joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ff80
Capabilities:
Delete file

Disassembly:
sub esp, 0x230
mov eax, dword [0x44e040]
xor eax, esp
mov dword [esp + 0x22c], eax
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.00425110
lea edx, [esp + 0x2c]
add esp, 0xc
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40ffb6
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
and eax, 0xffbf
or eax, 0x415
mov word [esp + 0x10], ax
lea eax, [esp]
lea edx, [esp + 0x20]
push eax
mov dword [esp + 8], 3
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.004216dc
add esp, 0x230
ret

Function at 0x411690
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x43a588
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x44e040]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov eax, dword [0x44e040]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
mov esi, ecx
mov ebx, edx
call fcn.00403c40
lea ecx, [esp + 0x10]
call fcn.004093d0
xor ebx, ebx
mov dword [esp + 0x38], ebx
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x4116ec
lea eax, [esp + 0x14]
push eax
call fcn.00436470
add esp, 4
test al, al
je 0x41171e
call fcn.00403c40
mov ecx, dword [edi]
mov edx, dword [eax]
push ebx
push ecx
push 0x47a
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [esp + 0x28], 8
jb 0x411773
mov eax, dword [esp + 0x14]
push eax
jmp 0x41176b
cmp dword [esi + 0x10], 0x64
jle 0x411727
mov dword [esi + 0x10], ebx
mov ecx, dword [esi + 0x10]
mov eax, ecx
cdq
mov ebx, 3
idiv ebx
inc ecx
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x14]
imul edx, edx, 0x54
lea eax, [edx + esi + 0x14]
mov esi, 8
cmp dword [esp + 0x28], esi
jae 0x411752
lea ecx, [esp + 0x14]
push ebp
push ecx
mov ecx, dword [esp + 0x48]
push edi
push ecx
push eax
call fcn.0040e140
cmp dword [esp + 0x28], esi
jb 0x411773
mov edx, dword [esp + 0x14]
push edx
call fcn.00421709
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004216dc
add esp, 0x2c
ret 8
Function at 0x411a30
Capabilities:
Create http request
Write file on windows

Disassembly:
sub esp, 0x410
mov eax, dword [0x44e040]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
push ebp
push esi
push edi
push 0
push 0
push 0
push 0
xor bl, bl
push 0x441bdc
mov esi, ecx
mov edi, edx
mov byte [esp + 0x27], bl
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebp, eax
test ebp, ebp
je 0x411b25
push 0
push 0x80000000
push 0
push 0
push esi
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
test esi, esi
je 0x411b1e
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x411b17
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [esp + 0x14], 0
lea ebx, [ebx]
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x24]
push ecx
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x411b03
test eax, eax
jbe 0x411b05
push 0
lea edx, [esp + 0x1c]
push edx
push 0x400
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x411b0c
cmp dword [esp + 0x14], 0
jne 0x411ac0
jmp 0x411b0c
test eax, eax
jne 0x411ac0
mov byte [esp + 0x13], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [esp + 0x13]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.004216dc
add esp, 0x410
ret
Function at 0x411cd0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x1c
cmp dword [esi], 0
jne 0x411def
push edi
call fcn.00403c40
push eax
mov edi, str.gzipdll.dll
lea ecx, [esp + 8]
call fcn.0040d3c0
mov edi, 8
cmp dword [eax + 0x18], edi
jb 0x411d00
mov eax, dword [eax + 4]
jmp 0x411d03
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
cmp dword [esp + 0x1c], edi
jb 0x411d1f
mov eax, dword [esp + 8]
push eax
call fcn.00421709
add esp, 4
mov eax, dword [esi]
test eax, eax
jne 0x411d48
push str.dtl:_LoadLibrary_gzipdll.dll__faled
push 0x40
push str..interfaceGzipInterface.cpp
push 4
call fcn.004383d0
push eax
call fcn.00437ce0
add esp, 0x14
xor al, al
pop edi
add esp, 0x1c
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.gz_compress
push eax
call edi
mov ecx, dword [esi]
push str.gz_uncompress
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi]
push str.gz_hash
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi]
push 0x441cb0
push eax
call edi
mov ecx, dword [esi]
push str.unzip
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi]
push str.unzipex
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi]
push str.gcompress_7z
push eax
call edi
mov ecx, dword [esi]
push str.guncompress_7z
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi]
push str.gcompress_7zEx
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi]
push str.zipMemory
push eax
call edi
mov ecx, dword [esi]
push str.unZipMemory
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi]
push str.freeMemory
push edx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
mov al, 1
pop edi
add esp, 0x1c
ret
xor al, al
add esp, 0x1c
ret

Function at 0x412720
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x439a68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x44e040]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x44e040]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
mov edi, ecx
xor ecx, ecx
mov word [esp + 0x14], cx
mov ecx, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x412772
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x14]
call fcn.0040b1e0
add edi, 0x18
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [esp + 0x58], 0
xor edx, edx
push 0xffffffffffffffff
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push edx
mov eax, esi
mov word [ecx + 4], dx
call fcn.0040a2f0
call fcn.00435b00
add esp, 0x20
cmp dword [esp + 0x28], 8
jb 0x4127da
mov eax, dword [esp + 0x14]
push eax
call fcn.00421709
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004216dc
add esp, 0x30
ret 4
Function at 0x412f80
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x20
push edi
call fcn.00403c40
push eax
mov edi, str.SFTM_LocalSft.dll
lea ecx, [esp + 0xc]
call fcn.0040d3c0
mov edi, 8
cmp dword [eax + 0x18], edi
jb 0x412fa7
mov eax, dword [eax + 4]
jmp 0x412faa
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
cmp dword [esp + 0x20], edi
jb 0x412fc6
mov eax, dword [esp + 0xc]
push eax
call fcn.00421709
add esp, 4
mov eax, dword [esi]
test eax, eax
jne 0x412fef
push str.load_SFTM_LocalSft.dll_failed_r_n
push 0x33
push str..interfaceSFTM_LocalSftInterface.cpp
push 4
call fcn.004383d0
push eax
call fcn.00437ce0
add esp, 0x14
xor al, al
pop edi
add esp, 0x20
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SFTM_Init
push eax
call edi
mov ecx, dword [esi]
push str.SFTM_UnInit
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi]
push str.SFTM_SetCallBackFun
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi]
push str.SFTM_UpdateLocalSoftInfo
push eax
call edi
mov ecx, dword [esi]
push str.SFTM_UpdateOneSoftInfo
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi]
push str.SFTM_ClearLocalSoftInfo
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov al, 1
pop edi
add esp, 0x20
ret
Function at 0x413050
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x1c
push esi
push edi
call fcn.00403c40
push eax
mov edi, 0x44224c
lea ecx, [esp + 0xc]
call fcn.0040d3c0
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x413078
mov eax, dword [eax + 4]
jmp 0x41307b
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4509dc], eax
cmp dword [esp + 0x20], esi
jb 0x41309f
mov eax, dword [esp + 0xc]
push eax
call fcn.00421709
mov eax, dword [0x4509dc]
add esp, 4
xor ecx, ecx
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], cx
test eax, eax
jne 0x4130c2
xor al, al
pop edi
pop esi
add esp, 0x1c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.STInit
push eax
call esi
mov edx, dword [0x4509dc]
push str.STUDPProxy
push edx
mov dword [0x4509d8], eax
call esi
mov dword [0x4509d4], eax
mov eax, dword [0x4509dc]
push str.STUDPTransfer
push eax
call esi
mov ecx, dword [0x4509dc]
push str.STCmdApp
push ecx
mov dword [0x4509d0], eax
call esi
mov edx, dword [0x4509dc]
push str.STEntryAddr
push edx
mov dword [0x4509bc], eax
call esi
mov dword [0x4509c8], eax
mov eax, dword [0x4509dc]
push str.STUnionID
push eax
call esi
mov ecx, dword [0x4509dc]
push str.STAppID
push ecx
mov dword [0x4509cc], eax
call esi
mov edx, dword [0x4509dc]
push str.STVersion
push edx
mov dword [0x4509c4], eax
call esi
mov dword [0x4509c0], eax
mov eax, dword [0x4509dc]
push str.STOnline
push eax
call esi
mov ecx, dword [0x4509dc]
push str.STOffline
push ecx
mov dword [0x4509b8], eax
call esi
mov edx, dword [0x4509dc]
push str.STAction
push edx
mov dword [0x4509b4], eax
call esi
mov dword [0x4509b0], eax
mov eax, dword [0x4509dc]
push str.STUninit
push eax
call esi
mov dword [0x4509ac], eax
mov eax, dword [0x4509d8]
test eax, eax
je 0x4130ba
pop edi
pop esi
add esp, 0x1c
jmp eax
Function at 0x417950
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x439333
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x44e040]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
xor ebx, ebx
or eax, 0xffffffff
mov dword [edi + 8], eax
mov dword [edi + 4], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 0x20], 0x451240
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [esp + 0x18], ebx
lea esi, [edi + 0x34]
mov dword [edi], vtable.TiXmlDocument.0
mov dword [esi], 0x451240
mov byte [esp + 0x18], 1
mov dword [edi + 0x40], eax
mov dword [edi + 0x3c], eax
push 0x441db9
xor ecx, ecx
mov dword [edi + 0x38], 4
mov byte [edi + 0x44], bl
mov byte [edi + 0x2c], bl
mov dword [edi + 0x30], ebx
call fcn.004169d0
mov dword [edi + 0x40], ebx
mov dword [edi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x41ac60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x44e040]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
lea eax, [esp + 4]
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 4]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41ac90
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 8]
call fcn.0040b1e0
call fcn.00411bd0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x41ad3a
push 1
lea ecx, [esp + 8]
push ecx
push edi
call eax
test eax, eax
jne 0x41ad3a
lea eax, [esp + 4]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41acd0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 8]
call fcn.0040b1e0
push 0xa
push str.onekey.xml
mov eax, esi
call fcn.00409170
cmp dword [esi + 0x18], 8
jb 0x41ad02
mov esi, dword [esi + 4]
jmp 0x41ad05
add esi, 4
push esi
push str.unzip_metafile__S_ok
push 0x1e
push str..MetaFile.cpp
push 8
call fcn.004383d0
push eax
call fcn.00437ce0
add esp, 0x18
mov al, 1
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004216dc
add esp, 0x20c
ret
push edi
push str.unzip_metafile__S_err
push 0x21
push str..MetaFile.cpp
push 1
call fcn.004383d0
push eax
call fcn.00437ce0
mov ecx, dword [esp + 0x224]
add esp, 0x18
pop esi
xor ecx, esp
xor al, al
call fcn.004216dc
add esp, 0x20c
ret

Function at 0x41de50
Capabilities:
Write file on windows

Disassembly:
cmp byte [ecx + 4], 0
je 0x41de5e
mov eax, 0x10000001
ret 0x10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call fcn.00424057
add esp, 0x10
ret 0x10

Function at 0x41de80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43a91e
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x44e040]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.004084c0
lea eax, [esi + 0x18]
push eax
mov dword [esp + 0x18], 0
call fcn.004084c0
lea edi, [esi + 0x30]
mov ecx, edi
call fcn.00436de0
push 0
push 0
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.004375a0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x41e410
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x68
mov eax, dword [0x44e040]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareDTLSoftDTLSoftMgr
push 0x80000002
call esi
test eax, eax
je 0x41e45d
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
push str.SoftwareDTLSoftDTLSoftMgr
push 0x80000001
call esi
test eax, eax
jne 0x41e495
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.UnionID
push edx
mov dword [esp + 0x24], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41e4a9
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
xor edx, edx
pop esi
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.004216dc
add esp, 0x68
ret
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
cmp eax, 3
jne 0x41e4d9
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41e4fb
push eax
lea ecx, [esp + 0x24]
push ecx
push 8
lea edx, [esp + 0x1c]
push edx
jmp 0x41e4f3
cmp eax, 4
jne 0x41e4fb
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41e4fb
push eax
lea eax, [esp + 0x24]
push eax
push 8
lea ecx, [esp + 0x1c]
push ecx
call fcn.004218bb
add esp, 0x10
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.004216dc
add esp, 0x68
ret

Function at 0x4216dc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e040]
jne 0x4216e6
repz ret
jmp fcn.004258c1

Function at 0x42566f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4256a0
call fcn.00426771
mov dword [eax], esi
call fcn.0042675e
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004222cd
add esp, 0x14
push 0x16
pop eax
jmp 0x4256f5
test dword [ebp + 0xc], 0xfffffff9
jne 0x42567c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4256cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00426784
pop ecx
call fcn.0042675e
mov eax, dword [eax]
jmp 0x4256f5
test al, 0x10
jne 0x4256f3
test al, 1
je 0x4256f3
test byte [ebp + 0xc], 2
je 0x4256f3
call fcn.00426771
mov dword [eax], 5
call fcn.0042675e
mov dword [eax], 0xd
jmp 0x4256c4
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4308b2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00427cfa
and dword [ebp - 4], 0
cmp dword [0x4508a4], 0
mov ebx, eax
jne 0x430963
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x430a14
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x430a14
push eax
call fcn.00427c88
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4508a4], eax
call esi
push eax
call fcn.00427c88
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4508a8], eax
call esi
push eax
call fcn.00427c88
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4508ac], eax
call esi
push eax
call fcn.00427c88
pop ecx
mov dword [0x4508b4], eax
test eax, eax
je 0x430963
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00427c88
pop ecx
mov dword [0x4508b0], eax
mov eax, dword [0x4508b0]
cmp eax, ebx
je 0x4309bb
cmp dword [0x4508b4], ebx
je 0x4309bb
push eax
call fcn.00427d03
push dword [0x4508b4]
mov esi, eax
call fcn.00427d03
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4309bb
test edi, edi
je 0x4309bb
call esi
test eax, eax
je 0x4309b2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4309b2
test byte [ebp - 0xc], 1
jne 0x4309bb
or dword [ebp + 0x10], 0x200000
jmp 0x4309f4
mov eax, dword [0x4508a8]
cmp eax, ebx
je 0x4309f4
push eax
call fcn.00427d03
pop ecx
test eax, eax
je 0x4309f4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4309f4
mov eax, dword [0x4508ac]
cmp eax, ebx
je 0x4309f4
push eax
call fcn.00427d03
pop ecx
test eax, eax
je 0x4309f4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4508a4]
call fcn.00427d03
pop ecx
test eax, eax
je 0x430a14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x430a16
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x435950
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.00435840
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], eax
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x435910
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x2c], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x2c], 0
je 0x4359b0
mov eax, dword [ebp - 8]
mov dword [eax + 0x20], 1
jmp 0x4359ba
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 8]
xor eax, eax
cmp dword [edx + 0x2c], 0
setne al
mov esp, ebp
pop ebp
ret
Function at 0x436100
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x43613f
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp eax, 1
jne 0x436139
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
jmp 0x436141
xor al, al
jmp 0x436141
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x436260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x436284
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [ebp - 4]
add eax, 4
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00425811
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x4362d4
xor al, al
jmp 0x4362d6
mov al, 1
mov esp, ebp
pop ebp
ret 0x14
Function at 0x436990
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 8
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00425110
add esp, 0xc
push 8
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.00425110
add esp, 0xc
push 8
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00425110
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4369f3
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov eax, dword [ebp - 0xc]
mov dword [ecx + 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
setg al
mov esp, ebp
pop ebp
ret
Function at 0x437ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00424057
add esp, 0x10
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
push edx
call fcn.00424b22
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x437d40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x44e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov ecx, dword [ebp - 0x28]
add ecx, 4
call fcn.00409a80
push eax
push 0x20
lea ecx, [ebp - 0x24]
push ecx
push 0x43ef84
mov ecx, dword [ebp - 0x28]
add ecx, 0x20
call fcn.00409a80
push eax
push str.filter
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x24]
push edx
call fcn.00422aa6
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004216dc
mov esp, ebp
pop ebp
ret