joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x98
push 0
push 0x4cc66c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x4cc670], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4cc66c], eax
mov eax, 0x4ca4e8
mov dword [0x4cc6ac], eax
call fcn.0041acc0
call fcn.0041a17f
call fcn.00419d20
call fcn.004189a0
call fcn.00416adc
call fcn.00416380
call fcn.00415964
call fcn.00414991
call fcn.004144e8
call fcn.004142b8
call fcn.0041412c
call fcn.00413b44
call fcn.0041353b
call fcn.00412bf0
call fcn.00411576
call fcn.0040e99a
call fcn.0040d989
call fcn.0040c55c
call fcn.0040c3b7
call fcn.0040b8d9
call fcn.0040b1a2
call fcn.0040af8e
call fcn.00408829
push edx
call fcn.0041ad10
pop edx
push eax
push edx
call fcn.0041ad10
pop edx
push eax
push edx
call fcn.0041ad10
pop edx
push eax
push edx
call fcn.0041ad10
pop edx
push eax
push edx
call fcn.0041ad10
pop edx
push eax
call fcn.0040b1d1
call fcn.004081e2
add dword [esp], edx
call fcn.004127c0
call fcn.004081e2
add dword [esp], edx
call fcn.0041283f
call fcn.00408200
mov eax, str.Advapi32.dll
push eax
push 0xffffffff
call fcn.0040c42a
mov dword [0x4cc684], eax
cmp dword [0x4cc684], 0
je 0x401194
mov eax, str.RegDeleteKeyExW
push eax
push dword [0x4cc684]
call fcn.0040c484
mov dword [0x4cc688], eax
mov eax, 0x4c941c
push eax
push dword [0x4cc684]
call fcn.0040c484
mov dword [0x4cc678], eax
mov eax, str.RegDeleteTreeW
push eax
push dword [0x4cc684]
call fcn.0040c484
mov dword [0x4cc680], eax
mov eax, 0x4c9976
push eax
push dword [0x4cc684]
call fcn.0040c484
mov dword [0x4cc674], eax
mov eax, str.RegCopyTreeW
push eax
push dword [0x4cc684]
call fcn.0040c484
mov dword [0x4cc67c], eax
push dword [0x4cc6e4]
call fcn.00414a42
push 7
push 0x4ca4d8
lea eax, [0x4cc6e4]
push eax
push 0xc
call fcn.004149b0
push dword [0x4cc6ec]
call fcn.00414a42
push 7
push 0x4ca4e0
lea eax, [0x4cc6ec]
push eax
push 4
call fcn.004149b0
push dword [0x4cc6f4]
call fcn.00414a42
push 7
push 0x4ca4ac
lea eax, [0x4cc6f4]
push eax
push 8
call fcn.004149b0
push dword [0x4cc6fc]
call fcn.00414a42
push 7
push 0x4ca4c8
lea eax, [0x4cc6fc]
push eax
push 0xc
call fcn.004149b0
mov dword [0x4cc6b0], 0
call fcn.0040634e
call fcn.00406cce
push 0
call 0x40125f
call fcn.0041acf0
push dword [0x4cc66c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004087e7
call fcn.0040b8c7
call fcn.0040c3ab
call fcn.0040c510
call fcn.0040e944
call fcn.00411553
call fcn.00412851
call fcn.00412be0
call fcn.0041351d
call fcn.0041411b
call fcn.004144dc
call fcn.00415957
call fcn.004189c0
call fcn.0041a20d
call fcn.0041a352
call fcn.00419d10
ret
Function at 0x405e27
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
xor eax, eax
push eax
push eax
call fcn.0041ad90
push edx
call fcn.0041ad10
pop edx
push eax
push edx
call fcn.0041ad10
pop edx
push eax
call fcn.0040b1d1
lea eax, [esp + 4]
push eax
call fcn.0041adf0
push edx
call fcn.0041ad10
pop edx
push eax
push edx
call fcn.0041ad10
pop edx
push eax
call fcn.0041289d
push edx
call fcn.0041ad10
pop edx
push eax
call fcn.004013cd
pop eax
mov edx, str..bat
push edx
call fcn.0041aee0
lea eax, [esp + 8]
push eax
call fcn.0041adf0
push dword [esp + 4]
push 0
call fcn.00412e00
and eax, eax
je 0x406040
mov eax, 0x4c92e8
push eax
push 0
call fcn.00413120
mov eax, str.:DeleteFile
push eax
push 0
call fcn.00413120
push edx
call fcn.0041ad10
pop edx
push eax
push edx
call fcn.0041ad10
pop edx
push eax
mov edx, str.del__
push edx
call fcn.0041aee0
mov edx, dword [esp + 8]
push edx
call fcn.0041aee0
mov edx, 0x4c9120
push edx
call fcn.0041aee0
call fcn.0041ae80
push 0
call fcn.004081e2
add dword [esp + 4], edx
call fcn.00413120
call fcn.00408200
push edx
call fcn.0041ad10
pop edx
push eax
push edx
call fcn.0041ad10
pop edx
push eax
mov edx, str.if_exist__
push edx
call fcn.0041aee0
mov edx, dword [esp + 8]
push edx
call fcn.0041aee0
mov edx, str.__goto_DeleteFile
push edx
call fcn.0041aee0
call fcn.0041ae80
push 0
call fcn.004081e2
add dword [esp + 4], edx
call fcn.00413120
call fcn.00408200
mov edx, dword [esp]
xor ecx, ecx
call fcn.00408220
jne 0x405fb6
push edx
call fcn.0041ad10
pop edx
push eax
push edx
call fcn.0041ad10
pop edx
push eax
mov edx, str.rd__
push edx
call fcn.0041aee0
lea ebp, [0x4cc6d4]
mov edx, dword [ebp + 8]
push edx
call fcn.0041aee0
mov edx, 0x4c9120
push edx
call fcn.0041aee0
call fcn.0041ae80
push 0
call fcn.004081e2
add dword [esp + 4], edx
call fcn.00413120
call fcn.00408200
push edx
call fcn.0041ad10
pop edx
push eax
push edx
call fcn.0041ad10
pop edx
push eax
mov edx, str.del__
push edx
call fcn.0041aee0
mov edx, dword [esp + 0xc]
push edx
call fcn.0041aee0
mov edx, 0x4c9120
push edx
call fcn.0041aee0
call fcn.0041ae80
push 0
call fcn.004081e2
add dword [esp + 4], edx
call fcn.00413120
call fcn.00408200
mov eax, 0x4c99a8
push eax
push 0
call fcn.00413120
push 0
call fcn.00412b20
push 0
push 0
push 0
push dword [esp + 0x10]
mov eax, str.open
push eax
push 0
call sub.SHELL32.DLL_ShellExecuteW
xor eax, eax
push dword [esp + 4]
call fcn.0041aeb0
push dword [esp]
call fcn.0041aeb0
add esp, 8
pop ebp
ret

Function at 0x406e12
Capabilities:
Check mutex on windows

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.0041ad90
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.00408000
push dword [esp]
push 1
push 0
call sub.KERNEL32.dll_CreateMutexW
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
and ebx, ebx
je 0x406e5c
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
jne 0x406e5c
mov eax, 1
jmp 0x406e5e
xor eax, eax
and eax, eax
je 0x406e74
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, 1
jmp 0x406e7a
xor eax, eax
jmp 0x406e7a
push dword [esp]
call fcn.0041aeb0
add esp, 8
pop ebx
ret 4
Function at 0x406e89
Capabilities:
Get file system object information

Disassembly:
push ebp
push ebx
mov edx, 0xae
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x406e90
call fcn.0041ad90
mov edx, dword [esp + 0x2c4]
lea ecx, [esp]
call fcn.00408000
push 0x110
push 0x2b4
lea eax, [esp + 0xc]
push eax
push 0
mov eax, dword [esp + 0x10]
push eax
call sub.SHELL32.DLL_SHGetFileInfoW
lea ebp, [esp + 4]
mov eax, dword [ebp]
jmp 0x406eda
push dword [esp]
call fcn.0041aeb0
add esp, 0x2b8
pop ebx
pop ebp
ret 4
Function at 0x406eed
Capabilities:
Get file system object information

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xb4
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x406ef5
call fcn.0041ad90
mov edx, dword [esp + 0x2e0]
lea ecx, [esp]
call fcn.00408000
push dword [esp]
call fcn.004129bd
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x406f32
jg 0x406f2e
cmp ebx, 0
jb 0x406f32
xor eax, eax
jmp 0x406f37
mov eax, 1
or eax, eax
je 0x406f42
xor eax, eax
jmp 0x4071d5
push dword [esp + 0x2e4]
mov ebx, 1
cmp ebx, dword [esp]
jg 0x406f6d
mov ebx, 0x10
cmp ebx, dword [esp]
jl 0x406f6d
mov dword [esp + 0x2c8], 1
jmp 0x406ff3
mov ebx, 0x11
cmp ebx, dword [esp]
jg 0x406f8e
mov ebx, 0x20
cmp ebx, dword [esp]
jl 0x406f8e
mov dword [esp + 0x2c8], 0
jmp 0x406ff3
mov ebx, 0x21
cmp ebx, dword [esp]
jg 0x406faf
mov ebx, 0x30
cmp ebx, dword [esp]
jl 0x406faf
mov dword [esp + 0x2c8], 2
jmp 0x406ff3
mov ebx, 0x31
cmp ebx, dword [esp]
jg 0x406fe9
mov ebx, 0x2000
cmp ebx, dword [esp]
jl 0x406fe9
call fcn.00411374
mov ebx, eax
cmp ebx, 0x46
jl 0x406fdc
mov dword [esp + 0x2c8], 4
jmp 0x406fe7
mov dword [esp + 0x2c8], 2
jmp 0x406ff3
xor eax, eax
add esp, 4
jmp 0x4071d5
pop eax
push 0x4000
push 0x2b4
lea eax, [esp + 0xc]
push eax
push 0
mov eax, dword [esp + 0x10]
push eax
call sub.SHELL32.DLL_SHGetFileInfoW
lea eax, [esp + 0x2b8]
push eax
mov ebp, 0x4ca6a8
push ebp
push dword [esp + 0x2cc]
call fcn.004071e9
mov ebx, eax
and ebx, ebx
jne 0x4071ca
lea eax, [esp + 0x2bc]
push eax
push 1
lea ebp, [esp + 0xc]
push dword [ebp + 4]
mov eax, dword [esp + 0x2c4]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
cmp dword [esp + 0x2bc], 0
je 0x4071ca
push 0xffffffff
push 0x20
push dword [esp + 0x2ec]
push dword [esp + 0x2f0]
push 0xffffffff
call fcn.00414532
mov dword [esp + 0x2c0], eax
cmp dword [esp + 0x2c0], 0
je 0x4071ca
push dword [esp + 0x2c0]
call fcn.004146da
push eax
call fcn.004142ec
and eax, eax
je 0x4071ca
cmp dword [esp + 0x2e8], 0
je 0x4070e9
push dword [esp + 0x2e4]
push dword [esp + 0x2e8]
push 0
push 0
push dword [esp + 0x2cc]
call fcn.00414351
jmp 0x4071b9
lea eax, [esp + 0x2cc]
push eax
lea eax, [esp + 0x2cc]
push eax
mov eax, dword [esp + 0x2c0]
push eax
mov eax, dword [eax]
call dword [eax + 0x40]
mov ebx, dword [esp + 0x2e4]
cmp ebx, dword [esp + 0x2c8]
jl 0x407128
mov ebx, dword [esp + 0x2e4]
cmp ebx, dword [esp + 0x2cc]
jl 0x407128
jmp 0x40712f
mov eax, 1
jmp 0x407131
xor eax, eax
and eax, eax
je 0x40715b
push dword [esp + 0x2e4]
push dword [esp + 0x2e8]
push 0
push 0
push dword [esp + 0x2cc]
call fcn.00414351
jmp 0x4071b9
mov ebx, dword [esp + 0x2e4]
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov edi, dword [esp + 0x2cc]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
push ebx
mov ebx, dword [esp + 0x2e8]
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov edi, dword [esp + 0x2cc]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
push ebx
push dword [esp + 0x2c4]
call fcn.00414393
push dword [esp + 0x2bc]
call sub.USER32.DLL_DestroyIcon
call fcn.004143e8
mov eax, dword [esp + 0x2c0]
jmp 0x4071d5
push dword [esp]
call fcn.0041aeb0
add esp, 0x2d0
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4088b4
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x40894c
push edi
push 0x4ccf80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4cc70c]
test edi, edi
je 0x408920
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x408919
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x4cc70c
call fcn.0041ac16
pop ecx
pop ecx
jmp 0x40891b
mov edi, dword [edi]
test edi, edi
jne 0x4088f0
pop ebx
mov eax, dword [0x4ca6d8]
mov esi, eax
inc eax
push 0x10
push 0x4cc70c
mov dword [0x4ca6d8], eax
call fcn.0041ac56
pop ecx
pop ecx
push 0x4ccf80
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x40b0c1
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x40b116
push dword [esp + 0x10]
push 0x40b040
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x4cc710]
test esi, esi
je 0x40b16f
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x40b10e
cmp byte [esi + 0x10], 0
je 0x40b10e
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x40b0ea
jmp 0x40b16f
mov esi, dword [0x4cc710]
test esi, esi
je 0x40b16f
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x40b168
cmp byte [esi + 0x11], 0
je 0x40b144
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x40b15b
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x4cc710
call fcn.0041ac16
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x40b123
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x40c723
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xc], 0
jle 0x40c741
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call sub.MSVCRT.dll_memmove
add esp, 0xc
push 0
lea eax, [ebp + 8]
push eax
mov eax, 0x1000
sub eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 4]
add eax, dword [esi + 0xc]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x40c76d
mov dword [esi + 0x10], 1
mov eax, dword [esi + 4]
add dword [esi + 0xc], ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret
Function at 0x411374
Capabilities:
Check os version

Disassembly:
sub esp, 0x34c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x114
push eax
mov esi, 0xc8
xor ebx, ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4114cc
mov eax, dword [esp + 0x20]
dec eax
je 0x4114af
dec eax
jne 0x4114cc
lea eax, [esp + 0x124]
xor ebp, ebp
push eax
call fcn.0041132d
pop ecx
test eax, eax
je 0x4113e0
mov ebx, dword [esp + 0x128]
mov edi, dword [esp + 0x12c]
cmp byte [esp + 0x23e], 1
jmp 0x41140d
lea eax, [esp + 0x240]
mov dword [esp + 0x240], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x411412
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp byte [esp + 0x35a], 1
jne 0x411412
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x4114ab
dec ebx
je 0x4114a7
dec ebx
je 0x411486
dec ebx
je 0x411440
sub ebx, 4
jne 0x4114cc
test edi, edi
jne 0x4114cc
push 0x6e
jmp 0x4114cb
sub edi, 0
je 0x411478
dec edi
je 0x41146a
dec edi
je 0x41145c
dec edi
jne 0x4114cc
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x4114cc
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x4114cc
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x4114cc
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x4114cc
sub edi, 0
je 0x4114a3
dec edi
je 0x41149f
dec edi
jne 0x4114cc
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x4114cc
push 0x3c
jmp 0x4114cb
push 0x32
jmp 0x4114cb
push 0x14
jmp 0x4114cb
push 5
jmp 0x4114cb
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4114c9
cmp eax, 0xa
je 0x4114c5
cmp eax, 0x5a
jne 0x4114cc
push 0x28
jmp 0x4114cb
push 0x1e
jmp 0x4114cb
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x34c
ret
Function at 0x4123a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x412422
push 9
call esi
test al, al
jns 0x412422
push 0x11
call esi
test al, al
js 0x412422
push 0x10
call esi
test al, al
js 0x412422
push 0x12
call esi
test al, al
js 0x412422
push 5
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetClassNameW]
push 4
lea eax, [ebp - 0x10]
push str.Rich
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x412422
push eax
push eax
push 0x44e
push ebx
call dword [sym.imp.USER32.DLL_SendMessageW]
test eax, 0x800
jne 0x412422
xor eax, eax
jmp 0x4124a3
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41244a
push 0x11
call esi
test al, al
js 0x412442
push 0x10
call esi
test al, al
js 0x412442
push 0x12
call esi
test al, al
jns 0x41244a
push 1
push edi
call fcn.004124ab
mov esi, dword [sym.imp.USER32.DLL_GetPropW]
test ebx, ebx
je 0x412460
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x4124a0
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x4124a0
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x4124a0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x4124a0
lea eax, [esi - 1]
push eax
push dword [0x4cd014]
call fcn.0041a4e7
test eax, eax
je 0x4124a0
mov eax, dword [eax + 8]
jmp 0x4124a2
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4129bd
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x412b05
xor ecx, ecx
cmp word [eax], cx
je 0x412b05
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x412a16
cmp eax, 3
jne 0x412a50
cmp word [esp + 0xa], 0x3a
jne 0x412a50
cmp eax, 2
jne 0x412a34
lea eax, [esp + 8]
push 0x49e530
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x412b05
push 0xfffffffffffffffe
pop edi
jmp 0x412b05
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x412a65
cmp ax, bx
jne 0x412a6f
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x412a58
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x412aae
test byte [esp + 0x21c], 0x10
je 0x412a95
push 0xfffffffffffffffe
pop edi
jmp 0x412aa5
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x412b03
cmp word [esp + 0x10], bp
jne 0x412abc
cmp word [esp + 0x12], bp
je 0x412adb
cmp word [esp + 0x10], bx
jne 0x412aca
cmp word [esp + 0x12], bx
je 0x412adb
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x412b03
cmp word [esp + 0x12], ax
jne 0x412b03
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x412af0
test al, 0x10
je 0x412b03
jmp 0x412b00
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x412b03
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x412b90
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x412bcc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x413160
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x413267
cmp dword [esi + 0x14], 1
jne 0x4131ab
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x413228
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x413213
dec eax
je 0x4131fc
sub eax, 2
je 0x4131e7
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00412b90
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x413255
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x4131d1
xor eax, eax
pop esi
add esp, 0xc
ret 0xc

Function at 0x413390
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x413484
cmp word [edx], 0
je 0x413484
mov ecx, dword [esp + 0x10]
push esi
cmp ecx, 0x19
jne 0x41341d
mov esi, dword [esp + 0xc]
mov ecx, edx
push edi
cmp dword [esi + 4], 0
lea edi, [ecx + 2]
je 0x4133f0
jmp 0x4133d0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4133d0
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00413160
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4133f0
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x10]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.00413490
mov esi, eax
test esi, esi
je 0x41347b
mov eax, dword [esp + 0xc]
cmp dword [eax + 4], 0
je 0x413458
push dword [esp + 0x10]
push esi
push eax
call fcn.00413160
mov dword [esp + 4], eax
jmp 0x41346c
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x18]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push 0
push dword [0x4cc66c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc