joyce8/EMBER2024-capa huggingface dataset:
Function at 0x586410
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x586470
push 0
push 0
call fcn.0058b6e1
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x586439
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x586457
cmp eax, 0xffffffff
je 0x586457
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x586f40
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
cmp dword [0x67c544], 1
jb 0x58704e
mov edi, dword [ebp + 8]
ja 0x586fcd
movzx edx, byte [ebp + 0xc]
mov eax, edx
shl edx, 8
or edx, eax
movd xmm3, edx
pshuflw xmm3, xmm3, 0
movlhps xmm3, xmm3
mov ecx, 0xf
and ecx, edi
or eax, 0xffffffff
shl eax, cl
sub edi, ecx
xor edx, edx
pop edi
pop esi
leave
ret
and al, 8
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x587087

Function at 0x5876a2
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x5876c0
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x5876bb
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x5876a5
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
adc ebx, ebp
invalid
adc ebx, ebp
or byte [ebx], bh
ror dword [edi], cl
test dword [esi + 1], ecx
add byte [eax], al
cmp edx, ebx
jne 0x5877fb
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x58767c
add eax, dword [eax + 4]
jmp 0x587669
mov dword [ebp + 0xc], ebx
jmp 0x5876cb
Function at 0x5876cd
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
or al, 0x66
cmp eax, dword [edi + 6]
jne 0x5876e3
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x587701
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x58775f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x587746
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x58774f
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x587759
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x58773b
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x5876c5
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x5877ac
dec eax
je 0x5877a3
sub eax, 3
je 0x58779a
mov dword [ebp - 4], 0x40
jmp 0x5877c9
mov dword [ebp - 4], 4
jmp 0x5877af
mov dword [ebp - 4], 0x20
jmp 0x5877af
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
jne 0x5877c7
call dword [ebp - 0xbc]
test eax, eax
je 0x5877fb
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x58777b
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0058700c
and eax, 0xffcf08b6
jne 0x587806
push 1
push esi
call edi
mov eax, esi
jmp 0x587807
rcr byte [edi + 0x5e], 0x5b
Function at 0x5883dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
je 0x58919f
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00586f7d
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x588419
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x588462
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x58840c
call fcn.0058700c
js 0x5884a5
pushfd
lodsb al, byte [esi]
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0058700c
adc eax, 0x8d941d54
test esp, edx
clc
invalid
fdiv st(0), st(0)
invalid
Function at 0x58c2a5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0058c124
Function at 0x4073e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4073fb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407434
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x407430
jmp 0x407420
cmp esi, eax
jae 0x407434
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x407420
cmp esi, eax
jb 0x40743b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x409422
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x409446
cmp dword [edi + 0x54], 0
jne 0x409446
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0040b6ab
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004093e3
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x411311
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x411358
call fcn.0040b6ab
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x411358
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x411374
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00410e89
mov esi, eax
test edi, edi
je 0x411372
test ebx, ebx
je 0x411372
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x417333
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x439f18]
jne 0x41733d
repz ret
jmp fcn.0041c916
Function at 0x426840
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041c325
and dword [ebp - 4], 0
cmp dword [0x43dca8], 0
mov ebx, eax
jne 0x4268f1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4269a2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43267c
push edi
call esi
test eax, eax
je 0x4269a2
push eax
call fcn.0041c2b3
mov dword [esp], 0x43266c
push edi
mov dword [0x43dca8], eax
call esi
push eax
call fcn.0041c2b3
mov dword [esp], 0x432658
push edi
mov dword [0x43dcac], eax
call esi
push eax
call fcn.0041c2b3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43dcb0], eax
call esi
push eax
call fcn.0041c2b3
pop ecx
mov dword [0x43dcb8], eax
test eax, eax
je 0x4268f1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041c2b3
pop ecx
mov dword [0x43dcb4], eax
mov eax, dword [0x43dcb4]
cmp eax, ebx
je 0x426949
cmp dword [0x43dcb8], ebx
je 0x426949
push eax
call fcn.0041c32e
push dword [0x43dcb8]
mov esi, eax
call fcn.0041c32e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x426949
test edi, edi
je 0x426949
call esi
test eax, eax
je 0x426940
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x426940
test byte [ebp - 0xc], 1
jne 0x426949
or dword [ebp + 0x10], 0x200000
jmp 0x426982
mov eax, dword [0x43dcac]
cmp eax, ebx
je 0x426982
push eax
call fcn.0041c32e
pop ecx
test eax, eax
je 0x426982
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x426982
mov eax, dword [0x43dcb0]
cmp eax, ebx
je 0x426982
push eax
call fcn.0041c32e
pop ecx
test eax, eax
je 0x426982
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43dca8]
call fcn.0041c32e
pop ecx
test eax, eax
je 0x4269a2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4269a4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401040
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
push edi
push 0x427590
push esi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00403b10
mov edi, eax
add esp, 8
mov dword [esp + 0x10], edi
test edi, edi
jne 0x401095
mov eax, dword [esp + 0x20]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402340
add esp, 8
push ebp
call fcn.0041256e
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0xc
ret
push ebx
mov ebx, dword [esp + 0x24]
xor eax, eax
push 0
mov ecx, dword [ebx + 4]
add ecx, dword [esi + 0x1000]
adc eax, dword [esi + 0x1004]
push eax
push ecx
push edi
call fcn.0040e8a6
add esp, 0x10
test eax, eax
jns 0x4010d7
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00402470
add esp, 0xc
jmp 0x4011a1
push dword [ebx + 0xc]
call fcn.00412589
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x401106
push dword [ebx + 0xc]
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.00402470
add esp, 0x10
jmp 0x4011a1
cmp byte [ebx + 0x10], 1
jne 0x40111b
push ebp
push 0
push ebx
push edi
call fcn.004011e0
add esp, 0x10
jmp 0x401192
mov esi, dword [ebx + 0xc]
xor ebx, ebx
mov dword [esp + 0x10], eax
test esi, esi
je 0x40116d
test ebx, ebx
jb 0x40113d
ja 0x401136
cmp esi, 0x2000
jbe 0x40113d
mov edi, 0x2000
jmp 0x40113f
mov edi, esi
push dword [esp + 0x14]
push 1
push edi
push eax
call fcn.0040e482
add esp, 0x10
cmp eax, 1
jb 0x401171
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebx, 0
add eax, edi
mov dword [esp + 0x10], eax
test ebx, ebx
ja 0x401136
jb 0x40116d
test esi, esi
jne 0x401128
xor eax, eax
jmp 0x40118e
mov eax, dword [esp + 0x24]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00402470
add esp, 0xc
or eax, 0xffffffff
mov edi, dword [esp + 0x14]
test eax, eax
je 0x4011a1
push ebp
call fcn.0041256e
add esp, 4
xor ebp, ebp
push edi
call fcn.0040e221
add esp, 4
pop ebx
test ebp, ebp
je 0x4011c0
push dword [esp + 0x24]
push ebp
call fcn.00403c20
add esp, 8
mov dword [esp + 0x14], eax
push ebp
call fcn.0041256e
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x4015a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
cmp byte [ebx + 0x11], 0x6e
jne 0x4015df
push dword [esp + 0x20]
push ebx
push dword [esp + 0x20]
call fcn.00401040
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x4015d7
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_create_symbolic_link__s__n
call fcn.00402340
add esp, 8
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret
push edi
push 0x427678
push dword [esp + 0x28]
call fcn.00403b10
mov edi, eax
add esp, 8
mov dword [esp + 0x14], edi
test edi, edi
jne 0x40161b
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_open_target_file__n
push str.fopen
call fcn.00402470
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov esi, dword [esp + 0x1c]
push ebp
push 0x427590
push esi
call fcn.00403b10
mov ebp, eax
add esp, 8
mov dword [esp + 0x14], ebp
test ebp, ebp
jne 0x401651
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402340
add esp, 8
or edi, 0xffffffff
jmp 0x40178c
mov ecx, dword [ebx + 4]
xor eax, eax
add ecx, dword [esi + 0x1000]
push 0
adc eax, dword [esi + 0x1004]
push eax
push ecx
push ebp
call fcn.0040e8a6
add esp, 0x10
test eax, eax
jns 0x401691
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00402470
add esp, 0xc
or edi, 0xffffffff
jmp 0x401783
cmp byte [ebx + 0x10], 1
jne 0x4016ab
push 0
push edi
push ebx
push ebp
call fcn.004011e0
add esp, 0x10
mov edi, eax
jmp 0x401783
push 0x2000
xor edi, edi
call fcn.00412589
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4016e0
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
push str.malloc
call fcn.00402470
add esp, 0xc
or edi, 0xffffffff
jmp 0x401783
mov esi, dword [ebx + 0xc]
xor ebp, ebp
test esi, esi
je 0x401776
nop dword [eax]
test ebp, ebp
jb 0x401705
ja 0x4016fe
cmp esi, 0x2000
jbe 0x401705
mov edi, 0x2000
jmp 0x401707
mov edi, esi
push dword [esp + 0x14]
push 1
push edi
push eax
call fcn.0040e482
add esp, 0x10
cmp eax, 1
jb 0x401759
push dword [esp + 0x18]
push 1
push edi
push dword [esp + 0x1c]
call fcn.0040eba5
add esp, 0x10
cmp eax, 1
jb 0x401749
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebp, 0
jne 0x4016f0
jb 0x401745
test esi, esi
jne 0x4016f0
xor edi, edi
jmp 0x401772
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_write_data_chunk__n
push str.fwrite
jmp 0x401767
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00402470
add esp, 0xc
or edi, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call fcn.0041256e
mov ebp, dword [esp + 0x18]
add esp, 4
push ebp
call fcn.0040e221
add esp, 4
push dword [esp + 0x18]
call fcn.0040e221
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x406b80
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1004
call fcn.0040af90
mov eax, dword [0x435040]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebx
push esi
push edi
mov edi, dword [esp + 0x1018]
xor ebx, ebx
push 0x427590
push eax
call fcn.00403b10
mov esi, eax
add esp, 8
test esi, esi
je 0x406bdc
push 0x427678
push edi
call fcn.00403b10
add esp, 8
mov edi, eax
push esi
test edi, edi
jne 0x406bf7
call fcn.0040e221
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0040ac53
add esp, 0x1004
ret
call fcn.0040e251
add esp, 4
test eax, eax
jne 0x406c69
push esi
push 0x1000
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0040e482
add esp, 0x10
test eax, eax
je 0x406c50
push edi
push eax
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0040eba5
add esp, 0x10
test eax, eax
je 0x406c4d
push edi
call fcn.0040e27d
add esp, 4
test eax, eax
jne 0x406c4d
push esi
call fcn.0040e251
add esp, 4
test eax, eax
je 0x406c03
jmp 0x406c69
push edi
jmp 0x406c5e
push esi
call fcn.0040e27d
add esp, 4
test eax, eax
je 0x406c69
push esi
call fcn.0041445b
add esp, 4
or ebx, 0xffffffff
push esi
call fcn.0040e221
push edi
call fcn.0040e221
mov ecx, dword [esp + 0x1014]
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040ac53
add esp, 0x1004
ret

Function at 0x406ca0
Capabilities:
Create directory

Disassembly:
mov eax, 0x3008
call fcn.0040af90
mov eax, dword [0x435040]
xor eax, esp
mov dword [esp + 0x3004], eax
mov eax, dword [esp + 0x300c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x301c]
mov ecx, esi
push edi
mov edi, dword [esp + 0x3024]
mov dword [esp + 0x10], eax
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406ce0
sub ecx, edx
mov edx, edi
lea ebx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x406cf0
sub edx, ebx
lea eax, [edx + 1]
add eax, ecx
cmp eax, 0x1000
jae 0x406db1
push 0x5c
push esi
push str._s_c
lea eax, [esp + 0x20]
push 0x1000
push eax
call fcn.00401b80
push 0x5c
push edi
mov ebp, eax
call fcn.0040c040
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x406dad
mov ebx, 0x1000
sub ebx, ebp
lea ebp, [esp + ebp + 0x14]
nop
push edi
mov eax, esi
sub eax, edi
push eax
push 0x428f08
push ebx
push ebp
call fcn.00401b80
lea eax, [esp + 0x28]
push eax
call fcn.00403ab0
add esp, 0x18
test eax, eax
jne 0x406d99
push 0x1000
lea eax, [esp + 0x1018]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00407d60
mov eax, dword [esp + 0x1c]
add esp, 0xc
push dword [eax + 0x301c]
lea eax, [esp + 0x1018]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x406db1
lea eax, [esi + 1]
push 0x5c
push eax
call fcn.0040c040
mov esi, eax
add esp, 8
test esi, esi
jne 0x406d40
xor eax, eax
jmp 0x406db4
or eax, 0xffffffff
mov ecx, dword [esp + 0x3014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040ac53
add esp, 0x3008
ret
Function at 0x406f70
Capabilities:
Create directory
Get disk information
Query environment variable

Disassembly:
mov eax, 0x4004
call fcn.0040af90
mov eax, dword [0x435040]
xor eax, esp
mov dword [esp + 0x4000], eax
mov eax, dword [esp + 0x4008]
push edi
push 0
push 0
push eax
call fcn.00407d60
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x406fc8
push str.LOADER:_failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.00402400
add esp, 4
xor eax, eax
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040ac53
add esp, 0x4004
ret
push esi
push 0x1000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov esi, eax
call fcn.0041256e
add esp, 4
test esi, esi
jne 0x40700f
push str.LOADER:_failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
call fcn.00402400
add esp, 4
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040ac53
add esp, 0x4004
ret
lea eax, [esp + 8]
push eax
call fcn.00407c10
add esp, 4
test eax, eax
je 0x4070a6
cmp word [esp + 0xc], 0x5c
je 0x407046
lea edi, [esp + 8]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x407033
mov eax, dword [0x429020]
mov dword [edi], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jg 0x407082
push eax
lea eax, [esp + 0xc]
push eax
push str.LOADER:_runtime_tmpdir_points_to_non_existent_drive__ls__type:__d___n
call fcn.00402400
add esp, 0xc
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040ac53
add esp, 0x4004
ret
lea eax, [esp + 8]
push eax
call fcn.00414b43
add esp, 4
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040ac53
add esp, 0x4004
ret
push 0x1000
lea eax, [esp + 0xc]
push eax
push 0
call fcn.00414fd4
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4070e6
push str.LOADER:_failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.00402400
add esp, 4
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040ac53
add esp, 0x4004
ret
push 0x5c
push esi
call fcn.0040c2a7
mov edi, eax
add esp, 8
test edi, edi
je 0x407146
nop word [eax + eax]
mov ecx, edi
lea eax, [esp + 0x2008]
push esi
sub ecx, esi
sar ecx, 1
push ecx
push str._.s
push 0x1000
push eax
call fcn.00402300
add esp, 0x14
lea eax, [esp + 0x2008]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [edi + 2]
push 0x5c
push eax
call fcn.0040c2a7
mov edi, eax
add esp, 8
test edi, edi
jne 0x407100
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407192
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x407192
push esi
push str.LOADER:_failed_to_create_runtime_tmpdir_path__ls__n
push str.CreateDirectory
call fcn.00402690
push esi
call fcn.0041256e
add esp, 0x10
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040ac53
add esp, 0x4004
ret
mov ecx, dword [esp + 0x4008]
mov eax, esi
pop esi
pop edi
xor ecx, esp
call fcn.0040ac53
add esp, 0x4004
ret