [esp + 0x10]
movzx edx, byte [eax + str.cw]
movzx eax, byte [esp + 0x11]
mov byte [esp + 0x10], dl
movzx edx, byte [eax + str.cw]
movzx eax, byte [esp + 0x12]
mov byte [esp + 0x11], dl
movzx edx, byte [eax + str.cw]
movzx eax, byte [esp + 0x13]
mov byte [esp + 0x12], dl
movzx edx, byte [eax + str.cw]
mov byte [esp + 0x13], dl
mov eax, esi
sub eax, edi
mov edx, dword [ecx + eax*4 + 0x10]
xor edx, dword [esp + 0x10]
add esi, 1
mov dword [ebx], edx
mov eax, dword [ecx + 0xc]
lea edx, [eax*4 + 4]
add ebx, 4
cmp esi, edx
jl 0x4053a0
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x4056b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 0x14]
mov eax, dword [ecx + 0x10]
mov dword [ecx + 0x104], edx
mov edx, dword [ecx + 0x1c]
mov dword [ecx + 0x10c], edx
mov dword [ecx + 0x100], eax
mov eax, dword [ecx + 0x18]
mov edx, 1
cmp dword [ecx + 0xc], edx
push esi
mov dword [ecx + 0x108], eax
jle 0x4057c7
lea eax, [ecx + 0x22]
push edi
jmp 0x4056f0
movzx esi, byte [eax + 1]
mov esi, dword [esi*4 + 0x4347b0]
movzx edi, byte [eax - 1]
xor esi, dword [edi*4 + 0x433fb0]
movzx edi, byte [eax - 2]
xor esi, dword [edi*4 + 0x433bb0]
movzx edi, byte [eax]
xor esi, dword [edi*4 + 0x4343b0]
movzx edi, byte [eax + 4]
mov dword [eax + 0xee], esi
movzx esi, byte [eax + 5]
mov esi, dword [esi*4 + 0x4347b0]
xor esi, dword [edi*4 + 0x4343b0]
movzx edi, byte [eax + 3]
xor esi, dword [edi*4 + 0x433fb0]
movzx edi, byte [eax + 2]
xor esi, dword [edi*4 + 0x433bb0]
movzx edi, byte [eax + 8]
mov dword [eax + 0xf2], esi
movzx esi, byte [eax + 9]
mov esi, dword [esi*4 + 0x4347b0]
xor esi, dword [edi*4 + 0x4343b0]
movzx edi, byte [eax + 7]
xor esi, dword [edi*4 + 0x433fb0]
movzx edi, byte [eax + 6]
xor esi, dword [edi*4 + 0x433bb0]
movzx edi, byte [eax + 0xc]
mov dword [eax + 0xf6], esi
movzx esi, byte [eax + 0xd]
mov esi, dword [esi*4 + 0x4347b0]
xor esi, dword [edi*4 + 0x4343b0]
movzx edi, byte [eax + 0xb]
xor esi, dword [edi*4 + 0x433fb0]
movzx edi, byte [eax + 0xa]
xor esi, dword [edi*4 + 0x433bb0]
add edx, 1
mov dword [eax + 0xfa], esi
add eax, 0x10
cmp edx, dword [ecx + 0xc]
jl 0x4056f0
pop edi
mov eax, edx
shl eax, 4
mov esi, dword [eax + ecx + 0x10]
add eax, ecx
add edx, 0x10
shl edx, 4
mov dword [edx + ecx], esi
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
mov dword [eax + 0x104], ecx
mov ecx, dword [eax + 0x1c]
mov dword [eax + 0x108], edx
mov dword [eax + 0x10c], ecx
pop esi
ret
Function at 0x406130
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x90
mov eax, dword [0x42f278]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [ebx + 4]
push ebp
push esi
push eax
call fcn.00410ff7
mov ebp, eax
xor esi, esi
add esp, 4
cmp ebp, esi
je 0x40621f
mov ecx, dword [ebx + 4]
push ecx
push esi
push ebp
call fcn.00416890
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
push edx
push eax
push ebp
call fcn.00416910
mov ecx, dword [esp + 0xb4]
mov eax, dword [0x4372e8]
add dword [ebp], ecx
add esp, 0x18
cmp eax, 0xc
je 0x4061eb
cmp eax, 0xd
je 0x4061eb
mov eax, dword [ebx + 4]
push edi
push ebp
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], esi
mov dword [esp + 0x54], 0x67452301
mov dword [esp + 0x58], 0xefcdab89
mov dword [esp + 0x5c], 0x98badcfe
mov dword [esp + 0x60], 0x10325476
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
call fcn.004062b0
lea edi, [esp + 0x68]
lea esi, [esp + 0xc]
call fcn.004063c0
mov eax, dword [ebx]
add eax, 0xfffffffe
cmp eax, 2
pop edi
ja 0x406216
lea ecx, [esp + 0x64]
jmp 0x40620b
mov eax, dword [ebx + 4]
lea edx, [esp + 0x74]
push edx
push eax
push ebp
call fcn.00403850
mov eax, dword [ebx]
add eax, 0xfffffffe
add esp, 0xc
cmp eax, 2
ja 0x406216
lea ecx, [esp + 0x74]
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x10]
call fcn.00405ad0
push ebp
call fcn.00410f1a
add esp, 4
mov ecx, dword [esp + 0x94]
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.004104f3
add esp, 0x90
ret 4

Function at 0x406240
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x60
mov eax, dword [0x42f278]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x64]
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [esp + 8], ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ecx
push eax
mov eax, dword [esp + 0x74]
lea ecx, [esp + 0xc]
mov dword [esp + 0x50], 0x67452301
mov dword [esp + 0x54], 0xefcdab89
mov dword [esp + 0x58], 0x98badcfe
mov dword [esp + 0x5c], 0x10325476
call fcn.004062b0
lea esi, [esp + 8]
call fcn.004063c0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
call fcn.004104f3
add esp, 0x60
ret 8
Function at 0x406fc0
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc
mov eax, dword [0x42f278]
xor eax, esp
mov dword [esp + 8], eax
push edi
push 0x42bcc8
mov edi, 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x42bcc8
push 0x436ec0
call fcn.00411372
add esp, 0xc
test eax, eax
jne 0x407008
mov eax, edi
pop edi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004104f3
add esp, 0xc
ret
mov eax, dword [0x436ec0]
mov cx, word [0x436ec4]
push esi
lea edx, [esp + 8]
xor esi, esi
push edx
mov dword [esp + 0xc], eax
mov word [esp + 0x10], cx
mov word [esp + 0x12], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, 2
je 0x4070c5
sub eax, 3
je 0x4070c5
lea eax, [esp + 8]
push esi
push eax
call fcn.0041231c
add esp, 8
test eax, eax
je 0x407144
push 0x104
push 0x436ec0
push 0x437378
mov dword [0x4372ec], 0xffffef32
mov word [0x437370], si
mov dword [0x437370], esi
call fcn.00410502
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x437580
mov word [0x43757e], si
call fcn.00410502
add esp, 0x18
mov word [0x437786], si
pop esi
mov dword [0x437374], 0x204
xor eax, eax
pop edi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004104f3
add esp, 0xc
ret
lea ecx, [esp + 8]
push esi
push ecx
call fcn.0041231c
add esp, 8
test eax, eax
je 0x407144
push 0x104
push 0x436ec0
push 0x437378
mov dword [0x4372ec], 0xffffef32
mov word [0x437370], si
mov dword [0x437370], esi
call fcn.00410502
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x437580
mov word [0x43757e], si
call fcn.00410502
add esp, 0x18
mov word [0x437786], si
pop esi
mov dword [0x437374], 0x1ec
xor eax, eax
pop edi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004104f3
add esp, 0xc
ret
mov ecx, dword [esp + 0x10]
pop esi
mov eax, edi
pop edi
xor ecx, esp
call fcn.004104f3
add esp, 0xc
ret
Function at 0x407160
Capabilities:
Create directory

Disassembly:
sub esp, 0xc48
mov eax, dword [0x42f278]
xor eax, esp
mov dword [esp + 0xc44], eax
push ebx
push ebp
push esi
push edi
push 0x410
xor ebx, ebx
lea eax, [esp + 0x18]
push ebx
push eax
mov esi, ecx
call fcn.00416890
push 0x420
lea ecx, [esp + 0x434]
push ebx
push ecx
call fcn.00416890
push 0x410
lea edx, [esp + 0x860]
push ebx
push edx
call fcn.00416890
lea edx, [esp + 0x38]
add esp, 0x24
mov eax, esi
sub edx, esi
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4071c0
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4071d6
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x12], 0x5c
je 0x407207
lea edi, [esp + 0x14]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4071f4
mov eax, dword [0x42bd8c]
mov dword [edi], eax
lea ecx, [esp + 0x14]
push 0x5c
push ecx
call fcn.00412984
lea edx, [esp + 0x1c]
push 0x5c
push edx
mov word [eax + 2], bx
call fcn.00411350
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x40722f
add ebp, 2
push 0x42bcc8
mov dword [esp + 0x14], 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [esp + 0x18]
push 0x42bcc8
push eax
call fcn.00411372
add esp, 0xc
test eax, eax
je 0x40725f
mov dword [esp + 0x10], ebx
jmp 0x407290
lea ecx, [esp + 0x18]
push 0x5c
push ecx
call fcn.00411350
add esp, 8
test eax, eax
jne 0x407279
xor eax, eax
jmp 0x4073d4
add eax, 2
push 0x5c
push eax
call fcn.00411350
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x407272
add ebp, 2
cmp word [ebp], bx
je 0x4073d2
lea ebx, [ebx]
push 0x5c
push ebp
call fcn.00411350
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4073d2
lea edx, [esp + 0x14]
mov esi, ebp
sub esi, edx
sar esi, 1
push esi
mov eax, edx
push eax
lea ecx, [esp + 0x84c]
push ecx
call fcn.00410502
xor eax, eax
add esp, 0xc
cmp dword [esp + 0x10], eax
mov word [esp + esi*2 + 0x844], 0
je 0x407340
jmp 0x4072f0
movzx ecx, word [eax + str._UNC_]
mov word [esp + eax + 0x424], cx
add eax, 2
test cx, cx
jne 0x4072f0
lea eax, [esp + 0x848]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407310
lea edi, [esp + 0x424]
sub eax, edx
add edi, 0xfffffffe
jmp 0x407330
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x407330
jmp 0x40738c
movzx ecx, word [eax + 0x42bce4]
mov word [esp + eax + 0x424], cx
add eax, 2
test cx, cx
jne 0x407340
lea eax, [esp + 0x844]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407360
lea edi, [esp + 0x424]
sub eax, edx
add edi, 0xfffffffe
jmp 0x407380
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x407380
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea edx, [esp + 0x428]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x4073bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4073ed
add ebp, 2
cmp word [ebp], 0
mov ebx, 1
jne 0x4072a0
mov eax, ebx
mov ecx, dword [esp + 0xc54]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004104f3
add esp, 0xc48
ret
mov eax, esi
jmp 0x4073d4
Function at 0x407700
Capabilities:
Check for time delay via gettickcount
Create directory
Delete directory
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x42f278]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
push edi
push 0x436ec0
mov edi, 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
push 0x436ec0
lea esi, [eax*2 + 0x436ebe]
call fcn.00412984
add esp, 8
cmp eax, esi
jne 0x407758
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x436ec0
push 0x42c188
lea eax, [esp + 0x14]
push eax
jmp 0x40776e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x436ec0
push str._s_08x
lea ecx, [esp + 0x14]
push ecx
call fcn.004112ba
add esp, 0x10
push 0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
jne 0x4077ac
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004104f3
add esp, 0x414
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x407814
push 0x208
lea ecx, [esp + 0x214]
push 0
push ecx
call fcn.00416890
add esp, 0xc
lea edx, [esp + 0x210]
push edx
push 0
push 0x42c1a8
push 0x436ec0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x407814
lea eax, [esp + 0x210]
push eax
call fcn.004041c0
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004104f3
add esp, 0x414
ret
mov ecx, dword [esp + 0x418]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.004104f3
add esp, 0x414
ret
Function at 0x408990
Capabilities:
Delete directory

Disassembly:
sub esp, 0x418
mov eax, dword [0x42f278]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
push edi
xor edi, edi
cmp dword [ebx], edi
je 0x4089ce
mov eax, ebx
mov edi, edi
mov eax, dword [eax]
cmp dword [eax], 0
je 0x4089c2
lea esi, [eax + 0x418]
call fcn.00403cb0
add edi, 1
cmp dword [ebx + edi*4], 0
lea eax, [ebx + edi*4]
jne 0x4089b0
cmp dword [ebx], 0
mov dword [esp + 8], 0
je 0x408aae
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, ebx
jmp 0x4089f0
mov eax, dword [esi]
cmp dword [eax], 0
je 0x408a96
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x408a96
push 0x436ec0
lea eax, [esp + 0x218]
push eax
call edi
push 0x436ec0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esi]
add ecx, 8
push ecx
lea edx, [esp + 0x10]
push edx
mov word [esp + eax*2 + 0x21a], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x218]
push ecx
call esi
test eax, eax
je 0x408a96
jmp 0x408a60
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [esp + 0xc]
push 0x5c
push eax
call fcn.00412984
add esp, 8
test eax, eax
je 0x408a83
mov word [eax], 0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x218]
push edx
call esi
test eax, eax
jne 0x408a60
mov eax, dword [esp + 8]
add eax, 1
cmp dword [ebx + eax*4], 0
lea esi, [ebx + eax*4]
mov dword [esp + 8], eax
jne 0x4089f0
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
xor ecx, esp
call fcn.004104f3
add esp, 0x418
ret
Function at 0x40bd80
Capabilities:
Delete directory

Disassembly:
sub esp, 0x414
mov eax, dword [0x42f278]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
push edi
push 0x208
lea eax, [esp + 0x214]
push 0
push eax
mov edi, ecx
call fcn.00416890
push 0x208
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00416890
mov esi, dword [edi + 0x418]
add esp, 0x18
test esi, esi
je 0x40be96
mov edi, edi
call fcn.00403cb0
mov esi, dword [esi + 0x820]
test esi, esi
jne 0x40bdd0
push ebp
mov ebp, dword [edi + 0x418]
test ebp, ebp
je 0x40be95
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x40be00
lea esi, [ebp + 0x410]
push esi
call edi
test eax, eax
je 0x40be86
push 0x436ec0
lea edx, [esp + 0x21c]
push edx
call ebx
push 0x436ec0
call edi
mov word [esp + eax*2 + 0x216], 0
push esi
lea eax, [esp + 0x14]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x21c]
push edx
call esi
test eax, eax
je 0x40be86
mov edi, edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.00412984
add esp, 8
test eax, eax
je 0x40be73
mov word [eax], 0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x21c]
push eax
call esi
test eax, eax
jne 0x40be50
mov ebp, dword [ebp + 0x820]
test ebp, ebp
jne 0x40be00
pop ebx
pop ebp
mov ecx, dword [esp + 0x418]
pop edi
pop esi
xor ecx, esp
call fcn.004104f3
add esp, 0x414
ret
Function at 0x40c9c0
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x424
mov eax, dword [0x42f278]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
mov ebp, dword [0x4377a4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x42bcc8
call esi
push eax
push 0x42bcc8
push 0x436ec0
call fcn.00411372
add esp, 0xc
xor ebx, ebx
test eax, eax
jne 0x40caba
jmp 0x40ca10
movzx ecx, word [eax + 0x436ec0]
mov word [esp + eax + 0x1c], cx
add eax, 2
cmp cx, bx
jne 0x40ca10
lea eax, [esp + 0x1c]
push eax
call esi
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
lea esi, [esp + eax*2 + 0x22]
call fcn.00412984
add esp, 8
cmp eax, esi
je 0x40ca65
push edi
lea edi, [esp + 0x20]
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x40ca50
mov edx, dword [0x42bd8c]
mov dword [edi], edx
pop edi
lea eax, [esp + 0x20]
push 0x5c
push eax
call fcn.00411350
add esp, 8
cmp eax, ebx
je 0x40cbc7
add eax, 2
push 0x5c
push eax
call fcn.00411350
add esp, 8
cmp eax, ebx
je 0x40cbc7
lea ecx, [esp + 0x1c]
sub eax, ecx
sar eax, 1
mov esi, eax
lea edx, [esi + 1]
push edx
mov eax, ecx
push eax
lea ecx, [esp + 0x22c]
push ecx
call fcn.00410502
mov word [esp + esi*2 + 0x232], bx
jmp 0x40cb27
mov eax, 0x436ec0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40cac2
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x40cae9
cmp word [0x436ec2], 0x3a
jne 0x40cae9
push 2
push 0x436ec0
jmp 0x40cb08
lea eax, [esp + 0x1c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40cbc7
push 2
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x22c]
push edx
call fcn.00410502
mov word [esp + 0x234], 0x5c
mov word [esp + 0x236], bx
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x40cbe1
push 0x40
push str.GetDiskFreeSpace2
push 0x4372f0
mov dword [0x4372ec], 0xcb
call fcn.00410502
add esp, 0xc
mov word [0x437370], bx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
push 0x436ec0
push 0x437378
mov dword [0x437370], eax
call fcn.00410502
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x437580
mov word [0x43757e], bx
call fcn.00410502
add esp, 0x18
mov word [0x437786], bx
mov dword [0x437374], 0xfb7
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004104f3
add esp, 0x424
ret
xor edx, edx
mov eax, ebp
div dword [esp + 0x14]
cmp edx, ebx
je 0x40cbf0
add eax, 1
xor edx, edx
div dword [esp + 0x10]
cmp edx, ebx
je 0x40cbfd
add eax, 1
cmp dword [esp + 0xc], eax
jae 0x40cc63
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x437580
mov dword [0x4372ec], 0xffffef30
mov word [0x437370], bx
mov dword [0x437370], ebx
mov word [0x43757e], bx
call fcn.00410502
add esp, 0xc
pop esi
pop ebp
mov word [0x437786], bx
mov dword [0x437374], 0xfce
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004104f3
add esp, 0x424
ret
mov ecx, dword [esp + 0x42c]
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004104f3
add esp, 0x424
ret
Function at 0x40f730
Capabilities:
Get file version info
Link many functions at runtime

Disassembly:
sub esp, 0x250
mov eax, dword [0x42f278]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
xor edi, edi
push str.sflog.dll
mov dword [esp + 0x10], edi
call esi
test eax, eax
mov dword [0x4377cc], eax
je 0x40f8cc
push str.sfcommon.dll
call esi
test eax, eax
mov dword [0x4377d0], eax
je 0x40f8e6
mov ecx, dword [0x4377cc]
push 0x104
lea eax, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x54]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [esp + 0x10], eax
je 0x40f8cc
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x40f8cc
mov ecx, dword [esp + 0x10]
push ebx
push ecx
push edi
lea edx, [esp + 0x5c]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x42bd8c
push ebx
call sub.VERSION.dll_VerQueryValueW
mov esi, dword [esp + 0x14]
mov ecx, 0xd
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x10
cmp ax, 7
jb 0x40f8b1
jne 0x40f81b
cmp cx, 0x32
jb 0x40f8b1
mov edx, dword [0x4377cc]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.sflog_log_init
push edx
call esi
test eax, eax
mov dword [0x4377d4], eax
je 0x40f8b1
mov eax, dword [0x4377cc]
push str.sflog_set_UserNameW
push eax
call esi
test eax, eax
mov dword [0x4377d8], eax
je 0x40f8b1
mov ecx, dword [0x4377cc]
push str.sflog_log_writeAccessFltW
push ecx
call esi
test eax, eax
mov dword [0x4377dc], eax
je 0x40f8b1
mov edx, dword [0x4377cc]
push str.sflog_log_term
push edx
call esi
test eax, eax
mov dword [0x4377e0], eax
je 0x40f8b1
mov eax, dword [0x4377d0]
push str.sfcm_reg_GetValueW
push eax
call esi
test eax, eax
mov dword [0x4377e4], eax
je 0x40f8b1
mov ecx, dword [0x4377d0]
push str.sfcm_misc_GetUNCPath
push ecx
call esi
test eax, eax
mov dword [0x4377e8], eax
je 0x40f8b1
mov dword [esp + 0xc], 1
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0xc], 0
jne 0x40f91a
mov edi, dword [esp + 0xc]
mov eax, dword [0x4377d0]
test eax, eax
je 0x40f8e6
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4377d0], 0
mov eax, dword [0x4377cc]
test eax, eax
je 0x40f900
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4377cc], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.004104f3
add esp, 0x250
ret
mov ecx, dword [esp + 0x258]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004104f3
add esp, 0x250
ret